@fougere/core 0.10.0-alpha.0 → 0.11.0-alpha.0

package/dist/wire/Emit.js

@@ -1,4 +1,5 @@
 import { lowerFirst } from '@fougere/schema';
+import { computeBindingPlan } from './binding.js';
 /** The container key of an emission — THE one place that spells the format. */
 export function emitKeyOf(fact) {
     return `${lowerFirst(fact)}Emit`;
@@ -34,6 +35,21 @@ export function factsAnnouncedBy(handlers) {
 export function factsAwaitedBy(handlers) {
     return factsIn(handlers, factOfAwaitKey);
 }
+/**
+ * What a set of handlers LISTENS to — the dual of what it announces, and the half no
+ * dependency spells: accepting a `Fact<T>` IS the subscription, so it is read from the
+ * binding plan, where `Emissions` reads it too.
+ */
+export function factsListenedTo(handlers) {
+    const taken = (contract) => {
+        const plan = contract.binding
+            ?? (contract.signature ? computeBindingPlan(contract.signature.params, NO_COLLECTOR) : []);
+        return plan.flatMap((bound) => bound.source.kind === 'fact' || bound.source.kind === 'pipe' ? [bound.source.factName] : []);
+    };
+    return [...new Set(handlers.flatMap((handler) => [...handler.operations.values()].flatMap(taken)))];
+}
+/** `Fact` and `Pipe` name themselves, and the plan reads them before it reads a collector. */
+const NO_COLLECTOR = new Set();
 function factsIn(handlers, behindKey) {
     return [...new Set(handlers
             .flatMap((handler) => handler.deps)

package/dist/wire/Emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"Emit.js","sourceRoot":"","sources":["../../src/wire/Emit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAU7C,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,MAAc;IACzC,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,QAAgD;IAC/E,OAAO,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,QAAgD;IAC7E,OAAO,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,OAAO,CACd,QAAgD,EAChD,SAA8C;IAE9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAChB,QAAQ;aACL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,GAAG,CAAC,SAAS,CAAC;aACd,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"Emit.js","sourceRoot":"","sources":["../../src/wire/Emit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAYlD,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,MAAc;IACzC,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,QAAgD;IAC/E,OAAO,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,QAAgD;IAC7E,OAAO,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkD;IAChF,MAAM,KAAK,GAAG,CAAC,QAA2B,EAAY,EAAE;QACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO;eACxB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE7F,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,8FAA8F;AAC9F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC,SAAS,OAAO,CACd,QAAgD,EAChD,SAA8C;IAE9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAChB,QAAQ;aACL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,GAAG,CAAC,SAAS,CAAC;aACd,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/wire/Invocation.d.ts

@@ -9,7 +9,8 @@ export declare class Invocation implements InvocationContext {
     readonly trace?: string;
     readonly identity?: string;
     readonly caller?: string;
-    /** Gives every entry and every transport the same seven-member value, frozen. */
+    readonly runAt?: number;
+    /** Gives every entry and every transport the same eight-member value, frozen. */
     private constructor();
     /** Takes a raw object or an invocation, so a caller never has to know which it holds. */
     static from(context?: PartialInvocation): Invocation;

package/dist/wire/Invocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Invocation.d.ts","sourceRoot":"","sources":["../../src/wire/Invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAuBhE,gEAAgE;AAChE,qBAAa,UAAW,YAAW,iBAAiB;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,iFAAiF;IACjF,OAAO;IAaP,yFAAyF;IACzF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,UAAU;IAIpD,MAAM,CAAC,QAAQ,CAAC,KAAK,aAAqB;IAE1C,wEAAwE;IACxE,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU;IAIrC,0FAA0F;IAC1F,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU;CAGtD"}
+{"version":3,"file":"Invocation.d.ts","sourceRoot":"","sources":["../../src/wire/Invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAuBhE,gEAAgE;AAChE,qBAAa,UAAW,YAAW,iBAAiB;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,iFAAiF;IACjF,OAAO;IAcP,yFAAyF;IACzF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,UAAU;IAIpD,MAAM,CAAC,QAAQ,CAAC,KAAK,aAAqB;IAE1C,wEAAwE;IACxE,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU;IAIrC,0FAA0F;IAC1F,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU;CAGtD"}

package/dist/wire/Invocation.js

@@ -29,7 +29,8 @@ export class Invocation {
     trace;
     identity;
     caller;
-    /** Gives every entry and every transport the same seven-member value, frozen. */
+    runAt;
+    /** Gives every entry and every transport the same eight-member value, frozen. */
     constructor(context) {
         this.params = canonicalRecord(context.params);
         this.query = canonicalRecord(context.query);
@@ -43,6 +44,8 @@ export class Invocation {
             this.identity = context.identity;
         if (context.caller !== undefined)
             this.caller = context.caller;
+        if (context.runAt !== undefined)
+            this.runAt = context.runAt;
         Object.freeze(this);
     }
     /** Takes a raw object or an invocation, so a caller never has to know which it holds. */

package/dist/wire/Invocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"Invocation.js","sourceRoot":"","sources":["../../src/wire/Invocation.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAE1E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,MAAM,OAAO,UAAU;IACZ,MAAM,CAA0B;IAChC,KAAK,CAA0B;IAC/B,KAAK,CAAU;IACf,KAAK,CAA0B;IAC/B,KAAK,CAAU;IACf,QAAQ,CAAU;IAClB,MAAM,CAAU;IAEzB,iFAAiF;IACjF,YAAoB,OAA0B;QAC5C,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,mFAAmF;QACnF,0DAA0D;QAC1D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAU,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1C,wEAAwE;IACxE,SAAS,CAAC,KAAc;QACtB,OAAO,IAAI,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,0FAA0F;IAC1F,SAAS,CAAC,KAA8B;QACtC,OAAO,IAAI,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC"}
+{"version":3,"file":"Invocation.js","sourceRoot":"","sources":["../../src/wire/Invocation.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAE1E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,gEAAgE;AAChE,MAAM,OAAO,UAAU;IACZ,MAAM,CAA0B;IAChC,KAAK,CAA0B;IAC/B,KAAK,CAAU;IACf,KAAK,CAA0B;IAC/B,KAAK,CAAU;IACf,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,KAAK,CAAU;IAExB,iFAAiF;IACjF,YAAoB,OAA0B;QAC5C,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,mFAAmF;QACnF,0DAA0D;QAC1D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAU,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1C,wEAAwE;IACxE,SAAS,CAAC,KAAc;QACtB,OAAO,IAAI,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,0FAA0F;IAC1F,SAAS,CAAC,KAA8B;QACtC,OAAO,IAAI,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC"}

package/dist/wire/InvocationContext.d.ts

@@ -6,5 +6,7 @@ export interface InvocationContext {
     trace?: string;
     identity?: string;
     caller?: string;
+    /** Epoch milliseconds before which this call is not to run. */
+    runAt?: number;
 }
 //# sourceMappingURL=InvocationContext.d.ts.map

package/dist/wire/InvocationContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InvocationContext.d.ts","sourceRoot":"","sources":["../../src/wire/InvocationContext.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"InvocationContext.d.ts","sourceRoot":"","sources":["../../src/wire/InvocationContext.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/wire/SignedCall.d.ts

@@ -8,5 +8,7 @@ export interface SignedCall {
     query?: Record<string, unknown>;
     input?: unknown;
     state?: Record<string, unknown>;
+    /** The hour, pinned like the input: moving it is moving the call. */
+    runAt?: number;
 }
 //# sourceMappingURL=SignedCall.d.ts.map

package/dist/wire/SignedCall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignedCall.d.ts","sourceRoot":"","sources":["../../src/wire/SignedCall.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC"}
+{"version":3,"file":"SignedCall.d.ts","sourceRoot":"","sources":["../../src/wire/SignedCall.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/core",
-  "version": "0.10.0-alpha.0",
+  "version": "0.11.0-alpha.0",
   "description": "The core — scan, call contract, façades, remote stand-ins.",
   "keywords": [
     "fougere",
@@ -61,12 +61,12 @@
   "dependencies": {
     "@typescript/typescript6": "^6.0.2",
     "dequal": "^2.0.3",
-    "@fougere/container": "0.10.0-alpha.0",
-    "@fougere/schema": "0.10.0-alpha.0"
+    "@fougere/schema": "0.11.0-alpha.0",
+    "@fougere/container": "0.11.0-alpha.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "@fougere/compiler": "0.10.0-alpha.0"
+    "@fougere/compiler": "0.11.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"

package/src/CallIdentity.ts

@@ -31,6 +31,8 @@ async function boundTo(call: SignedCall) {
     params: call.params ?? {},
     query: call.query ?? {},
     input: await digestOf(call.input),
+    // Omitted when absent, so a call with no hour pins what it always pinned.
+    ...(call.runAt === undefined ? {} : { runAt: call.runAt }),
   };
 }
 

package/src/Constraint.ts

@@ -1,2 +1,2 @@
 /** A promise the judge at the facade cannot keep, because it is about rows it never sees. */
-export type Constraint = 'unique';
+export type Constraint = 'unique' | 'relation';

package/src/Source.ts

@@ -6,10 +6,11 @@ import type { SourceConfig } from './SourceConfig.js';
 
 /** Whether an entity asks for one, anywhere but on its key. */
 export function declares(schema: SchemaView, constraint: Constraint): boolean {
-  if (constraint !== 'unique') return false;
+  const fields = Object.values(schema.getFields());
+  if (constraint === 'relation') return fields.some((field) => Role.of(field).isReference);
   if ((schema.getUnique() ?? []).length > 0) return true;
 
-  return Object.values(schema.getFields()).some((field) => Role.of(field).isUnique);
+  return fields.some((field) => Role.of(field).isUnique);
 }
 
 /**

package/src/boot/Hosting.ts

@@ -0,0 +1,38 @@
+import type { SchemaView } from '@fougere/schema';
+import type { Constraint } from '../Constraint.js';
+import type { Peer } from './Peer.js';
+import type { Journal } from '../dispatch/Journal.js';
+
+/**
+ * Where an entity's rows are hosted, and what the host keeps — what a `ref()` asks the boot.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export interface Hosting {
+  /** False behind `remotes:` — whose `sourceOf` still answers the default, and means nothing. */
+  hostedHere(entity: string): boolean;
+  sourceOf(entity: string): string;
+  enforces(source: string, constraint: Constraint): boolean;
+  /**
+   * Resolved through the frond that owns it, never the asking frond's scope: a scope sees its
+   * parent and not its siblings, so a target of another frond was answered by nothing.
+   */
+  storageOf(entity: string): unknown | undefined;
+  /** Every entity of every frond — a row is named from wherever its namer was declared. */
+  entities(): ReadonlyMap<string, SchemaView>;
+  /**
+   * The process that HOLDS an entity's rows, when this one does not. Absent when nothing can
+   * reach it: no `remotes:` entry, or no transport to carry the ask.
+   */
+  peerOf(entity: string): Peer | undefined;
+  /**
+   * One per declared remote, whatever this process knows of what lives there.
+   *
+   * A frond behind `remotes:` may have no sources here at all — `fougere sync` writes a card
+   * and nothing else — so this process cannot see that its rows name ours. Only the process
+   * holding them can, which is why a release asks every remote rather than deciding for it.
+   */
+  peers(): readonly Peer[];
+  /** The journal a package registered, resolved per call — absent for what CARRIES one. */
+  journal(entity: string): Journal | undefined;
+}

package/src/boot/Peer.ts

@@ -0,0 +1,15 @@
+/** The process that holds rows this one names, reached by the two readings core always serves. */
+export interface Peer {
+  /** Which of these keys no row answers over there — the write's question, asked across. */
+  missing(entity: string, keys: readonly unknown[]): Promise<readonly unknown[]>;
+  /** Who names these rows over there, and what becomes of them — its own `dependentsOf`. */
+  dependents(entity: string): Promise<unknown>;
+  /**
+   * Release a row over there: its rows go first, then the row, on its side of the wire.
+   *
+   * `visited` travels so a release cannot bounce: two processes that declare each other would
+   * otherwise ask each other about the same row forever. It is carried rather than held,
+   * because the two sides share no memory.
+   */
+  release(entity: string, key: unknown, visited: readonly string[]): Promise<void>;
+}

package/src/boot/bootstrap.ts

@@ -5,6 +5,12 @@ import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
 import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import { hostedBy } from './hosted.js';
 import { installFrond, type Assembly } from './install.js';
+import { dependentsOf, releasing, unfinishable, unheldAmong } from './relations.js';
+import { release as releaseRow } from '../dispatch/Release.js';
+import type { Hosting } from './Hosting.js';
+import { peerOver } from './peerOver.js';
+import { JOURNAL, type Journal } from '../dispatch/Journal.js';
+import type { RelationCheck } from '../dispatch/RelationCheck.js';
 import { refusalOf, type Diagnostic } from '../diagnostic.js';
 import type { AuthRuntime } from './AuthRuntime.js';
 import type { App } from './App.js';
@@ -30,7 +36,8 @@ import { type EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
 
 import { InFlight } from '../dispatch/InFlight.js';
 // The keys, each read from where its concept is declared — never respelled here.
-import { type RpcAnswer } from '../wire/RpcAnswer.js';
+import { RPC_ENTITY, type RpcAnswer } from '../wire/RpcAnswer.js';
+import { Invocation } from '../wire/Invocation.js';
 import { facadeKeyOf } from '../wire/Facade.js';
 import { identityCardOf } from './card.js';
 import { AppLifecycle, migrating } from './AppLifecycle.js';
@@ -251,12 +258,16 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         error,
       ),
     );
-    const dispatcher = new Dispatcher(routeRegistry, inflight, dispatchLifecycle);
+    // Resolved at the call and never here: a journal is a provider of a brought frond, and
+    // the extension that registers it rises long after this line.
+    const keeping = (): Journal | undefined => journalOf();
+    const dispatcher = new Dispatcher(routeRegistry, inflight, dispatchLifecycle, undefined, keeping);
     const localDispatcher = new Dispatcher(
       routeRegistry,
       inflight,
       dispatchLifecycle,
       new LocalRoutePolicy((surface) => fronds.servedNames(surface)),
+      keeping,
     );
 
     function getMiddlewares(entity: string): AppMiddleware[] {
@@ -280,6 +291,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
     /** What every check of this boot writes into — refused together, once they have all run. */
     const refused: Diagnostic[] = [];
+    const relations: RelationCheck[] = [];
     keyClaims(fronds, options.remotes, refused);
     // Said before anything is installed: a key claimed twice makes every later error worse —
     // the route registry collides first, and names a route instead of the two fronds.
@@ -313,6 +325,78 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       [...operations].map(([name, operation]) => [name, operation as OperationContract] as const),
     );
 
+    /**
+     * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
+     * facade.
+     */
+    const storageFor = (entity: string): unknown | undefined => {
+      const owner = fronds.owner(entity);
+      if (!owner) return undefined;
+
+      const key = storageKeyOf(entity);
+      try {
+        return container.resolve<Container>(`frond:${owner.name}`).resolve(key);
+      } catch {
+        return undefined;
+      }
+    };
+
+    // What carries a release writes none: an instrumentation frond's own rows are kept while a
+    // release happens, and journalling them would begin one inside the one being written down.
+    const carriesRelease = new Set(
+      fronds.filter((one) => one.brought).flatMap((one) => one.entities.map((e) => e.name)),
+    );
+
+    /**
+     * The journal a package registered, found where its own frond put it — a provider lands in
+     * its frond's scope, and the app container sees none of them.
+     */
+    const journalOf = (): Journal | undefined => {
+      for (const frond of fronds) {
+        if (!frond.brought) continue;
+        const scope = container.resolve<Container>(`frond:${frond.name}`);
+        if (scope.has(JOURNAL)) return scope.resolve<Journal>(JOURNAL);
+      }
+
+      return undefined;
+    };
+
+    const hosting: Hosting = {
+      hostedHere: (entity) => !(options.remotes && (frondOf.get(entity) ?? '') in options.remotes),
+      sourceOf: (name) => options.sourceOf?.(name) ?? 'db',
+      enforces: (source, constraint) => options.enforces?.(source, constraint) ?? false,
+      storageOf: storageFor,
+      entities: () => entityByName,
+      // The two readings core serves in EVERY process, asked of the one that holds the rows.
+      // Nothing is cached: a peer that was down at boot answers the next call.
+      // Built from `remotes:` itself, not from the router: the router indexes by ENTITY, read
+      // off a card, and the question here is asked of a PROCESS about rows it may be alone
+      // in knowing about.
+      // Resolved per call and never at boot: the package that registers it rises in the
+      // ascent, long after this answer is built.
+      journal: (entity) => (carriesRelease.has(entity) ? undefined : journalOf()),
+      peers: () => (options.remoteTransport
+        ? declaredRemotes.map(([, url]) => peerOver(options.remoteTransport!(url)))
+        : []),
+      peerOf: (entity) => (remoteRouter ? {
+        dependents: async (named) => (await remoteRouter.route(entity))
+          .transport({ entity: RPC_ENTITY, op: 'dependents' },
+            { ...Invocation.empty, params: { entity: named } as never }),
+        missing: async (named, keys) => {
+          const answer = await (await remoteRouter.route(entity))
+            .transport({ entity: RPC_ENTITY, op: 'holds' },
+              { ...Invocation.empty, params: { entity: named, keys } as never });
+
+          return (answer as { missing: readonly unknown[] }).missing;
+        },
+        release: async (named, key) => {
+          const route = await remoteRouter.route(entity);
+          await route.transport({ entity: RPC_ENTITY, op: 'release' },
+            { ...Invocation.empty, params: { entity: named, key } as never });
+        },
+      } : undefined),
+    };
+
     // Every port an implementation was bound to, so a `ports:` entry that named none
     // can say so rather than look obeyed.
     const boundPorts = new Set<string>();
@@ -322,11 +406,34 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     // table, one emission list — so what a frond serves is there for the next one to find.
     const assembly: Assembly = {
       container, routeRegistry, emissions, dispatcher, localDispatcher, effectiveByKey,
-      boundPorts, refused, operationModel, entityByName, frondOf, contractsOf, getMiddlewares, use,
-      log, options,
+      boundPorts, refused, relations, hosting, operationModel, entityByName, frondOf, contractsOf,
+      getMiddlewares, use, log, options,
     };
     for (const frond of fronds) await installFrond(frond, assembly);
 
+    // A reference no key holds and no storage answers: said at the END, for the reason the
+    // `ports:` warning below is — a target is another frond's, so no single frond can tell
+    // an absence from a neighbour that had not been installed yet.
+    const unheld = unheldAmong(relations, hosting);
+    // Declared here, and this process cannot finish what it starts — both halves are local,
+    // so nothing is asked of anyone. Said once, after every frond installed, because a journal
+    // arrives with an extension and an extension rises last.
+    const unfinished = unfinishable(hosting);
+    if (unfinished.length > 0) {
+      log.warn(
+        `[relations] ${unfinished.join(', ')} — declared, and this process keeps nothing on `
+        + 'restart: a release interrupted here is not resumed. Install @fougere/workflow, or '
+        + 'expect to finish one by hand.',
+      );
+    }
+
+    if (unheld.length > 0) {
+      log.warn(
+        `[relations] ${unheld.join(', ')} — declared, and nothing in this process holds them: `
+        + 'no foreign key, and the target answers elsewhere. A row may name one that is gone.',
+      );
+    }
+
     // Every check of the install, said at once — a boot that stops at the first makes the
     // next one visible only after a fix and a restart.
     const bootRefusal = refusalOf(refused, 'declaration(s) that do not hold');
@@ -495,22 +602,6 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         : undefined;
     };
 
-    /**
-     * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
-     * facade.
-     */
-    const storageFor = (entity: string): unknown | undefined => {
-      const owner = fronds.owner(entity);
-      if (!owner) return undefined;
-
-      const key = storageKeyOf(entity);
-      try {
-        return container.resolve<Container>(`frond:${owner.name}`).resolve(key);
-      } catch {
-        return undefined;
-      }
-    };
-
     /** The presenter of an entity, resolved through its owning frond's scope. */
     const presenterFor = (entity: string): unknown | undefined => {
       const owner = fronds.owner(entity);
@@ -577,8 +668,39 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
     // The card is an rpc op like any other, so one registry answers and one refusal names
     // what is served. A package's op is declared the same way, from outside.
+    // What a release is, resolved once and registered: a package that drives one asks for it
+    // by type, the way every other dependency is asked for.
+    container.registerValue('Releasing', releasing(hosting));
+
     app.serveRpc('discover', (_invocation, surface) => identityCardOf(app, surface));
 
+    // What a release asks another process, and what it tells it to do. Served by EVERY process
+    // the way `discover` is: a frond that hosts rows is the only one that can answer for them.
+    //
+    // Read off the STORAGE and never off a facade: a facade answers what its handler chose to
+    // show — `PostHandler.list` hands back published posts — so a draft naming a deleted user
+    // would be invisible to the very question that exists to find it.
+    // The dual of `release`, and the same reason it is served by every process: only the one
+    // that holds the rows can say a key is missing, and only from the STORAGE — a facade
+    // answers what its handler chose to show.
+    app.serveRpc('holds', async (invocation) => {
+      const named = String(invocation.params.entity);
+      const keys = (invocation.params.keys ?? []) as readonly unknown[];
+      const rows = storageFor(named) as { findByKeys(k: readonly string[]): Promise<Map<string, unknown>> } | undefined;
+      if (!rows) return { missing: [] };
+      const found = await rows.findByKeys(keys.map(String));
+
+      return { missing: keys.filter((key) => !found.has(String(key))) };
+    });
+    app.serveRpc('dependents', (invocation) =>
+      dependentsOf(String(invocation.params.entity), hosting));
+    app.serveRpc('release', async (invocation) => {
+      await releaseRow(String(invocation.params.entity), invocation.params.key, releasing(hosting),
+        (invocation.params.visited ?? []) as readonly string[]);
+
+      return { released: true };
+    });
+
     // The last thing the boot does, and the first thing a release undoes. An extension may
     // await here — which is what a provider needing to OPEN something could never do.
     built = app;

package/src/boot/declared.ts

@@ -5,6 +5,7 @@
  */
 import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
 import { facadeKeyOf } from '../wire/Facade.js';
+import { factsAnnouncedBy, factsAwaitedBy, factsListenedTo } from '../wire/Emit.js';
 import { type DeclaredEdge } from '../wire/topology/DeclaredEdge.js';
 import { type DeclaredFrond } from '../wire/topology/DeclaredFrond.js';
 import { type DeclaredTopology } from '../wire/topology/DeclaredTopology.js';
@@ -65,21 +66,52 @@ export function reachedBy(deps: readonly string[], from: string, index: Map<stri
   return [...new Set(reached)];
 }
 
+/**
+ * The two ways a call leaves a frond: a façade its code names, and a fact it announces.
+ *
+ * The second cannot be read the way the first is. A dependency names what it reaches, where an
+ * announcement names a SUBJECT and a subscriber names nothing at all — so the edge is found from
+ * both ends, the announcer's deps and the listener's binding plan. Reading the deps alone
+ * reported `demos/pipe-split` as four fronds with nothing between them, and three of its four
+ * fronds are reached by a fact.
+ */
 function crossings(hosted: readonly FrondDescriptor[]): DeclaredEdge[] {
   const index = servedBy(hosted);
+  const heard = listenedBy(hosted);
   const found = new Map<string, DeclaredEdge>();
+  const cross = (from: string, to: string) => {
+    if (from !== to) found.set(`${from} ${to}`, { from, to });
+  };
 
   for (const frond of hosted) {
     for (const handler of frond.handlers) {
-      for (const to of reachedBy(handler.deps, frond.name, index)) {
-        found.set(`${frond.name} ${to}`, { from: frond.name, to });
-      }
+      for (const to of reachedBy(handler.deps, frond.name, index)) cross(frond.name, to);
+    }
+    for (const fact of announcedIn(frond)) {
+      for (const to of heard.get(fact) ?? []) cross(frond.name, to);
     }
   }
 
   return [...found.values()];
 }
 
+/** Which fronds listen to each fact — every one of them, since an announcement names no recipient. */
+function listenedBy(hosted: readonly FrondDescriptor[]): Map<string, string[]> {
+  const index = new Map<string, string[]>();
+  for (const frond of hosted) {
+    for (const fact of factsListenedTo(frond.handlers)) {
+      index.set(fact, [...(index.get(fact) ?? []), frond.name]);
+    }
+  }
+
+  return index;
+}
+
+/** A fact announced here, whether the announcer waits for an answer or not. */
+function announcedIn(frond: FrondDescriptor): string[] {
+  return [...new Set([...factsAnnouncedBy(frond.handlers), ...factsAwaitedBy(frond.handlers)])];
+}
+
 function hostOf(address: string): string {
   try {
     const url = new URL(address);

package/src/boot/install.ts

@@ -26,6 +26,9 @@ import { inheritsCrud, subjectOf } from '../prefab/CrudConstructor.js';
 import { repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
 import { storageKeyOf } from '../storage/Storage.js';
 import { declares } from '../Source.js';
+import { heldBy, refuseUnwritableNull, releasing } from './relations.js';
+import type { Hosting } from './Hosting.js';
+import type { RelationCheck } from '../dispatch/RelationCheck.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
 import { collectorKeyOf } from '../prefab/collector.js';
 import { RouteAddress } from '../wire/RouteAddress.js';
@@ -51,6 +54,14 @@ export interface Assembly {
   boundPorts: Set<string>;
   /** Where a check writes what does not hold — collected across fronds, refused together. */
   refused: Diagnostic[];
+  /**
+   * The references this process reads itself, collected across fronds. Whether one is
+   * ANSWERED can only be asked once every frond has registered, which is why the list
+   * leaves here rather than being judged where it is built.
+   */
+  relations: RelationCheck[];
+  /** Where each entity is hosted — one answer for a frond's storage, its frames and its surfaces. */
+  hosting: Hosting;
   /** What the model resolved before the boot performed any side effect. */
   operationModel: EffectiveOperationModel;
   entityByName: Map<string, SchemaView>;
@@ -87,6 +98,9 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   }
   const scope = container.createScope();
   const frondLog = log.child(frond.name);
+  // The frond's own voice, a child of the APP logger and never of `log` — which is the
+  // boot's, so a service's line would have claimed `boot:` long after the boot was over.
+  scope.registerValue('Logger', container.resolve<Logger>('Logger').child(frond.name));
 
   // `reads:` is what makes a cross-source reader exist here, and the list IS its
   // environment — a source holding none of these is never opened. Registered under
@@ -174,6 +188,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // When a handler declares Crud(Entity, Output), scope the storage via .output(Output)
   if (options.storageFactory) {
     const unenforced: string[] = [];
+    const release = releasing(assembly.hosting);
     for (const entity of frond.entities) {
       const key = storageKeyOf(entity.name);
       const source = options.sourceOf?.(entity.name) ?? 'db';
@@ -194,7 +209,12 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
       // arrived. Same order the client facade has held since `StorageGuard` existed.
       const linked = wrapping('Storage', seams.get('Storage') ?? [], scoped, (dep) => scope.resolve(dep));
       // Storage is a way out like the client surface — see `StorageGuard`.
-      const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(linked);
+      refused.push(...refuseUnwritableNull(entity.entityClass, entity.name, entity.filePath));
+      const relations = heldBy(entity.entityClass, entity.name, assembly.hosting);
+      assembly.relations.push(...relations);
+      const guarded = new StorageGuard(
+        entity.entityClass.getFields(), entity.name, {}, relations, release,
+      ).guard(linked);
       scope.registerValue(key, guarded);
 
       // The default repository IS the guarded port — it already answers every gesture a
@@ -243,6 +263,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
       sourceOf: options.sourceOf,
       transacts: options.transacts,
       transacted: options.transacted,
+      hosting: assembly.hosting,
       log: frondLog,
     },
     refused,
@@ -415,7 +436,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
           ? { view: (outputSchema as { getFields(): Fields }).getFields() }
           : {}),
         outOfView: (message) => frondLog.warn(message),
-      }).guard(scoped);
+      }, heldBy(entity.entityClass, entity.name, assembly.hosting), releasing(assembly.hosting)).guard(scoped);
       surfaceScope.registerValue(storageKeyOf(entity.name), guarded);
       surfaceScope.registerValue(repositoryKeyOf(entity.name), guarded);
     }

package/src/boot/peerOver.ts

@@ -0,0 +1,17 @@
+/** The two readings core serves everywhere, asked of one process over one transport. */
+import { Invocation } from '../wire/Invocation.js';
+import { RPC_ENTITY } from '../wire/RpcAnswer.js';
+import type { Transport } from '../wire/Transport.js';
+import type { Peer } from './Peer.js';
+
+export function peerOver(transport: Transport): Peer {
+  const ask = (op: string, params: Record<string, unknown>) =>
+    transport({ entity: RPC_ENTITY, op }, { ...Invocation.empty, params: params as never });
+
+  return {
+    missing: async (entity, keys) =>
+      ((await ask('holds', { entity, keys })) as { missing: readonly unknown[] }).missing,
+    dependents: (entity) => ask('dependents', { entity }),
+    release: async (entity, key, visited) => { await ask('release', { entity, key, visited }); },
+  };
+}