@earendil-works/chord 1.2.0 → 1.4.0

package/dist/reload.js

@@ -1,31 +1,44 @@
 import { bind, coverage } from "./contract.js";
-import { asChordError, ChordError, invalid } from "./errors.js";
+import { asChordError, ChordError, invalid, isChordError } from "./errors.js";
+import { hostLifetime, makeService, memberSchemas, RefImpl, } from "./object.js";
 import { holdPublications } from "./publish.js";
-import { HandleImpl, makeService, memberSchemas, } from "./record.js";
 import { assertValid, deepEqual } from "./schema.js";
-const noop = () => { };
 /**
  * Computes the new derivation functions over the candidate values and validates every prospective value (migrated
  * cells and derivations) against every schema that will apply after the commit: the cell's new schema and the new
- * behavior's remote state-member schemas. A failure fails prepare; the commit then installs without re-checking.
+ * implementation's remote state-member schemas. A failure fails prepare; the commit then installs without re-checking.
  */
 function dryRun(candidate) {
-    const { run, migrated, service, record } = candidate;
-    const exposed = memberSchemas(service, run.behavior);
+    const { run, migrated, service, object } = candidate;
+    const exposed = memberSchemas(service, run.implementation);
     for (const [cell, value] of migrated) {
         for (const schema of exposed.get(cell) ?? [])
-            assertValid("state", `${record.address}: migrated state ${cell.key}`, schema, value);
+            assertValid("state", `${object.address}: migrated state ${cell.key}`, schema, value);
     }
     const values = new Map(migrated);
     const derives = [...run.decls.derives].sort(([, a], [, b]) => a.seq - b.seq);
     for (const [name, derived] of derives) {
-        const value = derived.compute((source) => (values.has(source) ? values.get(source) : source.value), run.decls.deriveFns.get(name));
+        const value = derived.compute((source) => (values.has(source) ? values.get(source) : candidateValue(source)));
         for (const schema of exposed.get(derived) ?? [])
-            assertValid("state", `${record.address}: derived ${name}`, schema, value);
+            assertValid("state", `${object.address}: derivation ${name}`, schema, value);
         values.set(derived, value);
     }
     candidate.derived = values;
 }
+/**
+ * A source's value for a dry run. A reference to a provider this reload upgrades too reads nothing before the commit
+ * (its new contract does not bind the old code): the dry run computes without it, the commit with the real value.
+ */
+function candidateValue(source) {
+    try {
+        return source.value;
+    }
+    catch (error) {
+        if (isChordError(error, "not_ready") || isChordError(error, "not_in_variant"))
+            return undefined;
+        throw error;
+    }
+}
 /** A reload error keeps the underlying code (`contract_mismatch`, `invalid`, ...) and says it aborted the reload. */
 export function reloadError(error) {
     const cause = asChordError(error, "reload");
@@ -49,30 +62,49 @@ export async function runReload(host, plugins, options) {
     }
 }
 /** Takes the host's reload slot and loads the plugin modules. Pair with `endReload`. */
-export async function beginReload(host, plugins, options, epoch) {
+export async function beginReload(host, plugins, options, codeVersion) {
     if (host.reloading) {
         throw new ChordError("unavailable", "a reload is already running", { reason: "reload_running" });
     }
     host.reloading = true;
     try {
-        return new Reload(host, await host.resolve(plugins), options, epoch);
+        return new Reload(host, await host.resolve(plugins), options, codeVersion);
     }
     catch (error) {
-        host.reloading = false;
+        host.reloadEnded();
         throw reloadError(error);
     }
 }
 export function endReload(host) {
-    host.reloading = false;
-    host.maybeRetire();
+    host.reloadEnded();
+}
+/** Most milliseconds a forced retirement waits for aborted roots to settle before it closes what they used. */
+const ABORTED_ROOTS_GRACE = 1000;
+/** Resolves true once `ready()` holds (checked whenever retirement-relevant state changes), false after `ms`. */
+function until(host, ready, ms) {
+    if (ready())
+        return Promise.resolve(true);
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            stop();
+            resolve(false);
+        }, ms);
+        const stop = host.watchRetirement(() => {
+            if (!ready())
+                return;
+            clearTimeout(timer);
+            stop();
+            resolve(true);
+        });
+    });
 }
 /** One reload on one host: `prepare` (load, prepare, gate), then `commit` or `rollback`. */
 export class Reload {
     host;
     facets;
     options;
-    /** Epoch id to commit (issued by the coordinating server); a local reload allocates one. */
-    epoch;
+    /** Code version id to commit (issued by the coordinating server); a local reload allocates one. */
+    codeVersion;
     candidates = new Map();
     abort = new AbortController();
     closed = [];
@@ -82,13 +114,15 @@ export class Reload {
     tables = new Map();
     gated = [];
     rolledBack = false;
-    /** Records of types this reload adds, with their staged listeners: their runtime starts at commit. */
+    /** Objects of types this reload adds, with their staged listeners: their runtime starts at commit. */
     deferred = new Map();
-    constructor(host, facets, options, epoch) {
+    /** This reload's run of each facet it loads (`FacetApi.signal`): installed at commit, aborted at rollback. */
+    facetRuns = new Map();
+    constructor(host, facets, options, codeVersion) {
         this.host = host;
         this.facets = facets;
         this.options = options;
-        this.epoch = epoch;
+        this.codeVersion = codeVersion;
     }
     /** Everything up to the commit. On failure the host is rolled back and the underlying error is thrown. */
     async prepare() {
@@ -97,11 +131,11 @@ export class Reload {
             this.load();
             this.checkProviders();
             await this.prepareAll();
-            // From here new records of changed types are rejected (upgrade_conflict, retryable) until commit or abort,
+            // From here new objects of changed types are rejected (upgrade_conflict, retryable) until commit or abort,
             // so the candidate set is final once the activations already in flight have been prepared.
             this.host.gating = this.changed;
             await this.withDeadline(this.prepareAll(), "activations in flight did not finish");
-            this.checkHolds();
+            this.checkRefs();
             this.tables = this.host.buildTables(this.entries());
             await this.gate();
             this.#alive();
@@ -114,14 +148,14 @@ export class Reload {
     }
     /** What a successful prepare will commit (a child sends it with its vote). */
     summary() {
-        const live = [...this.candidates.values()].filter(({ record }) => record.status === "live");
+        const live = [...this.candidates.values()].filter(({ object }) => object.status === "live");
         return {
-            epoch: this.host.pending?.id ?? this.host.current.id,
+            codeVersion: this.host.pending?.id ?? this.host.current.id,
             previous: this.host.current.id,
             changed: [...this.changed],
             removed: [...this.removed],
-            prepared: live.map(({ record }) => record.address),
-            gated: this.gated.map(({ record }) => record.address),
+            prepared: live.map(({ object }) => object.address),
+            gated: this.gated.map(({ object }) => object.address),
         };
     }
     /** After every await of prepare: a rollback meanwhile (abort from the coordinator) ends it. */
@@ -131,33 +165,37 @@ export class Reload {
     }
     /**
      * Subscribes every new listener now, buffering its events, so a failing source fails prepare instead of leaving a
-     * half-installed epoch. Records running only the new code (types this reload adds) are staged too.
+     * half-installed code version. Objects running only the new code (types this reload adds) are staged too.
      */
     #stage() {
         for (const candidate of this.candidates.values()) {
-            if (candidate.record.status === "live")
-                candidate.staged = candidate.record.stageListeners(candidate.run.decls);
+            if (candidate.object.status === "live")
+                candidate.staged = candidate.object.stageListeners(candidate.run.decls);
         }
-        for (const record of this.host.records.values()) {
-            if (record.status === "live" && record.deferredRuntime)
-                this.deferred.set(record, record.stageListeners(record.decls));
+        for (const object of this.host.objects.values()) {
+            if (object.status === "live" && object.deferredRuntime)
+                this.deferred.set(object, object.stageListeners(object.decls));
         }
     }
+    /**
+     * Retires the previous code version before loading the next one (a host keeps two). Waits until its roots ended and,
+     * on a child host, its parent retired it too (`retire` frame), at most `retireDeadline`. Past the deadline it is
+     * retired anyway: its remaining roots are aborted first and get a short grace to stop, so they see cancellation
+     * before the resources only that code version used are closed; their next call is `superseded`.
+     */
     async waitForRetirement() {
         const host = this.host;
-        if (host.previous === undefined)
+        const previous = host.previous;
+        if (previous === undefined)
             return;
-        if (host.previous.roots.size > 0) {
-            let timer;
-            await new Promise((resolve) => {
-                host.retired = resolve;
-                timer = setTimeout(resolve, this.options.retireDeadline ?? 5000);
-            });
-            clearTimeout(timer);
-            host.retired = noop;
-        }
-        // Roots of the dropped epoch still running get `superseded` on their next call.
-        host.retire();
+        const deadline = this.options.retireDeadline ?? 5000;
+        const gone = () => host.previous !== previous;
+        if (!(await until(host, () => gone() || host.retirable(), deadline)) && !gone()) {
+            previous.abort.abort(new ChordError("superseded", `code version ${previous.id} was retired`));
+            await until(host, () => gone() || previous.roots.size === 0, Math.min(deadline, ABORTED_ROOTS_GRACE));
+        }
+        if (!gone())
+            host.retire();
     }
     /** Builds the candidate service table: unchanged services plus everything the given facets serve. */
     load() {
@@ -165,7 +203,9 @@ export class Reload {
         const current = this.host.current.services;
         this.services = new Map([...current].filter(([, service]) => !replaced.has(service.facet)));
         for (const facet of this.facets) {
-            facet.setup(this.host.facetApi(((type, factory, options = {}) => this.host.serveInto(this.services, makeService(type, factory, options, facet.name)))));
+            const run = new AbortController();
+            this.facetRuns.set(facet.name, run);
+            facet.setup(this.host.facetApi(((type, factory, options = {}) => this.host.serveInto(this.services, makeService(type, factory, options, facet.name))), run.signal));
         }
         for (const [name, service] of this.services)
             if (current.get(name) !== service)
@@ -174,10 +214,11 @@ export class Reload {
             if (!this.services.has(name))
                 this.removed.add(name);
         this.host.pending = {
-            id: this.host.nextEpochId(this.epoch),
+            id: this.host.nextCodeVersionId(this.codeVersion),
             services: this.services,
             tables: new Map(),
             roots: new Map(),
+            abort: new AbortController(),
         };
     }
     async withDeadline(promise, what) {
@@ -219,33 +260,33 @@ export class Reload {
         }
     }
     /**
-     * Prepares every live record of a changed type, including records that activate meanwhile, to a fixpoint. Records
+     * Prepares every live object of a changed type, including objects that activate meanwhile, to a fixpoint. Objects
      * already running the new code (types this reload adds) are skipped.
      */
     async prepareAll() {
         for (;;) {
-            const todo = [...this.host.records.values()].filter((record) => this.changed.has(record.typeName) &&
-                !this.candidates.has(record) &&
-                record.service !== this.services.get(record.typeName) &&
-                (record.status === "live" || record.status === "activating"));
+            const todo = [...this.host.objects.values()].filter((object) => this.changed.has(object.typeName) &&
+                !this.candidates.has(object) &&
+                object.service !== this.services.get(object.typeName) &&
+                (object.status === "live" || object.status === "activating"));
             if (todo.length === 0)
                 return;
-            await Promise.allSettled(todo.map((record) => record.ready));
+            await Promise.allSettled(todo.map((object) => object.ready));
             this.#alive();
-            for (const record of todo) {
-                if (record.status === "live" && record.service !== this.services.get(record.typeName)) {
-                    await this.prepareRecord(record);
+            for (const object of todo) {
+                if (object.status === "live" && object.service !== this.services.get(object.typeName)) {
+                    await this.prepareObject(object);
                     this.#alive();
                 }
             }
         }
     }
     /** Runs the new factory in recording mode and opens what can be opened without the gate. */
-    async prepareRecord(record) {
-        const service = this.services.get(record.typeName);
-        const run = record.run(service, record.decls);
+    async prepareObject(object) {
+        const service = this.services.get(object.typeName);
+        const run = object.run(service, object.decls);
         const candidate = {
-            record,
+            object,
             service,
             run,
             reasons: [],
@@ -255,20 +296,19 @@ export class Reload {
             derived: new Map(),
             staged: undefined,
         };
-        this.candidates.set(record, candidate);
-        const bumped = service.stateVersion !== record.stateVersion;
-        if (bumped)
-            candidate.reasons.push(`state version ${record.stateVersion} -> ${service.stateVersion}`);
+        this.candidates.set(object, candidate);
+        // Each cell carries its own version: a raised one gates and migrates, a schema change without one is refused.
         for (const [name, cell] of run.decls.cells) {
-            if (record.decls.cells.get(name) !== cell || deepEqual(cell.schema, run.decls.cellSchemas.get(name)))
+            if (object.decls.cells.get(name) !== cell)
                 continue;
-            if (!bumped) {
-                throw invalid("state", `${record.address}: schema of state ${name} changed without a state-version bump`);
-            }
-        }
-        for (const name of Object.keys(service.options.state?.migrate ?? {})) {
-            if (!run.decls.cells.has(name))
-                throw invalid("state", `${record.address}: migrate for undeclared state ${name}`);
+            const from = object.decls.cellVersions.get(name) ?? 1;
+            const to = run.decls.cellVersions.get(name) ?? 1;
+            if (to < from)
+                throw invalid("state", `${object.address}: version of state ${name} lowered from ${from} to ${to}`);
+            if (to > from)
+                candidate.reasons.push(`state ${name} version ${from} -> ${to}`);
+            else if (!deepEqual(cell.schema, run.decls.cellSchemas.get(name)))
+                throw invalid("state", `${object.address}: schema of state ${name} changed without a version bump`);
         }
         const deferred = new Set();
         for (const resource of run.created.resources) {
@@ -277,57 +317,62 @@ export class Reload {
         }
         for (const resource of deferred) {
             candidate.atGate.push(resource);
-            const old = record.decls.resources.get(resource.key);
+            const old = object.decls.resources.get(resource.key);
             if (resource.exclusive && old?.exclusive && old.state === "open")
                 candidate.replaced.push(old);
         }
         if (deferred.size > 0)
             candidate.reasons.push("exclusive resource replaced");
-        if (candidate.reasons.length === 0)
+        await object.open(run.created.resources.filter((resource) => !deferred.has(resource)), run.created.refs, this.abort.signal);
+        await object.waitHydrated(run);
+        // Cells this reload adds read their first value once the new resources are open (gated objects: at the gate);
+        // the derivations over them are checked after.
+        if (candidate.reasons.length === 0) {
+            await object.initCells(run, this.abort.signal);
             dryRun(candidate);
-        await record.open(run.created.resources.filter((resource) => !deferred.has(resource)), run.created.holds, this.abort.signal);
+        }
     }
     /**
-     * Every hold that survives into the new epoch must bind to the new provider. Browser holds don't block a reload:
-     * after the commit they get `upgrade_required` instead.
+     * Every reference that survives into the new code version must bind to the new provider. Browser references don't block a
+     * reload: after the commit they get `upgrade_required` instead.
      */
-    checkHolds() {
+    checkRefs() {
         const dropped = new Set();
-        for (const { record, run } of this.candidates.values()) {
-            for (const hold of record.decls.holds.values())
-                if (![...run.decls.holds.values()].includes(hold))
-                    dropped.add(hold);
-        }
-        for (const record of this.host.records.values()) {
-            const service = this.services.get(record.typeName);
-            if (service === undefined || !this.changed.has(record.typeName))
+        for (const { object, run } of this.candidates.values()) {
+            for (const ref of object.decls.refs.values())
+                if (![...run.decls.refs.values()].includes(ref))
+                    dropped.add(ref);
+        }
+        for (const object of this.host.objects.values()) {
+            const service = this.services.get(object.typeName);
+            if (service === undefined || !this.changed.has(object.typeName))
                 continue;
-            for (const hold of record.holds) {
-                // The host's bootstrap hold follows this provider at commit; it is not an old-code consumer.
-                if (hold === this.host.eager.get(record.typeName))
+            for (const ref of object.refs) {
+                // The host's bootstrap reference follows this provider at commit; it is not an old-code consumer.
+                if (ref === this.host.hostObjects.get(object.typeName))
                     continue;
-                if (!dropped.has(hold) && hold.owner !== "client")
-                    bind(service.contract, service.options.accepts, hold.contract);
+                if (!dropped.has(ref) && ref.owner !== "client")
+                    bind(service.contract, service.options.accepts, ref.contract);
             }
         }
     }
     entries() {
         return this.host
             .liveDecls(true)
-            .filter(([record]) => !this.removed.has(record.typeName))
-            .map(([record, decls]) => [record, this.candidates.get(record)?.run.decls ?? decls]);
+            .filter(([object]) => !this.removed.has(object.typeName))
+            .map(([object, decls]) => [object, this.candidates.get(object)?.run.decls ?? decls]);
     }
     /**
      * Admission cut, wait for grandfathered roots (deadline), replace exclusive resources, migrate into private
-     * copies. Old tasks of gated records are stopped at the cut; listener events are queued until commit or abort.
+     * copies. Old tasks of gated objects are stopped at the cut; listener events are queued until commit or abort.
      */
     async gate() {
-        this.gated = [...this.candidates.values()].filter((candidate) => candidate.reasons.length > 0 && candidate.record.status === "live");
-        const drained = this.gated.map(({ record }) => {
-            const grandfathered = new Set(record.leases.keys());
+        this.gated = [...this.candidates.values()].filter((candidate) => candidate.reasons.length > 0 && candidate.object.status === "live");
+        const drained = this.gated.map(({ object }) => {
+            const grandfathered = new Set(object.leases.keys());
             return new Promise((resolve) => {
-                record.gate = { grandfathered, queue: [], drained: resolve };
-                record.stopTasks();
+                object.gate = { grandfathered, queue: [], drained: resolve };
+                object.stopTasks();
                 if (grandfathered.size === 0)
                     resolve();
             });
@@ -342,7 +387,7 @@ export class Reload {
         ]);
         clearTimeout(timer);
         if (timedOut) {
-            const blocking = this.gated.flatMap(({ record }) => [...(record.gate?.grandfathered ?? [])]);
+            const blocking = this.gated.flatMap(({ object }) => [...(object.gate?.grandfathered ?? [])]);
             throw new ChordError("aborted", `gate deadline (${deadline} ms) missed; blocking roots: ${blocking.join(", ")}`, {
                 reason: "gate_deadline",
                 details: { blocking },
@@ -350,35 +395,36 @@ export class Reload {
         }
         this.#alive();
         for (const candidate of this.gated) {
-            const { record } = candidate;
+            const { object } = candidate;
             for (const old of candidate.replaced) {
                 // Owned by the rollback before closing: a failing close must still be restored.
-                this.closed.push([record, old]);
-                await old.close(record.openOrder);
+                this.closed.push([object, old]);
+                await old.close(object.openOrder);
             }
-            await record.open(candidate.atGate, [], this.abort.signal);
+            await object.open(candidate.atGate, [], this.abort.signal);
+            this.#alive();
+            await object.initCells(candidate.run, this.abort.signal);
             this.#alive();
         }
         for (const candidate of this.gated)
             this.migrate(candidate);
     }
     migrate(candidate) {
-        const { record, service, run } = candidate;
-        const migrate = service.options.state?.migrate ?? {};
-        const bumped = service.stateVersion !== record.stateVersion;
+        const { object, run } = candidate;
         for (const [name, cell] of run.decls.cells) {
-            if (record.decls.cells.get(name) !== cell)
+            if (object.decls.cells.get(name) !== cell)
                 continue;
             const schema = run.decls.cellSchemas.get(name);
-            const fn = migrate[name];
+            const from = object.decls.cellVersions.get(name) ?? 1;
+            const fn = run.decls.cellMigrations.get(name);
             let value;
-            if (bumped && fn !== undefined)
-                value = fn(structuredClone(cell.value), record.stateVersion);
+            if ((run.decls.cellVersions.get(name) ?? 1) > from && fn !== undefined)
+                value = fn(structuredClone(cell.value), from);
             else if (!deepEqual(cell.schema, schema))
                 value = cell.value;
             else
                 continue;
-            assertValid("state", `${record.address}: migrated state ${name}`, schema, value);
+            assertValid("state", `${object.address}: migrated state ${name}`, schema, value);
             candidate.migrated.set(cell, value);
         }
         dryRun(candidate);
@@ -388,54 +434,56 @@ export class Reload {
             return;
         this.rolledBack = true;
         this.abort.abort(new ChordError("aborted", "reload aborted"));
+        for (const run of this.facetRuns.values())
+            run.abort(new ChordError("aborted", "reload aborted"));
         const report = (error) => this.host.report(error);
         for (const candidate of this.candidates.values())
             candidate.staged?.discard();
         for (const staged of this.deferred.values())
             staged.discard();
-        for (const { record, run } of this.candidates.values()) {
-            record.pending.delete(run.decls);
-            await record.unwind(run).catch(report);
+        for (const { object, run } of this.candidates.values()) {
+            object.pending.delete(run.decls);
+            await object.unwind(run).catch(report);
         }
         // Replaced exclusive resources are restored; one that cannot be is marked unavailable, never silently closed.
-        for (const [record, resource] of this.closed) {
+        for (const [object, resource] of this.closed) {
             if (resource.state !== "closed")
                 continue;
-            await resource.open(new AbortController().signal, record.openOrder).catch((error) => {
+            await resource.open(new AbortController().signal, object.openOrder).catch((error) => {
                 resource.markUnavailable();
-                report(new ChordError("unavailable", `${record.address}: resource ${resource.key} could not be restored`, {
+                report(new ChordError("unavailable", `${object.address}: resource ${resource.key} could not be restored`, {
                     cause: error,
                 }));
             });
         }
-        for (const { record } of this.gated) {
-            if (record.gate === undefined)
+        for (const { object } of this.gated) {
+            if (object.gate === undefined)
                 continue;
-            record.openGate();
-            for (const name of record.decls.tasks.keys())
-                record.startTask(name, this.host.current.id);
+            object.openGate();
+            object.startTasks();
         }
-        // Records of types this reload would have added lose their code.
+        // Objects of types this reload would have added lose their code.
         const reason = new ChordError("gone", "reload aborted; type not served");
-        for (const record of [...this.host.records.values()]) {
-            if (!this.host.current.services.has(record.typeName))
-                await record.dispose(true, reason).catch(report);
+        for (const object of [...this.host.objects.values()]) {
+            if (!this.host.current.services.has(object.typeName))
+                await object.dispose(true, reason).catch(report);
         }
         this.host.pending = undefined;
         this.host.gating = undefined;
     }
     /**
-     * Publishes the new epoch in one synchronous step. Everything fallible ran in prepare (factories, opens, migration
-     * and derivation checks against the prospective schemas, listener subscriptions), so this only installs. Observers
-     * (state, shapes, registries, listener roots) are notified after the whole step. If an install still throws, the
-     * epoch is half-published: the host fails terminally and admits no more work.
+     * Publishes the new code version in one synchronous step. Everything fallible ran in prepare (factories, opens,
+     * migration and derivation checks against the prospective schemas, listener subscriptions), so this only installs.
+     * Observers (state, shapes, registries, listener roots) are notified after the whole step. If an install still
+     * throws, the code version is half-published: the host fails terminally and admits no more work.
      */
     commit(beforeStart) {
         try {
             return holdPublications(() => {
                 const report = this.#publish();
-                // Installed, not yet started: the coordinator queues its commit frames here, so nothing this epoch starts
-                // (tasks, eager activations, then the held listener/registry/state notifications) can reach a child first.
+                // Installed, not yet started: the coordinator queues its commit frames here, so nothing this code version
+                // starts (tasks, host object activations, then the held listener/registry/state notifications) can reach a child
+                // first.
                 beforeStart?.();
                 for (const start of this.#starts.splice(0))
                     start();
@@ -447,103 +495,119 @@ export class Reload {
             throw reloadError(error);
         }
     }
-    /** Work that may start new-epoch roots, run after installation (and after the coordinator's commit frames). */
+    /** Work that may start new-code-version roots, run after installation (and after the coordinator's commit frames). */
     #starts = [];
     #publish() {
         const host = this.host;
         const previous = host.current;
         const next = host.pending;
         host.pending = undefined;
-        host.epochs.set(next.id, next);
+        host.codeVersions.set(next.id, next);
         host.previous = previous;
         host.current = next;
         const prepared = [];
-        for (const record of [...host.records.values()]) {
-            if (this.removed.has(record.typeName))
+        for (const object of [...host.objects.values()]) {
+            if (this.removed.has(object.typeName))
                 continue;
-            const candidate = this.candidates.get(record);
+            const candidate = this.candidates.get(object);
             if (candidate === undefined) {
-                const installed = record.behaviors.get(previous.id);
+                const installed = object.implementations.get(previous.id);
                 if (installed !== undefined)
-                    record.behaviors.set(next.id, { ...installed, epoch: next.id });
+                    object.implementations.set(next.id, { ...installed, codeVersion: next.id });
                 continue;
             }
-            if (record.status !== "live")
+            if (object.status !== "live")
                 continue;
             this.install(candidate, next.id);
-            prepared.push(record.address);
+            prepared.push(object.address);
         }
-        for (const { record, run, staged } of this.candidates.values()) {
-            if (record.status === "live")
+        for (const { object, run, staged } of this.candidates.values()) {
+            if (object.status === "live")
                 continue;
             staged?.discard();
-            record.pending.delete(run.decls);
-            record.unwind(run).catch((error) => host.report(error));
+            object.pending.delete(run.decls);
+            object.unwind(run).catch((error) => host.report(error));
         }
-        // Records of types this reload adds start their runtime now.
-        for (const [record, staged] of this.deferred) {
-            if (record.status !== "live") {
+        // Objects of types this reload adds start their runtime now.
+        for (const [object, staged] of this.deferred) {
+            if (object.status !== "live") {
                 staged.discard();
                 continue;
             }
-            record.deferredRuntime = false;
+            object.deferredRuntime = false;
             staged.activate();
-            this.#starts.push(() => record.startTasks());
+            this.#starts.push(() => object.startTasks());
         }
         host.installTables(next, this.tables, true);
         const reason = new ChordError("gone", "type no longer served");
-        for (const record of [...host.records.values()]) {
-            if (this.removed.has(record.typeName))
-                record.dispose(true, reason).catch((error) => host.report(error));
+        for (const object of [...host.objects.values()]) {
+            if (this.removed.has(object.typeName))
+                object.dispose(true, reason).catch((error) => host.report(error));
         }
         for (const name of this.removed)
-            host.eager.delete(name);
+            host.hostObjects.delete(name);
         for (const facet of this.facets)
             host.facets.set(facet.name, facet);
         for (const name of this.options.remove ?? [])
             host.facets.delete(name);
+        // The replaced and removed runs' signals abort after the install, like other observers.
+        for (const [name, run] of this.facetRuns)
+            this.#starts.push(() => host.facetRunChanged(name, run));
+        for (const name of this.options.remove ?? [])
+            this.#starts.push(() => host.facetRunChanged(name, undefined));
         host.gating = undefined;
         for (const [name, service] of this.services) {
-            if (service.options.eager && this.changed.has(name) && host.eager.get(name)?.record?.status !== "live") {
-                this.#starts.push(() => host.startEager(service));
+            if (hostLifetime(service) && this.changed.has(name) && host.hostObjects.get(name)?.object?.status !== "live") {
+                this.#starts.push(() => host.startHostObject(service));
+            }
+            // A type whose lifetime became "referenced" lives on only while someone else references its object.
+            const pinned = host.hostObjects.get(name);
+            if (!hostLifetime(service) && pinned !== undefined) {
+                host.hostObjects.delete(name);
+                this.#starts.push(() => pinned.release());
             }
         }
         return {
-            epoch: next.id,
+            codeVersion: next.id,
             previous: previous.id,
             changed: [...this.changed],
             removed: [...this.removed],
             prepared,
-            gated: this.gated.map(({ record }) => record.address),
+            gated: this.gated.map(({ object }) => object.address),
         };
     }
-    install(candidate, epoch) {
-        const { record, run, service } = candidate;
+    install(candidate, codeVersion) {
+        const { object, run, service } = candidate;
         const gated = candidate.reasons.length > 0;
-        record.pending.delete(run.decls);
-        record.stopTasks();
+        object.pending.delete(run.decls);
+        object.stopTasks();
         if (gated) {
-            // Old derivations would compute over migrated values; the old behavior can no longer run anyway.
+            // Old derivations would compute over migrated values; the old implementation can no longer run anyway.
             const kept = new Set(run.decls.derives.values());
-            for (const derived of record.decls.derives.values())
+            for (const derived of object.decls.derives.values())
                 if (!kept.has(derived))
                     derived.detach();
         }
-        record.decls = run.decls;
-        record.service = service;
-        record.stateVersion = service.stateVersion;
-        record.behaviors.set(epoch, { epoch, service, behavior: run.behavior, decls: run.decls });
+        object.decls = run.decls;
+        object.service = service;
+        // Kept resources close with the new code's `close`; replaced ones keep their own (closed at retirement).
+        for (const [resource, declaration] of run.decls.adopted)
+            resource.adopt(declaration);
+        object.implementations.set(codeVersion, {
+            codeVersion,
+            service,
+            implementation: run.implementation,
+            decls: run.decls,
+        });
         if (gated) {
-            // Old code can never run over migrated state: drop the previous behavior now, not at retirement.
-            record.minEpoch = epoch;
-            for (const old of [...record.behaviors.keys()])
-                if (old !== epoch)
-                    this.host.retireBehavior(record, old);
+            // Old code can never run over migrated state: drop the previous implementation now, not at retirement.
+            object.minCodeVersion = codeVersion;
+            for (const old of [...object.implementations.keys()])
+                if (old !== codeVersion)
+                    this.host.retireImplementation(object, old);
         }
         // Schemas first, then the values validated against them in prepare.
-        record.refreshSchemas();
-        for (const [name, derived] of run.decls.derives)
-            derived.setFn(run.decls.deriveFns.get(name));
+        object.refreshSchemas();
         for (const [name, cell] of run.decls.cells) {
             const schema = run.decls.cellSchemas.get(name);
             if (candidate.migrated.has(cell))
@@ -558,31 +622,31 @@ export class Reload {
             if (!created.has(derived))
                 derived.refresh();
         candidate.staged?.activate();
-        this.#starts.push(() => record.startTasks());
-        record.openGate();
-        const eager = this.host.eager.get(record.typeName);
-        if (eager?.record === record && eager.contract.fingerprint !== service.contract.fingerprint) {
-            const replacement = new HandleImpl(record, service.contract, "host");
-            // Acquire first: releasing the only hold must not dispose/reopen the surviving eager record.
-            record.addHold(replacement);
-            this.host.eager.set(record.typeName, replacement);
-            eager.release();
-        }
-        for (const handle of [...record.holds]) {
-            // Browser holds whose contract no longer binds are told to reload their code (they never block a reload).
-            if (handle.owner === "client") {
+        this.#starts.push(() => object.startTasks());
+        object.openGate();
+        const pinned = this.host.hostObjects.get(object.typeName);
+        if (pinned?.object === object && pinned.contract.fingerprint !== service.contract.fingerprint) {
+            const replacement = new RefImpl(object, service.contract, "host");
+            // Acquire first: releasing the only reference must not dispose/reopen the surviving host object.
+            object.addRef(replacement);
+            this.host.hostObjects.set(object.typeName, replacement);
+            pinned.release();
+        }
+        for (const ref of [...object.refs]) {
+            // Browser references whose contract no longer binds are told to reload their code (they never block a reload).
+            if (ref.owner === "client") {
                 try {
-                    bind(service.contract, service.options.accepts, handle.contract);
+                    bind(service.contract, service.options.accepts, ref.contract);
                 }
                 catch (error) {
-                    handle.gone(new ChordError("upgrade_required", `${record.typeName} changed; reload the web facets`, {
+                    ref.gone(new ChordError("upgrade_required", `${object.typeName} changed; reload the web facets`, {
                         cause: error,
                     }));
-                    record.release(handle);
+                    object.release(ref);
                     continue;
                 }
             }
-            handle.shapeChanged();
+            ref.shapeChanged();
         }
     }
 }