@earendil-works/chord 1.4.0 → 1.5.1

package/dist/host/host.js

@@ -0,0 +1,1318 @@
+// Hosts (§3): `createHost`, loading facets and the start barrier, links to children, the parent (connected again after
+// a drop) and routes, the origins it relays holds for, getting and holding references as a principal, the heartbeat
+// of every link, revocation (§4), presence (§19) and keep-alive counts, registries and root scopes (slice 8), reloads
+// (staging, the commit, each object's fate, the report; old work and its reload cycles), closing; one batch per host,
+// the backoff map and the endings new instances wait for.
+import { NOOP_TELEMETRY_CONTEXT, } from "@earendil-works/pi-telemetry";
+import { awaitWithContext, BACKGROUND_CONTEXT, withAbortSignal, withoutAbortSignal, withTelemetry, } from "../context/index.js";
+import { contractData } from "../contracts/internal.js";
+import { ChordError } from "../data/index.js";
+import { asChordError, binds, canonicalJson, checkParams, identityKey, invalid, principalKey, } from "../data/internal.js";
+import { binaryCodec } from "../link/index.js";
+import { linkLimits } from "../link/internal.js";
+import { RegistryRecord } from "../registries/internal.js";
+import { HostLink, Path, RemoteObject, } from "../remote/internal.js";
+import { Batch } from "../state/internal.js";
+import { capped, chordMetrics, chordSpans, countingOnly, ended, hostAttribute, parentOf, untraced, } from "../telemetry.js";
+import { Activity } from "./activity.js";
+import { notLive } from "./attempt.js";
+import { Backoff } from "./backoff.js";
+import { withLinkedAbortSignal } from "./ctx.js";
+import { Destination } from "./destination.js";
+import { contributionOf } from "./members.js";
+import { ChordObject } from "./object.js";
+import { chainAttempts, OldWork } from "./old-work.js";
+import { References } from "./presence.js";
+import { Binding } from "./reference.js";
+import { ReloadCycles } from "./reload-cycle.js";
+import { RevocationKeys } from "./revocation.js";
+import { RootScopes } from "./root.js";
+import { Route } from "./route.js";
+import { addStaged, checkPluginNames, emptyStaged, recordFactory, stagePlugin, } from "./staging.js";
+import { UnboundIndex } from "./unbound.js";
+import { UnboundClock } from "./unbound-clock.js";
+import { uuidv7 } from "./uuid.js";
+/** Creates a host. */
+export function createHost(options) {
+    return new ChordHost(options);
+}
+/** No activation chain (Q5). */
+const NO_CHAIN = [];
+/** The params of a type with empty params, as checked: nothing, and the empty key. */
+const EMPTY_PARAMS = { params: {}, key: "" };
+/** What a span records for no principal. */
+const NO_ATTRIBUTES = Object.freeze({});
+/** The host: its served types, its objects by identity, its batch, backoff and endings. */
+export class ChordHost {
+    batch;
+    timeouts;
+    /** Its old work during reloads (whether a context runs under it): see `old-work.ts`. */
+    oldWork = new OldWork();
+    /** The waits of old work on objects that are not live, cut at once when they cycle through their own drain. */
+    reloadCycles = new ReloadCycles();
+    backoff = new Backoff((identity) => this.#due(identity));
+    address;
+    principal;
+    /** This run of the host, sent in every handshake (R20). */
+    incarnation = uuidv7();
+    compression;
+    /** The host's store, if it has one. */
+    store;
+    /** The telemetry adapter: root spans start on it, carriers from links are extracted with it. */
+    telemetry;
+    /** The `chord.host` attribute of this host's spans: its address key, `client` without an address. */
+    spanHost;
+    /** Chord's instruments on the adapter's metrics: the host's own counts (links, holds, calls, commits). */
+    metrics;
+    /** The telemetry of this host's work under a context without a span (`#counted`); none without an adapter. */
+    #counting;
+    #activity;
+    #principalKey;
+    #principalAttributes;
+    #revocationKeys;
+    /** The presence list of each type someone asked about (`references`), by type name. */
+    #references = new Map();
+    #onError;
+    /** The served types by name: the published plugin set's (a reload's commit replaces it). */
+    #types = new Map();
+    /** The published plugins by name: their facet (an unchanged one is the same object), registries and contributions. */
+    #plugins = new Map();
+    /** The reloads, one after another (slice 7b §1): the last one's end, which the next one waits for. */
+    #reloading = Promise.resolve();
+    /** By identity, in the order they went live (the others where they were created). */
+    #objects = new Map();
+    /** Teardowns still running, by identity: the next instance of an identity waits for its previous ones. */
+    #endings = new Map();
+    /** The requests waiting unbound after the publication (in the index, and registry readers), reported after 5 s. */
+    #clock = new UnboundClock((error) => this.report(error));
+    /** The requests that cannot bind yet, by name: before the publication all of them, then those left unbound. */
+    #unbound = new UnboundIndex(this.#clock);
+    /** Resolved at the host's first publication (`load`'s batch), or its close. */
+    #publication = Promise.withResolvers();
+    #published = false;
+    /** Every open link: children, routes and the parent. */
+    #links = new Set();
+    /** Where holds go that are not served here and not routed: the parent link, across reconnects. */
+    #parent = new Path(() => { });
+    /**
+     * Remote references failed for a part past a link's limits: on no link's path (no reconnect holds them, no route
+     * resolves for them) until `ref.retry()` places them anew; ended at `close` like the others.
+     */
+    unplaced = new Path(() => { });
+    #routes = new Map();
+    #destination;
+    /** The downstream origins this host relays holds for, by their number on upstream links (never reused). */
+    relays = new Map();
+    #nextOrigin = 1;
+    /** Aborted when the host closes: the context of every route's `resolve`, and the end of waiting `host.registry`s. */
+    #routing = new AbortController();
+    #heartbeat;
+    /** Its registries by name, each made by its first use (a serve, a contribution or a reader). */
+    #registries = new Map();
+    #roots = new RootScopes(this);
+    /** The one heartbeat timer, running while the host has a link. */
+    #ticking;
+    #state = "new";
+    /** The one closing, which every `close` returns. */
+    #closing;
+    constructor(options) {
+        this.address = options.address;
+        this.principal = options.principal;
+        this.#principalKey = options.principalKey;
+        this.#principalAttributes = options.principalAttributes;
+        this.#onError = options.onError;
+        this.telemetry = options.telemetry ?? NOOP_TELEMETRY_CONTEXT;
+        this.spanHost = hostAttribute(this.address);
+        this.metrics = chordMetrics(this.telemetry.metrics);
+        const metrics = this.telemetry.metrics;
+        this.#counting = untraced(this.telemetry) || metrics === undefined ? undefined : countingOnly(metrics);
+        this.batch = new Batch((error) => this.report(error), this.telemetry.metrics);
+        this.compression = options.compression;
+        this.#activity = new Activity(this.batch);
+        // `revokedBy` is called with this host's principals only, the `P`s its links stamp.
+        this.#revocationKeys = new RevocationKeys(options.revokedBy);
+        const close = options.closeTimeout ?? 30_000;
+        const reload = Math.min(close, options.reloadDrainTimeout ?? 5_000);
+        this.timeouts = { close, ready: options.readyTimeout ?? 60_000, reload };
+        this.#heartbeat = { ping: options.heartbeat?.ping ?? 15_000, close: options.heartbeat?.close ?? 30_000 };
+        this.#destination = new Destination(this.address, this.#routes, this.#parent);
+        // Chord's own: `openStore` made it.
+        this.store = options.store;
+        this.store?.attach({ failed: (error) => this.#storageFailed(error), batch: this.batch });
+    }
+    async load(facets, context) {
+        this.batch.assertOutside("load");
+        this.#assertOpen();
+        if (this.#state !== "new")
+            throw new Error("load runs once per host");
+        checkPluginNames(facets);
+        this.#state = "loading";
+        const parent = context.telemetry;
+        if (untraced(parent))
+            return this.#load(facets, context);
+        return chordSpans(parent)("chord.load", { "chord.host": this.spanHost, plugins: facets.length }, async (span) => {
+            try {
+                const report = await this.#load(facets, withTelemetry(span, context));
+                span.setAttributes({ failed: report.failed.length });
+                return report;
+            }
+            catch (error) {
+                ended(span, "load_failed", error, context.abortSignal);
+                throw error;
+            }
+        });
+    }
+    /** `load`'s steps under its span: the setups, the publication, then the start barrier. */
+    async #load(facets, context) {
+        const staged = emptyStaged();
+        const loaded = new Map();
+        const failed = [];
+        // A name given twice is refused the second time whether or not the first staged.
+        const given = new Set();
+        // In the given order: of two plugins serving one name, the later is left out.
+        for (const plugin of facets) {
+            const twice = given.has(plugin.name);
+            given.add(plugin.name);
+            const error = twice ? loadedTwice(plugin.name) : this.#stageInto(staged, plugin);
+            if (error === undefined)
+                loaded.set(plugin.name, plugin.facet);
+            else
+                failed.push({ plugin: plugin.name, error });
+        }
+        this.#types = staged.types;
+        // The publication: the types and registries served, the facets' contributions and the first composition of
+        // every served registry, in one batch, before any object activates.
+        this.batch.commit(() => {
+            this.#publish(staged, loaded);
+            for (const record of this.#registries.values())
+                record.composeServed();
+        }, context);
+        // After the batch: what waited for the publication is placed (the gate lasted only for the setups).
+        this.#published = true;
+        this.#publication.resolve();
+        this.#reportUndeclared();
+        this.#unbound.wakeAll();
+        const objects = [...this.#types.values()]
+            .filter((served) => served.kind === "local" && served.hostLifetime)
+            .map((served) => this.#object(served, EMPTY_PARAMS, undefined, context.telemetry, context));
+        await Promise.all(objects.map(({ firstOutcome }) => firstOutcome));
+        if (this.#state === "loading")
+            this.#state = "loaded";
+        return { failed };
+    }
+    /**
+     * Whether a request for `Type` with `params` binds to `served` as a real bind checks it (`bind`): its kind, version
+     * and fingerprint, and the provider's own host address; one whose `hostAddress` throws does not.
+     */
+    #wouldBind(served, Type, params) {
+        if (unboundCause(served, Type.kind, Type.name, Type.version, Type.fingerprint) !== undefined)
+            return false;
+        try {
+            return this.#misplaced(Type, served, params) === undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Whether a request for `Type` with `params` goes here; a `hostAddress` that throws: not here (it fails at bind). */
+    #placedHere(Type, params) {
+        try {
+            return this.#destination.placedHere(Type, params);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Stages `plugin`'s new code into `staged`: the error that refuses it (its setup, a declaration, a name served twice). */
+    #stageInto(staged, plugin) {
+        try {
+            return addStaged(staged, stagePlugin(plugin, this.#stagingHost()));
+        }
+        catch (error) {
+            return error;
+        }
+    }
+    reload(facets, context, options = {}) {
+        this.batch.assertOutside("reload");
+        if (this.#state === "closed")
+            return Promise.reject(this.#closedError());
+        if (this.#state !== "loaded")
+            throw new Error("reload runs after load");
+        checkPluginNames(facets);
+        const reload = this.#reloading.then(() => this.#reload(facets, options.failed ?? [], context));
+        // The tail settles to nothing: a report kept as its value would keep a rejected facet's closure (its error).
+        this.#reloading = reload.then(() => { }, () => { });
+        return reload;
+    }
+    /** One reload, after the previous one, in its span: each object's fate an event of it. */
+    async #reload(facets, before, context) {
+        const parent = context.telemetry;
+        if (untraced(parent))
+            return this.#reloadSteps(facets, before, context);
+        return chordSpans(parent)("chord.reload", { "chord.host": this.spanHost, plugins: facets.length }, async (span) => {
+            try {
+                const report = await this.#reloadSteps(facets, before, withTelemetry(span, context));
+                for (const { object, kind } of report.objects)
+                    span.addEvent("chord.reload.fate", { object: capped(object), fate: kind });
+                const { added, changed, removed } = report.plugins;
+                const counts = { added: added.length, changed: changed.length, removed: removed.length };
+                span.setAttributes({ ...counts, failed: report.failed.length, fates: report.objects.length });
+                return report;
+            }
+            catch (error) {
+                ended(span, "reload_failed", error, context.abortSignal);
+                throw error;
+            }
+        });
+    }
+    /** One reload's steps: staging, the commit, the fates, the report. */
+    async #reloadSteps(facets, before, context) {
+        this.#assertOpen();
+        if (context.abortSignal?.aborted)
+            throw reloadAborted();
+        const plan = this.#stageReload(facets, before, context);
+        // Aborted while it staged (a setup may abort it synchronously): nothing changed.
+        if (context.abortSignal?.aborted)
+            throw reloadAborted();
+        const started = this.#commit(plan, context);
+        const { added, changed, removed, failed } = plan;
+        const plugins = { added, changed, removed };
+        const committed = { ...plugins, failed: failed.map(({ plugin }) => plugin) };
+        const objects = await this.#report(started, committed, context);
+        return { plugins, failed, objects };
+    }
+    /**
+     * Staging (slice 7b §2), synchronous (no request or arriving hold meets it half done), per plugin (decision "Per
+     * plugin at startup and reload"): a pass stages the new code (`#stagePass`); a plugin whose new code fails there
+     * (or failed `before`, passed as its loaded facet) keeps its old code (an added one is left out) and staging runs
+     * again without it; then a changed plugin whose recorded requests would not bind because of such a plugin keeps its
+     * old code too (`#closure`), until nothing more fails. Bounded by the number of plugins with new code.
+     */
+    #stageReload(facets, before, context) {
+        const failed = new Map(before.map(({ plugin, error }) => [plugin, error]));
+        const given = new Map();
+        // A name given twice: the second is refused, the first staged.
+        const twice = [];
+        for (const { name, facet } of facets) {
+            if (given.has(name))
+                twice.push({ plugin: name, error: loadedTwice(name) });
+            else
+                given.set(name, facet);
+        }
+        for (;;) {
+            const pass = this.#stagePass(given, failed, context);
+            if (pass.kind === "failed") {
+                for (const [name, error] of pass.failed)
+                    failed.set(name, error);
+                continue;
+            }
+            const kept = this.#closure(pass.plan, pass.recorded, failed);
+            if (kept.size > 0) {
+                for (const [name, error] of kept)
+                    failed.set(name, error);
+                continue;
+            }
+            const failures = [...failed].map(([plugin, error]) => ({ plugin, error }));
+            return { ...pass.plan, failed: [...twice, ...failures] };
+        }
+    }
+    /**
+     * One staging pass: the loaded entries of the plugins kept as they are (unchanged, or failed: their setups not run
+     * again) first, then every other plugin's new code in the given order (one refused by a name the table has already
+     * fails), then the new factory of every object of a changed or removed plugin whose type is still served (a throw
+     * fails the plugin serving it). Its plan, or the plugins that failed.
+     */
+    #stagePass(given, failed, context) {
+        const staged = emptyStaged();
+        const failing = new Map();
+        const fresh = [];
+        for (const [name, facet] of given) {
+            const loaded = this.#plugins.get(name);
+            if (loaded !== undefined && (loaded.facet === facet || failed.has(name)))
+                addStaged(staged, loaded.staged);
+            else if (!failed.has(name))
+                fresh.push({ name, facet });
+        }
+        for (const plugin of fresh) {
+            const error = this.#stageInto(staged, plugin);
+            if (error !== undefined)
+                failing.set(plugin.name, error);
+        }
+        if (failing.size > 0)
+            return { kind: "failed", failed: failing };
+        const applied = new Set(fresh.map(({ name }) => name));
+        const removed = [...this.#plugins.keys()].filter((name) => !given.has(name));
+        const reloaded = new Set([...applied, ...removed]);
+        const fates = [];
+        const recorded = [];
+        for (const object of this.#objects.values()) {
+            if (!reloaded.has(object.served.plugin))
+                continue;
+            const served = staged.types.get(object.served.contract.name);
+            if (served === undefined || served.kind !== object.served.kind) {
+                fates.push({ kind: "end", object });
+                continue;
+            }
+            try {
+                const declared = recordFactory(object, served, context);
+                recorded.push({ plugin: served.plugin, recorded: declared });
+                fates.push({ kind: object.reloadFate(), object, served, requests: declared.requests });
+            }
+            catch (error) {
+                if (!failing.has(served.plugin))
+                    failing.set(served.plugin, error);
+            }
+        }
+        if (failing.size > 0)
+            return { kind: "failed", failed: failing };
+        const facets = new Map(fresh.map(({ name, facet }) => [name, facet]));
+        const added = fresh.filter(({ name }) => !this.#plugins.has(name)).map(({ name }) => name);
+        const changed = fresh.filter(({ name }) => this.#plugins.has(name)).map(({ name }) => name);
+        const plan = { staged, facets, added, changed, removed, failed: [], fates };
+        return { kind: "staged", plan, recorded };
+    }
+    /**
+     * The closure rule: the changed plugins (new code applied) of `plan` with a recorded request that would not bind in
+     * the staged table because of a plugin that failed in this reload: its name served there by such a plugin's old code,
+     * or not served at all while some plugin failed (what a failed setup would have served is unknown). Requests to
+     * another host are not checked (a rollout's rules). Each such plugin with the error it keeps its old code for.
+     */
+    #closure(plan, recorded, failed) {
+        const kept = new Map();
+        if (failed.size === 0)
+            return kept;
+        for (const { plugin, recorded: declared } of recorded) {
+            if (kept.has(plugin) || !plan.facets.has(plugin))
+                continue;
+            for (const request of declared.requests) {
+                const unbound = this.#unboundRequest(plan.staged, request, failed);
+                if (unbound === undefined)
+                    continue;
+                kept.set(plugin, new Error(`plugin "${plugin}": ${unbound}`));
+                break;
+            }
+        }
+        return kept;
+    }
+    /**
+     * Why `request` (of a new factory) would not bind in `staged` because of a plugin in `failed`; `undefined`
+     * when it binds, is placed on another host, or does not bind for another reason (it waits as any request does).
+     */
+    #unboundRequest(staged, request, failed) {
+        const name = request.kind === "type" ? request.contract.name : request.registry.name;
+        const provider = request.kind === "type" ? staged.types.get(name)?.plugin : staged.registries.get(name)?.plugin;
+        if (provider !== undefined && !failed.has(provider))
+            return undefined;
+        if (request.kind === "type") {
+            const { contract, params } = request;
+            // A remote type the object reaches on another host: placed by the rollout's rules, not this host's.
+            if (!this.#placedHere(contract, params))
+                return undefined;
+            const served = staged.types.get(name);
+            if (served !== undefined && this.#wouldBind(served, contract, params))
+                return undefined;
+            return provider === undefined
+                ? `needs ${name} v${contract.version}, which no plugin serves now (a plugin failed)`
+                : `needs ${name} v${contract.version}, which plugin "${provider}" serves on its old code`;
+        }
+        const served = staged.registries.get(name);
+        if (served !== undefined && registryServes(served, request.registry.version))
+            return undefined;
+        return provider === undefined
+            ? `needs registry ${name} v${request.registry.version}, which no plugin serves now (a plugin failed)`
+            : `needs registry ${name} v${request.registry.version}, which plugin "${provider}" serves on its old code`;
+    }
+    /**
+     * The commit (slice 7b §3), one batch: the served types become the staged ones (an unchanged plugin's stay as
+     * they were), the removed plugins' registry providers go and the reloaded ones' are replaced, their facet
+     * contributions replaced by plugin, every changed registry composed once; a removed type's presence list goes.
+     * Then each object takes its fate (`#startFates`), host-lifetime objects of new types start, and the publication
+     * wakes the requests waiting for the names the reload serves.
+     */
+    #commit(plan, context) {
+        const { staged, changed, removed } = plan;
+        const published = new Set(plan.facets.keys());
+        // A kept plugin's types are its loaded ones, as they are: its objects are untouched.
+        const types = staged.types;
+        this.batch.commit(() => {
+            for (const name of [...changed, ...removed]) {
+                const loaded = this.#plugins.get(name);
+                for (const registry of loaded.staged.registries.keys()) {
+                    if (staged.registries.get(registry)?.plugin !== name)
+                        this.registryRecord(registry).unserve();
+                }
+                for (const contribution of loaded.contributions)
+                    contribution.record.remove(contribution);
+                this.#plugins.delete(name);
+            }
+            this.#types = types;
+            this.#publish(staged, plan.facets);
+            for (const name of published) {
+                for (const registry of staged.plugins.get(name).registries.keys()) {
+                    this.registryRecord(registry).composeServed();
+                }
+            }
+        }, context);
+        this.#reportUndeclared();
+        for (const name of this.#references.keys())
+            if (!types.has(name))
+                this.#references.delete(name);
+        const names = new Set();
+        for (const [name, served] of types)
+            if (published.has(served.plugin))
+                names.add(name);
+        for (const [name, { plugin }] of staged.registries)
+            if (published.has(plugin))
+                names.add(name);
+        const started = this.#startFates(plan.fates);
+        for (const type of types.values()) {
+            if (type.kind === "local" && type.hostLifetime) {
+                this.#object(type, EMPTY_PARAMS, undefined, context.telemetry, context);
+            }
+        }
+        this.#unbound.wake(names);
+        return started;
+    }
+    /**
+     * Starts `fates` and returns them in their order, for the report: the removals first (a dependent whose new code
+     * still needs a removed provider then parks, decision 4), then the restarts and retries; then the restarts'
+     * readiness and successors, once every object has its new served type (their requests bind against the new code).
+     */
+    #startFates(fates) {
+        const started = new Map();
+        for (const fate of fates)
+            if (fate.kind === "end")
+                started.set(fate, this.#startFate(fate));
+        for (const fate of fates)
+            if (fate.kind !== "end")
+                started.set(fate, this.#startFate(fate));
+        for (const fate of fates)
+            if (fate.kind === "restart")
+                fate.object.startSuccessor();
+        // Every fate started above.
+        return fates.map((fate) => started.get(fate));
+    }
+    /**
+     * Starts one object's fate after the commit: a removed type's object ends, its holders waiting `not_served`; any
+     * other restarts or retries on its new served type.
+     */
+    #startFate(fate) {
+        const { object } = fate;
+        if (fate.kind === "end") {
+            const error = new ChordError({
+                code: "unavailable",
+                message: `${object.served.contract.name} is not served here`,
+            });
+            object.remove({ kind: "waiting", error });
+            return { object: object.label, kind: "ended" };
+        }
+        const attempt = object.reload(fate.served, fate.kind, fate.requests);
+        return { object: object.label, kind: fate.kind === "restart" ? "restarted" : "retried", target: object, attempt };
+    }
+    /**
+     * The report, once every retry had its first dependency check (a parked one reports why); a restart reports at once
+     * what its readiness found (its successor's own check follows the old attempt's end). `context`'s abort ends only
+     * this wait (`aborted`, its `details` naming what the commit applied: `committed`).
+     */
+    async #report(started, committed, context) {
+        const checks = started.map(async (fate) => {
+            if (fate.kind === "ended")
+                return { object: fate.object, kind: fate.kind };
+            const cause = await this.#checked(fate);
+            return cause === undefined
+                ? { object: fate.object, kind: fate.kind }
+                : { object: fate.object, kind: "parked", cause };
+        });
+        try {
+            return await awaitWithContext(Promise.all(checks), context);
+        }
+        catch {
+            const { added, changed, removed, failed } = committed;
+            const details = {
+                committed: { added: [...added], changed: [...changed], removed: [...removed], failed: [...failed] },
+            };
+            throw new ChordError({ code: "aborted", message: "reload: aborted after its commit", details });
+        }
+    }
+    /**
+     * Why a restarted or retried object's new attempt waits, for the report: what a restart's readiness found, at once
+     * (its new attempt's own check follows the old attempt's end), also for a retry of an attempt that still waits for
+     * an open old attempt; otherwise its new attempt's first dependency check.
+     */
+    #checked(fate) {
+        const { target, attempt } = fate;
+        if (fate.kind === "restarted" || target.openOldAttempt !== undefined)
+            return Promise.resolve(target.readinessCause);
+        return attempt.checked;
+    }
+    /** This host as staging sees it: whom it acts as, its address and its presence lists. */
+    #stagingHost() {
+        // Setups get presence lists of this host's `P`; staging passes them on as they are.
+        const references = (Type) => this.references(Type);
+        return { principal: this.principal, address: this.address, references: references };
+    }
+    async get(Type, params, context, options = {}) {
+        const binding = await this.acquire(Type, params, this.#own(), context, options);
+        // The binding was built from `Type`'s members.
+        return binding.reference;
+    }
+    hold(Type, params, context, options = {}) {
+        this.batch.assertOutside("hold");
+        // The binding was built from `Type`'s members; it may be unbound, so `variant` may be undefined.
+        return this.#hold(Type, params, this.#own(), context, options).reference;
+    }
+    accept(link, options, context) {
+        this.#assertOpen();
+        this.#link(link, "child", options, context);
+    }
+    connect(link, options, context) {
+        this.#assertOpen();
+        if (this.#parent.link !== undefined)
+            throw new Error("connect: this host has an open parent link");
+        const parent = this.#link(link, "parent", options, context);
+        if (parent.open)
+            this.#parent.connected(parent);
+    }
+    route(Kind, options, context) {
+        this.#assertOpen();
+        if (this.#state !== "new")
+            throw new Error("route: routes are declared before load");
+        if (this.#routes.has(Kind.kind))
+            throw new Error(`route: ${Kind.kind} is routed already`);
+        // The parent of the route's work: its `resolve`s and the holds and calls on its links, aborted when it closes.
+        const routing = withAbortSignal(this.#routing.signal, context);
+        // A route calls `authorize` with the principals of holds on this host, `P`s, and addresses of `Kind`.
+        const route = new Route(Kind, options, this, routing);
+        this.#routes.set(Kind.kind, route);
+        return {
+            retry: (address) => route.retry(address.key),
+            suspend: (address) => route.suspend(address.key),
+        };
+    }
+    revoke(revocation, context) {
+        const count = this.#revoke(revocation, context);
+        const parent = context.telemetry;
+        // Recorded after the work: a revocation is synchronous, its span only says what it ended.
+        if (!untraced(parent)) {
+            const attributes = { "chord.host": this.spanHost };
+            void chordSpans(parent)("chord.revoke", attributes, (span) => span.setAttributes({ count }));
+        }
+    }
+    /** `revoke`'s work; how many objects it ended and child links it closed. */
+    #revoke(revocation, context) {
+        let count = 0;
+        const key = canonicalJson(revocation, context);
+        const revoked = (principal) => !this.#isOwn(principal, context) && this.#revocationKeys.revokes(principal, key, context);
+        const error = (label) => new ChordError({ code: "forbidden", reason: "revoked", message: `${label}: revoked` });
+        for (const object of [...this.#objects.values()]) {
+            if (object.principal === undefined || !revoked(object.principal))
+                continue;
+            object.end(error(object.label));
+            count++;
+        }
+        // Requests not bound (waiting for the publication or a provider, refused, waiting for their link) end too: nothing
+        // revives them.
+        const unbound = error("an unbound request");
+        this.#unbound.revoke(revoked, unbound);
+        for (const link of this.#links)
+            link.revokeUnbound(revoked, unbound);
+        // This host's own requests over its paths, linked or not (a route still resolving, a link down): a later link
+        // would hold them again (fix round 1).
+        for (const holder of this.#pathHolders()) {
+            if (holder.kind !== "remote")
+                continue;
+            const { principal } = holder.caller;
+            if (principal !== undefined && revoked(principal))
+                holder.revoke(error(holder.label));
+        }
+        // Down the route links before the child links close: a worker ends the principal's objects with the revocation's
+        // error before the closed origins release their holds.
+        for (const link of this.#links)
+            if (link.role === "route")
+                link.send({ kind: "revoke", revocation });
+        for (const link of [...this.#links]) {
+            if (link.role !== "child" || !revoked(link.principal))
+                continue;
+            link.close();
+            count++;
+        }
+        return count;
+    }
+    get activity() {
+        // Its value is an `ActivityCounts`.
+        return this.#activity;
+    }
+    references(Type) {
+        let references = this.#references.get(Type.name);
+        if (references === undefined) {
+            references = new References(this.batch);
+            for (const object of this.#objects.values()) {
+                if (object.served.contract.name !== Type.name)
+                    continue;
+                for (const holder of object.holders)
+                    if (holder.listed)
+                        references.record(object, holder);
+            }
+            this.#references.set(Type.name, references);
+        }
+        // Entries of `Type`'s objects, acting as `P`s.
+        return references;
+    }
+    async registry(R, context, options = {}) {
+        this.batch.assertOutside("registry");
+        this.#assertOpen();
+        this.#assertLoadCalled(`registry ${R.name}`);
+        const timeout = options.readyTimeout ?? this.timeouts.ready;
+        const expired = new AbortController();
+        const waiting = withLinkedAbortSignal(expired.signal, context);
+        let last;
+        const deadline = setTimeout(() => expired.abort(last ?? notLive(`registry ${R.name}`, timeout)), timeout);
+        // The host's close ends the wait at once, `released/closed` (its timer with it).
+        const closing = () => expired.abort(this.#closedError());
+        this.#routing.signal.addEventListener("abort", closing, { once: true });
+        try {
+            await awaitWithContext(this.#publication.promise, waiting.context);
+            this.#assertOpen();
+            const value = this.registryRecord(R.name).value(R.version);
+            // Its values are the composition as `R`'s version has it, `V`.
+            const usable = () => {
+                const start = value.start();
+                if (start.kind === "value" || start.last !== undefined)
+                    return true;
+                last = start.error;
+                return false;
+            };
+            if (!usable())
+                await untilUsable(value, usable, waiting.context);
+            return value;
+        }
+        finally {
+            clearTimeout(deadline);
+            this.#routing.signal.removeEventListener("abort", closing);
+            waiting.release();
+        }
+    }
+    async root(fn, context, options = {}) {
+        this.batch.assertOutside("root");
+        this.#assertOpen();
+        // The scope's ctx acts as `principal`, a `P`: an explicit `undefined` runs anonymous (an HTTP request nobody
+        // authenticated), only an omitted one takes the host's.
+        const principal = "principal" in options ? options.principal : this.principal;
+        const run = fn;
+        const trace = options.trace;
+        if (trace === undefined || untraced(this.telemetry))
+            return this.#roots.run(run, principal, this.#counted(context));
+        const attributes = { "chord.host": this.spanHost, ...trace.attributes };
+        return this.telemetry.startSpan({ name: trace.name, attributes }, async (span) => {
+            try {
+                return await this.#roots.run(run, principal, withTelemetry(span, context));
+            }
+            catch (error) {
+                ended(span, "trace_failed", error, context.abortSignal);
+                throw error;
+            }
+        });
+    }
+    principalAttributes(principal, context) {
+        if (principal === undefined)
+            return NO_ATTRIBUTES;
+        if (this.#principalAttributes !== undefined)
+            return this.#principalAttributes(principal);
+        return { "chord.principal": capped(principalKey(principal, context, this.#principalKey)) };
+    }
+    /**
+     * The names requests here wait for unbound that no plugin here serves (types and registries: `not_served`), sorted;
+     * a name served at another version (`version`) is not among them.
+     */
+    unservedNames() {
+        return this.#unbound
+            .names()
+            .filter((name) => !this.#types.has(name) && this.#registries.get(name)?.providedVersion === undefined);
+    }
+    /** How many objects here have an activation under way (`ChordObject.activating`). */
+    activationsUnderWay() {
+        let count = 0;
+        for (const object of this.#objects.values())
+            if (object.activating)
+                count++;
+        return count;
+    }
+    /** The registries with contributions here and no provider, each with the newest version contributed, by name. */
+    undeclaredRegistries() {
+        const found = [];
+        for (const record of this.#registries.values()) {
+            const version = record.newestContribution;
+            if (version !== undefined && record.providedVersion === undefined)
+                found.push({ name: record.name, version });
+        }
+        return found.sort((a, b) => (a.name < b.name ? -1 : 1));
+    }
+    /** The record of registry `name` on this host, made by its first use. */
+    registryRecord(name) {
+        let record = this.#registries.get(name);
+        if (record === undefined) {
+            record = new RegistryRecord(name, this.batch, (error) => this.report(error), this.#clock);
+            this.#registries.set(name, record);
+        }
+        return record;
+    }
+    async close(_context) {
+        this.batch.assertOutside("close");
+        this.#closing ??= this.#close();
+        return this.#closing;
+    }
+    /**
+     * Whether the host published its setups (`load`'s batch): until then requests made here and holds arriving wait in
+     * the unbound index, placed by the publication.
+     */
+    get published() {
+        return this.#published;
+    }
+    /**
+     * `request` cannot bind yet: indexed under `name` (the type or registry it waits for) until woken or ended, waiting
+     * for the publication (no `cause`) or for a provider that fits (`cause`).
+     */
+    index(name, request, cause) {
+        this.#unbound.add(name, request, cause);
+    }
+    /**
+     * `binding`, whose object left it (its type removed, its version no longer bound: slice 7b §6), waits unbound with
+     * `cause` under its type's name; a publication places it again (`params` checked as it was, under `context`).
+     */
+    rewait(binding, Type, params, cause, context) {
+        this.#wait(binding, Type.name, cause, () => this.#place(binding, Type, params, context));
+    }
+    /** `request` left the unbound index's wait for `name` (it ended, or a retry checks it again). */
+    unindex(name, request) {
+        this.#unbound.delete(name, request);
+    }
+    /** Whether the host closes: its objects end through `close`, not through its links. */
+    get closing() {
+        return this.#state === "closed";
+    }
+    /**
+     * A reference to `Type` made by `caller` (its principal, its origin's incarnation), once it is live (`host.get`,
+     * `ctx.get`): a hold, waited for up to the getter's one deadline, across reconnects and through `loading`,
+     * `failed { transient }` and `failed { waiting }`; a broken failure rejects at once, the deadline with the last
+     * failure's error. A getter that gives up releases its reference.
+     */
+    async acquire(Type, params, caller, context, options) {
+        this.batch.assertOutside("get");
+        const binding = this.#hold(Type, params, caller, context, options);
+        const timeout = options.readyTimeout ?? this.timeouts.ready;
+        const expired = new AbortController();
+        const waiting = withLinkedAbortSignal(expired.signal, context);
+        const deadline = setTimeout(() => expired.abort(binding.lastFailure ?? notLive(binding.label, timeout)), timeout);
+        try {
+            // Old work's getter whose target's activation waits on that work's own drain fails at once (rule 6).
+            const target = binding.target;
+            const live = binding.live(waiting.context);
+            await (target instanceof ChordObject ? this.waitAsOldWork(live, target, Type, context) : live);
+            return binding;
+        }
+        catch (error) {
+            binding.release();
+            throw error;
+        }
+        finally {
+            clearTimeout(deadline);
+            waiting.release();
+        }
+    }
+    /**
+     * `waiting` (a getter's or a gate's wait on `target`, for `contract`'s version) as `context` makes it: as old work it
+     * is cut at once with `unavailable/reload_cycle` when it cycles through that work's own drain (`ReloadCycles`);
+     * otherwise as it is.
+     */
+    waitAsOldWork(waiting, target, contract, context) {
+        if (!this.oldWork.of(context))
+            return waiting;
+        const chain = chainAttempts(context);
+        return chain.size === 0 ? waiting : this.reloadCycles.wait(waiting, target, contract, chain);
+    }
+    /** Adds `delta` to the keep-alive count of `kind` (`host.activity`), where the work happens. */
+    count(kind, delta) {
+        this.#activity.count(kind, delta);
+    }
+    /** `holder` references `object`: listed in its type's presence, if someone asked for it and it is listed. */
+    referenced(object, holder, context) {
+        if (holder.listed)
+            this.#references.get(object.served.contract.name)?.add(object, holder, context);
+    }
+    /** `holders` of `object` ended: gone from its type's presence. */
+    unreferenced(object, holders, context) {
+        this.#references.get(object.served.contract.name)?.remove(holders, context);
+    }
+    /** Reports a background failure to `onError`; a throwing `onError` has nowhere left to report to. */
+    report(error) {
+        try {
+            this.#onError(error);
+        }
+        catch {
+            // Nothing to do: teardowns and attempts go on.
+        }
+    }
+    /**
+     * An unbound reference to an object of `Type` made by `caller`, declared by `dependent` (`undefined` for
+     * `host.get`, `host.hold` and `ctx.get`).
+     */
+    reference(Type, dependent, caller, options) {
+        this.#assertOpen();
+        return this.#binding(Type, dependent, caller, options);
+    }
+    /**
+     * Binds `binding` to the object for (Type, params) as its principal where its host address puts it (`Destination`):
+     * the object here, created with its first attempt if there is none, or a remote object held over its path. Placed
+     * here, the check is only against the type served here: not served (or of the other kind) or not at the caller's
+     * version and fingerprint, the reference waits unbound, `failed { waiting }`, indexed under the type's name. Returns
+     * the object it bound to; throws as `Destination.reference` does (a broken refusal).
+     */
+    bind(binding, Type, params, context) {
+        const { principal } = binding.caller;
+        const placed = this.#destination.reference(Type, params.params, principal, context);
+        if (placed.kind === "path") {
+            const { caller, dependent } = binding;
+            const remote = new RemoteObject(this, Type, params, placed.address, caller, placed.path, dependent, context.telemetry);
+            placed.path.attach(remote);
+            binding.bind(remote);
+            return remote;
+        }
+        const served = this.#types.get(Type.name);
+        const unbound = unboundCause(served, Type.kind, Type.name, Type.version, Type.fingerprint) ??
+            this.#misplaced(Type, served, params.params);
+        if (unbound !== undefined) {
+            // Old work never waits for a code update (rule 2): a version the new code dropped binds the object while its
+            // open old attempt still serves it, and fails at once otherwise.
+            if (unbound.error.code === "contract_mismatch" && this.oldWork.of(context)) {
+                const object = this.#objects.get(this.#identity(served, params, principal, context));
+                if (object === undefined || !object.oldServes(Type.version, Type.fingerprint))
+                    throw unbound.error;
+                binding.bind(object);
+                return object;
+            }
+            this.#wait(binding, Type.name, unbound, () => this.#place(binding, Type, params, context));
+            return undefined;
+        }
+        // An anonymous scope (an HTTP request nobody authenticated) is no principal a remote type's factory can serve
+        // (Opus's build review F5): refused, never bound as the host.
+        if (served.kind !== "local" && principal === undefined) {
+            throw new ChordError({
+                code: "forbidden",
+                message: `${Type.name}: an anonymous caller gets no remote object`,
+            });
+        }
+        // Checked above: served here at the caller's version.
+        const object = this.#object(served, params, principal, context.telemetry, context, NO_CHAIN, binding.dependent);
+        binding.bind(object);
+        // A getter waiting for a shared activation links to it (decision "Shared work").
+        const activation = object.activationSpan;
+        if (activation !== undefined && !untraced(context.telemetry))
+            context.telemetry.addLink({ context: activation });
+        return object;
+    }
+    /** Where a hold arriving on `link` goes (`Destination.hold`: by the address it names); `released` once the host closed. */
+    place(request, link, caller, context) {
+        this.#assertOpen();
+        return this.#destination.hold(request, link, caller.principal, context);
+    }
+    /**
+     * What a hold placed here binds to, acting as `principal`: the object, or why it waits unbound (`failed
+     * { waiting }`): a remote type not served here (`not_served`), not at the hold's version and fingerprint, or whose
+     * params put it on another host (code skew: `version`). Throws for a broken refusal: invalid params, an activation
+     * the hold's chain waits for (`invalid/cycle`, Q5). A new object keeps the hold's chain.
+     */
+    serving(request, params, principal, context) {
+        const { type, version, fingerprint, chain = NO_CHAIN } = request;
+        const served = this.#types.get(type);
+        const unbound = unboundCause(served, "remote", type, version, fingerprint);
+        if (unbound !== undefined)
+            return { kind: "waiting", cause: unbound };
+        // Checked above: a remote type served here.
+        const remote = served;
+        const checked = checkParams(remote.contract, params, context);
+        const misplaced = this.#destination.misplaced(remote.contract, checked.params);
+        if (misplaced !== undefined)
+            return { kind: "waiting", cause: { kind: "waiting", error: misplaced } };
+        // The hold's carrier with this host's adapter: the first trigger of an object it creates.
+        const trigger = parentOf(request.trace, this.telemetry);
+        const object = this.#object(remote, checked, principal, trigger, context, chain);
+        const activation = object.activationId;
+        if (activation !== undefined && chain.includes(activation))
+            throw this.cycle(chain, activation, [object.label]);
+        return { kind: "object", object };
+    }
+    /**
+     * The path a remote reference of `Type` with `params` acting as `principal` goes over now: `ref.retry()` places a
+     * reference failed for a part past the limits anew (a route may have forgotten its old path). Throws as
+     * `Destination.reference` does, and `unavailable` for a type placed here now.
+     */
+    pathOf(Type, params, principal) {
+        // A retry has no context of its own: its admission checks count on none.
+        const placed = this.#destination.reference(Type, params, principal, BACKGROUND_CONTEXT);
+        if (placed.kind === "path")
+            return placed.path;
+        throw new ChordError({ code: "unavailable", message: `${Type.name} is placed here now` });
+    }
+    /**
+     * The `invalid/cycle` error of a cycle through `chain` (Q5): its entries from the activation `id` on, by label
+     * where the object is on this host ("…" for other hosts'), then `closing`.
+     */
+    cycle(chain, id, closing) {
+        const labels = new Map([...this.#objects.values()].map((each) => [each.activationId, each.label]));
+        const cycle = chain.slice(chain.indexOf(id)).map((entry) => labels.get(entry) ?? "…");
+        return invalid("cycle", `dependency cycle: ${[...cycle, ...closing].join(" → ")}`);
+    }
+    /** A new origin number for `side`, which relays holds upstream; registered in `relays` until it closes. */
+    relayOrigin(side) {
+        const origin = this.#nextOrigin++;
+        this.relays.set(origin, side);
+        return origin;
+    }
+    /**
+     * A route's link, its work under the route's `context`: registered with the host and its heartbeat; one closed
+     * already is returned closed.
+     */
+    routeLink(link, options, context) {
+        return this.#link(link, "route", options, context);
+    }
+    /** A link completed its handshake: a route's address resolves again once if it drops. */
+    linkOpened(link) {
+        if (link.role !== "route")
+            return;
+        for (const route of this.#routes.values())
+            route.opened(link);
+    }
+    /**
+     * Forgets a link once it closed: the origins relaying to it, then the parent's path or its route's address are
+     * told; the heartbeat may stop.
+     */
+    unlink(link) {
+        this.#links.delete(link);
+        for (const relay of this.relays.values())
+            relay.unlinked(link);
+        if (this.#links.size === 0) {
+            clearInterval(this.#ticking);
+            this.#ticking = undefined;
+        }
+        if (link.role === "parent")
+            this.#parent.disconnected(link);
+        if (link.role === "route")
+            for (const route of this.#routes.values())
+                if (route.closed(link))
+                    break;
+    }
+    /** Moves `object` behind every object that went live before it (close ends in reverse); its backoff is over. */
+    wentLive(object) {
+        this.#objects.delete(object.identity);
+        this.#objects.set(object.identity, object);
+        this.backoff.delete(object.identity);
+    }
+    /** Drops an ended object (once, before a next instance of its identity exists). */
+    forget(object) {
+        this.#objects.delete(object.identity);
+        this.backoff.ended(object.identity);
+    }
+    /** Records a teardown for `identity`: its next attempt waits for it and for every earlier one still running. */
+    ending(identity, teardown) {
+        const previous = this.#endings.get(identity);
+        const ending = previous === undefined ? teardown : Promise.all([previous, teardown]).then(() => { });
+        this.#endings.set(identity, ending);
+        void ending.then(() => {
+            if (this.#endings.get(identity) === ending)
+                this.#endings.delete(identity);
+        });
+    }
+    /** What the next attempt for `identity` waits for: its previous instances' teardowns, if any still run. */
+    endingOf(identity) {
+        return this.#endings.get(identity);
+    }
+    /**
+     * A reference to `Type` made by `caller` for `host.hold` and getters: params checked at once (`invalid/params`,
+     * also before `load`), then placed (`#place`); before the host's publication it waits in the unbound index,
+     * `loading`, and the publication places it.
+     */
+    #hold(Type, params, caller, context, options) {
+        this.#assertOpen();
+        this.#assertLoadCalled(Type.name);
+        const checked = checkParams(Type, params, context);
+        const binding = this.#binding(Type, undefined, caller, options);
+        const place = () => this.#place(binding, Type, checked, context);
+        if (this.#published)
+            place();
+        else
+            this.#wait(binding, Type.name, undefined, place);
+        return binding;
+    }
+    /**
+     * Places a reference (`bind`); where it cannot go (a `hostAddress` or `authorize` that throws or refuses) fails it
+     * broken, until `ref.retry()` places it again. One woken after the host closed ends as the close ended the others.
+     */
+    #place(binding, Type, checked, context) {
+        if (this.#state === "closed") {
+            binding.end(this.#closedError());
+            return;
+        }
+        try {
+            this.bind(binding, Type, checked, context);
+        }
+        catch (error) {
+            const again = () => this.#place(binding, Type, checked, context);
+            binding.refuse({ kind: "broken", error: asChordError(error, Type.name) }, again);
+        }
+    }
+    /**
+     * The provider's own host-address check of a remote `Type` placed here by the consumer's contract, against the one
+     * served (`invalid/host_address`, `waiting`: code skew); none when both have the same `hostAddress` (the consumer
+     * computed it with the provider's function) or the type is local. A provider's `hostAddress` that throws throws.
+     */
+    #misplaced(Type, served, params) {
+        if (served.kind !== "remote" || contractData(Type).hostAddress === contractData(served.contract).hostAddress) {
+            return undefined;
+        }
+        const error = this.#destination.misplaced(served.contract, params);
+        return error === undefined ? undefined : { kind: "waiting", error };
+    }
+    /** Leaves `binding` unbound in the index under `name`: `cause` (`waiting`), or none before the publication. */
+    #wait(binding, name, cause, place) {
+        binding.wait(cause, place, () => this.#unbound.delete(name, binding));
+        this.#unbound.add(name, binding, cause);
+    }
+    /** A new reference's binding made by `caller`; its parked calls wait its `readyTimeout`. */
+    #binding(Type, dependent, caller, options) {
+        return new Binding(Type, this.batch, dependent, caller, options.readyTimeout ?? this.timeouts.ready);
+    }
+    /** This host as the maker of its own references: its principal and incarnation. */
+    #own() {
+        return { principal: this.principal, incarnation: this.incarnation };
+    }
+    /** Whether `principal` is this host's own (by principal key): revocation never touches it. */
+    #isOwn(principal, context) {
+        const own = this.principal;
+        if (own === undefined)
+            return false;
+        // Principals on this host are `P`s: its own, and the ones its links stamp.
+        return (principalKey(own, context, this.#principalKey) === principalKey(principal, context, this.#principalKey));
+    }
+    /**
+     * `context` for work this host does under it (a link's, a root scope's): one without a span carries this host's
+     * adapter's metrics (`countingOnly`), so the cost counters of that work reach the adapter (review L6).
+     */
+    #counted(context) {
+        const counting = this.#counting;
+        if (counting === undefined || context.telemetry !== NOOP_TELEMETRY_CONTEXT)
+            return context;
+        return withTelemetry(counting, context);
+    }
+    /** A new link of `role`, registered with the heartbeat while open. */
+    #link(link, role, options, context) {
+        const { principal, trusted = false, codec = binaryCodec } = options;
+        const limits = linkLimits(trusted, options.limits);
+        const made = new HostLink(this, link, { role, principal, trusted, codec, limits }, this.#counted(withoutAbortSignal(context)));
+        if (!made.open)
+            return made;
+        this.#links.add(made);
+        if (this.#ticking === undefined) {
+            const { ping, close } = this.#heartbeat;
+            const every = Math.min(ping, close) / 10;
+            let last = Date.now();
+            this.#ticking = setInterval(() => {
+                const now = Date.now();
+                // A tick a whole interval late is time this process did not run (a sleeping laptop, a blocked event loop).
+                const late = now - last - every;
+                const paused = late >= every ? late : 0;
+                last = now;
+                for (const each of [...this.#links])
+                    each.tick(now, paused, ping, close);
+            }, every);
+        }
+        return made;
+    }
+    /** The identity of `served`'s object for `params` and `principal` (a remote type's includes its principal key). */
+    #identity(served, params, principal, context) {
+        if (served.kind === "local")
+            return identityKey(served.contract, params.key);
+        // A host serving remote types has a principal, which its references act as unless a link stamped its own (only
+        // `P`s).
+        return identityKey(served.contract, params.key, principalKey(principal, context, this.#principalKey));
+    }
+    /**
+     * The object for `params` (checked by L1) and, for a remote type, `principal` (its key is part of the identity),
+     * created if there is none; its first attempt starts at once, or when its identity's backoff window ends. A new one
+     * keeps the activation chain it is created for (Q5): `chain` (a hold's), or that of `dependent`'s activation when
+     * an activation declared it, so its own holds over links carry that chain on. A new one's first activation span
+     * links to `trigger` (decision "Shared work").
+     */
+    #object(served, params, principal, trigger, context, chain = NO_CHAIN, dependent) {
+        const { params: checked, key } = params;
+        const identity = this.#identity(served, params, principal, context);
+        let object = this.#objects.get(identity);
+        if (object === undefined) {
+            // Shared by every getter: one getter's cancellation does not cancel it.
+            const owner = served.kind === "local" ? undefined : principal;
+            const created = dependent?.activationChain() ?? chain;
+            object = new ChordObject(this, served, checked, owner, key, identity, trigger, withoutAbortSignal(context), created);
+            this.#objects.set(identity, object);
+            if (!this.backoff.waiting(identity))
+                object.attempt();
+        }
+        return object;
+    }
+    /**
+     * Closes the links, then ends every object at once and tears them down one by one, the last to go live first, after
+     * the endings already running.
+     */
+    async #close() {
+        this.#state = "closed";
+        this.#routing.abort(this.#closedError());
+        // Links first, children, routes, then the parent: no `gone` goes out for the objects ending below.
+        const links = [...this.#links];
+        for (const role of ["child", "route", "parent"])
+            for (const link of links)
+                if (link.role === role)
+                    link.close();
+        // Remote references end now: their parked calls reject `released`, no later link holds them.
+        const closed = this.#closedError();
+        // Code outside objects stops at its next use of Chord: an `fn` waiting in `sleep(ms, ctx)` ends.
+        this.#roots.close(closed);
+        for (const holder of this.#pathHolders())
+            if (holder.kind === "remote")
+                holder.lost(closed);
+        // At the fence too: requests still waiting for a publication or a provider end as the others did, and gets
+        // waiting for a publication that will not come fail now, not after the slow closes below (fix round 1).
+        this.#unbound.close(closed);
+        this.#clock.close();
+        this.#publication.resolve();
+        this.backoff.clear();
+        // Every object is sealed before any teardown releases a reference, so none ends in the background.
+        const teardowns = [...this.#objects.values()].reverse().map((object) => object.stop());
+        await Promise.all(this.#endings.values());
+        const failures = [];
+        for (const tearDown of teardowns)
+            failures.push(...(await tearDown()));
+        this.#types.clear();
+        // Their facets keep their factories' closures (which may keep objects' handles).
+        this.#plugins.clear();
+        for (const record of this.#registries.values())
+            record.close();
+        this.#registries.clear();
+        this.store?.detach();
+        if (failures.length > 0) {
+            const message = `host.close: ${failures.length} native close(s) threw`;
+            throw new AggregateError(failures.map(({ error }) => error), message);
+        }
+    }
+    /** Every holder of the parent path, the unplaced one and every route's paths: this host's requests over links. */
+    #pathHolders() {
+        const routed = [...this.#routes.values()].flatMap((route) => route.holders());
+        return [...this.#parent.holders(), ...this.unplaced.holders(), ...routed];
+    }
+    /** The store stopped after a backend error (it tells the host once): reported, and the host closes. */
+    #storageFailed(error) {
+        this.report({ kind: "storage_failed", error });
+        this.#closing ??= this.#close();
+        // The app's own `close` returns this closing and gets its failures.
+        this.#closing.catch(() => { });
+    }
+    /** A backoff window ended: the identity's object is retried; without one the entry goes. */
+    #due(identity) {
+        const object = this.#objects.get(identity);
+        if (object === undefined)
+            this.backoff.delete(identity);
+        else
+            object.attempt();
+    }
+    /**
+     * Publishes the staged plugins of `facets` (by name), inside the publication's batch: the registries they serve
+     * served, their facet contributions entered into the tables (the types are the staged table's, set by the caller).
+     */
+    #publish(staged, facets) {
+        for (const [name, facet] of facets) {
+            const plugin = staged.plugins.get(name);
+            for (const [registry, { registry: token, provider }] of plugin.registries) {
+                this.registryRecord(registry).serve(token.version, provider);
+            }
+            const contributions = plugin.contributions.map(({ registry, value }) => contributionOf(this.registryRecord(registry.name), { plugin: name, type: undefined }, registry.version, value));
+            for (const contribution of contributions)
+                contribution.record.add(contribution);
+            this.#plugins.set(name, { facet, staged: plugin, contributions });
+        }
+    }
+    #assertOpen() {
+        if (this.#state === "closed")
+            throw this.#closedError();
+    }
+    /**
+     * A request of this host's own (`get`, `hold`, `registry`, a root's `ctx.get`) for `name` before its first `load`
+     * would wait for a publication nobody started: it throws `not_ready` at once (decision "Mistakes that wait are
+     * reported at once" (a)). Holds arriving on its links before `load` still wait for the publication (a worker
+     * connects first, W6).
+     */
+    #assertLoadCalled(name) {
+        if (this.#state !== "new")
+            return;
+        const fix = "call host.load first (a host with nothing to load calls load([]))";
+        throw new ChordError({ code: "not_ready", message: `${name}: the host has not loaded; ${fix}` });
+    }
+    /**
+     * At each publication (`load`'s, a reload's commit), after its batch: every registry with contributions and no
+     * provider here is reported `registry_undeclared`, naming its contributors; again only once they change.
+     */
+    #reportUndeclared() {
+        for (const record of this.#registries.values())
+            record.reportUndeclared();
+    }
+    #closedError() {
+        return new ChordError({ code: "released", reason: "closed", message: "the host is closed" });
+    }
+}
+/**
+ * Why a reference to a type of `kind` at `version` and `fingerprint`, placed here, cannot bind to `served` (the type of
+ * that name served here): not served, or as the other kind (`unavailable`); another version or fingerprint
+ * (`contract_mismatch`); `undefined` when it binds. Both wait for a publication: `failed { waiting }`.
+ */
+function unboundCause(served, kind, name, version, fingerprint) {
+    if (served === undefined || served.kind !== kind) {
+        return { kind: "waiting", error: new ChordError({ code: "unavailable", message: `${name} is not served here` }) };
+    }
+    const { contract } = served;
+    if (binds(served.provider, version, fingerprint))
+        return undefined;
+    const message = `${name} v${version} does not match the served v${contract.version}`;
+    return { kind: "waiting", error: new ChordError({ code: "contract_mismatch", message }) };
+}
+/**
+ * Waits until `usable()` (a registry value's check, which records its last error) holds, checked at every change the
+ * value tells its waiters of (after the batch that made it); rejects when `context` aborts or the value closes. It
+ * waits on the value only while it runs.
+ */
+async function untilUsable(value, usable, context) {
+    let changed = Promise.withResolvers();
+    const release = value.wait({
+        dependencyMoved: () => queueMicrotask(() => changed.resolve()),
+        // The value closed with its host: the wait ends with the close's error.
+        closed: (error) => changed.reject(error),
+    });
+    try {
+        while (!usable()) {
+            await awaitWithContext(changed.promise, context);
+            changed = Promise.withResolvers();
+        }
+    }
+    finally {
+        release();
+    }
+}
+/** The `aborted` error of a reload whose context aborted before its commit: nothing changed. */
+function reloadAborted() {
+    return new ChordError({ code: "aborted", message: "reload: aborted" });
+}
+/** The error of a plugin name given twice: the second is refused. */
+function loadedTwice(name) {
+    return new Error(`plugin "${name}" is loaded twice`);
+}
+/** Whether registry provider `served` serves readers of `version`: its own, or an older one its `accepts` maps back. */
+function registryServes(served, version) {
+    const provided = served.registry.version;
+    return provided === version || (provided > version && served.provider.accepts?.[version]?.value !== undefined);
+}
+//# sourceMappingURL=host.js.map