@fougere/core 0.9.3-alpha.0 → 0.11.0-alpha.0

package/src/boot/card.ts

@@ -1,10 +1,11 @@
 /** What an app says about ITSELF — the `rpc.discover` answer, built from the app. */
 import { Card } from '@fougere/schema';
-import type { App } from './types.js';
-import { factsAnnouncedBy } from '../wire/emit.js';
-import type { InvocationContext } from '../wire/Invocation.js';
-import { facadeKeyOf, contractsKeyOf, type CardOp, type IdentityCard } from '../wire/call.js';
-import type { OperationContract } from '../wire/operation.js';
+import type { App } from './App.js';
+import { factsAnnouncedBy } from '../wire/Emit.js';
+import type { InvocationContext } from '../wire/InvocationContext.js';
+import { type CardOp } from '../wire/card/CardOp.js';
+import { type IdentityCard } from '../wire/card/IdentityCard.js';
+import { facadeKeyOf } from '../wire/Facade.js';
 
 type AnyFacade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
 
@@ -16,12 +17,12 @@ export function identityCardOf(app: App, surface?: string): IdentityCard {
     // What this app SERVES, never what instruments it. A frond an extension BROUGHT is a
     // subscriber — `@fougere/calls` and `@fougere/observability` each bring one — and it is
     // in every process that installed the extension, so two remotes then claimed the same
-    // door and routing refused: `Two remotes serve 'export'`. `FrondDescriptor.brought` is
+    // facade and routing refused: `Two remotes serve 'export'`. `FrondDescriptor.brought` is
     // the mark `calls`' panel and `rpc.topology` already read.
     fronds: app.fronds.filter((frond) => !frond.brought).map((frond) => {
       // What the frond answers to, not what it stores. This walked `frond.entities`, so a
       // handler carrying no entity — a health check, a search across shapes — was built,
-      // served, and absent from the card: `sync` could not generate its door and a remote
+      // served, and absent from the card: `sync` could not generate its facade and a remote
       // consumer had no way to know it existed. The boot has said "pointing at nothing is
       // legal" since handlers became the subject; the card had not caught up.
       const byEntity = new Map(frond.entities.map((entity) => [entity.name, entity]));
@@ -32,14 +33,14 @@ export function identityCardOf(app: App, surface?: string): IdentityCard {
 
       return {
         name: frond.name,
-        doors: addresses.flatMap((address) => {
+        facades: addresses.flatMap((address) => {
           const ops = facadeOps(app, address, surface);
           if (ops.length === 0) return [];
           const entity = byEntity.get(address);
           return [{
             name: address,
             ops,
-            // Absent when nothing of that name is stored. A door is still a door.
+            // Absent when nothing of that name is stored. A facade is still a facade.
             ...(entity ? { schema: Card.fromSchema(entity.entityClass, address).descriptor } : {}),
           }];
         }),
@@ -65,7 +66,8 @@ function facadeOps(app: App, entityName: string, surface?: string): CardOp[] {
   const effective = app.operationsFor(entityName, surface);
   if (!effective) {
     throw new Error(
-      `Facade '${facadeKeyOf(entityName, surface)}' exists without an effective operation table.`,
+      `Facade '${facadeKeyOf(entityName, surface)}' exists without an effective operation table. `
+      + 'A facade and its table are built together, so no declaration can produce this.',
     );
   }
 
@@ -73,7 +75,8 @@ function facadeOps(app: App, entityName: string, surface?: string): CardOp[] {
     const contract = effective.get(name);
     if (!contract) {
       throw new Error(
-        `Facade '${facadeKeyOf(entityName, surface)}' serves '${name}' without an effective contract.`,
+        `Facade '${facadeKeyOf(entityName, surface)}' serves '${name}' without an effective contract. `
+        + 'A facade and its table are built together, so no declaration can produce this.',
       );
     }
 
@@ -83,6 +86,7 @@ function facadeOps(app: App, entityName: string, surface?: string): CardOp[] {
       ...(contract?.input && { input: Card.fromSchema(contract.input, name).descriptor }),
       ...(contract?.output && { output: Card.fromSchema(contract.output, name).descriptor }),
       ...(contract?.cardinality && { cardinality: contract.cardinality }),
+      ...(contract.errors?.length ? { errors: contract.errors } : {}),
       kind: contract.kind,
     };
   });

package/src/boot/declared.ts

@@ -3,8 +3,12 @@
  *
  * Documented: [observability](https://fougere.dev/docs/infra/observability).
  */
-import type { FrondDescriptor } from '../descriptor/frond.js';
-import { facadeKeyOf, type DeclaredEdge, type DeclaredFrond, type DeclaredTopology } from '../wire/call.js';
+import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
+import { facadeKeyOf } from '../wire/Facade.js';
+import { factsAnnouncedBy, factsAwaitedBy, factsListenedTo } from '../wire/Emit.js';
+import { type DeclaredEdge } from '../wire/topology/DeclaredEdge.js';
+import { type DeclaredFrond } from '../wire/topology/DeclaredFrond.js';
+import { type DeclaredTopology } from '../wire/topology/DeclaredTopology.js';
 
 interface Declaring {
   fronds: readonly FrondDescriptor[];
@@ -62,21 +66,52 @@ export function reachedBy(deps: readonly string[], from: string, index: Map<stri
   return [...new Set(reached)];
 }
 
+/**
+ * The two ways a call leaves a frond: a façade its code names, and a fact it announces.
+ *
+ * The second cannot be read the way the first is. A dependency names what it reaches, where an
+ * announcement names a SUBJECT and a subscriber names nothing at all — so the edge is found from
+ * both ends, the announcer's deps and the listener's binding plan. Reading the deps alone
+ * reported `demos/pipe-split` as four fronds with nothing between them, and three of its four
+ * fronds are reached by a fact.
+ */
 function crossings(hosted: readonly FrondDescriptor[]): DeclaredEdge[] {
   const index = servedBy(hosted);
+  const heard = listenedBy(hosted);
   const found = new Map<string, DeclaredEdge>();
+  const cross = (from: string, to: string) => {
+    if (from !== to) found.set(`${from} ${to}`, { from, to });
+  };
 
   for (const frond of hosted) {
     for (const handler of frond.handlers) {
-      for (const to of reachedBy(handler.deps, frond.name, index)) {
-        found.set(`${frond.name} ${to}`, { from: frond.name, to });
-      }
+      for (const to of reachedBy(handler.deps, frond.name, index)) cross(frond.name, to);
+    }
+    for (const fact of announcedIn(frond)) {
+      for (const to of heard.get(fact) ?? []) cross(frond.name, to);
     }
   }
 
   return [...found.values()];
 }
 
+/** Which fronds listen to each fact — every one of them, since an announcement names no recipient. */
+function listenedBy(hosted: readonly FrondDescriptor[]): Map<string, string[]> {
+  const index = new Map<string, string[]>();
+  for (const frond of hosted) {
+    for (const fact of factsListenedTo(frond.handlers)) {
+      index.set(fact, [...(index.get(fact) ?? []), frond.name]);
+    }
+  }
+
+  return index;
+}
+
+/** A fact announced here, whether the announcer waits for an answer or not. */
+function announcedIn(frond: FrondDescriptor): string[] {
+  return [...new Set([...factsAnnouncedBy(frond.handlers), ...factsAwaitedBy(frond.handlers)])];
+}
+
 function hostOf(address: string): string {
   try {
     const url = new URL(address);

package/src/boot/frame.ts

@@ -4,8 +4,8 @@
  */
 import { FieldSet, type SchemaView } from '@fougere/schema';
 import { dequal } from 'dequal';
-import { declares } from '../source.js';
-import type { Logger } from '../builtin/logger.js';
+import { declares } from '../Source.js';
+import type { Logger } from '../builtin/Logger.js';
 
 /** One write that landed, and how to take it back. */
 export interface Undo {

package/src/boot/hosted.ts

@@ -1,5 +1,5 @@
 /** What this app hosts — what it STATED, or what a scan FOUND. */
-import type { FrondDescriptor } from '../descriptor/frond.js';
+import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
 import type { ScanResult } from '../scan.js';
 import { Fronds } from '../descriptor/Fronds.js';
 

package/src/boot/install.ts

@@ -1,27 +1,34 @@
 /** Putting one frond into the app being built: its scope, what it serves, what it takes. */
 import type { Container } from '@fougere/container';
 import { lowerFirst, type Fields, type SchemaView } from '@fougere/schema';
-import type { Logger } from '../builtin/logger.js';
+import type { Logger } from '../builtin/Logger.js';
 import type { Dispatcher } from '../dispatch/Dispatcher.js';
 import type { RouteRegistry } from '../dispatch/RouteRegistry.js';
 import type { Emissions } from './Emissions.js';
-import type { EffectiveOperationsMap, EffectiveOperationModel } from '../effective-operation.js';
-import { nameOf, type ProviderEntry } from '../descriptor/frond.js';
-import type { EntityEntry, FrondDescriptor, HandlerEntry } from '../descriptor/frond.js';
-import type { OperationsMap } from '../wire/operation.js';
-import type { AppMiddleware } from '../wire/middleware.js';
-import type { CreateAppOptions } from './types.js';
+import type { EffectiveOperationModel } from '../EffectiveOperationModel.js';
+import type { EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
+import { nameOf } from '../descriptor/FrondDescriptor.js';
+import type { EntityEntry } from '../descriptor/EntityEntry.js';
+import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
+import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
+import type { OperationsMap } from '../wire/OperationsMap.js';
+import type { AppMiddleware } from '../wire/AppMiddleware.js';
+import type { CreateAppOptions } from './CreateAppOptions.js';
 import { registerFrames } from './together.js';
+import type { Diagnostic } from '../diagnostic.js';
 import { HandlerFacade } from '../dispatch/HandlerFacade.js';
 import { targetOf } from '../prefab/prefab.js';
-import { ownersOf, refuseSharedName, refuseStorageInUserCode, refuseCrudOnOwned } from './ownership.js';
+import { ownersOf, sharedNames, storageInUserCode, crudOnOwned } from './ownership.js';
 import { StorageGuard } from '../dispatch/StorageGuard.js';
 import { portBindings, seamChains, wrapping, SEAMS } from './ports.js';
-import { facadeKeyOf, contractsKeyOf } from '../wire/call.js';
-import { inheritsCrud, subjectOf } from '../prefab/crud.js';
-import { repositoryKeyOf } from '../prefab/repository.js';
-import { storageKeyOf } from '../storage/port.js';
-import { declares } from '../source.js';
+import { contractsKeyOf, facadeKeyOf } from '../wire/Facade.js';
+import { inheritsCrud, subjectOf } from '../prefab/CrudConstructor.js';
+import { repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
+import { storageKeyOf } from '../storage/Storage.js';
+import { declares } from '../Source.js';
+import { heldBy, refuseUnwritableNull, releasing } from './relations.js';
+import type { Hosting } from './Hosting.js';
+import type { RelationCheck } from '../dispatch/RelationCheck.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
 import { collectorKeyOf } from '../prefab/collector.js';
 import { RouteAddress } from '../wire/RouteAddress.js';
@@ -39,12 +46,22 @@ export interface Assembly {
   routeRegistry: RouteRegistry;
   emissions: Emissions;
   dispatcher: Dispatcher;
-  /** A door under a named surface answers only what that surface serves. */
+  /** A facade under a named surface answers only what that surface serves. */
   localDispatcher: Dispatcher;
   /** Filled per façade key, read back by `operationsFor` and the identity card. */
   effectiveByKey: Map<string, EffectiveOperationsMap>;
   /** Every `ports:` key some frond actually settled — what is left is a typo. */
   boundPorts: Set<string>;
+  /** Where a check writes what does not hold — collected across fronds, refused together. */
+  refused: Diagnostic[];
+  /**
+   * The references this process reads itself, collected across fronds. Whether one is
+   * ANSWERED can only be asked once every frond has registered, which is why the list
+   * leaves here rather than being judged where it is built.
+   */
+  relations: RelationCheck[];
+  /** Where each entity is hosted — one answer for a frond's storage, its frames and its surfaces. */
+  hosting: Hosting;
   /** What the model resolved before the boot performed any side effect. */
   operationModel: EffectiveOperationModel;
   entityByName: Map<string, SchemaView>;
@@ -61,7 +78,7 @@ export interface Assembly {
 export async function installFrond(frond: FrondDescriptor, assembly: Assembly): Promise<void> {
   const {
     container, routeRegistry, emissions, dispatcher, localDispatcher, effectiveByKey,
-    boundPorts, operationModel, entityByName, frondOf, contractsOf, getMiddlewares, use,
+    boundPorts, refused, operationModel, entityByName, frondOf, contractsOf, getMiddlewares, use,
     log, options,
   } = assembly;
 
@@ -69,7 +86,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // register nothing locally — resolve() falls through to the remote façade.
   if (options.remotes && frond.name in options.remotes) {
     log.child(frond.name).info('declared remote — not hosted locally');
-    // Its doors answer elsewhere, but what they LISTEN to was read here.
+    // Its facades answer elsewhere, but what they LISTEN to was read here.
     for (const handler of frond.handlers) {
       const key = facadeKeyOf(handler.address, handler.surface);
       const operations = operationModel.forHandler(handler);
@@ -81,6 +98,9 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   }
   const scope = container.createScope();
   const frondLog = log.child(frond.name);
+  // The frond's own voice, a child of the APP logger and never of `log` — which is the
+  // boot's, so a service's line would have claimed `boot:` long after the boot was over.
+  scope.registerValue('Logger', container.resolve<Logger>('Logger').child(frond.name));
 
   // `reads:` is what makes a cross-source reader exist here, and the list IS its
   // environment — a source holding none of these is never opened. Registered under
@@ -99,7 +119,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   if (frond.reads?.length && options.sourcesFactory) {
     // Resolved across the WHOLE app, not this frond's own entities: a cross-source
     // query joins entities from different fronds by definition — `Progress` here,
-    // `Book` next door — so restricting the list to its own would make it useless.
+    // `Book` next facade — so restricting the list to its own would make it useless.
     // Naming one IS the authorization; that is what the declaration is for.
     const named = frond.reads
       .map((name) => entityByName.get(lowerFirst(name)))
@@ -117,10 +137,10 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
 
   // Who owns what, and the rule that makes owning mean something. Before anything is
   // registered, so a bad line is named by this refusal rather than by the container's.
-  refuseSharedName(frond);
-  const owners = ownersOf(frond.providers);
-  refuseStorageInUserCode(frond, owners, (entity) => entityByName.has(entity));
-  refuseCrudOnOwned(frond, owners);
+  sharedNames(frond, refused);
+  const owners = ownersOf(frond.providers, frond.name, refused);
+  storageInUserCode(frond, owners, (entity) => entityByName.has(entity), refused);
+  crudOnOwned(frond, owners, refused);
 
   for (const provider of frond.providers) {
     scope.register(nameOf(provider), provider.ctor, { deps: provider.deps });
@@ -128,7 +148,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // What this frond puts in front of one of the framework's own ports. Its own, like every
   // provider — a link goes where its frond goes, which is what a frond behind `remotes:`
   // takes with it.
-  const seams = seamChains(frond.providers, options.ports);
+  const seams = seamChains(frond.providers, options.ports, refused);
   for (const [seam, links] of seams) {
     boundPorts.add(seam);
     frondLog.debug(`seam ${seam} → ${links.map((one) => one.ctor.name).join(' → ')} → the realization`);
@@ -137,7 +157,10 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // reaches the realization instead of the base class it is declared against.
   // Registered AFTER the loop above so a port key always wins over the base's
   // own registration — same precedence as a declared repository over its default.
-  for (const [port, chain] of portBindings(frond.providers, (n) => scope.has(n), options.ports)) {
+  for (const [port, chain] of portBindings(frond.providers, (n) => scope.has(n), options.ports, refused)) {
+    // A chain a refusal emptied — `ports:` named a class that extends nothing. Already
+    // reported, and there is no realization left to put a key in front of.
+    if (chain.length === 0) continue;
     // A seam is bound where its realization is BUILT, not under a container key — nothing
     // resolves `Storage`, and `<Entity>Storage` is what a handler asks for.
     if (SEAMS.has(port)) continue;
@@ -165,6 +188,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // When a handler declares Crud(Entity, Output), scope the storage via .output(Output)
   if (options.storageFactory) {
     const unenforced: string[] = [];
+    const release = releasing(assembly.hosting);
     for (const entity of frond.entities) {
       const key = storageKeyOf(entity.name);
       const source = options.sourceOf?.(entity.name) ?? 'db';
@@ -182,10 +206,15 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
 
       // The declared chain first, then the guard OUTSIDE it: the guard hands on the value
       // it parsed, so a wrapper reads what the entity says a row is rather than what
-      // arrived. Same order the client door has held since `StorageGuard` existed.
+      // arrived. Same order the client facade has held since `StorageGuard` existed.
       const linked = wrapping('Storage', seams.get('Storage') ?? [], scoped, (dep) => scope.resolve(dep));
       // Storage is a way out like the client surface — see `StorageGuard`.
-      const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(linked);
+      refused.push(...refuseUnwritableNull(entity.entityClass, entity.name, entity.filePath));
+      const relations = heldBy(entity.entityClass, entity.name, assembly.hosting);
+      assembly.relations.push(...relations);
+      const guarded = new StorageGuard(
+        entity.entityClass.getFields(), entity.name, {}, relations, release,
+      ).guard(linked);
       scope.registerValue(key, guarded);
 
       // The default repository IS the guarded port — it already answers every gesture a
@@ -194,7 +223,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
       // existed to make `repo.storage` true in both, back when `.storage` was the way in.
       //
       // Not registered for an OWNED entity: an aggregate's members are reached through it
-      // and nowhere else, and the default would be a second door under a name a handler
+      // and nowhere else, and the default would be a second facade under a name a handler
       // can spell. Every member is skipped, not just the one the key is named after —
       // that asymmetry was the whole hole.
       const repoKey = repositoryKeyOf(entity.name);
@@ -223,7 +252,8 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   // so nothing is registered for a frame nobody wants.
   registerFrames(
     scope,
-    [...frond.handlers, ...frond.providers, ...frond.presenters, ...frond.collectors].flatMap((d) => d.deps),
+    [...frond.handlers, ...frond.providers, ...frond.presenters, ...frond.collectors]
+      .flatMap((d) => d.deps.map((key) => ({ key, filePath: d.filePath }))),
     frond.providers,
     {
       entityByName,
@@ -233,8 +263,10 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
       sourceOf: options.sourceOf,
       transacts: options.transacts,
       transacted: options.transacted,
+      hosting: assembly.hosting,
       log: frondLog,
     },
+    refused,
   );
 
   // Register presenters in scope — PascalCase type name (e.g. 'PostPresenter')
@@ -278,7 +310,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   const surfaceHandlers = frond.handlers.filter((h) => h.surface);
   const defaultHandlerMap = new Map(defaultHandlers.map((h) => [h.address, h]));
 
-  /** Build the door of a handler and register it under the audience it serves. */
+  /** Build the facade of a handler and register it under the audience it serves. */
   const buildFacade = (
     entity: EntityEntry | undefined,
     handler: HandlerEntry,
@@ -304,7 +336,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
     });
     // Emissions use the same contracts and execution path as direct calls.
     emissions.note(facade.contracts, facadeKey);
-    // The terms alongside the door, under the same audience — a surface that serves
+    // The terms alongside the facade, under the same audience — a surface that serves
     // fewer ops describes fewer ops.
     container.registerValue(contractsKeyOf(handler.address, handler.surface), facade.contracts);
     effectiveByKey.set(facadeKey, facade.effectiveOperations);
@@ -381,7 +413,7 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
   //
   // Pointing at nothing is legal HERE TOO. This loop used to `continue` when no entity
   // carried the handler's name, so `handlers/public/SearchHandler.ts` with no `Search`
-  // entity got no door at all and no line saying why — while the very same handler at
+  // entity got no facade at all and no line saying why — while the very same handler at
   // the default surface is built and logged. One rule, both surfaces.
   for (const handler of surfaceHandlers) {
     const entity = frond.entities.find((e) => e.name === handler.address);
@@ -390,21 +422,21 @@ export async function installFrond(frond: FrondDescriptor, assembly: Assembly):
     // Register scoped storage if output override differs from entity — under the REPOSITORY
     // key, which is what a Crud handler asks for, and under the port's own for a holder
     // that legitimately names it. Registering only the latter left a named surface with
-    // no door at all once the façade stopped spelling the storage.
+    // no facade at all once the façade stopped spelling the storage.
     if (entity && options.storageFactory) {
       const baseStorage = options.storageFactory(entity.entityClass, entity.name);
       const outputSchema = handler.outputOverride ?? (handler.ctor as any).__output;
       const scoped = outputSchema && outputSchema !== entity.entityClass
         ? baseStorage.output(outputSchema)
         : baseStorage;
-      // The view is handed over so a filter on a field this door hides is SAID. The
+      // The view is handed over so a filter on a field this facade hides is SAID. The
       // guard holds no logger — a warning is the boot's to voice, as a seed's report is.
       const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name, {
         ...(outputSchema && outputSchema !== entity.entityClass
           ? { view: (outputSchema as { getFields(): Fields }).getFields() }
           : {}),
         outOfView: (message) => frondLog.warn(message),
-      }).guard(scoped);
+      }, heldBy(entity.entityClass, entity.name, assembly.hosting), releasing(assembly.hosting)).guard(scoped);
       surfaceScope.registerValue(storageKeyOf(entity.name), guarded);
       surfaceScope.registerValue(repositoryKeyOf(entity.name), guarded);
     }

package/src/boot/ownership.ts

@@ -1,34 +1,44 @@
 import { lowerFirst } from '@fougere/schema';
-import { nameOf, type FrondDescriptor, type ProviderEntry } from '../descriptor/frond.js';
-import { inheritsCrud } from '../prefab/crud.js';
+import { nameOf, type FrondDescriptor } from '../descriptor/FrondDescriptor.js';
+import { type ProviderEntry } from '../descriptor/ProviderEntry.js';
+import { inheritsCrud } from '../prefab/CrudConstructor.js';
 import { targetOf } from '../prefab/prefab.js';
-import { ownedBy, repositoryKeyOf } from '../prefab/repository.js';
-import { entityOfStorageKey } from '../storage/port.js';
+import { ownedBy, repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
+import { entityOfStorageKey } from '../storage/Storage.js';
+import type { Diagnostic } from '../diagnostic.js';
 
 /** One name, one file: two providers under one key and the second silently replaces the first. */
-export function refuseSharedName(frond: FrondDescriptor): void {
+export function sharedNames(frond: FrondDescriptor, refused: Diagnostic[]): void {
   const declared = new Map<string, string>();
 
   for (const provider of frond.providers) {
     const name = nameOf(provider);
     const first = declared.get(name);
     if (first !== undefined) {
-      throw new Error(
-        `[provider] two files declare ${name}:\n`
-        + `    ${first}\n`
-        + `    ${provider.filePath}\n`
-        + `  A frond registers both under one key, so the second replaces the first and whoever `
-        + `asks for ${name} is handed whichever was scanned last.\n`
-        + '  Rename one of the two.',
-      );
+      refused.push({
+        severity: 'blocking',
+        code: 'provider-name-taken',
+        filePath: provider.filePath,
+        frond: frond.name,
+        subject: name,
+        message: `${first} already declares ${name}. A frond registers both under one key, so the `
+          + `second replaces the first and whoever asks for ${name} is handed whichever was `
+          + 'scanned last. Rename one of the two.',
+      });
     }
     declared.set(name, provider.filePath);
   }
 }
 
 /** Who owns an entity's storage. */
-export function ownersOf(providers: readonly ProviderEntry[]): Map<string, string> {
+export function ownersOf(
+  providers: readonly ProviderEntry[],
+  frond: string,
+  refused: Diagnostic[],
+): Map<string, string> {
   const owners = new Map<string, string>();
+  /** Claimed twice, so it has no owner — and no owner is nobody to judge a reader against. */
+  const contested = new Set<string>();
   for (const provider of providers) {
     const owned = ownedBy(provider.ctor);
     if (owned.length < 2) continue;
@@ -39,14 +49,26 @@ export function ownersOf(providers: readonly ProviderEntry[]): Map<string, strin
         // Refused rather than settled, for the reason `ports:` refuses two implementations
         // and `remotes` two owners of an entity: whichever won would depend on scan order,
         // and one of the two aggregates would be silently unenforced.
-        throw new Error(
-          `[aggregate] ${first} and ${provider.ctor.name} both own ${name}. `
-          + 'An entity has one owner: merge the two, or take it out of one of them.',
-        );
+        refused.push({
+          severity: 'blocking',
+          code: 'entity-owned-twice',
+          filePath: provider.filePath,
+          frond,
+          subject: name,
+          message: `${first} and ${provider.ctor.name} both own ${name}. An entity has one owner: `
+            + 'merge the two, or take it out of one of them.',
+        });
+        contested.add(name);
+        continue;
       }
       owners.set(name, provider.ctor.name);
     }
   }
+  // The second claimant is BUILT ON what it claims, so `storageInUserCode` would read it as
+  // reaching around the first — two more refusals naming the same declaration, in the one
+  // case where the answer to "who owns this" is already the diagnostic above.
+  for (const name of contested) owners.delete(name);
+
   return owners;
 }
 
@@ -62,12 +84,13 @@ function builtOn(ctor: unknown): string[] {
 }
 
 /** `Storage<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in. */
-export function refuseStorageInUserCode(
+export function storageInUserCode(
   frond: FrondDescriptor,
   owners: Map<string, string>,
   known: (entity: string) => boolean,
+  refused: Diagnostic[],
 ): void {
-  const doors = [
+  const facades = [
     ...frond.handlers.map((h) => ({ ...h, kind: 'handler' })),
     ...frond.presenters.map((p) => ({ ...p, kind: 'presenter' })),
     ...frond.collectors.map((c) => ({ ...c, kind: 'collector' })),
@@ -81,15 +104,19 @@ export function refuseStorageInUserCode(
     const held = entityOfStorageKey(registered, known);
     if (!held) continue;
 
-    throw new Error(
-      `[storage] ${registered} is a provider, and it is the container key of ${held}'s `
-      + `own storage — the storage is registered second, so the provider is never resolved.\n`
-      + `  Name it for what it holds; \`<Entity>Storage\` belongs to the entity.\n`
-      + `  ${provider.filePath}`,
-    );
+    refused.push({
+      severity: 'blocking',
+      code: 'storage-key-is-provider',
+      filePath: provider.filePath,
+      frond: frond.name,
+      subject: registered,
+      message: `${registered} is a provider, and it is the container key of ${held}'s own storage `
+        + '— the storage is registered second, so the provider is never resolved. Name it for '
+        + 'what it holds; `<Entity>Storage` belongs to the entity.',
+    });
   }
 
-  for (const decl of [...doors, ...holders]) {
+  for (const decl of [...facades, ...holders]) {
     const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
     for (const dep of decl.deps) {
       const entity = entityOfStorageKey(dep, known);
@@ -97,42 +124,55 @@ export function refuseStorageInUserCode(
 
       const owner = owners.get(entity);
       if (owner && owner !== decl.ctor.name) {
-        throw new Error(
-          `[aggregate] ${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}.\n`
-          + `  Nothing else reaches an owned entity's storage — name the operation on `
-          + `${owner} and ask for it:\n`
-          + `    constructor(private ${entity}: ${owner}) {}\n`
-          + `  ${decl.filePath}`,
-        );
+        refused.push({
+          severity: 'blocking',
+          code: 'aggregate-storage-reached',
+          filePath: decl.filePath,
+          frond: frond.name,
+          subject: `${decl.ctor.name}(${dep})`,
+          message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
+            + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
+            + `constructor(private ${entity}: ${owner}) {}`,
+        });
+        continue;
       }
       if (allowed.includes(entity)) continue;
 
-      throw new Error(
-        `${decl.ctor.name} asks for ${dep}. Storage is reached through a repository, `
-        + `never through the port:\n`
-        + `    constructor(private ${entity}: ${repositoryKeyOf(entity)}) {}\n`
-        + `  It answers every gesture ${dep} does, whether or not anyone wrote the file — `
-        + `and the day ${entity} belongs to an aggregate, this line does not move.\n`
-        + `  ${decl.filePath}`,
-      );
+      refused.push({
+        severity: 'blocking',
+        code: 'storage-outside-repository',
+        filePath: decl.filePath,
+        frond: frond.name,
+        subject: `${decl.ctor.name}(${dep})`,
+        message: `${decl.ctor.name} asks for ${dep}. Storage is reached through a repository, never `
+          + `through the port: constructor(private ${entity}: ${repositoryKeyOf(entity)}) {}. It `
+          + `answers every gesture ${dep} does, whether or not anyone wrote the file — and the day `
+          + `${entity} belongs to an aggregate, this line does not move.`,
+      });
     }
   }
 }
 
 /** An owned entity has no automatic CRUD — said at boot, not at the first request. */
-export function refuseCrudOnOwned(frond: FrondDescriptor, owners: Map<string, string>): void {
+export function crudOnOwned(
+  frond: FrondDescriptor,
+  owners: Map<string, string>,
+  refused: Diagnostic[],
+): void {
   for (const handler of frond.handlers) {
     const owner = owners.get(handler.address);
     if (!owner || handler.deps.length > 0 || !inheritsCrud(handler.ctor)) continue;
 
-    throw new Error(
-      `[aggregate] ${handler.ctor.name} takes the five gestures on ${handler.address}, `
-      + `which ${owner} owns.\n`
-      + `  An owned entity has no automatic CRUD: nothing writes it but its owner, so there `
-      + `is no storage to hand this handler.\n`
-      + `  Name the operations on ${owner} and call them:\n`
-      + `    constructor(private ${handler.address}: ${owner}) {}\n`
-      + `  ${handler.filePath}`,
-    );
+    refused.push({
+      severity: 'blocking',
+      code: 'crud-on-owned-entity',
+      filePath: handler.filePath,
+      frond: frond.name,
+      subject: handler.ctor.name,
+      message: `${handler.ctor.name} takes the five gestures on ${handler.address}, which ${owner} `
+        + 'owns. An owned entity has no automatic CRUD: nothing writes it but its owner, so there '
+        + `is no storage to hand this handler. Name the operations on ${owner} and call them: `
+        + `constructor(private ${handler.address}: ${owner}) {}`,
+    });
   }
 }

package/src/boot/peerOver.ts

@@ -0,0 +1,17 @@
+/** The two readings core serves everywhere, asked of one process over one transport. */
+import { Invocation } from '../wire/Invocation.js';
+import { RPC_ENTITY } from '../wire/RpcAnswer.js';
+import type { Transport } from '../wire/Transport.js';
+import type { Peer } from './Peer.js';
+
+export function peerOver(transport: Transport): Peer {
+  const ask = (op: string, params: Record<string, unknown>) =>
+    transport({ entity: RPC_ENTITY, op }, { ...Invocation.empty, params: params as never });
+
+  return {
+    missing: async (entity, keys) =>
+      ((await ask('holds', { entity, keys })) as { missing: readonly unknown[] }).missing,
+    dependents: (entity) => ask('dependents', { entity }),
+    release: async (entity, key, visited) => { await ask('release', { entity, key, visited }); },
+  };
+}