@jr2/orchestrator 0.5.1 → 0.6.0

package/src/pick.ts

@@ -63,9 +63,11 @@ import type { PickAnswer } from "./wire.ts";
  *   command,
  *   defineEvent,
  *   fail,
+ *   isReady,
  *   jr2Setup,
  *   paramsOf,
  *   workspace,
+ *   worktree,
  *   type Workspaced,
  * } from "@jr2/orchestrator";
  *
@@ -83,6 +85,8 @@ import type { PickAnswer } from "./wire.ts";
  *
  * type Input = Workspaced<{}, "app">;
  *
+ * const fixTree = (context: Input) => `${context.workspace.repos.app}/fix` as const;
+ *
  * const body = jr2Setup({
  *   types: {} as { context: Input; input: Input },
  *   events: [runTest, finished],
@@ -91,6 +95,7 @@ import type { PickAnswer } from "./wire.ts";
  *       model: "anthropic/claude-haiku-5-5",
  *       instructions: "You are a careful engineer.",
  *     }),
+ *     cut: worktree(),
  *     test: command(["node", "--test", arg("file")]),
  *     fail: fail(),
  *   },
@@ -98,12 +103,22 @@ import type { PickAnswer } from "./wire.ts";
  *   id: "fix-tests",
  *   context: ({ input }) => input,
  *   on: { "workspace.lost": ".lost", "agent.fault": ".failed" },
- *   initial: "coding",
+ *   initial: "cutting",
  *   states: {
+ *     cutting: {
+ *       invoke: {
+ *         src: "cut",
+ *         input: ({ context }) => ({ path: fixTree(context), branch: "fix-tests" }),
+ *         onDone: [{ guard: ({ event }) => isReady(event.output), target: "coding" }, { target: "notCut" }],
+ *       },
+ *     },
  *     coding: {
  *       invoke: {
  *         src: "coder",
- *         input: { prompt: "Make the tests pass. Run the tests of one module at a time." },
+ *         input: ({ context }) => ({
+ *           prompt: "Make the tests pass. Run the tests of one module at a time.",
+ *           cwd: fixTree(context),
+ *         }),
  *       },
  *       on: { finished: "done" },
  *       initial: "ready",
@@ -113,13 +128,17 @@ import type { PickAnswer } from "./wire.ts";
  *           invoke: {
  *             src: "test",
  *             // A plain mapper: the Machine makes the file name from the pick's `module`.
- *             input: ({ event }) => ({ file: `test/${paramsOf(event, runTest).module}.test.js` }),
+ *             input: ({ context, event }) => ({
+ *               file: `test/${paramsOf(event, runTest).module}.test.js`,
+ *               worktree: fixTree(context),
+ *             }),
  *             onDone: "ready",
  *           },
  *         },
  *       },
  *     },
  *     done: { type: "final" },
+ *     notCut: { invoke: { src: "fail", input: { reason: "the Worktree was not cut" } } },
  *     failed: { invoke: { src: "fail", input: { reason: "the Agent's Turn could not go on" } } },
  *     lost: { invoke: { src: "fail", input: { reason: "the Sandbox is gone" } } },
  *   },
@@ -127,7 +146,6 @@ import type { PickAnswer } from "./wire.ts";
  *
  * export const machine = workspace(body, {
  *   repos: { app: { url: "https://github.com/you/app.git" } },
- *   spec: () => ({ branch: "fix-tests" }),
  * });
  * ```
  *
@@ -640,8 +658,10 @@ export const isAnswer = (action: unknown): boolean =>
  *   command,
  *   defineEvent,
  *   fail,
+ *   isReady,
  *   jr2Setup,
  *   workspace,
+ *   worktree,
  *   type Workspaced,
  * } from "@jr2/orchestrator";
  *
@@ -659,6 +679,8 @@ export const isAnswer = (action: unknown): boolean =>
  *
  * type Input = Workspaced<{}, "app">;
  *
+ * const fixTree = (context: Input) => `${context.workspace.repos.app}/fix` as const;
+ *
  * const body = jr2Setup({
  *   types: {} as { context: Input; input: Input },
  *   events: [runTests, finished],
@@ -667,6 +689,7 @@ export const isAnswer = (action: unknown): boolean =>
  *       model: "anthropic/claude-haiku-5-5",
  *       instructions: "You are a careful engineer.",
  *     }),
+ *     cut: worktree(),
  *     tests: command(["npm", "test"]),
  *     fail: fail(),
  *   },
@@ -674,10 +697,20 @@ export const isAnswer = (action: unknown): boolean =>
  *   id: "fix-tests",
  *   context: ({ input }) => input,
  *   on: { "workspace.lost": ".lost", "agent.fault": ".failed" },
- *   initial: "coding",
+ *   initial: "cutting",
  *   states: {
+ *     cutting: {
+ *       invoke: {
+ *         src: "cut",
+ *         input: ({ context }) => ({ path: fixTree(context), branch: "fix-tests" }),
+ *         onDone: [{ guard: ({ event }) => isReady(event.output), target: "coding" }, { target: "notCut" }],
+ *       },
+ *     },
  *     coding: {
- *       invoke: { src: "coder", input: { prompt: "Make the tests pass." } },
+ *       invoke: {
+ *         src: "coder",
+ *         input: ({ context }) => ({ prompt: "Make the tests pass.", cwd: fixTree(context) }),
+ *       },
  *       on: { finished: "done" },
  *       initial: "ready",
  *       states: {
@@ -685,6 +718,7 @@ export const isAnswer = (action: unknown): boolean =>
  *         testing: {
  *           invoke: {
  *             src: "tests",
+ *             input: ({ context }) => ({ worktree: fixTree(context) }),
  *             onDone: {
  *               target: "ready",
  *               // The Agent reads this string, not the whole output of the command.
@@ -699,6 +733,7 @@ export const isAnswer = (action: unknown): boolean =>
  *       },
  *     },
  *     done: { type: "final" },
+ *     notCut: { invoke: { src: "fail", input: { reason: "the Worktree was not cut" } } },
  *     failed: { invoke: { src: "fail", input: { reason: "the Agent's Turn could not go on" } } },
  *     lost: { invoke: { src: "fail", input: { reason: "the Sandbox is gone" } } },
  *   },
@@ -706,7 +741,6 @@ export const isAnswer = (action: unknown): boolean =>
  *
  * export const machine = workspace(body, {
  *   repos: { app: { url: "https://github.com/you/app.git" } },
- *   spec: () => ({ branch: "fix-tests" }),
  * });
  * ```
  *

package/src/pool.ts

@@ -38,6 +38,7 @@ import type { EventDef } from "@jr2/agent-protocol";
 import { fail, failurePayload, isFailure, type FailureInput } from "./fail.ts";
 import { gate } from "./gate.ts";
 import { attachWrapperBody, type JR2Wrapper, type WrapperActors } from "./parts.ts";
+import { parsedNestedDoor } from "./vocabulary.ts";
 import { attachInputSchema, attachVocabulary } from "./vocabulary.ts";
 
 // The rich shape's `open` is the one bit that separates DRAINED from DEADLOCKED when the pool goes
@@ -50,22 +51,27 @@ import { attachInputSchema, attachVocabulary } from "./vocabulary.ts";
  */
 export type SourceNextResult<T> = T | null | { item: T | null; open: number };
 
+/** The input of a Source's `next`: the ids of the items that workers have now, the ids of the items
+ * that settled, and the Pool's input. So a Source over a list that a Machine holds needs no state
+ * of its own. */
+export type PoolNextInput<TInput = unknown> = { active: string[]; settled: string[]; input: TInput };
+
 // The Source port (ADR-0017).
 /** Where a Pool gets its work items: the Source. Make one with {@link source}. */
-export type SourceSpec<T> = {
+export type SourceSpec<T, TInput = unknown> = {
   // A union of the accepted output shapes because xstate's actor-logic type is invariant in its
   // output — a `fromPromise` inferred as `T | null` must still assign.
   /** Claim the next ready item. Write it as an xstate promise actor,
-   * `fromPromise(async ({ input }) => …)`. Its input is `{ active }`: the ids of the items that
-   * workers have now, which it must not give again. It must also not give again an item that a
-   * worker finished. It resolves to a {@link SourceNextResult}. The Pool calls it when the run
-   * starts, after each claim, and when a worker settles. While workers run and no item is ready, it
+   * `fromPromise(async ({ input }) => …)`. Its input is {@link PoolNextInput}: `active`, the ids of
+   * the items that workers have now, `settled`, the ids of the items that finished or failed, and
+   * `input`, the Pool's input. It must not give again an item in `active` or `settled`. It resolves
+   * to a {@link SourceNextResult}. The Pool calls it when the run starts, after each claim, and when a worker settles. While workers run and no item is ready, it
    * also calls it on `wake` and every `pollEvery`. */
   next:
-    | PromiseActorLogic<SourceNextResult<T>, { active: string[] }>
-    | PromiseActorLogic<{ item: T | null; open: number }, { active: string[] }>
-    | PromiseActorLogic<T | null, { active: string[] }>
-    | PromiseActorLogic<null, { active: string[] }>;
+    | PromiseActorLogic<SourceNextResult<T>, PoolNextInput<TInput>>
+    | PromiseActorLogic<{ item: T | null; open: number }, PoolNextInput<TInput>>
+    | PromiseActorLogic<T | null, PoolNextInput<TInput>>
+    | PromiseActorLogic<null, PoolNextInput<TInput>>;
   // The webhook / `jr2 send` push seam. The def IS the pool machine's vocabulary (ADR-0011).
   /** An external event, made with `defineEvent`, that tells the Pool that new work is ready, for
    * example from a webhook or `jr2 send`. While workers run and no item is ready, it makes the Pool
@@ -91,7 +97,7 @@ export type SourceSpec<T> = {
  * @example
  * ```ts
  * import { fromPromise } from "xstate";
- * import { source } from "@jr2/orchestrator";
+ * import { source, type PoolNextInput } from "@jr2/orchestrator";
  *
  * type Issue = { id: string; title: string };
  *
@@ -101,7 +107,7 @@ export type SourceSpec<T> = {
  * ];
  *
  * export const issues = source<Issue>({
- *   next: fromPromise(async ({ input }: { input: { active: string[] } }) => {
+ *   next: fromPromise(async ({ input }: { input: PoolNextInput }) => {
  *     const issue = backlog.find((i) => !input.active.includes(i.id)) ?? null;
  *     if (issue) backlog.splice(backlog.indexOf(issue), 1);
  *     return issue;
@@ -114,7 +120,7 @@ export type SourceSpec<T> = {
  * @see docs/concepts/pools-and-sources.md
  * @see docs/reference/decisions/0017-pool-over-a-source-port.md
  */
-export function source<T>(spec: SourceSpec<T>): SourceSpec<T> {
+export function source<T, TInput = unknown>(spec: SourceSpec<T, TInput>): SourceSpec<T, TInput> {
   return spec;
 }
 
@@ -143,8 +149,10 @@ export type PoolSpec<T, TInput = unknown> = {
    * `itemInput` read it, typed by it. A worker never gets it: each worker gets its item. Default:
    * none, and then their `input` is `unknown`. */
   input?: z.ZodObject;
+  // `SourceSpec<T>` too: xstate's actor logic is invariant in its input, so a `next` that does not
+  // read the Pool's input must still assign under a typed door.
   /** Where the items come from. Make it with {@link source}. */
-  source: SourceSpec<T>;
+  source: SourceSpec<T, TInput> | SourceSpec<T>;
   // Stable child identity: the spawn id, the active-set entry, the outcome key.
   /** The id of an item. The Pool uses it as the id of the item's worker and in the `active` list
    * that `next` gets. It is also the key of that worker's output in `items`. Give each item an id
@@ -250,7 +258,7 @@ function normalizeClaim(output: unknown): Claim {
  * @example
  * ```ts
  * import { fromPromise } from "xstate";
- * import { customize, pool, source } from "@jr2/orchestrator";
+ * import { customize, pool, source, type PoolNextInput } from "@jr2/orchestrator";
  * import { task } from "@jr2/machines";
  *
  * type Issue = { id: string; title: string };
@@ -261,7 +269,7 @@ function normalizeClaim(output: unknown): Claim {
  * ];
  *
  * const issues = source<Issue>({
- *   next: fromPromise(async ({ input }: { input: { active: string[] } }) => {
+ *   next: fromPromise(async ({ input }: { input: PoolNextInput }) => {
  *     const issue = backlog.find((i) => !input.active.includes(i.id)) ?? null;
  *     if (issue) backlog.splice(backlog.indexOf(issue), 1);
  *     return issue;
@@ -325,13 +333,22 @@ export function pool(worker: AnyStateMachine, spec: PoolSpec<any, any>): AnyStat
     actors: { worker, next: spec.source.next, gate, fail: fail() },
   }).createMachine({
     id: spec.id ?? "pool",
-    context: ({ input }): PoolCtx => ({
-      runInput: (input ?? {}) as Record<string, unknown>,
-      cap: typeof spec.cap === "function" ? spec.cap({ input }) : (spec.cap ?? 1),
-      active: [],
-      items: {},
-      failures: {},
-    }),
+    context: ({ input, self }): PoolCtx => {
+      // RunHost parsed a root run's door. A parent's input is parsed here, and a value that is
+      // wrong starts no worker (ADR-0033). The handles and `instanceId` are no caller's to send.
+      const sent = (input ?? {}) as Record<string, unknown>;
+      const runInput =
+        spec.input && self._parent
+          ? parsedNestedDoor(spec.input, sent, ["workspace", "instanceId"], "pool input invalid, before any worker")
+          : sent;
+      return {
+        runInput,
+        cap: typeof spec.cap === "function" ? spec.cap({ input: runInput as never }) : (spec.cap ?? 1),
+        active: [],
+        items: {},
+        failures: {},
+      };
+    },
     // The wake seam: a standing gate for the whole run's life (root invokes stop only at final).
     // The invoke id IS the gate's name (the id derives from the actor path — ADR-0011):
     // `source` when the pool is the root, `<path>.source` nested — so two nested
@@ -386,7 +403,11 @@ export function pool(worker: AnyStateMachine, spec: PoolSpec<any, any>): AnyStat
         invoke: {
           id: "discover",
           src: "next",
-          input: ({ context }) => ({ active: (context as PoolCtx).active }),
+          input: ({ context }) => ({
+            active: (context as PoolCtx).active,
+            settled: [...Object.keys((context as PoolCtx).items), ...Object.keys((context as PoolCtx).failures)],
+            input: (context as PoolCtx).runInput,
+          }),
           onDone: [
             {
               // Claimed: record it, spawn its worker (TOP-LEVEL spawnChild — the visualize

package/src/registration.ts

@@ -30,7 +30,7 @@ import { SENDER_KEY, type EventDef, type Sender } from "@jr2/agent-protocol";
 import type { AgentAdmission } from "./actor.ts";
 import type { EffectMarker, EffectRow } from "./effect.ts";
 import type { EffectorPlacement, EffectorTarget } from "./http-effect.ts";
-import type { NoticeScope, TakenNotices } from "./notices.ts";
+import type { NoticeScope, RaiseOptions, TakenNotices } from "./notices.ts";
 import type { AnswerSeat } from "./pick.ts";
 import type { Notice, PickAnswer } from "./wire.ts";
 import type { SandboxPort } from "./workspace.ts";
@@ -82,6 +82,20 @@ export type Registration = {
    * Harness runs on the host, in no Sandbox at all): those are the Instance token's business.
    */
   sandbox?: string;
+  /**
+   * An Agent's: its SLOT (ADR-0076) — the actor path of its Machine and its agent name, which is its
+   * continued conversation's Instance ID without the run id ({@link continuedIid}). The Harness
+   * states it on every control request, from its own record of the conversation, and the
+   * Orchestrator speaks here only for that slot. Two Agents with one key in two child Machines are
+   * two slots. Absent on gates.
+   */
+  slot?: string;
+  /** An Agent's: the step boundary's read of its conversation's pending notices (ADR-0062), each
+   * reserved for this Turn until {@link noticesHeard} or the Turn's end releases it. */
+  boundaryNotices?: () => Promise<Array<{ id: string; notice: Notice }>>;
+  /** An Agent's: the Harness appended these step-boundary notices — they are heard, ledgered in one
+   * save. Answers how many were this Turn's reservations. */
+  noticesHeard?: (ids: readonly string[]) => number;
   /** Close over the invoking state's `sendBack`; delivery lands where the actor was invoked. */
   deliver: (event: DeliveredEvent) => void;
   /** An Agent's: the Harness read this surface (`GET /agents/:iid/surface`), so it has the Turn in
@@ -313,9 +327,15 @@ export function actorPath(ref: AnyActorRef): string[] {
  * Turn adds a random suffix, a burned conversation's successor its epoch), and the Agent's Actor
  * names the conversation it burns with it.
  */
-export function continuedIid(machine: AnyActorRef | undefined, runId: string, agentName: string): string {
+/** An Agent's slot (ADR-0076): its continued conversation's Instance ID without the run id —
+ * `<machine actor path>/<agent>`. What the Harness states and the registration records. */
+export function agentSlot(machine: AnyActorRef | undefined, agentName: string): string {
   const path = (machine ? actorPath(machine).join(".") : "") || "root";
-  return `${runId}/${path}/${agentName}`;
+  return `${path}/${agentName}`;
+}
+
+export function continuedIid(machine: AnyActorRef | undefined, runId: string, agentName: string): string {
+  return `${runId}/${agentSlot(machine, agentName)}`;
 }
 
 /** The address of a run's gate: gate ids are run-scoped by construction (ADR-0011). */
@@ -488,9 +508,18 @@ export type RunBinding = {
    * Record an Agent invocation's durable admission in the host ledger (ADR-0016): persisted
    * beside the snapshot in the same RunBlob save, keyed by iid (globally unique, so the map is
    * flat). Optional so a bare unit-test binding can omit it — then admissions simply are not
-   * durable.
+   * durable. `delivered` are the notices the admission carried, delivered by this save in `taker`'s
+   * conversation — the Instance ID the admission rides (ADR-0062). `member`: the Workspace the
+   * conversation was admitted in, its slot and whether it continues — so it is in the audience of
+   * every kill there from now on, in the same save.
    */
-  recordAdmission?: (instanceId: string, admission: AgentAdmission, delivered?: readonly string[]) => void;
+  recordAdmission?: (
+    instanceId: string,
+    admission: AgentAdmission,
+    delivered?: readonly string[],
+    taker?: string,
+    member?: { workspace: string; slot: string; continued: boolean },
+  ) => void;
   /**
    * The admission ledger's READ half (ADR-0016): the last admission ledgered under this iid. A
    * continued Turn asks it whether its conversation was ever admitted — only then can the Harness
@@ -521,14 +550,27 @@ export type RunBinding = {
    * `older` names earlier events this one tells the same as, marked raised with it (`NoticeLedger`).
    * A burned conversation's notice is raised by `bumpEpoch` itself, in the same save.
    */
-  raiseNotice?: (notice: Notice, to: string, source?: string, older?: readonly string[]) => void;
+  raiseNotice?: (notice: Notice, to: string, source?: string, older?: readonly string[], opts?: RaiseOptions) => void;
   /** Put back a notice an admission carried that no model heard, WITH its source (`NoticeLedger.restore`):
-   * a raise would drop it, its source being seen. Persisted at the write. */
-  restoreNotice?: (notice: Notice, to: string, source?: string) => void;
-  /** Reserve the pending notices in one admission's scope. They are delivered by the
-   * `recordAdmission` that ledgers it (its `delivered` ids), or released if the admission fails. */
+   * a raise would drop it, its source being seen. A Workspace notice is pending again for `taker`,
+   * the conversation that did not hear it. Persisted at the write. */
+  restoreNotice?: (notice: Notice, to: string, source?: string, taker?: string) => void;
+  /** Reserve the pending notices in one admission's scope, for its conversation (`scope.taker`).
+   * They are delivered by the `recordAdmission` that ledgers it (its `delivered` ids and `taker`),
+   * or released for that conversation if the admission fails. */
   takeNotices?: (scope: NoticeScope) => TakenNotices;
-  releaseNotices?: (ids: readonly string[]) => void;
+  releaseNotices?: (ids: readonly string[], taker?: string) => void;
+  /** What `takeNotices` would reserve in this scope, reserving nothing (`NoticeLedger.peek`). */
+  peekNotices?: (scope: NoticeScope) => Array<{ id: string; notice: Notice; source?: string }>;
+  /** The Harness acknowledged a step boundary's notices (ADR-0062): each that `taker` reserved is
+   * heard there, persisted at the write. Answers how many were. */
+  acknowledgeNotices?: (ids: readonly string[], taker: string) => number;
+  /** The conversations each kill's `bash` answer told (ADR-0062, D4 rule 3), off the pod's list:
+   * they leave that kill's audience. Persisted at the write when anything changed. */
+  noticesTold?: (told: ReadonlyArray<{ source: string; takers: readonly string[] }>) => void;
+  /** A Turn of these conversations in `workspace` ended: a fresh one leaves every audience there,
+   * a continued one stays for its next Turn (ADR-0062). Persisted at the write. */
+  noticeTurnEnded?: (workspace: string, takers: readonly string[]) => void;
   /**
    * The pick the Turn now at this address has outstanding, or answered and not yet read (ADR-0024):
    * what the Agent's Actor asks when its Harness restarted under a Turn — a Turn whose pick is still

package/src/repo-identity.ts

@@ -18,7 +18,8 @@ export type RepoIdentity = {
    * absolute path for a local repository. Path case is KEPT: hosts are case-insensitive, paths on
    * most forges are not. */
   identity: string;
-  /** `<slug>-<sha256(identity)[:8]>` — a DNS-1123 label of at most 49 characters. */
+  /** `<slug>-<sha256(identity)[:32]>` — a DNS-1123 label of at most 49 characters: a slug of at
+   * most 16 characters and 128 bits of the hash, so no one finds two identities with one key. */
   key: string;
   scheme: "https" | "http" | "ssh" | "git" | "local";
 };
@@ -139,7 +140,10 @@ function keyOf(identity: string): string {
       .toLowerCase()
       .replace(/[^a-z0-9]+/g, "-")
       .replace(/^-+|-+$/g, "")
-      .slice(0, 40)
+      .slice(0, 16)
       .replace(/-+$/, "") || "repo";
-  return `${slug}-${createHash("sha256").update(identity).digest("hex").slice(0, 8)}`;
+  // 128 bits (ADR-0051): the key names the cache that a Sandbox mounts, and a per-run url is the
+  // Agent's text. With 32 bits a search found a url of another repository with the same key in
+  // seconds, and that url mounted the other repository's cache.
+  return `${slug}-${createHash("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }

package/src/repos.ts

@@ -192,10 +192,28 @@ export function kubeRepos(opts: KubeReposOptions): RepoResources {
     return item;
   };
 
+  /** The resource that stands under `repo.key`, when it is `repo`'s identity; else a throw that names
+   * both urls (ADR-0051). The key is collision-resistant, so another identity under one key is a
+   * defect or an attack, and no statement of this port writes a resource of another identity: not
+   * its url, not its `secretRef`, not its clock. */
+  const sameIdentity = async (repo: { url: string; identity: string; key: string }): Promise<RepoItem> => {
+    const item = await get(repo.key);
+    const stands = item.metadata?.annotations?.[ANNOTATION_REPO_IDENTITY];
+    if (stands !== repo.identity) {
+      throw new Error(
+        `Repo "${repo.key}" stands for ${stands === undefined ? "no stated identity" : `"${stands}"`} ` +
+          `(url ${item.spec?.url ?? "unknown"}), not for "${repo.identity}" (url ${repo.url}): one key, two ` +
+          "repositories, so jr2 changes nothing on it (ADR-0051). Delete that Repo if it is stale.",
+      );
+    }
+    return item;
+  };
+
   return {
     async bind(repo) {
       const { secretRef, cr } = await resourceFor({ ...repo, bound: true });
       if (await create(cr)) return;
+      await sameIdentity(repo);
       // Already there from an earlier deploy: ONE merge patch says what the Machine resolves now —
       // url, credential, and the label `jr2 gc` honors. `secretRef: null` clears a credential the
       // config no longer names, so a dropped entry does not linger. The clock is not touched: it
@@ -216,12 +234,12 @@ export function kubeRepos(opts: KubeReposOptions): RepoResources {
       // Already there — the boot's statement, or an earlier run's. The eviction clock moves: the
       // run attached it now. The url stays as stated, whatever spelling this run brought.
       const clock = { metadata: { annotations: { [ANNOTATION_REPO_LAST_ATTACHED]: attached } } };
+      const standing = await sameIdentity(repo);
       // A Machine's slot binds it: the boot is its writer, and restates the credential at the next
-      // deploy. Read nothing.
+      // deploy.
       if (repo.bound) return patch(repo.key, clock);
       // This run's slot is per-run, but another registered Machine may bind the identity — the
       // label says so, and then the boot is still the writer.
-      const standing = await get(repo.key);
       if (standing.metadata?.labels?.[LABEL_REPO_BOUND] === "true") return patch(repo.key, clock);
       // Nothing binds it: no boot ever restates it, so this attach does — the credential resolved
       // against the url that STANDS, since the scheme picks the Secret's kind (config.ts) and the