@fougere/core 0.9.3-alpha.0 → 0.11.0-alpha.0

package/src/boot/Hosting.ts

@@ -0,0 +1,38 @@
+import type { SchemaView } from '@fougere/schema';
+import type { Constraint } from '../Constraint.js';
+import type { Peer } from './Peer.js';
+import type { Journal } from '../dispatch/Journal.js';
+
+/**
+ * Where an entity's rows are hosted, and what the host keeps — what a `ref()` asks the boot.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export interface Hosting {
+  /** False behind `remotes:` — whose `sourceOf` still answers the default, and means nothing. */
+  hostedHere(entity: string): boolean;
+  sourceOf(entity: string): string;
+  enforces(source: string, constraint: Constraint): boolean;
+  /**
+   * Resolved through the frond that owns it, never the asking frond's scope: a scope sees its
+   * parent and not its siblings, so a target of another frond was answered by nothing.
+   */
+  storageOf(entity: string): unknown | undefined;
+  /** Every entity of every frond — a row is named from wherever its namer was declared. */
+  entities(): ReadonlyMap<string, SchemaView>;
+  /**
+   * The process that HOLDS an entity's rows, when this one does not. Absent when nothing can
+   * reach it: no `remotes:` entry, or no transport to carry the ask.
+   */
+  peerOf(entity: string): Peer | undefined;
+  /**
+   * One per declared remote, whatever this process knows of what lives there.
+   *
+   * A frond behind `remotes:` may have no sources here at all — `fougere sync` writes a card
+   * and nothing else — so this process cannot see that its rows name ours. Only the process
+   * holding them can, which is why a release asks every remote rather than deciding for it.
+   */
+  peers(): readonly Peer[];
+  /** The journal a package registered, resolved per call — absent for what CARRIES one. */
+  journal(entity: string): Journal | undefined;
+}

package/src/boot/Peer.ts

@@ -0,0 +1,15 @@
+/** The process that holds rows this one names, reached by the two readings core always serves. */
+export interface Peer {
+  /** Which of these keys no row answers over there — the write's question, asked across. */
+  missing(entity: string, keys: readonly unknown[]): Promise<readonly unknown[]>;
+  /** Who names these rows over there, and what becomes of them — its own `dependentsOf`. */
+  dependents(entity: string): Promise<unknown>;
+  /**
+   * Release a row over there: its rows go first, then the row, on its side of the wire.
+   *
+   * `visited` travels so a release cannot bounce: two processes that declare each other would
+   * otherwise ask each other about the same row forever. It is carried rather than held,
+   * because the two sides share no memory.
+   */
+  release(entity: string, key: unknown, visited: readonly string[]): Promise<void>;
+}

package/src/boot/apply.ts

@@ -1,5 +1,5 @@
-import type { FougereConfig } from '../config-loader.js';
-import { setLogLevel, logLevel, envLevel } from '../builtin/logger.js';
+import type { FougereConfig } from '../FougereConfig.js';
+import { envLevel, logLevel, setLogLevel } from '../builtin/Logger.js';
 import { dequal } from 'dequal';
 
 export interface ConfigApplication {

package/src/boot/bootstrap.ts

@@ -1,56 +1,62 @@
 import type { Container } from '@fougere/container';
-import { lowerFirst, type Fields, type SchemaView } from '@fougere/schema';
-import { nameOf } from '../descriptor/frond.js';
-import type { EntityEntry, HandlerEntry, PresenterEntry } from '../descriptor/frond.js';
+import { lowerFirst, type SchemaView } from '@fougere/schema';
+
+import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
+import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import { hostedBy } from './hosted.js';
 import { installFrond, type Assembly } from './install.js';
-import type { AuthRuntime } from './auth.js';
-import type { CreateAppOptions, App } from './types.js';
-import type { AppMiddleware } from '../wire/middleware.js';
-import { Carry, Logger } from '../builtin/logger.js';
-import type { LogRecord } from '../builtin/logger.js';
+import { dependentsOf, releasing, unfinishable, unheldAmong } from './relations.js';
+import { release as releaseRow } from '../dispatch/Release.js';
+import type { Hosting } from './Hosting.js';
+import { peerOver } from './peerOver.js';
+import { JOURNAL, type Journal } from '../dispatch/Journal.js';
+import type { RelationCheck } from '../dispatch/RelationCheck.js';
+import { refusalOf, type Diagnostic } from '../diagnostic.js';
+import type { AuthRuntime } from './AuthRuntime.js';
+import type { App } from './App.js';
+import type { CreateAppOptions } from './CreateAppOptions.js';
+import type { AppMiddleware } from '../wire/AppMiddleware.js';
+import { Carry } from '../builtin/Carry.js';
+import { Logger } from '../builtin/Logger.js';
+import type { LogRecord } from '../builtin/LogRecord.js';
 import LogLine, { CARRIES_LINE } from '../builtin/LogLine.js';
-import { emitKeyOf, type Emit } from '../wire/emit.js';
+import { emitKeyOf, type Emit } from '../wire/Emit.js';
 
 /** The fact the boot announces, spelled once. */
 const LOG_LINE = lowerFirst(LogLine.name);
 import { Config } from '../builtin/config.js';
 import { createRemoteRouter, createRemoteFacade } from './remote.js';
-import { registerFrames } from './together.js';
+
 import { Emissions } from './Emissions.js';
-import { HandlerFacade } from '../dispatch/HandlerFacade.js';
-import { targetOf } from '../prefab/prefab.js';
-import { ownersOf, refuseStorageInUserCode, refuseCrudOnOwned } from './ownership.js';
-import type { OperationContract, OperationsMap } from '../wire/operation.js';
-import {
-  resolveEffectiveOperations,
-  type EffectiveOperationsMap,
-} from '../effective-operation.js';
-import { StorageGuard } from '../dispatch/StorageGuard.js';
-import { portBindings } from './ports.js';
+
+import type { OperationContract } from '../wire/OperationContract.js';
+import type { OperationsMap } from '../wire/OperationsMap.js';
+import { resolveEffectiveOperations } from '../EffectiveOperationModel.js';
+import { type EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
+
 import { InFlight } from '../dispatch/InFlight.js';
 // The keys, each read from where its concept is declared — never respelled here.
-import { facadeKeyOf, contractsKeyOf, type RpcAnswer } from '../wire/call.js';
+import { RPC_ENTITY, type RpcAnswer } from '../wire/RpcAnswer.js';
+import { Invocation } from '../wire/Invocation.js';
+import { facadeKeyOf } from '../wire/Facade.js';
 import { identityCardOf } from './card.js';
 import { AppLifecycle, migrating } from './AppLifecycle.js';
 import { seeding } from './seed.js';
-import { inheritsCrud, subjectOf } from '../prefab/crud.js';
-import { repositoryKeyOf } from '../prefab/repository.js';
-import { storageKeyOf } from '../storage/port.js';
-import { declares } from '../source.js';
+
+import { storageKeyOf } from '../storage/Storage.js';
+
 import { presenterKeyOf } from '../prefab/presenter.js';
-import { collectorKeyOf } from '../prefab/collector.js';
+
 import { RouteAddress } from '../wire/RouteAddress.js';
 import { DispatchLifecycle } from '../dispatch/DispatchLifecycle.js';
 import { Dispatcher } from '../dispatch/Dispatcher.js';
 import { LocalRoutePolicy } from '../dispatch/LocalRoutePolicy.js';
-import { servedSurfaces } from '../descriptor/surface.js';
+
 import { OperationRoute } from '../dispatch/OperationRoute.js';
 import { remoteRoutes } from '../dispatch/remoteRoutes.js';
 import { RouteRegistry } from '../dispatch/RouteRegistry.js';
 import { facadeOperations } from '../entry/facade.js';
 
-
 /** The one wording for "nobody hosts this here", with both ways out. */
 const notLoaded = (entity: string) =>
   `Frond for '${entity}' is not loaded.\n` +
@@ -58,29 +64,39 @@ const notLoaded = (entity: string) =>
   `  - Or declare a remote: remotes: { ${entity}: 'http://...' }`;
 
 /** Two fronds cannot claim one name — said at boot, because nothing else says it. */
-function assertOneOwnerPerKey(
+function keyClaims(
   fronds: { name: string; handlers: HandlerEntry[]; presenters: PresenterEntry[] }[],
   remotes: Record<string, string> | undefined,
+  refused: Diagnostic[],
 ): void {
   const owner = new Map<string, string>();
+  const fileOf = new Map<string, string>();
 
-  const claim = (key: string, frond: string, what: string) => {
+  const claim = (key: string, frond: string, what: string, filePath: string) => {
     const first = owner.get(key);
     if (first !== undefined && first !== frond) {
-      throw new Error(
-        `Two fronds claim the key '${key}': '${first}' and '${frond}'.\n`
-        + `  A ${what} is registered under a key that names no frond, so one would silently replace the other.\n`
-        + `  - Rename one of the two classes, or\n`
-        + `  - keep one of the two fronds out of this process (--fronds), or declare it in remotes:`,
-      );
+      refused.push({
+        severity: 'blocking',
+        code: 'frond-key-taken',
+        filePath,
+        frond,
+        subject: key,
+        message: `'${first}' and '${frond}' both claim the key '${key}'. A ${what} is registered `
+          + 'under a key that names no frond, so one would silently replace the other. Rename one '
+          + 'of the two classes, or keep one frond out of this process (--fronds). '
+          + `'${first}' declares it in ${fileOf.get(key)}.`,
+      });
+
+      return;
     }
     owner.set(key, frond);
+    fileOf.set(key, filePath);
   };
 
   for (const frond of fronds) {
     if (remotes && frond.name in remotes) continue;
-    for (const handler of frond.handlers) claim(facadeKeyOf(handler.address, handler.surface), frond.name, 'door');
-    for (const presenter of frond.presenters) claim(presenterKeyOf(presenter.entityName), frond.name, 'presenter');
+    for (const handler of frond.handlers) claim(facadeKeyOf(handler.address, handler.surface), frond.name, 'facade', handler.filePath);
+    for (const presenter of frond.presenters) claim(presenterKeyOf(presenter.entityName), frond.name, 'presenter', presenter.filePath);
   }
 }
 
@@ -171,7 +187,9 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     if (!options.fronds && !options.scan && !options.auth && brought.length === 0) {
       throw new Error(
         'createApp needs `fronds:` (what this app states) or `scan:` (what a scanner found). '
-        + 'Neither was given, and nothing else declares entities of its own.',
+        + 'Neither was given, and nothing else declares entities of its own.\n'
+        + '    createApp({ fronds: [blog] })\n'
+        + '    createApp({ scan: await scanProject(root) })',
       );
     }
     const operationModel = resolveEffectiveOperations(fronds, {
@@ -189,17 +207,8 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     for (const d of diagnostics) if (d.severity === 'warning') log.warn(`[${d.code}] ${d.message}`);
 
     /** An ambiguous convention is not a partial scan. */
-    const invalidOperations = operationModel.resolutionDiagnostics
-      .filter((diagnostic) => diagnostic.severity === 'blocking');
-    if (invalidOperations.length > 0) {
-      const details = invalidOperations.map((d) =>
-        `  [${d.code}]${d.subject ? ` ${d.subject}` : ''}\n    ${d.message}\n    ${d.filePath}`,
-      );
-      throw new Error(
-        `Fougere boot refused: ${invalidOperations.length} unresolved operation contract(s):\n`
-        + details.join('\n'),
-      );
-    }
+    const unresolved = refusalOf(operationModel.resolutionDiagnostics, 'unresolved operation contract(s)');
+    if (unresolved) throw unresolved;
 
     // Auth runtime — built once from the lazy AuthConfig produced by a provider factory
     // (e.g. betterAuth({...})) in fougere.config.ts. The provider receives our db +
@@ -207,7 +216,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     let authRuntime: AuthRuntime | undefined;
     if (options.auth) {
       if (!options.storageFactory) {
-        throw new Error('createApp: `auth` is set but `storageFactory` is missing — auth providers need it to back their adapter.');
+        throw new Error('createApp: `auth` is set but `storageFactory` is missing — auth providers need it to back their adapter. Pass one through CreateAppOptions.storageFactory.');
       }
       if (options.db === undefined) {
         throw new Error('createApp: `auth` is set but `db` is missing — pass the storage handle through CreateAppOptions.db.');
@@ -233,7 +242,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       ? createRemoteRouter(Object.fromEntries(declaredRemotes), options.remoteTransport)
       : undefined;
 
-    // What is running on this app — counted at the one door every caller goes through,
+    // What is running on this app — counted at the one facade every caller goes through,
     // so releasing it can wait for the work instead of pulling the floor out.
     const inflight = new InFlight();
 
@@ -249,12 +258,16 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         error,
       ),
     );
-    const dispatcher = new Dispatcher(routeRegistry, inflight, dispatchLifecycle);
+    // Resolved at the call and never here: a journal is a provider of a brought frond, and
+    // the extension that registers it rises long after this line.
+    const keeping = (): Journal | undefined => journalOf();
+    const dispatcher = new Dispatcher(routeRegistry, inflight, dispatchLifecycle, undefined, keeping);
     const localDispatcher = new Dispatcher(
       routeRegistry,
       inflight,
       dispatchLifecycle,
       new LocalRoutePolicy((surface) => fronds.servedNames(surface)),
+      keeping,
     );
 
     function getMiddlewares(entity: string): AppMiddleware[] {
@@ -276,7 +289,14 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       scopedMiddlewares.set(entity, scoped);
     }
 
-    assertOneOwnerPerKey(fronds, options.remotes);
+    /** What every check of this boot writes into — refused together, once they have all run. */
+    const refused: Diagnostic[] = [];
+    const relations: RelationCheck[] = [];
+    keyClaims(fronds, options.remotes, refused);
+    // Said before anything is installed: a key claimed twice makes every later error worse —
+    // the route registry collides first, and names a route instead of the two fronds.
+    const claimed = refusalOf(refused, 'declaration(s) that do not hold');
+    if (claimed) throw claimed;
 
     // Every entity of every frond, by name — so a fact can be validated where it LANDS, and
     // so a `reads:` clause can name a neighbour's.
@@ -295,6 +315,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       fronds, entityByName, container,
       // No carry: this is what CARRIES a fact, and a line about carrying one comes back.
       new Logger('boot:app'),
+      refused,
       options.onEmit,
     );
     /** Canonical operation tables, indexed by the same audience key as their facades. */
@@ -304,6 +325,78 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       [...operations].map(([name, operation]) => [name, operation as OperationContract] as const),
     );
 
+    /**
+     * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
+     * facade.
+     */
+    const storageFor = (entity: string): unknown | undefined => {
+      const owner = fronds.owner(entity);
+      if (!owner) return undefined;
+
+      const key = storageKeyOf(entity);
+      try {
+        return container.resolve<Container>(`frond:${owner.name}`).resolve(key);
+      } catch {
+        return undefined;
+      }
+    };
+
+    // What carries a release writes none: an instrumentation frond's own rows are kept while a
+    // release happens, and journalling them would begin one inside the one being written down.
+    const carriesRelease = new Set(
+      fronds.filter((one) => one.brought).flatMap((one) => one.entities.map((e) => e.name)),
+    );
+
+    /**
+     * The journal a package registered, found where its own frond put it — a provider lands in
+     * its frond's scope, and the app container sees none of them.
+     */
+    const journalOf = (): Journal | undefined => {
+      for (const frond of fronds) {
+        if (!frond.brought) continue;
+        const scope = container.resolve<Container>(`frond:${frond.name}`);
+        if (scope.has(JOURNAL)) return scope.resolve<Journal>(JOURNAL);
+      }
+
+      return undefined;
+    };
+
+    const hosting: Hosting = {
+      hostedHere: (entity) => !(options.remotes && (frondOf.get(entity) ?? '') in options.remotes),
+      sourceOf: (name) => options.sourceOf?.(name) ?? 'db',
+      enforces: (source, constraint) => options.enforces?.(source, constraint) ?? false,
+      storageOf: storageFor,
+      entities: () => entityByName,
+      // The two readings core serves in EVERY process, asked of the one that holds the rows.
+      // Nothing is cached: a peer that was down at boot answers the next call.
+      // Built from `remotes:` itself, not from the router: the router indexes by ENTITY, read
+      // off a card, and the question here is asked of a PROCESS about rows it may be alone
+      // in knowing about.
+      // Resolved per call and never at boot: the package that registers it rises in the
+      // ascent, long after this answer is built.
+      journal: (entity) => (carriesRelease.has(entity) ? undefined : journalOf()),
+      peers: () => (options.remoteTransport
+        ? declaredRemotes.map(([, url]) => peerOver(options.remoteTransport!(url)))
+        : []),
+      peerOf: (entity) => (remoteRouter ? {
+        dependents: async (named) => (await remoteRouter.route(entity))
+          .transport({ entity: RPC_ENTITY, op: 'dependents' },
+            { ...Invocation.empty, params: { entity: named } as never }),
+        missing: async (named, keys) => {
+          const answer = await (await remoteRouter.route(entity))
+            .transport({ entity: RPC_ENTITY, op: 'holds' },
+              { ...Invocation.empty, params: { entity: named, keys } as never });
+
+          return (answer as { missing: readonly unknown[] }).missing;
+        },
+        release: async (named, key) => {
+          const route = await remoteRouter.route(entity);
+          await route.transport({ entity: RPC_ENTITY, op: 'release' },
+            { ...Invocation.empty, params: { entity: named, key } as never });
+        },
+      } : undefined),
+    };
+
     // Every port an implementation was bound to, so a `ports:` entry that named none
     // can say so rather than look obeyed.
     const boundPorts = new Set<string>();
@@ -313,11 +406,39 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     // table, one emission list — so what a frond serves is there for the next one to find.
     const assembly: Assembly = {
       container, routeRegistry, emissions, dispatcher, localDispatcher, effectiveByKey,
-      boundPorts, operationModel, entityByName, frondOf, contractsOf, getMiddlewares, use,
-      log, options,
+      boundPorts, refused, relations, hosting, operationModel, entityByName, frondOf, contractsOf,
+      getMiddlewares, use, log, options,
     };
     for (const frond of fronds) await installFrond(frond, assembly);
 
+    // A reference no key holds and no storage answers: said at the END, for the reason the
+    // `ports:` warning below is — a target is another frond's, so no single frond can tell
+    // an absence from a neighbour that had not been installed yet.
+    const unheld = unheldAmong(relations, hosting);
+    // Declared here, and this process cannot finish what it starts — both halves are local,
+    // so nothing is asked of anyone. Said once, after every frond installed, because a journal
+    // arrives with an extension and an extension rises last.
+    const unfinished = unfinishable(hosting);
+    if (unfinished.length > 0) {
+      log.warn(
+        `[relations] ${unfinished.join(', ')} — declared, and this process keeps nothing on `
+        + 'restart: a release interrupted here is not resumed. Install @fougere/workflow, or '
+        + 'expect to finish one by hand.',
+      );
+    }
+
+    if (unheld.length > 0) {
+      log.warn(
+        `[relations] ${unheld.join(', ')} — declared, and nothing in this process holds them: `
+        + 'no foreign key, and the target answers elsewhere. A row may name one that is gone.',
+      );
+    }
+
+    // Every check of the install, said at once — a boot that stops at the first makes the
+    // next one visible only after a fix and a restart.
+    const bootRefusal = refusalOf(refused, 'declaration(s) that do not hold');
+    if (bootRefusal) throw bootRefusal;
+
     // A `ports:` key that matched no port anywhere reads as a choice that was made, and
     // was not. Said once, at the end, because the entry is app-wide while a port is a
     // frond's — no single frond can tell whether a key is a typo or a neighbour's.
@@ -329,14 +450,19 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       );
     }
 
-    // Once every door exists: what is announced here and what is listened to are both known.
+    // Once every facade exists: what is announced here and what is listened to are both known.
     emissions.register();
 
-    // Which doors carry a line, read from who SUBSCRIBED — so a third party's destination
+    // The third phase: what a fact's links and its answer type state. Said after `register`,
+    // which is where a pipe order and an `Emit<T, A>` are read.
+    const announced = refusalOf(refused, 'declaration(s) that do not hold');
+    if (announced) throw announced;
+
+    // Which facades carry a line, read from who SUBSCRIBED — so a third party's destination
     // is left alone by the two middlewares that observe every operation.
-    for (const door of emissions.doorsFor(LOG_LINE)) {
-      CARRIES_LINE.add(door.replace(/Handler$/, '').replace(/^./, (c) => c.toLowerCase()));
-      CARRIES_LINE.add(door);
+    for (const facade of emissions.facadesFor(LOG_LINE)) {
+      CARRIES_LINE.add(facade.replace(/Handler$/, '').replace(/^./, (c) => c.toLowerCase()));
+      CARRIES_LINE.add(facade);
     }
 
     /** The last resort, held by the container so every resolution path shares it. */
@@ -353,7 +479,6 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       );
     });
 
-
     /** Stop taking calls, and resolve once the ones already running are done. */
     const drain = async (timeoutMs?: number): Promise<void> => {
       inflight.close();
@@ -386,7 +511,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       if (found) return found.entityClass;
       if (remoteRouter) {
         const route = await remoteRouter.route(entity);
-        // A remote door that stores nothing publishes ops and no shape. Saying so beats
+        // A remote facade that stores nothing publishes ops and no shape. Saying so beats
         // handing back an empty schema, which would validate every input it was given.
         if (!route.schema) {
           throw new Error(
@@ -409,12 +534,12 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       }
     };
 
-    /** Said once per pair, so a door that registers in a loop says it once. */
+    /** Said once per pair, so a facade that registers in a loop says it once. */
     const saidAbsent = new Set<string>();
 
     /**
      * A surface is declared in the frond that serves it. When that frond runs in another
-     * process, this one never asked for its doors, and answering 'no' is the only thing a
+     * process, this one never asked for its facades, and answering 'no' is the only thing a
      * synchronous rule can do — so it says so rather than registering nothing in silence.
      */
     const sayNoSurfaceAcross = (entity: string, surface: string): void => {
@@ -422,8 +547,8 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       saidAbsent.add(`${surface}:${entity}`);
       log.warn(
         `surface '${surface}' serves nothing for '${entity}' — the frond that declares it runs `
-        + 'elsewhere, and a remote is asked for its doors at the first call, not at boot. '
-        + 'The default door answers.',
+        + 'elsewhere, and a remote is asked for its facades at the first call, not at boot. '
+        + 'The default facade answers.',
       );
     };
 
@@ -465,7 +590,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       }));
     }
 
-    /** The terms beside a door, with the exact same named-surface fallback rule. */
+    /** The terms beside a facade, with the exact same named-surface fallback rule. */
     const operationsFor = (entity: string, surface?: string): EffectiveOperationsMap | undefined => {
       if (!surface) return effectiveByKey.get(facadeKeyOf(entity));
 
@@ -477,22 +602,6 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         : undefined;
     };
 
-    /**
-     * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
-     * door.
-     */
-    const storageFor = (entity: string): unknown | undefined => {
-      const owner = fronds.owner(entity);
-      if (!owner) return undefined;
-
-      const key = storageKeyOf(entity);
-      try {
-        return container.resolve<Container>(`frond:${owner.name}`).resolve(key);
-      } catch {
-        return undefined;
-      }
-    };
-
     /** The presenter of an entity, resolved through its owning frond's scope. */
     const presenterFor = (entity: string): unknown | undefined => {
       const owner = fronds.owner(entity);
@@ -508,7 +617,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     const app: App = {
       container,
       fronds,
-      // What this app publishes, straight from fougere.config.ts — the doors read it,
+      // What this app publishes, straight from fougere.config.ts — the facades read it,
       // so an undeclared adapter serves nothing whatever a host mounted.
       adapters: options.adapters ?? {},
       // Where a call goes, as DECLARED. Kept because a reader needs it beside what the
@@ -534,7 +643,10 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         // depend on wiring order, and `discover` is in here precisely so it cannot be taken.
         const address = new RouteAddress({ entity: 'rpc', operation: op });
         if (routeRegistry.find(address)) {
-          throw new Error(`rpc operation '${op}' is already served; a second declaration would depend on wiring order`);
+          throw new Error(
+            `[claim] rpc operation '${op}' is already served; a second declaration would depend on wiring order.\n`
+            + '  Two extensions declare it — keep one out of `extensions:`.',
+          );
         }
         routeRegistry.register(new OperationRoute(
           'system',
@@ -556,15 +668,56 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
     // The card is an rpc op like any other, so one registry answers and one refusal names
     // what is served. A package's op is declared the same way, from outside.
+    // What a release is, resolved once and registered: a package that drives one asks for it
+    // by type, the way every other dependency is asked for.
+    container.registerValue('Releasing', releasing(hosting));
+
     app.serveRpc('discover', (_invocation, surface) => identityCardOf(app, surface));
 
+    // What a release asks another process, and what it tells it to do. Served by EVERY process
+    // the way `discover` is: a frond that hosts rows is the only one that can answer for them.
+    //
+    // Read off the STORAGE and never off a facade: a facade answers what its handler chose to
+    // show — `PostHandler.list` hands back published posts — so a draft naming a deleted user
+    // would be invisible to the very question that exists to find it.
+    // The dual of `release`, and the same reason it is served by every process: only the one
+    // that holds the rows can say a key is missing, and only from the STORAGE — a facade
+    // answers what its handler chose to show.
+    app.serveRpc('holds', async (invocation) => {
+      const named = String(invocation.params.entity);
+      const keys = (invocation.params.keys ?? []) as readonly unknown[];
+      const rows = storageFor(named) as { findByKeys(k: readonly string[]): Promise<Map<string, unknown>> } | undefined;
+      if (!rows) return { missing: [] };
+      const found = await rows.findByKeys(keys.map(String));
+
+      return { missing: keys.filter((key) => !found.has(String(key))) };
+    });
+    app.serveRpc('dependents', (invocation) =>
+      dependentsOf(String(invocation.params.entity), hosting));
+    app.serveRpc('release', async (invocation) => {
+      await releaseRow(String(invocation.params.entity), invocation.params.key, releasing(hosting),
+        (invocation.params.visited ?? []) as readonly string[]);
+
+      return { released: true };
+    });
+
     // The last thing the boot does, and the first thing a release undoes. An extension may
     // await here — which is what a provider needing to OPEN something could never do.
     built = app;
+
+    // What the FRONDS declared, folded in after what the host handed over — a frond's
+    // extension is written beside the code it instruments and travels with it, so it mounts
+    // on whichever process ends up serving that frond. Added here rather than at the top
+    // because the fronds are read below that line, and `up` has not run yet.
+    appLifecycle.add(...fronds.flatMap((frond) => (frond.extensions ?? []).map((one) => ({
+      name: one.name,
+      ...one.extension,
+    }))));
+
     await appLifecycle.up(app);
 
     // The boot's own lines, and every line after them. Held until here because a boot
-    // writes most of what a process logs and writes it before any door exists — so the
+    // writes most of what a process logs and writes it before any facade exists — so the
     // lines that say what this app is made of are the ones a destination would miss.
     // `LogLine` is core's for this reason: naming it costs no optional package.
     //