@kairos-es/core 0.0.0 → 1.0.0-alpha.1

package/dist/esm/AppendIsOwned.js

@@ -0,0 +1,73 @@
+/**
+ * `AppendIsOwned` — the marker saying *"an append is already owned here"*, and the
+ * check that refuses a second one.
+ *
+ * ## Why a write-side concept core does not need for its own job lives in core
+ *
+ * A bracket that derives one `AppendCondition` from every read its body performed
+ * (`@kairos-es/codec`'s `transact`) owns exactly one append: the one it issues at
+ * close, under that derived condition. Any OTHER append inside that body is a
+ * wiring mistake, and the dangerous case is not the one that looks dangerous. A
+ * command runner appending mid-body usually writes into the very slice the body
+ * read, so its events match the union the bracket is about to guard on — and the
+ * bracket's own closing append is then refused by a condition its own body
+ * invalidated. The failure arrives at the wrong line, describing a conflict that
+ * was self-inflicted.
+ *
+ * The refusal therefore has to catch a RAW `store.append` and not merely a nested
+ * bracket, which is what puts it here rather than in the codec. Enforcing it one
+ * layer up would catch a nested bracket and a command runner and miss a direct
+ * store call — and a syntactic lint rule cannot close that gap either, having no
+ * call graph, so an append one function away in a helper is invisible to both.
+ * `makeContractStore` is the one seam every engine's append already passes
+ * through, so the check is written once and inherited whole, exactly as
+ * `assertServableQuery` is.
+ *
+ * The cost is real and is accepted: core learns a concept it does not need for its
+ * own job. It is affordable because core already owns the write contract, and
+ * *"an append is already owned"* is a write-side fact about that contract rather
+ * than a fact about the codec.
+ *
+ * ## Present means refused, so a sanctioned append REMOVES the marker
+ *
+ * The check reads the tag through `Effect.serviceOption`, so its ABSENCE is the
+ * normal case and costs the `append` signature nothing — `DcbEventStore.append`
+ * keeps `R = never` and no caller provides anything. Presence is what refuses.
+ *
+ * That shape decides how the two legitimate appends inside a bracket get through,
+ * and there is only one route: run with the marker STRIPPED from the context
+ * (`Effect.mapInputContext` over `Context.omit(AppendIsOwned)`). The bracket's own
+ * closing append is issued outside the scope it provided the marker in, and the
+ * codec's escape hatch strips it explicitly. Neither needs a second tag, a
+ * sanctioning flag or a mutable cell, and there is no way to be exempt by
+ * accident: an append is either lexically outside the marked region or it says in
+ * as many words that it is removing the marker.
+ */
+import { Context, Effect } from 'effect';
+/**
+ * Marks that an append is already owned by an enclosing bracket, and names what
+ * owns it.
+ *
+ * `by` is a human-readable owner name and exists for the defect message alone —
+ * the refusal is decided by the tag's PRESENCE, never by this value, so nothing
+ * branches on it and no caller need agree on a vocabulary for it.
+ */
+export class AppendIsOwned extends /*#__PURE__*/Context.Tag('@kairos-es/core/AppendIsOwned')() {}
+/**
+ * Die if an append is already owned here; do nothing otherwise.
+ *
+ * A DEFECT and not an error-channel value, deliberately. There is no
+ * data-dependent recovery from it: the events this append would have written
+ * belong to a bracket that is going to write its own, so no caller could sensibly
+ * catch it and carry on. It is the same class of fault as a non-servable query,
+ * and it is refused in the same place and in the same way. The remedy is one
+ * identifier away in every case — the codec's `decideOnly` for a command runner,
+ * its escape hatch for a deliberate second append — which is what makes a defect
+ * affordable here.
+ *
+ * `Effect.serviceOption` is what keeps this free: it reads the tag if present and
+ * adds NOTHING to the requirement channel, so every existing append is unchanged
+ * and unprovisioned.
+ */
+export const assertAppendNotOwned = /*#__PURE__*/Effect.flatMap(/*#__PURE__*/Effect.serviceOption(AppendIsOwned), owner => owner._tag === 'None' ? Effect.void : Effect.die(new Error(`makeContractStore.append: an append is already owned here (by '${owner.value.by}'), ` + 'so this one is refused. A bracket derives one append condition from every ' + 'read its body performed and issues one append under it; a second append ' + 'inside that body writes events the bracket is about to guard against, and ' + "refuses the bracket's own close. Return the events instead of appending " + "them, or say the append is deliberate with the codec's escape hatch.")));
+//# sourceMappingURL=AppendIsOwned.js.map

package/dist/esm/AppendIsOwned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppendIsOwned.js","names":["Context","Effect","AppendIsOwned","Tag","assertAppendNotOwned","flatMap","serviceOption","owner","_tag","void","die","Error","value","by"],"sources":["../../src/AppendIsOwned.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAASA,OAAO,EAAEC,MAAM,QAAQ,QAAQ;AAExC;;;;;;;;AAQA,OAAM,MAAOC,aAAc,sBAAQF,OAAO,CAACG,GAAG,CAAC,+BAA+B,CAAC,EAG5E;AAEH;;;;;;;;;;;;;;;;AAgBA,OAAO,MAAMC,oBAAoB,gBAAwBH,MAAM,CAACI,OAAO,cACrEJ,MAAM,CAACK,aAAa,CAACJ,aAAa,CAAC,EAClCK,KAAK,IACJA,KAAK,CAACC,IAAI,KAAK,MAAM,GACjBP,MAAM,CAACQ,IAAI,GACXR,MAAM,CAACS,GAAG,CACR,IAAIC,KAAK,CACP,kEAAkEJ,KAAK,CAACK,KAAK,CAACC,EAAE,MAAM,GACpF,4EAA4E,GAC5E,0EAA0E,GAC1E,4EAA4E,GAC5E,0EAA0E,GAC1E,sEAAsE,CACzE,CACF,CACR","ignoreList":[]}

package/dist/esm/ContractStore.js

@@ -1,4 +1,5 @@
 import { Effect, Predicate, Schema, Stream } from 'effect';
+import { assertAppendNotOwned } from "./AppendIsOwned.js";
 import { ReadLimit } from "./Event.js";
 import { assertServableQuery } from "./Query.js";
 /** Decode an unknown limit through `ReadLimit`, dying on a defect-worthy value. */
@@ -17,7 +18,16 @@ export const makeContractStore = raw => ({
     // Infrastructure faults are defects, not contract values.
     return Effect.orDie(raw.read(query, options));
   }),
-  append: (events, condition) => Effect.suspend(() => {
+  append: (events, condition) =>
+  // The ownership refusal runs FIRST and sits OUTSIDE the suspend, because it is
+  // the only one of append's four checks that is EFFECTFUL: it consults a
+  // `Context.Tag` rather than inspecting the arguments. `Effect.flatMap` over an
+  // already-lazy effect defers it exactly as the suspend defers the throws below,
+  // so nothing runs at the call site either way; what it buys is that the
+  // "you are inside a bracket" defect arrives before any argument is judged, which
+  // is the order a reader expects when both are wrong at once. `AppendIsOwned.ts`
+  // owns why the concept is in core at all.
+  Effect.flatMap(assertAppendNotOwned, () => Effect.suspend(() => {
     // An EMPTY batch is a plain-data caller bypassing the
     // `NonEmptyReadonlyArray` type: there is nothing to append. The engines
     // diverge on it at an unchecked boundary — Postgres inserts zero rows and
@@ -59,7 +69,7 @@ export const makeContractStore = raw => ({
     // narrows the raw `AppendConditionFailed | E` to the contract's single
     // error, which is what keeps `append` at `E = AppendConditionFailed`.
     return Effect.catchAll(raw.append(events, condition), error => Predicate.isTagged('AppendConditionFailed')(error) ? Effect.fail(error) : Effect.die(error));
-  }),
+  })),
   subscribe: (query, after) =>
   // `Effect.sync` runs when the stream is executed; a throw from
   // `assertServableQuery` becomes a stream defect (identical rule to

package/dist/esm/ContractStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"ContractStore.js","names":["Effect","Predicate","Schema","Stream","ReadLimit","assertServableQuery","decodeReadLimit","decodeUnknownSync","makeContractStore","raw","read","query","options","suspend","limit","undefined","orDie","append","events","condition","length","Error","failIfEventsMatch","catchAll","error","isTagged","fail","die","subscribe","after","unwrap","sync"],"sources":["../../src/ContractStore.ts"],"sourcesContent":[null],"mappings":"AAgCA,SAASA,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAEC,MAAM,QAAQ,QAAQ;AAI1D,SAASC,SAAS,QAAQ,YAAS;AAEnC,SAASC,mBAAmB,QAAoB,YAAS;AAEzD;AACA,MAAMC,eAAe,gBAAGJ,MAAM,CAACK,iBAAiB,CAACH,SAAS,CAAC;AAwB3D;;;;AAIA,OAAO,MAAMI,iBAAiB,GAC5BC,GAAwB,KACG;EAC3BC,IAAI,EAAEA,CAACC,KAAK,EAAEC,OAAO,KACnBZ,MAAM,CAACa,OAAO,CAAC,MAAK;IAClB;IACAR,mBAAmB,CAACM,KAAK,CAAC;IAC1B,IAAIC,OAAO,EAAEE,KAAK,KAAKC,SAAS,EAAE;MAChCT,eAAe,CAACM,OAAO,CAACE,KAAK,CAAC;IAChC;IACA;IACA,OAAOd,MAAM,CAACgB,KAAK,CAACP,GAAG,CAACC,IAAI,CAACC,KAAK,EAAEC,OAAO,CAAC,CAAC;EAC/C,CAAC,CAAC;EAEJK,MAAM,EAAEA,CAACC,MAAM,EAAEC,SAAS,KACxBnB,MAAM,CAACa,OAAO,CAAC,MAAK;IAClB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAIK,MAAM,CAACE,MAAM,KAAK,CAAC,EAAE;MACvB,MAAM,IAAIC,KAAK,CACb,uEAAuE,GACrE,oEAAoE,GACpE,kEAAkE,CACrE;IACH;IACA;IACA,IAAIF,SAAS,KAAKJ,SAAS,EAAE;MAC3BV,mBAAmB,CAACc,SAAS,CAACG,iBAAiB,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,OAAOtB,MAAM,CAACuB,QAAQ,CAACd,GAAG,CAACQ,MAAM,CAACC,MAAM,EAAEC,SAAS,CAAC,EAAGK,KAAK,IAC1DvB,SAAS,CAACwB,QAAQ,CAAC,uBAAuB,CAAC,CAACD,KAAK,CAAC,GAC9CxB,MAAM,CAAC0B,IAAI,CAACF,KAAK,CAAC,GAClBxB,MAAM,CAAC2B,GAAG,CAACH,KAAK,CAAC,CACtB;EACH,CAAC,CAAC;EAEJI,SAAS,EAAEA,CAACjB,KAAK,EAAEkB,KAAK;EACtB;EACA;EACA;EACA;EACA1B,MAAM,CAAC2B,MAAM,CACX9B,MAAM,CAAC+B,IAAI,CAAC,MAAK;IACf1B,mBAAmB,CAACM,KAAK,CAAC;IAC1B,OAAOR,MAAM,CAACa,KAAK,CAACP,GAAG,CAACmB,SAAS,CAACjB,KAAK,EAAEkB,KAAK,CAAC,CAAC;EAClD,CAAC,CAAC;CAEP,CAAC","ignoreList":[]}
+{"version":3,"file":"ContractStore.js","names":["Effect","Predicate","Schema","Stream","assertAppendNotOwned","ReadLimit","assertServableQuery","decodeReadLimit","decodeUnknownSync","makeContractStore","raw","read","query","options","suspend","limit","undefined","orDie","append","events","condition","flatMap","length","Error","failIfEventsMatch","catchAll","error","isTagged","fail","die","subscribe","after","unwrap","sync"],"sources":["../../src/ContractStore.ts"],"sourcesContent":[null],"mappings":"AAmCA,SAASA,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAEC,MAAM,QAAQ,QAAQ;AAE1D,SAASC,oBAAoB,QAAQ,oBAAiB;AAGtD,SAASC,SAAS,QAAQ,YAAS;AAEnC,SAASC,mBAAmB,QAAoB,YAAS;AAEzD;AACA,MAAMC,eAAe,gBAAGL,MAAM,CAACM,iBAAiB,CAACH,SAAS,CAAC;AAwB3D;;;;AAIA,OAAO,MAAMI,iBAAiB,GAC5BC,GAAwB,KACG;EAC3BC,IAAI,EAAEA,CAACC,KAAK,EAAEC,OAAO,KACnBb,MAAM,CAACc,OAAO,CAAC,MAAK;IAClB;IACAR,mBAAmB,CAACM,KAAK,CAAC;IAC1B,IAAIC,OAAO,EAAEE,KAAK,KAAKC,SAAS,EAAE;MAChCT,eAAe,CAACM,OAAO,CAACE,KAAK,CAAC;IAChC;IACA;IACA,OAAOf,MAAM,CAACiB,KAAK,CAACP,GAAG,CAACC,IAAI,CAACC,KAAK,EAAEC,OAAO,CAAC,CAAC;EAC/C,CAAC,CAAC;EAEJK,MAAM,EAAEA,CAACC,MAAM,EAAEC,SAAS;EACxB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACApB,MAAM,CAACqB,OAAO,CAACjB,oBAAoB,EAAE,MACnCJ,MAAM,CAACc,OAAO,CAAC,MAAK;IAClB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAIK,MAAM,CAACG,MAAM,KAAK,CAAC,EAAE;MACvB,MAAM,IAAIC,KAAK,CACb,uEAAuE,GACrE,oEAAoE,GACpE,kEAAkE,CACrE;IACH;IACA;IACA,IAAIH,SAAS,KAAKJ,SAAS,EAAE;MAC3BV,mBAAmB,CAACc,SAAS,CAACI,iBAAiB,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,OAAOxB,MAAM,CAACyB,QAAQ,CAACf,GAAG,CAACQ,MAAM,CAACC,MAAM,EAAEC,SAAS,CAAC,EAAGM,KAAK,IAC1DzB,SAAS,CAAC0B,QAAQ,CAAC,uBAAuB,CAAC,CAACD,KAAK,CAAC,GAC9C1B,MAAM,CAAC4B,IAAI,CAACF,KAAK,CAAC,GAClB1B,MAAM,CAAC6B,GAAG,CAACH,KAAK,CAAC,CACtB;EACH,CAAC,CAAC,CACH;EAEHI,SAAS,EAAEA,CAAClB,KAAK,EAAEmB,KAAK;EACtB;EACA;EACA;EACA;EACA5B,MAAM,CAAC6B,MAAM,CACXhC,MAAM,CAACiC,IAAI,CAAC,MAAK;IACf3B,mBAAmB,CAACM,KAAK,CAAC;IAC1B,OAAOT,MAAM,CAACc,KAAK,CAACP,GAAG,CAACoB,SAAS,CAAClB,KAAK,EAAEmB,KAAK,CAAC,CAAC;EAClD,CAAC,CAAC;CAEP,CAAC","ignoreList":[]}

package/dist/esm/Projection.js

@@ -27,6 +27,22 @@ const mergeQuery = (left, right) => {
     items: [...left.items, ...right.items]
   };
 };
+/**
+ * OR-merge a list of queries into one. The empty list is the wildcard.
+ *
+ * The same merge `composeProjections` folds its record through, reachable
+ * WITHOUT a record — which is what a caller accumulating queries rather than
+ * projections needs, and the codec's read ledger is one. Without it that caller
+ * either hand-rolls the merge, or fabricates a projection per query to reach this
+ * one; both were tried and the first is a TRAP. An empty `items` is the WILDCARD
+ * and is absorbing under OR, while spreading an empty list contributes nothing, so
+ * a hand-rolled union silently narrows a match-everything query to its siblings —
+ * in the unsafe direction, and with nothing to notice.
+ *
+ * Seeding the fold with the wildcard would swallow everything for the same reason,
+ * so the list is reduced with no seed and the empty case answers directly.
+ */
+export const unionQueries = queries => queries.length === 0 ? WILDCARD : queries.reduce((acc, q) => mergeQuery(acc, q));
 /**
  * Compose named projections into one whose state is a record of sub-states and
  * whose query is the OR-merge of all sub-queries. Each sub-projection only
@@ -41,10 +57,7 @@ const mergeQuery = (left, right) => {
 export const composeProjections = projections => {
   const keys = Object.keys(projections);
   const initialState = Object.fromEntries(keys.map(key => [key, projections[key].initialState]));
-  // Seeding the reduce with the wildcard would swallow everything (mergeQuery
-  // treats an empty-items query as a wildcard), so fold the sub-queries
-  // directly with no seed.
-  const mergedQuery = keys.length === 0 ? WILDCARD : keys.map(key => projections[key].query).reduce((acc, q) => mergeQuery(acc, q));
+  const mergedQuery = unionQueries(keys.map(key => projections[key].query));
   return {
     initialState,
     query: mergedQuery,

package/dist/esm/Projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"Projection.js","names":["matchesSequenced","WILDCARD","items","AnyProjection","of","projection","mergeQuery","left","right","length","composeProjections","projections","keys","Object","initialState","fromEntries","map","key","mergedQuery","query","reduce","acc","q","evolve","state","decoded","next","sequenced"],"sources":["../../src/Projection.ts"],"sourcesContent":[null],"mappings":"AA4BA,SAASA,gBAAgB,QAAQ,YAAS;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,QAAQ,GAAU;EAAEC,KAAK,EAAE;AAAE,CAAE;AAqDrC,OAAO,MAAMC,aAAa,GAAG;EAC3B;;;;;;;EAOAC,EAAE,EAAMC,UAAyB,IAC/BA;CACM;AAaV;AACA,MAAMC,UAAU,GAAGA,CAACC,IAAW,EAAEC,KAAY,KAAW;EACtD,IAAID,IAAI,CAACL,KAAK,CAACO,MAAM,KAAK,CAAC,IAAID,KAAK,CAACN,KAAK,CAACO,MAAM,KAAK,CAAC,EAAE;IACvD,OAAOR,QAAQ;EACjB;EACA,OAAO;IAAEC,KAAK,EAAE,CAAC,GAAGK,IAAI,CAACL,KAAK,EAAE,GAAGM,KAAK,CAACN,KAAK;EAAC,CAAE;AACnD,CAAC;AAED;;;;;;;;;;;AAWA,OAAO,MAAMQ,kBAAkB,GAC7BC,WAAc,IACmB;EACjC,MAAMC,IAAI,GAAGC,MAAM,CAACD,IAAI,CAACD,WAAW,CAAoC;EAExE,MAAMG,YAAY,GAAGD,MAAM,CAACE,WAAW,CACrCH,IAAI,CAACI,GAAG,CAAEC,GAAG,IAAK,CAACA,GAAG,EAAEN,WAAW,CAACM,GAAG,CAAC,CAACH,YAAY,CAAC,CAAC,CACnC;EAEtB;EACA;EACA;EACA,MAAMI,WAAW,GACfN,IAAI,CAACH,MAAM,KAAK,CAAC,GACbR,QAAQ,GACRW,IAAI,CACDI,GAAG,CAAEC,GAAG,IAAKN,WAAW,CAACM,GAAG,CAAC,CAACE,KAAK,CAAC,CACpCC,MAAM,CAAC,CAACC,GAAG,EAAEC,CAAC,KAAKhB,UAAU,CAACe,GAAG,EAAEC,CAAC,CAAC,CAAC;EAE/C,OAAO;IACLR,YAAY;IACZK,KAAK,EAAED,WAAW;IAClBK,MAAM,EAAEA,CAACC,KAAK,EAAEC,OAAO,KAAI;MACzB,MAAMC,IAAI,GAAG;QAAE,GAAGF;MAAK,CAAuC;MAC9D,KAAK,MAAMP,GAAG,IAAIL,IAAI,EAAE;QACtB,MAAMP,UAAU,GAAGM,WAAW,CAACM,GAAG,CAAC;QACnC,IAAI,CAACjB,gBAAgB,CAACyB,OAAO,CAACE,SAAS,EAAEtB,UAAU,CAACc,KAAK,CAAC,EAAE;UAC1D;QACF;QACAO,IAAI,CAACT,GAAG,CAAC,GAAGZ,UAAU,CAACkB,MAAM,CAACC,KAAK,CAACP,GAAG,CAAC,EAAEQ,OAAO,CAEhD;MACH;MACA,OAAOC,IAAI;IACb;GACD;AACH,CAAC","ignoreList":[]}
+{"version":3,"file":"Projection.js","names":["matchesSequenced","WILDCARD","items","AnyProjection","of","projection","mergeQuery","left","right","length","unionQueries","queries","reduce","acc","q","composeProjections","projections","keys","Object","initialState","fromEntries","map","key","mergedQuery","query","evolve","state","decoded","next","sequenced"],"sources":["../../src/Projection.ts"],"sourcesContent":[null],"mappings":"AA4BA,SAASA,gBAAgB,QAAQ,YAAS;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,QAAQ,GAAU;EAAEC,KAAK,EAAE;AAAE,CAAE;AAqDrC,OAAO,MAAMC,aAAa,GAAG;EAC3B;;;;;;;EAOAC,EAAE,EAAMC,UAAyB,IAC/BA;CACM;AAaV;AACA,MAAMC,UAAU,GAAGA,CAACC,IAAW,EAAEC,KAAY,KAAW;EACtD,IAAID,IAAI,CAACL,KAAK,CAACO,MAAM,KAAK,CAAC,IAAID,KAAK,CAACN,KAAK,CAACO,MAAM,KAAK,CAAC,EAAE;IACvD,OAAOR,QAAQ;EACjB;EACA,OAAO;IAAEC,KAAK,EAAE,CAAC,GAAGK,IAAI,CAACL,KAAK,EAAE,GAAGM,KAAK,CAACN,KAAK;EAAC,CAAE;AACnD,CAAC;AAED;;;;;;;;;;;;;;;AAeA,OAAO,MAAMQ,YAAY,GAAIC,OAA6B,IACxDA,OAAO,CAACF,MAAM,KAAK,CAAC,GAChBR,QAAQ,GACRU,OAAO,CAACC,MAAM,CAAC,CAACC,GAAG,EAAEC,CAAC,KAAKR,UAAU,CAACO,GAAG,EAAEC,CAAC,CAAC,CAAC;AAEpD;;;;;;;;;;;AAWA,OAAO,MAAMC,kBAAkB,GAC7BC,WAAc,IACmB;EACjC,MAAMC,IAAI,GAAGC,MAAM,CAACD,IAAI,CAACD,WAAW,CAAoC;EAExE,MAAMG,YAAY,GAAGD,MAAM,CAACE,WAAW,CACrCH,IAAI,CAACI,GAAG,CAAEC,GAAG,IAAK,CAACA,GAAG,EAAEN,WAAW,CAACM,GAAG,CAAC,CAACH,YAAY,CAAC,CAAC,CACnC;EAEtB,MAAMI,WAAW,GAAGb,YAAY,CAACO,IAAI,CAACI,GAAG,CAAEC,GAAG,IAAKN,WAAW,CAACM,GAAG,CAAC,CAACE,KAAK,CAAC,CAAC;EAE3E,OAAO;IACLL,YAAY;IACZK,KAAK,EAAED,WAAW;IAClBE,MAAM,EAAEA,CAACC,KAAK,EAAEC,OAAO,KAAI;MACzB,MAAMC,IAAI,GAAG;QAAE,GAAGF;MAAK,CAAuC;MAC9D,KAAK,MAAMJ,GAAG,IAAIL,IAAI,EAAE;QACtB,MAAMZ,UAAU,GAAGW,WAAW,CAACM,GAAG,CAAC;QACnC,IAAI,CAACtB,gBAAgB,CAAC2B,OAAO,CAACE,SAAS,EAAExB,UAAU,CAACmB,KAAK,CAAC,EAAE;UAC1D;QACF;QACAI,IAAI,CAACN,GAAG,CAAC,GAAGjB,UAAU,CAACoB,MAAM,CAACC,KAAK,CAACJ,GAAG,CAAC,EAAEK,OAAO,CAEhD;MACH;MACA,OAAOC,IAAI;IACb;GACD;AACH,CAAC","ignoreList":[]}

package/dist/esm/Query.js

@@ -88,19 +88,48 @@ export const matchesSequenced = (sequenced, query) => matchesQuery(sequenced.eve
  * engine" behaviour.
  */
 export const assertServableQuery = query => {
+  const fault = servableQueryFault(query);
+  if (fault !== undefined) {
+    throw new Error(fault);
+  }
+};
+/**
+ * The servable grammar as a TOTAL function: the reason `query` cannot be served,
+ * or `undefined` when it can.
+ *
+ * The same rule as `assertServableQuery` above and NOT a second statement of it —
+ * that function is this one plus a throw, so the grammar is defined once and the
+ * two differ only in DISPOSITION. A store boundary wants the defect, because a
+ * non-servable query there is a programming error with no recovery; a caller that
+ * can still act on the answer wants a value, and the codec's read ledger is one:
+ * it asks whether a hop it is about to record would make the accumulated union
+ * unservable, and refuses on the error channel BEFORE the read is paid for.
+ *
+ * The alternative was for that caller to re-derive the rule, and it was tried:
+ * the codec's own copy tested each recorded query separately, which silently
+ * admitted a FIRST hop composed of two tagless slices — a multi-item query, and
+ * unservable, dying at the store one layer away. A grammar with two homes drifts
+ * at exactly the shapes neither author had in mind. The shape here is the read
+ * side's own (`projectionWiringFault` returns `string | undefined` for the same
+ * reason), so a fault is one exit route and one return type.
+ */
+export const servableQueryFault = query => {
   const {
     items
   } = query;
   // Wildcard and single-item queries are always servable.
   if (items.length <= 1) {
-    return;
+    return undefined;
   }
   // A multi-item query is servable only if every item is tagged; a tagless
   // (type-only) item mixed with tagged items cannot ride a single index.
-  const hasTaglessItem = items.some(item => item.tags.length === 0);
-  if (hasTaglessItem) {
-    throw new Error('assertServableQuery: a multi-item query must have every item carry at ' + 'least one tag; a type-only item mixed with tagged items is not servable');
-  }
+  // The `assertServableQuery:` prefix is part of the MESSAGE and not something the
+  // throw adds, so both dispositions emit byte-identical text. It names the rule in
+  // the vocabulary a store rejects in, which is what lets the read side's wiring gate
+  // report a violation in the same words a store would — an author who meets it in
+  // both places meets it once. Building it here is also what stops a second caller
+  // re-deriving the prefix to match.
+  return items.some(item => item.tags.length === 0) ? 'assertServableQuery: a multi-item query must have every item carry at ' + 'least one tag; a type-only item mixed with tagged items is not servable' : undefined;
 };
 /**
  * Classify a servable `Query` into the shape that serves it.

package/dist/esm/Query.js.map

@@ -1 +1 @@
-{"version":3,"file":"Query.js","names":["Array","Arr","Schema","EventType","Tag","QueryItem","Struct","types","tags","Query","items","matchesQueryItem","event","item","typeOk","length","includes","type","eventTags","Set","every","tag","has","matchesQuery","query","some","matchesSequenced","sequenced","assertServableQuery","hasTaglessItem","Error","classifyServableQuery","kind","only","undefined","isNonEmptyReadonlyArray","fields","all","or"],"sources":["../../src/Query.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAASA,KAAK,IAAIC,GAAG,EAAEC,MAAM,QAAQ,QAAQ;AAC7C,SAAwBC,SAAS,EAAuBC,GAAG,QAAQ,YAAS;AAE5E;;;;AAIA,OAAO,MAAMC,SAAS,gBAAGH,MAAM,CAACI,MAAM,CAAC;EACrCC,KAAK,eAAEL,MAAM,CAACF,KAAK,CAACG,SAAS,CAAC;EAC9BK,IAAI,eAAEN,MAAM,CAACF,KAAK,CAACI,GAAG;CACvB,CAAC;AAGF;AACA,OAAO,MAAMK,KAAK,gBAAGP,MAAM,CAACI,MAAM,CAAC;EACjCI,KAAK,eAAER,MAAM,CAACF,KAAK,CAACK,SAAS;CAC9B,CAAC;AAGF;;;;AAIA,OAAO,MAAMM,gBAAgB,GAAGA,CAACC,KAAe,EAAEC,IAAe,KAAa;EAC5E,MAAMC,MAAM,GAAGD,IAAI,CAACN,KAAK,CAACQ,MAAM,KAAK,CAAC,IAAIF,IAAI,CAACN,KAAK,CAACS,QAAQ,CAACJ,KAAK,CAACK,IAAI,CAAC;EACzE,IAAI,CAACH,MAAM,EAAE;IACX,OAAO,KAAK;EACd;EACA,MAAMI,SAAS,GAAG,IAAIC,GAAG,CAASP,KAAK,CAACJ,IAAI,CAAC;EAC7C,OAAOK,IAAI,CAACL,IAAI,CAACY,KAAK,CAAEC,GAAG,IAAKH,SAAS,CAACI,GAAG,CAACD,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;AAKA,OAAO,MAAME,YAAY,GAAGA,CAACX,KAAe,EAAEY,KAAY,KAAa;EACrE,IAAIA,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,EAAE;IAC5B,OAAO,IAAI;EACb;EACA,OAAOS,KAAK,CAACd,KAAK,CAACe,IAAI,CAAEZ,IAAI,IAAKF,gBAAgB,CAACC,KAAK,EAAEC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;AACA,OAAO,MAAMa,gBAAgB,GAAGA,CAC9BC,SAAyB,EACzBH,KAAY,KACAD,YAAY,CAACI,SAAS,CAACf,KAAK,EAAEY,KAAK,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,OAAO,MAAMI,mBAAmB,GAAIJ,KAAY,IAAU;EACxD,MAAM;IAAEd;EAAK,CAAE,GAAGc,KAAK;EACvB;EACA,IAAId,KAAK,CAACK,MAAM,IAAI,CAAC,EAAE;IACrB;EACF;EACA;EACA;EACA,MAAMc,cAAc,GAAGnB,KAAK,CAACe,IAAI,CAAEZ,IAAI,IAAKA,IAAI,CAACL,IAAI,CAACO,MAAM,KAAK,CAAC,CAAC;EACnE,IAAIc,cAAc,EAAE;IAClB,MAAM,IAAIC,KAAK,CACb,wEAAwE,GACtE,yEAAyE,CAC5E;EACH;AACF,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,MAAMC,qBAAqB,GAAIP,KAAY,IAAwB;EACxE,IAAIA,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,EAAE;IAC5B,OAAO;MAAEiB,IAAI,EAAE;IAAU,CAAE;EAC7B;EACA,MAAMC,IAAI,GAAGT,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,GAAGS,KAAK,CAACd,KAAK,CAAC,CAAC,CAAC,GAAGwB,SAAS;EAClE,IAAID,IAAI,KAAKC,SAAS,IAAID,IAAI,CAACzB,IAAI,CAACO,MAAM,KAAK,CAAC,EAAE;IAChD,OAAOd,GAAG,CAACkC,uBAAuB,CAACF,IAAI,CAAC1B,KAAK,CAAC,GAC1C;MAAEyB,IAAI,EAAE,UAAU;MAAEzB,KAAK,EAAE0B,IAAI,CAAC1B;IAAK,CAAE,GACvC;MAAEyB,IAAI,EAAE;IAAU,CAAE;EAC1B;EACA,OAAO;IAAEA,IAAI,EAAE;EAAQ,CAAE;AAC3B,CAAC;AAED;AAEA;;;;;;AAMA,MAAMnB,IAAI,GAAIuB,MAGb,KAAiB;EAChB7B,KAAK,EAAE6B,MAAM,CAAC7B,KAAK,IAAI,EAAE;EACzBC,IAAI,EAAE4B,MAAM,CAAC5B;CACd,CAAC;AAEF;AACA,MAAM6B,GAAG,GAAGA,CAAA,MAAc;EAAE3B,KAAK,EAAE;AAAE,CAAE,CAAC;AAExC;;;;AAIA,MAAMF,IAAI,GAAGA,CACXA,IAA2C,EAC3CD,KAAgC,MACrB;EACXG,KAAK,EAAE,CAACG,IAAI,CAAC;IAAEL,IAAI;IAAE,IAAID,KAAK,KAAK2B,SAAS,GAAG,EAAE,GAAG;MAAE3B;IAAK,CAAE;EAAC,CAAE,CAAC;CAClE,CAAC;AAEF;;;;;AAKA,MAAMA,KAAK,GACTA,KAAwD,KAC7C;EAAEG,KAAK,EAAE,CAAC;IAAEH,KAAK;IAAEC,IAAI,EAAE;EAAE,CAAE;AAAC,CAAE,CAAC;AAE9C;;;;;AAKA,MAAM8B,EAAE,GACN5B,KAAwD,KAC7C;EACXA;CACD,CAAC;AAEF;AACA,OAAO,MAAMc,KAAK,GAAG;EACnBa,GAAG;EACHxB,IAAI;EACJyB,EAAE;EACF9B,IAAI;EACJD;CACQ","ignoreList":[]}
+{"version":3,"file":"Query.js","names":["Array","Arr","Schema","EventType","Tag","QueryItem","Struct","types","tags","Query","items","matchesQueryItem","event","item","typeOk","length","includes","type","eventTags","Set","every","tag","has","matchesQuery","query","some","matchesSequenced","sequenced","assertServableQuery","fault","servableQueryFault","undefined","Error","classifyServableQuery","kind","only","isNonEmptyReadonlyArray","fields","all","or"],"sources":["../../src/Query.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAASA,KAAK,IAAIC,GAAG,EAAEC,MAAM,QAAQ,QAAQ;AAC7C,SAAwBC,SAAS,EAAuBC,GAAG,QAAQ,YAAS;AAE5E;;;;AAIA,OAAO,MAAMC,SAAS,gBAAGH,MAAM,CAACI,MAAM,CAAC;EACrCC,KAAK,eAAEL,MAAM,CAACF,KAAK,CAACG,SAAS,CAAC;EAC9BK,IAAI,eAAEN,MAAM,CAACF,KAAK,CAACI,GAAG;CACvB,CAAC;AAGF;AACA,OAAO,MAAMK,KAAK,gBAAGP,MAAM,CAACI,MAAM,CAAC;EACjCI,KAAK,eAAER,MAAM,CAACF,KAAK,CAACK,SAAS;CAC9B,CAAC;AAGF;;;;AAIA,OAAO,MAAMM,gBAAgB,GAAGA,CAACC,KAAe,EAAEC,IAAe,KAAa;EAC5E,MAAMC,MAAM,GAAGD,IAAI,CAACN,KAAK,CAACQ,MAAM,KAAK,CAAC,IAAIF,IAAI,CAACN,KAAK,CAACS,QAAQ,CAACJ,KAAK,CAACK,IAAI,CAAC;EACzE,IAAI,CAACH,MAAM,EAAE;IACX,OAAO,KAAK;EACd;EACA,MAAMI,SAAS,GAAG,IAAIC,GAAG,CAASP,KAAK,CAACJ,IAAI,CAAC;EAC7C,OAAOK,IAAI,CAACL,IAAI,CAACY,KAAK,CAAEC,GAAG,IAAKH,SAAS,CAACI,GAAG,CAACD,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;AAKA,OAAO,MAAME,YAAY,GAAGA,CAACX,KAAe,EAAEY,KAAY,KAAa;EACrE,IAAIA,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,EAAE;IAC5B,OAAO,IAAI;EACb;EACA,OAAOS,KAAK,CAACd,KAAK,CAACe,IAAI,CAAEZ,IAAI,IAAKF,gBAAgB,CAACC,KAAK,EAAEC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;AACA,OAAO,MAAMa,gBAAgB,GAAGA,CAC9BC,SAAyB,EACzBH,KAAY,KACAD,YAAY,CAACI,SAAS,CAACf,KAAK,EAAEY,KAAK,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,OAAO,MAAMI,mBAAmB,GAAIJ,KAAY,IAAU;EACxD,MAAMK,KAAK,GAAGC,kBAAkB,CAACN,KAAK,CAAC;EACvC,IAAIK,KAAK,KAAKE,SAAS,EAAE;IACvB,MAAM,IAAIC,KAAK,CAACH,KAAK,CAAC;EACxB;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;AAoBA,OAAO,MAAMC,kBAAkB,GAAIN,KAAY,IAAwB;EACrE,MAAM;IAAEd;EAAK,CAAE,GAAGc,KAAK;EACvB;EACA,IAAId,KAAK,CAACK,MAAM,IAAI,CAAC,EAAE;IACrB,OAAOgB,SAAS;EAClB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAOrB,KAAK,CAACe,IAAI,CAAEZ,IAAI,IAAKA,IAAI,CAACL,IAAI,CAACO,MAAM,KAAK,CAAC,CAAC,GAC/C,wEAAwE,GACtE,yEAAyE,GAC3EgB,SAAS;AACf,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,MAAME,qBAAqB,GAAIT,KAAY,IAAwB;EACxE,IAAIA,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,EAAE;IAC5B,OAAO;MAAEmB,IAAI,EAAE;IAAU,CAAE;EAC7B;EACA,MAAMC,IAAI,GAAGX,KAAK,CAACd,KAAK,CAACK,MAAM,KAAK,CAAC,GAAGS,KAAK,CAACd,KAAK,CAAC,CAAC,CAAC,GAAGqB,SAAS;EAClE,IAAII,IAAI,KAAKJ,SAAS,IAAII,IAAI,CAAC3B,IAAI,CAACO,MAAM,KAAK,CAAC,EAAE;IAChD,OAAOd,GAAG,CAACmC,uBAAuB,CAACD,IAAI,CAAC5B,KAAK,CAAC,GAC1C;MAAE2B,IAAI,EAAE,UAAU;MAAE3B,KAAK,EAAE4B,IAAI,CAAC5B;IAAK,CAAE,GACvC;MAAE2B,IAAI,EAAE;IAAU,CAAE;EAC1B;EACA,OAAO;IAAEA,IAAI,EAAE;EAAQ,CAAE;AAC3B,CAAC;AAED;AAEA;;;;;;AAMA,MAAMrB,IAAI,GAAIwB,MAGb,KAAiB;EAChB9B,KAAK,EAAE8B,MAAM,CAAC9B,KAAK,IAAI,EAAE;EACzBC,IAAI,EAAE6B,MAAM,CAAC7B;CACd,CAAC;AAEF;AACA,MAAM8B,GAAG,GAAGA,CAAA,MAAc;EAAE5B,KAAK,EAAE;AAAE,CAAE,CAAC;AAExC;;;;AAIA,MAAMF,IAAI,GAAGA,CACXA,IAA2C,EAC3CD,KAAgC,MACrB;EACXG,KAAK,EAAE,CAACG,IAAI,CAAC;IAAEL,IAAI;IAAE,IAAID,KAAK,KAAKwB,SAAS,GAAG,EAAE,GAAG;MAAExB;IAAK,CAAE;EAAC,CAAE,CAAC;CAClE,CAAC;AAEF;;;;;AAKA,MAAMA,KAAK,GACTA,KAAwD,KAC7C;EAAEG,KAAK,EAAE,CAAC;IAAEH,KAAK;IAAEC,IAAI,EAAE;EAAE,CAAE;AAAC,CAAE,CAAC;AAE9C;;;;;AAKA,MAAM+B,EAAE,GACN7B,KAAwD,KAC7C;EACXA;CACD,CAAC;AAEF;AACA,OAAO,MAAMc,KAAK,GAAG;EACnBc,GAAG;EACHzB,IAAI;EACJ0B,EAAE;EACF/B,IAAI;EACJD;CACQ","ignoreList":[]}

package/dist/esm/index.js

@@ -4,11 +4,15 @@
  *
  * Exposes the domain types (`DcbEvent`, `SequencedEvent`, `Position`, `Tag`,
  * `EventType`), the selection language (`Query`, `QueryItem`, the pure match
- * predicate + smart constructors, and the servable-shape dispatch every engine
- * compiles its plans through), the `AppendCondition`, tagged errors, the
- * `DcbEventStore` contract, the in-memory layer, the shared subscribe machine
+ * predicate + smart constructors, the servable grammar in both its dispositions —
+ * `assertServableQuery`'s throw and `servableQueryFault`'s total `string |
+ * undefined` — and the servable-shape dispatch every engine compiles its plans
+ * through), the `AppendCondition`, tagged errors, the
+ * `DcbEventStore` contract, `AppendIsOwned` and the refusal every engine's `append`
+ * inherits from it, the in-memory layer, the shared subscribe machine
  * every engine's `subscribe` is built from (`SubscribeMachine.ts`), the pure
- * projection primitives (`Projection`, `DecodedEvent`, `composeProjections`), and
+ * projection primitives (`Projection`, `DecodedEvent`, `composeProjections` and the
+ * `unionQueries` its query merge is reachable through without a record), and
  * `retryOnConflict`.
  *
  * Core keeps only the *pure* fold: projections fold an already-`DecodedEvent`
@@ -23,6 +27,7 @@
  * write-only consumer depend on a package it uses nothing else of (ADR-0008).
  */
 export * from "./AppendCondition.js";
+export * from "./AppendIsOwned.js";
 export * from "./ContractStore.js";
 export * from "./DcbEventStore.js";
 export * from "./Event.js";

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["DcbEventStoreInMemory"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,cAAc,sBAAmB;AACjC,cAAc,oBAAiB;AAC/B,cAAc,oBAAiB;AAC/B,cAAc,YAAS;AACvB,cAAc,aAAU;AACxB;AACA;AACA;AACA,SAASA,qBAAqB,QAAQ,eAAY;AAClD,cAAc,iBAAc;AAC5B,cAAc,YAAS;AACvB,cAAc,sBAAmB;AACjC,cAAc,uBAAoB","ignoreList":[]}
+{"version":3,"file":"index.js","names":["DcbEventStoreInMemory"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,cAAc,sBAAmB;AACjC,cAAc,oBAAiB;AAC/B,cAAc,oBAAiB;AAC/B,cAAc,oBAAiB;AAC/B,cAAc,YAAS;AACvB,cAAc,aAAU;AACxB;AACA;AACA;AACA,SAASA,qBAAqB,QAAQ,eAAY;AAClD,cAAc,iBAAc;AAC5B,cAAc,YAAS;AACvB,cAAc,sBAAmB;AACjC,cAAc,uBAAoB","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kairos-es/core",
-  "version": "0.0.0",
+  "version": "1.0.0-alpha.1",
   "description": "DCB-first event-sourcing contract and in-memory store for Effect v3",
   "license": "BSD-3-Clause",
   "repository": {

package/src/AppendIsOwned.ts

@@ -0,0 +1,92 @@
+/**
+ * `AppendIsOwned` — the marker saying *"an append is already owned here"*, and the
+ * check that refuses a second one.
+ *
+ * ## Why a write-side concept core does not need for its own job lives in core
+ *
+ * A bracket that derives one `AppendCondition` from every read its body performed
+ * (`@kairos-es/codec`'s `transact`) owns exactly one append: the one it issues at
+ * close, under that derived condition. Any OTHER append inside that body is a
+ * wiring mistake, and the dangerous case is not the one that looks dangerous. A
+ * command runner appending mid-body usually writes into the very slice the body
+ * read, so its events match the union the bracket is about to guard on — and the
+ * bracket's own closing append is then refused by a condition its own body
+ * invalidated. The failure arrives at the wrong line, describing a conflict that
+ * was self-inflicted.
+ *
+ * The refusal therefore has to catch a RAW `store.append` and not merely a nested
+ * bracket, which is what puts it here rather than in the codec. Enforcing it one
+ * layer up would catch a nested bracket and a command runner and miss a direct
+ * store call — and a syntactic lint rule cannot close that gap either, having no
+ * call graph, so an append one function away in a helper is invisible to both.
+ * `makeContractStore` is the one seam every engine's append already passes
+ * through, so the check is written once and inherited whole, exactly as
+ * `assertServableQuery` is.
+ *
+ * The cost is real and is accepted: core learns a concept it does not need for its
+ * own job. It is affordable because core already owns the write contract, and
+ * *"an append is already owned"* is a write-side fact about that contract rather
+ * than a fact about the codec.
+ *
+ * ## Present means refused, so a sanctioned append REMOVES the marker
+ *
+ * The check reads the tag through `Effect.serviceOption`, so its ABSENCE is the
+ * normal case and costs the `append` signature nothing — `DcbEventStore.append`
+ * keeps `R = never` and no caller provides anything. Presence is what refuses.
+ *
+ * That shape decides how the two legitimate appends inside a bracket get through,
+ * and there is only one route: run with the marker STRIPPED from the context
+ * (`Effect.mapInputContext` over `Context.omit(AppendIsOwned)`). The bracket's own
+ * closing append is issued outside the scope it provided the marker in, and the
+ * codec's escape hatch strips it explicitly. Neither needs a second tag, a
+ * sanctioning flag or a mutable cell, and there is no way to be exempt by
+ * accident: an append is either lexically outside the marked region or it says in
+ * as many words that it is removing the marker.
+ */
+import { Context, Effect } from 'effect'
+
+/**
+ * Marks that an append is already owned by an enclosing bracket, and names what
+ * owns it.
+ *
+ * `by` is a human-readable owner name and exists for the defect message alone —
+ * the refusal is decided by the tag's PRESENCE, never by this value, so nothing
+ * branches on it and no caller need agree on a vocabulary for it.
+ */
+export class AppendIsOwned extends Context.Tag('@kairos-es/core/AppendIsOwned')<
+  AppendIsOwned,
+  { readonly by: string }
+>() {}
+
+/**
+ * Die if an append is already owned here; do nothing otherwise.
+ *
+ * A DEFECT and not an error-channel value, deliberately. There is no
+ * data-dependent recovery from it: the events this append would have written
+ * belong to a bracket that is going to write its own, so no caller could sensibly
+ * catch it and carry on. It is the same class of fault as a non-servable query,
+ * and it is refused in the same place and in the same way. The remedy is one
+ * identifier away in every case — the codec's `decideOnly` for a command runner,
+ * its escape hatch for a deliberate second append — which is what makes a defect
+ * affordable here.
+ *
+ * `Effect.serviceOption` is what keeps this free: it reads the tag if present and
+ * adds NOTHING to the requirement channel, so every existing append is unchanged
+ * and unprovisioned.
+ */
+export const assertAppendNotOwned: Effect.Effect<void> = Effect.flatMap(
+  Effect.serviceOption(AppendIsOwned),
+  (owner) =>
+    owner._tag === 'None'
+      ? Effect.void
+      : Effect.die(
+          new Error(
+            `makeContractStore.append: an append is already owned here (by '${owner.value.by}'), ` +
+              'so this one is refused. A bracket derives one append condition from every ' +
+              'read its body performed and issues one append under it; a second append ' +
+              'inside that body writes events the bracket is about to guard against, and ' +
+              "refuses the bracket's own close. Return the events instead of appending " +
+              "them, or say the append is deliberate with the codec's escape hatch.",
+          ),
+        ),
+)

package/src/ContractStore.ts

@@ -19,7 +19,10 @@
  *   `E = never` on the contract, so a raw fault is a defect, not a channel value;
  * - the `AppendConditionFailed`-else-die classification on append, matched by
  *   `_tag` and never by class identity — ONLY the contract conflict rides the
- *   error channel; every other fault is a defect.
+ *   error channel; every other fault is a defect;
+ * - `assertAppendNotOwned` on append — an append inside a bracket that already
+ *   owns one is a DEFECT. Read `AppendIsOwned.ts` for the rule and for why a
+ *   write-side concept core does not need for its own job is enforced here.
  *
  * The throws are deferred into the returned Effect/Stream (via `Effect.suspend`
  * / `Effect.sync`), so a validation failure surfaces as a DEFECT WHEN THE EFFECT
@@ -32,6 +35,7 @@
 import type { Array as Arr, Scope } from 'effect'
 import { Effect, Predicate, Schema, Stream } from 'effect'
 import type { AppendCondition } from './AppendCondition'
+import { assertAppendNotOwned } from './AppendIsOwned'
 import type { DcbEventStore, ReadOptions, ReadResponse } from './DcbEventStore'
 import type { DcbEvent, Position, SequencedEvent } from './Event'
 import { ReadLimit } from './Event'
@@ -82,57 +86,67 @@ export const makeContractStore = <E>(
     }),
 
   append: (events, condition) =>
-    Effect.suspend(() => {
-      // An EMPTY batch is a plain-data caller bypassing the
-      // `NonEmptyReadonlyArray` type: there is nothing to append. The engines
-      // diverge on it at an unchecked boundary — Postgres inserts zero rows and
-      // its conditional function returns zero rows, indistinguishable from a
-      // conflict, so it surfaces a PHANTOM `AppendConditionFailed`, whereas
-      // in-memory silently returns the previous head (`start - 1n`). Make it a
-      // DEFECT here, at the one choke point, so the policy is definitionally
-      // identical across engines and zero-rows stays an unambiguous conflict
-      // signal (a throw inside the suspend becomes a defect, like
-      // `assertServableQuery`).
-      if (events.length === 0) {
-        throw new Error(
-          'makeContractStore.append: the events batch is empty; append requires ' +
-            'at least one event (a NonEmptyReadonlyArray). An empty batch is a ' +
-            'plain-data caller bypassing the type — a defect, not a conflict.',
+    // The ownership refusal runs FIRST and sits OUTSIDE the suspend, because it is
+    // the only one of append's four checks that is EFFECTFUL: it consults a
+    // `Context.Tag` rather than inspecting the arguments. `Effect.flatMap` over an
+    // already-lazy effect defers it exactly as the suspend defers the throws below,
+    // so nothing runs at the call site either way; what it buys is that the
+    // "you are inside a bracket" defect arrives before any argument is judged, which
+    // is the order a reader expects when both are wrong at once. `AppendIsOwned.ts`
+    // owns why the concept is in core at all.
+    Effect.flatMap(assertAppendNotOwned, () =>
+      Effect.suspend(() => {
+        // An EMPTY batch is a plain-data caller bypassing the
+        // `NonEmptyReadonlyArray` type: there is nothing to append. The engines
+        // diverge on it at an unchecked boundary — Postgres inserts zero rows and
+        // its conditional function returns zero rows, indistinguishable from a
+        // conflict, so it surfaces a PHANTOM `AppendConditionFailed`, whereas
+        // in-memory silently returns the previous head (`start - 1n`). Make it a
+        // DEFECT here, at the one choke point, so the policy is definitionally
+        // identical across engines and zero-rows stays an unambiguous conflict
+        // signal (a throw inside the suspend becomes a defect, like
+        // `assertServableQuery`).
+        if (events.length === 0) {
+          throw new Error(
+            'makeContractStore.append: the events batch is empty; append requires ' +
+              'at least one event (a NonEmptyReadonlyArray). An empty batch is a ' +
+              'plain-data caller bypassing the type — a defect, not a conflict.',
+          )
+        }
+        // A non-servable guard query is a defect in every engine.
+        if (condition !== undefined) {
+          assertServableQuery(condition.failIfEventsMatch)
+        }
+        // Only `AppendConditionFailed` belongs on the contract error channel;
+        // every other fault (a `SqlError`, a `55P03` lock-timeout abort, …) is
+        // infrastructure and surfaces OFF the shared contract as a defect.
+        //
+        // Classified by `_tag`, NEVER by `instanceof`, and this is the site where
+        // that matters most: it is the ONE gate every backend's conflicts pass
+        // through, so a class-identity check here is a single point of silent
+        // failure for the whole write side. `@kairos-es/core` ships dual ESM/CJS,
+        // so a consumer's graph can hold two distinct `AppendConditionFailed`
+        // classes for one error — an engine wired against one copy of core and
+        // wrapped by a `makeContractStore` from another. Under `instanceof` that
+        // engine's GENUINE conflicts fail the class check and are `Effect.die`d
+        // as infrastructure, which does not merely mislabel them: it takes the
+        // conflict OFF the error channel, where `retryOnConflict` (which already
+        // matches on the tag, and correctly) can never see it to retry. The tag
+        // is the error's identity across realms; `retryOnConflict.ts` makes the
+        // argument at length and this is its other end.
+        //
+        // `Predicate.isTagged` is total over `unknown` — an object check, then
+        // `_tag` equality — so a `null`, a string or a raw `SqlError` on the
+        // engine's channel simply answers false and dies as it should. It also
+        // narrows the raw `AppendConditionFailed | E` to the contract's single
+        // error, which is what keeps `append` at `E = AppendConditionFailed`.
+        return Effect.catchAll(raw.append(events, condition), (error) =>
+          Predicate.isTagged('AppendConditionFailed')(error)
+            ? Effect.fail(error)
+            : Effect.die(error),
         )
-      }
-      // A non-servable guard query is a defect in every engine.
-      if (condition !== undefined) {
-        assertServableQuery(condition.failIfEventsMatch)
-      }
-      // Only `AppendConditionFailed` belongs on the contract error channel;
-      // every other fault (a `SqlError`, a `55P03` lock-timeout abort, …) is
-      // infrastructure and surfaces OFF the shared contract as a defect.
-      //
-      // Classified by `_tag`, NEVER by `instanceof`, and this is the site where
-      // that matters most: it is the ONE gate every backend's conflicts pass
-      // through, so a class-identity check here is a single point of silent
-      // failure for the whole write side. `@kairos-es/core` ships dual ESM/CJS,
-      // so a consumer's graph can hold two distinct `AppendConditionFailed`
-      // classes for one error — an engine wired against one copy of core and
-      // wrapped by a `makeContractStore` from another. Under `instanceof` that
-      // engine's GENUINE conflicts fail the class check and are `Effect.die`d
-      // as infrastructure, which does not merely mislabel them: it takes the
-      // conflict OFF the error channel, where `retryOnConflict` (which already
-      // matches on the tag, and correctly) can never see it to retry. The tag
-      // is the error's identity across realms; `retryOnConflict.ts` makes the
-      // argument at length and this is its other end.
-      //
-      // `Predicate.isTagged` is total over `unknown` — an object check, then
-      // `_tag` equality — so a `null`, a string or a raw `SqlError` on the
-      // engine's channel simply answers false and dies as it should. It also
-      // narrows the raw `AppendConditionFailed | E` to the contract's single
-      // error, which is what keeps `append` at `E = AppendConditionFailed`.
-      return Effect.catchAll(raw.append(events, condition), (error) =>
-        Predicate.isTagged('AppendConditionFailed')(error)
-          ? Effect.fail(error)
-          : Effect.die(error),
-      )
-    }),
+      }),
+    ),
 
   subscribe: (query, after) =>
     // `Effect.sync` runs when the stream is executed; a throw from

package/src/Projection.ts

@@ -118,6 +118,26 @@ const mergeQuery = (left: Query, right: Query): Query => {
   return { items: [...left.items, ...right.items] }
 }
 
+/**
+ * OR-merge a list of queries into one. The empty list is the wildcard.
+ *
+ * The same merge `composeProjections` folds its record through, reachable
+ * WITHOUT a record — which is what a caller accumulating queries rather than
+ * projections needs, and the codec's read ledger is one. Without it that caller
+ * either hand-rolls the merge, or fabricates a projection per query to reach this
+ * one; both were tried and the first is a TRAP. An empty `items` is the WILDCARD
+ * and is absorbing under OR, while spreading an empty list contributes nothing, so
+ * a hand-rolled union silently narrows a match-everything query to its siblings —
+ * in the unsafe direction, and with nothing to notice.
+ *
+ * Seeding the fold with the wildcard would swallow everything for the same reason,
+ * so the list is reduced with no seed and the empty case answers directly.
+ */
+export const unionQueries = (queries: ReadonlyArray<Query>): Query =>
+  queries.length === 0
+    ? WILDCARD
+    : queries.reduce((acc, q) => mergeQuery(acc, q))
+
 /**
  * Compose named projections into one whose state is a record of sub-states and
  * whose query is the OR-merge of all sub-queries. Each sub-projection only
@@ -138,15 +158,7 @@ export const composeProjections = <T extends Record<string, AnyProjection>>(
     keys.map((key) => [key, projections[key].initialState]),
   ) as CompositeState<T>
 
-  // Seeding the reduce with the wildcard would swallow everything (mergeQuery
-  // treats an empty-items query as a wildcard), so fold the sub-queries
-  // directly with no seed.
-  const mergedQuery =
-    keys.length === 0
-      ? WILDCARD
-      : keys
-          .map((key) => projections[key].query)
-          .reduce((acc, q) => mergeQuery(acc, q))
+  const mergedQuery = unionQueries(keys.map((key) => projections[key].query))
 
   return {
     initialState,