@kexhq/kex 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/kex_repl_wasm.data

@@ -171,6 +171,50 @@ make [A], implement: Monoid do
   #   groups.reduce([]) { |acc, g| acc.combine(g) }
   let combine(other: This) -> This = this + other
 end
+# Atoms: the +:name+ values. An atom is its own name — two atoms with the same
+# text are the same value, and comparing them is as cheap as comparing numbers.
+#
+#   :ok
+#   :b@localhost                  # an interior `@` is part of a bare atom
+#   :"b@host.example.com"         # the quoted form spells any text
+#
+# Most atoms are written in the source. From text:
+#
+#   "hello".as(Atom)     # at compile time, from a literal
+#   Atom.from(text)      # at run time, making the atom — a node name, say
+#   text.to(Atom)        # at run time, only an atom that already exists: Atom?
+#
+# and +string+ gives the text back.
+module Atom do
+  # Returns the atom whose name is +text+.
+  #
+  # On the BEAM atoms are never freed, and a node holds at most about a
+  # million. Build atoms from a bounded set of names — node names, config
+  # keys — never from untrusted input; +text.to(Atom)+ is the safe form for
+  # that, since it only finds atoms that already exist.
+  #
+  # @param text [String] the atom's name
+  # @return [Atom] the atom
+  #
+  # @example
+  #   Atom.from("ok") == :ok                # => true
+  #   Atom.from("app@${host}")              # => :"app@myhost"
+  from : String -> Atom
+  let from(text) = Kex.Intrinsic.Atom.from(text)
+end
+
+make Atom do
+  # Returns the atom's name as text, without the leading colon. Total, like
+  # +Char.string+: every atom has a name.
+  #
+  # @return [String] the name
+  #
+  # @example
+  #   :ok.string                    # => "ok"
+  #   :"b@host.example.com".string  # => "b@host.example.com"
+  string :> String
+  let string = Kex.Intrinsic.Atom.name(this)
+end
 # An opaque, immutable sequence of bytes. A +Binary+ never implicitly becomes
 # text.
 #
@@ -312,6 +356,31 @@ make Binary, implement: Showable, Inspectable do
   #   data.at(-1)   # => None
   let at(index: Integer) -> Byte? = Kex.Intrinsic.Binary.at(this, index)
 
+  # The byte at +index+, counting from zero. The same as +at+, matching the
+  # +get+ that +List+ and +String+ carry.
+  #
+  # @param index [Integer] the position to read
+  # @return [Byte?] the byte, or +None+ when the index is outside the binary
+  #
+  # @example
+  #   Binary.fromBytes([104, 105]).get(1)   # => Just(105)
+  #   Binary.fromBytes([104, 105]).get(9)   # => None
+  get :> Integer -> Byte?
+  let get(index) = this.at(index)
+
+  # The byte at +index+, or +default+ when the index is outside the binary.
+  # The total form of +get+: the byte comes back unwrapped.
+  #
+  # @param index [Integer] the position to read
+  # @param default [Byte] the value to use when out of range
+  # @return [Byte] the byte, or +default+
+  #
+  # @example
+  #   Binary.fromBytes([104, 105]).get(0, 0)   # => 104
+  #   Binary.fromBytes([104, 105]).get(9, 0)   # => 0
+  get :> Integer -> Byte -> Byte
+  let get(index, default) = this.at(index).or(default)
+
   # The first +count+ bytes.
   #
   # Clamped at both ends, like the list operations: a +count+ of zero or less
@@ -1108,231 +1177,338 @@ module Console do
   enabled? : Bool
   let enabled? = Kex.Intrinsic.Console.enabled?
 end
-# Bounded retries for operations whose failures can be classified by the
-# application.
-#
-# A retry is never automatically safe just because an error was temporary.
-# The caller owns the operation and, where necessary, a predicate that excludes
-# permanent failures and non-idempotent work. Policies bound attempts, delay,
-# and optionally total sleep so a dependency cannot stall the program forever.
+# Retry an operation after it returns an error.
 #
+# @example Retry a request and handle the final result
 #   using Control.Retry
+#   using Net.HTTP
 #
-#   let policy = Retry.exponential(4, 100.milliseconds, 2.seconds)
-#     .withJitter(0.2)
-#   Retry.run(policy, ~retryable?) do
-#     client.get("https://api.example.com/inventory")
+#   let result = Retry.run(attempts: 5) do
+#     HTTP.get("https://api.example.com/inventory")
+#   end
+#   match result do
+#     Ok(response) => IO.printLine(response.status.code)
+#     Error(error) => IO.printLine(error.message)
 #   end
-module Control.Retry
-
-# A bounded retry schedule. Attempts includes the initial call.
-# Delays are immutable +Duration+ values and never exceed +maximumDelay+.
-record Policy do
-  maximumAttempts : Integer
-  initialDelay : Duration
-  multiplier : Float
-  maximumDelay : Duration
-  maximumElapsed : Duration? = None
-  jitterFraction : Float = 0.0
-end
-
-# Decides whether an application error is eligible for another attempt.
-type Predicate<E> = E -> Bool
-
-# Performs one scheduled delay. Supplying this callback makes retry tests
-# deterministic without sleeping.
-type Sleeper = Duration -> Void
-
-# Builds a constant-delay retry policy.
-#
-# Fixed delays are predictable and useful for a local resource expected to
-# become ready shortly. For many clients sharing a remote dependency, prefer
-# exponential backoff with jitter to avoid synchronized retry bursts.
-#
-# @param maximumAttempts [Integer] total calls including the first
-# @param delay [Duration] delay before each subsequent call
-# @return [Policy] the retry schedule
-#
-# @example Waiting briefly for a local test server to start
-#   let policy = Retry.fixed(5, 50.milliseconds)
-fixed : Integer -> Duration -> Policy
-let fixed(maximumAttempts, delay) = Policy {
-  maximumAttempts: maximumAttempts,
-  initialDelay: delay,
-  multiplier: 1.0,
-  maximumDelay: delay,
-  maximumElapsed: None,
-  jitterFraction: 0.0
-}
-
-# Builds a doubling backoff capped at +maximumDelay+.
-#
-# The first retry waits +initialDelay+; later delays double until they reach
-# the cap. Add jitter for production network traffic.
-#
-# @param maximumAttempts [Integer] total calls including the first
-# @param initialDelay [Duration] delay after the first failure
-# @param maximumDelay [Duration] upper bound for each delay
-# @return [Policy] the retry schedule
-#
-# @example Backing off calls to a busy upstream service
-#   Retry.exponential(5, 200.milliseconds, 5.seconds).withJitter(0.25)
-exponential : Integer -> Duration -> Duration -> Policy
-let exponential(maximumAttempts, initialDelay, maximumDelay) = Policy {
-  maximumAttempts: maximumAttempts,
-  initialDelay: initialDelay,
-  multiplier: 2.0,
-  maximumDelay: maximumDelay,
-  maximumElapsed: None,
-  jitterFraction: 0.0
-}
-
-make Policy do
-  # Returns the same schedule with a bound on total scheduled sleep time.
-  #
-  # The operation's own execution time is not counted; use operation-specific
-  # deadlines for that. A retry whose next delay would exceed this bound is
-  # not started.
-  #
-  # @param maximumElapsed [Duration] maximum cumulative scheduled delay
-  # @return [Policy] a copied policy with the elapsed bound
-  # @example +Retry.fixed(5, 1.seconds).withMaximumElapsed(2.seconds)+.
-  let withMaximumElapsed(maximumElapsed: Duration) -> Policy = Policy {
-    maximumAttempts: @maximumAttempts,
-    initialDelay: @initialDelay,
-    multiplier: @multiplier,
-    maximumDelay: @maximumDelay,
-    maximumElapsed: Just(maximumElapsed),
-    jitterFraction: @jitterFraction
-  }
-
-  # Returns the same schedule with symmetric bounded jitter. A fraction of
-  # +0.25+ selects each actual delay from 75% through 125% of its scheduled
-  # value. Fractions are clamped to +0.0..1.0+.
-  #
-  # Jitter prevents many workers that failed together from retrying together.
-  # It changes delay timing, never the number of attempts or the backoff cap.
-  #
-  # @param fraction [Float] maximum proportional variation on either side
-  # @return [Policy] a copied policy with bounded jitter
-  #
-  # @example Spreading retries by up to 20 percent
-  #   Retry.exponential(4, 1.seconds, 10.seconds).withJitter(0.2)
-  let withJitter(fraction: Float) -> Policy = Policy {
-    maximumAttempts: @maximumAttempts,
-    initialDelay: @initialDelay,
-    multiplier: @multiplier,
-    maximumDelay: @maximumDelay,
-    maximumElapsed: @maximumElapsed,
-    jitterFraction: if fraction < 0.0 then 0.0 else if fraction > 1.0 then 1.0 else fraction end end
-  }
-end
-
-# Runs +operation+ until it succeeds or exhausts the policy.
 #
-# The last application error is returned unchanged. This helper performs no
-# network-specific classification: callers decide what operation to wrap.
+# @example Fixed delays: three waits of 250 milliseconds
+#   let schedule = Retry.Schedule {
+#     attempts: 4, delay: 250.milliseconds, backoff: 1.0,
+#     maximumDelay: 250.milliseconds, jitter: 0.0
+#   }
+#   Retry.run(schedule: schedule) do
+#     Error("not ready")
+#   end
+#   # => Error("not ready"), after four calls and 750 ms of sleep
+#
+# @example Exponential delays: 200, 400, 800, 1600 milliseconds
+#   let schedule = Retry.Schedule {
+#     attempts: 5, delay: 200.milliseconds, backoff: 2.0,
+#     maximumDelay: 5.seconds, jitter: 0.0
+#   }
+#   Retry.run(schedule: schedule) do
+#     Error("busy")
+#   end
+#   # => Error("busy"), after five calls and three seconds of sleep
 #
-# @param policy [Policy] the bounded schedule
-# @param operation [Block<Result<X,E>>] a fresh attempt
-# @return [Result<X,E>] the first success or final failure
+# @example Capped delays: 500 ms, 1 s, 2 s, 2 s, 2 s
+#   Retry.Schedule {
+#     attempts: 6, delay: 500.milliseconds, backoff: 2.0,
+#     maximumDelay: 2.seconds, jitter: 0.0
+#   }
 #
-# @example Retrying an idempotent health check
-#   Retry.run(Retry.fixed(3, 250.milliseconds)) do
-#     HTTP.get("https://service.example.com/health")
+# @example Use one schedule for two requests
+#   using Net.HTTP
+#   let schedule = Retry.Schedule { attempts: 5 }
+#   let inventory = Retry.run(schedule: schedule) do
+#     HTTP.get("https://api.example.com/inventory")
 #   end
-run : Policy -> Block<Result<X, E>> -> Result<X, E>
-foul run(policy, operation) = runWithRandom(policy, { |error| true }, { |delay| Task.sleep(delay) }, { Kex.Intrinsic.Retry.randomUnit() }, operation)
-
-# Runs with an application-specific error predicate.
+#   let orders = Retry.run(schedule: schedule) do
+#     HTTP.get("https://api.example.com/orders")
+#   end
+#   # Each request gets up to five attempts, independently.
 #
-# A false predicate returns that error immediately. The predicate is evaluated
-# only when another attempt would otherwise be possible.
+# @example Set retry options directly
+#   Retry.run(attempts: 5, delay: 200.milliseconds, jitter: 0.0) do
+#     Ok("ready")
+#   end
+#   # => Ok("ready")
+#
+# @example Limit the time spent sleeping
+#   Retry.run(
+#     attempts: 5, delay: 1.seconds, backoff: 2.0,
+#     jitter: 0.0, maximumTotalDelay: Just(2.seconds)
+#   ) do
+#     Error("busy")
+#   end
+#   # => Error("busy"), two calls and one second of sleep
+#
+# @example Test jitter without waiting
+#   Retry.run(
+#     attempts: 2, delay: 4.seconds, jitter: 0.25,
+#     sleeper: { |wait| Assert.equal(wait, 3.seconds) },
+#     random: { 0.0 }
+#   ) do
+#     Error("temporary")
+#   end
+#   # => Error("temporary"), two calls and one fake sleep
 #
-# @param policy [Policy] the bounded schedule
-# @param predicate [Predicate<E>] whether an error may be retried
-# @param operation [Block<Result<X,E>>] a fresh attempt
-# @return [Result<X,E>] the first success or final/non-retryable failure
+# @example Report progress
+#   using Net.HTTP
+#   Retry.run(attempts: 5, onRetry: { |info|
+#     let progress = "retrying ${info.nextAttempt}/${info.maximumAttempts}"
+#     IO.printLine("${progress} in ${info.delay.seconds} seconds")
+#   }) do
+#     HTTP.get("https://api.example.com/inventory")
+#   end
 #
-# @example Retrying timeouts but returning parse failures immediately
-#   Retry.run(policy, { |error| error.kind == Timeout }) do
-#     client.get(url)
+# @example Retry temporary HTTP failures and selected statuses
+#   using Net
+#   using Net.HTTP
+#   let schedule = Retry.Schedule { attempts: 5 }
+#   let outcome = Retry.run(schedule: schedule) do
+#     let result = HTTP.get("https://api.example.com/inventory")
+#     match result do
+#       Error(error) => if error.kind == Timeout || error.kind == Connect
+#         Retry.again(result)
+#       else
+#         Retry.done(result)
+#       end
+#       Ok(response) => if [429, 502, 503, 504].contains?(response.status.code)
+#         Retry.again(result)
+#       else
+#         Retry.done(result)
+#       end
+#     end
 #   end
-run : Policy -> Predicate<E> -> Block<Result<X, E>> -> Result<X, E>
-foul run(policy, predicate, operation) = runWithRandom(policy, predicate, { |delay| Task.sleep(delay) }, { Kex.Intrinsic.Retry.randomUnit() }, operation)
-
-# Runs with injected error classification and sleeping.
-#
-# This is the deterministic testing seam: a fake sleeper can record durations
-# or advance a virtual clock. Production callers normally use +Retry.run+.
-#
-# @param policy [Policy] the bounded schedule
-# @param predicate [Predicate<E>] whether an error may be retried
-# @param sleeper [Sleeper] performs or records each scheduled delay
-# @param operation [Block<Result<X,E>>] a fresh attempt
-# @return [Result<X,E>] the first success or final failure
-runWith : Policy -> Predicate<E> -> Sleeper -> Block<Result<X, E>> -> Result<X, E>
-foul runWith(policy, predicate, sleeper, operation) = runWithRandom(policy, predicate, sleeper, { 0.5 }, operation)
-
-# Runs with injected sleeping and a random source returning a value in
-# +0.0..1.0+. Out-of-range test values are clamped. Production +run+ uses a
-# cryptographically secure backend source; this overload makes jitter specs
-# deterministic.
-runWithRandom : Policy -> Predicate<E> -> Sleeper -> Block<Float> -> Block<Result<X, E>> -> Result<X, E>
-foul runWithRandom(policy, predicate, sleeper, random, operation) = attempt(policy, predicate, sleeper, random, operation, 1, policy.initialDelay, Duration.seconds(0))
-
-foul attempt(policy: Policy, predicate: Predicate<E>, sleeper: Sleeper, random: Block<Float>, operation: Block<Result<X, E>>, number: Integer, delay: Duration, elapsed: Duration) -> Result<X, E> do
-  let result = operation()
-  return match result do
-    Ok(value) => Ok(value)
-    Error(error) => do
-      if number >= policy.maximumAttempts || !predicate(error)
-        return Error(error)
-      end
-      let sample = random()
-      let boundedSample = if sample < 0.0 then 0.0 else if sample > 1.0 then 1.0 else sample end end
-      let jittered = Duration { seconds: delay.seconds * (1.0 + ((boundedSample * 2.0 - 1.0) * policy.jitterFraction)) }
-      let nextElapsed = Duration { seconds: elapsed.seconds + jittered.seconds }
-      let withinElapsed = match policy.maximumElapsed do
-        None => true
-        Just(maximum) => nextElapsed.seconds <= maximum.seconds
-      end
-      if !withinElapsed
-        return Error(error)
-      end
-      sleeper(jittered)
-      let nextSeconds = delay.seconds * policy.multiplier
-      let bounded = if nextSeconds > policy.maximumDelay.seconds then policy.maximumDelay else Duration { seconds: nextSeconds } end
-      return attempt(policy, predicate, sleeper, random, operation, number + 1, bounded, nextElapsed)
-    end
-  end
-end
+#   match outcome do
+#     Done(result) => IO.printLine(result)
+#     Again(last) => IO.printLine("retry budget exhausted: ${last}")
+#   end
+module Control.Retry
 
-# The imported public namespace: `using Control.Retry` then `Retry.run(...)`.
+# +run+ calls the block immediately. +Ok+ stops; +Error+ waits and retries.
+# When the schedule runs out, it returns the last error unchanged.
+# Use +again+ and +done+ when your application needs to choose what to retry.
+#
+# HTTP 429 and 503 responses are +Ok(response)+, so retrying those statuses
+# requires an explicit decision. For writes, make sure repeating the request
+# is safe, for example by using an idempotency key. Set request timeouts
+# separately: the schedule limits sleep, not time spent inside the operation.
 module Retry do
-  # Public imported alias of +Control.Retry.fixed+.
-  fixed : Integer -> Duration -> Policy
-  let fixed(maximumAttempts, delay) = Control.Retry.fixed(maximumAttempts, delay)
+  # Timing and attempt limits for +run+.
+  #
+  # Defaults: three attempts, starting with a 100 ms wait, doubling up to
+  # 5 seconds, with 20% jitter. All fields are optional.
+  # A schedule holds settings. Reusing it starts each run from attempt one.
+  #
+  # * +attempts+: maximum executions, including the first; default 3.
+  # * +delay+: initial base wait; default 100 milliseconds.
+  # * +backoff+: base-delay multiplier; default 2.0, or 1.0 for fixed waits.
+  # * +maximumDelay+: cap on each actual wait, including jitter; default 5 seconds.
+  # * +jitter+: symmetric proportional variation; default 0.2, or 0.0 to disable.
+  # * +maximumTotalDelay+: cumulative sleep allowance; default +None+.
+  #   Operation execution time is excluded. A wait that exceeds the remaining
+  #   allowance ends the run without sleeping or calling the operation again.
+  #
+  record Schedule do
+    # Maximum executions including the initial call. Default: 3.
+    # Values below 1 are treated as 1: the initial call always happens.
+    attempts : Integer = 3
+    # Base wait before the second attempt. Default: 100 milliseconds.
+    # Negative durations are treated as zero; the delay cap applies here too.
+    delay : Duration = Duration.milliseconds(100)
+    # Base-delay multiplier. Default: 2.0. Values below 1 become 1.
+    # Set to 1.0 for fixed delays. Jitter never changes the next base delay.
+    backoff : Float = 2.0
+    # Maximum actual wait, including jitter. Default: 5 seconds.
+    # Negative durations become zero. Hitting this cap does not stop retries.
+    maximumDelay : Duration = Duration.seconds(5)
+    # Symmetric proportional variation. Default: 0.2; clamped to 0..1.
+    # For a 200 ms base, 0.2 samples 160..240 ms, then applies the cap.
+    # Set to 0.0 for exact waits. Samples are independent between runs.
+    jitter : Float = 0.2
+    # Optional bound on cumulative actual sleep. Default: None.
+    # A wait exceeding the remaining allowance stops retries before sleeping.
+    # Negative bounds become zero. Operation execution time is not counted.
+    maximumTotalDelay : Duration? = None
+  end
 
-  # Public imported alias of +Control.Retry.exponential+.
-  exponential : Integer -> Duration -> Duration -> Policy
-  let exponential(maximumAttempts, initialDelay, maximumDelay) = Control.Retry.exponential(maximumAttempts, initialDelay, maximumDelay)
+  # Whether to retry, together with the last result.
+  # +Done(value)+ means the block stopped deliberately. +Again(value)+
+  # returned by +run+ means the schedule was exhausted before completion.
+  # The value inside can be any application result, including an +Error+.
+  type Decision<X> = Again(X) | Done(X)
+
+  # Retry this operation if the schedule has room for another attempt.
+  #
+  # @param value [X] the last outcome, retained if the schedule is exhausted
+  # @return [Decision<X>] +Again(value)+
+  again : X -> Decision<X>
+  let again(value) = Again(value)
+
+  # Stop now. The supplied value may be a success or a permanent failure.
+  #
+  # @param value [X] the final application outcome
+  # @return [Decision<X>] +Done(value)+
+  done : X -> Decision<X>
+  let done(value) = Done(value)
+
+  # Progress passed to +onRetry+ before the next wait.
+  #
+  # The callback runs only when another attempt is allowed. It does not run
+  # for the first call, a successful result, +done+, or exhaustion.
+  # Durations count scheduled sleep; they exclude time spent in the operation.
+  #
+  # * +attempt+: the just-completed attempt, starting at 1.
+  # * +nextAttempt+: the attempt that follows the upcoming wait.
+  # * +maximumAttempts+: total permitted executions, including the first.
+  # * +remainingAttempts+: executions remaining, including the upcoming one.
+  # * +delay+: actual upcoming wait, after jitter and the delay cap.
+  # * +totalDelay+: sleep already performed, excluding the upcoming wait.
+  # * +result+: the last +Error+ or +Again+, including its application payload.
+  record Info<X> do
+    # The attempt that just finished, starting at 1.
+    attempt : Integer
+    # The attempt that will run after the upcoming delay.
+    nextAttempt : Integer
+    # Total allowed executions, normalized to at least 1.
+    maximumAttempts : Integer
+    # Executions still allowed, including the upcoming attempt.
+    remainingAttempts : Integer
+    # The actual upcoming wait, after jitter and the delay cap.
+    delay : Duration
+    # Sleep already performed in this run, excluding the upcoming wait.
+    totalDelay : Duration
+    # The last Error or Again value, including the application's payload.
+    result : X
+  end
 
-  # Public imported alias of +Control.Retry.run+.
-  run : Policy -> Block<Result<X, E>> -> Result<X, E>
-  foul run(policy, operation) = Control.Retry.run(policy, operation)
+  # Call the block until it succeeds, returns +done+, or runs out of attempts or sleep time.
+  #
+  # The first attempt is immediate. Every later attempt follows one sleep.
+  # There is no sleep after success or the final error. Named timing options
+  # override the corresponding schedule field for this execution only.
+  #
+  # Return a +Result+ from the block for automatic retries: +Ok+ stops and
+  # +Error+ retries. If no more retries are allowed, +run+ returns the last error.
+  #
+  # Return +done(value)+ or +again(value)+ to make the decision yourself.
+  # The final +Done+ means the block chose to stop; +Again+ means it wanted
+  # another try but the schedule ran out. Use one return form throughout the
+  # block. Runtime faults propagate; they are not retried.
+  #
+  # Out-of-range settings are adjusted: attempts below one become one, negative
+  # durations become zero, backoff below one becomes one, jitter and random
+  # samples are clamped to 0..1. Non-finite Float settings are unsupported.
+  #
+  # @param operation [Block<X>] called again for each attempt; returns Result or Decision
+  # @param schedule [Schedule] reusable settings; defaults to +Schedule {}+
+  # @param attempts [Integer] total attempts; defaults to the schedule field
+  # @param delay [Duration] initial wait; defaults to the schedule field
+  # @param backoff [Float] delay multiplier; defaults to the schedule field
+  # @param maximumDelay [Duration] sleep cap; defaults to the schedule field
+  # @param jitter [Float] variation fraction; defaults to the schedule field
+  # @param maximumTotalDelay [Duration?] sleep budget; defaults to the field
+  # @param sleeper [Duration -> Void] defaults to real +Task.sleep+
+  # @param random [Block<Float>] defaults to secure backend sampling in 0..1
+  # @param onRetry [Info<X> -> Void] reports an allowed retry; defaults to no action
+  # @return [X] first Ok/Done, or last Error/Again when retries run out
+  #
+  # +Done(Error(...))+ means the application stopped on a permanent error.
+  # +Again(Ok(response))+ means an unacceptable HTTP status persisted until
+  # exhaustion. HTTP status classification and Retry-After handling are the
+  # application's responsibility; +run+ has no HTTP-specific behavior.
+  #
+  # The testing hooks are independent: replacing sleep keeps normal random
+  # sampling, and replacing randomness keeps real sleep. A random sample of
+  # 0 selects the lower jitter bound, 0.5 the base, and 1 the upper bound.
+  # With zero jitter no random sample is needed.
+  # lint:allow parameter-count — named options make each setting independent
+  run : Block<X> -> Schedule -> Integer -> Duration -> Float -> Duration -> Float -> Duration? -> (Duration -> Void) -> Block<Float> -> (Info<X> -> Void) -> X
+  foul run(
+    operation,
+    schedule = Schedule {},
+    attempts = schedule.attempts,
+    delay = schedule.delay,
+    backoff = schedule.backoff,
+    maximumDelay = schedule.maximumDelay,
+    jitter = schedule.jitter,
+    maximumTotalDelay = schedule.maximumTotalDelay,
+    sleeper = { |wait| Task.sleep(wait) },
+    random = { Kex.Intrinsic.Retry.randomUnit() },
+    onRetry = { |_info| () }
+  ) do
+    let settings = Schedule {
+      attempts: attempts,
+      delay: delay,
+      backoff: backoff,
+      maximumDelay: maximumDelay,
+      jitter: jitter,
+      maximumTotalDelay: maximumTotalDelay
+    }
+    attempt(settings, sleeper, random, onRetry, operation, 1, boundedDelay(settings, delay.seconds), 0.0)
+  end
 
-  # Retries only errors accepted by +predicate+.
-  run : Policy -> Predicate<E> -> Block<Result<X, E>> -> Result<X, E>
-  foul run(policy, predicate, operation) = Control.Retry.run(policy, predicate, operation)
+  private do
+    retry? : Result<X, E> -> Bool
+    let retry?(Ok(_)) = false
+    let retry?(Error(_)) = true
+    retry? : Decision<X> -> Bool
+    let retry?(Done(_)) = false
+    let retry?(Again(_)) = true
+
+    let clamp(value: Float, low: Float, high: Float) -> Float do
+      if value < low
+        low
+      elif value > high
+        high
+      else
+        value
+      end
+    end
 
-  # Deterministic seam with an injected sleeper, primarily for specifications.
-  runWith : Policy -> Predicate<E> -> Sleeper -> Block<Result<X, E>> -> Result<X, E>
-  foul runWith(policy, predicate, sleeper, operation) = Control.Retry.runWith(policy, predicate, sleeper, operation)
+    let boundedDelay(schedule: Schedule, waitSeconds: Float) -> Float do
+      let cap = if schedule.maximumDelay.seconds < 0.0
+        0.0
+      else
+        schedule.maximumDelay.seconds
+      end
+      clamp(waitSeconds, 0.0, cap)
+    end
 
-  # Deterministic seam with injected sleeping and random sampling.
-  runWithRandom : Policy -> Predicate<E> -> Sleeper -> Block<Float> -> Block<Result<X, E>> -> Result<X, E>
-  foul runWithRandom(policy, predicate, sleeper, random, operation) = Control.Retry.runWithRandom(policy, predicate, sleeper, random, operation)
+    attempt : Schedule -> (Duration -> Void) -> Block<Float> -> (Info<X> -> Void) -> Block<X> -> Integer -> Float -> Float -> X
+    foul attempt(schedule, sleeper, random, onRetry, operation, number, base, elapsed) do
+      let result = operation()
+      if number >= schedule.attempts || !retry?(result)
+        return result
+      end
+      let fraction = clamp(schedule.jitter, 0.0, 1.0)
+      let sample = fraction == 0.0 then 0.5 else clamp(random(), 0.0, 1.0)
+      let sleepSeconds = boundedDelay(schedule, base * (1.0 + (sample * 2.0 - 1.0) * fraction))
+      let nextElapsed = elapsed + sleepSeconds
+      let allowed = match schedule.maximumTotalDelay do
+        None => true
+        Just(limit) => nextElapsed <= (limit.seconds < 0.0 then 0.0 else limit.seconds)
+      end
+      if !allowed
+        return result
+      end
+      onRetry(Info {
+        attempt: number,
+        nextAttempt: number + 1,
+        maximumAttempts: schedule.attempts,
+        remainingAttempts: schedule.attempts - number,
+        delay: Duration { seconds: sleepSeconds },
+        totalDelay: Duration { seconds: elapsed },
+        result: result
+      })
+      sleeper(Duration { seconds: sleepSeconds })
+      let factor = schedule.backoff < 1.0 then 1.0 else schedule.backoff
+      let nextBase = boundedDelay(schedule, base * factor)
+      attempt(schedule, sleeper, random, onRetry, operation, number + 1, nextBase, nextElapsed)
+    end
+  end
 end
 # A first-in-first-out queue.
 #
@@ -2481,6 +2657,89 @@ module Digest do
   fileSha256 : String -> String?
   let fileSha256(path) = Kex.Intrinsic.Digest.fileSha256(path)
 end
+# Dimension algebra, implemented with ordinary Kex maps and integers.
+#
+# A base dimension is identified by the type of a marker value. Reuse that
+# marker type to share a dimension across modules. Its display name and the
+# marker's field values do not participate in dimensional arithmetic.
+#
+# Multiplication adds exponents, division subtracts them, and integer powers
+# multiply them. Zero exponents are removed so cancellation is structural.
+module Dimensions
+
+# A normalized map from base identities to integer exponents.
+#
+# Construct dimensions with +Dimensions.base+ and compose them with arithmetic.
+# If importing a map, use +Dimensions.fromPowers+ to remove zero exponents.
+# This runtime representation does not itself provide static measure typing.
+record Dimension do
+  powers : {Type: Integer}
+end
+
+# The dimension with no remaining base factors.
+#
+# @return [Dimension] the multiplicative identity
+let one -> Dimension = Dimension { powers: {} }
+
+# Defines a base dimension using the nominal type of a marker value.
+#
+# @param marker [A] a value of a dedicated marker type
+# @return [Dimension] that base dimension, raised to the first power
+let base(marker: A) -> Dimension = Dimension {
+  powers: {}.put(Type.of(marker), 1)
+}
+
+# Normalizes a map of base identities and powers.
+#
+# @param powers [Map<Type, Integer>] the dimension's exponents
+# @return [Dimension] the same dimension with zero exponents removed
+let fromPowers(powers: {Type: Integer}) -> Dimension = Dimension {
+  powers: powers.filter { |_, exponent| exponent != 0 }
+}
+
+make Dimension do
+  # Whether every base factor has cancelled.
+  #
+  # @return [Bool] true for a dimensionless quantity
+  dimensionless? :> Bool
+  let dimensionless? = @powers.values.all? { |exponent| exponent == 0 }
+
+  # The exponent of the supplied marker's dimension, or zero if absent.
+  #
+  # @param marker [A] a value of the base marker type
+  # @return [Integer] the base's exponent
+  exponentOf :> A -> Integer
+  let exponentOf(marker) = @powers.get(Type.of(marker), 0)
+
+  # Composes dimensions by adding their base exponents.
+  #
+  # @param other [Dimension] the other factor
+  # @return [Dimension] the normalized product
+  * :> Dimension -> Dimension
+  let *(other) do
+    let powers = other.powers.entries.reduce(@powers) do |result, entry|
+      let (base, exponent) = entry
+      result.put(base, result.get(base, 0) + exponent)
+    end
+    Dimensions.fromPowers(powers)
+  end
+
+  # Composes dimensions by subtracting the denominator's exponents.
+  #
+  # @param other [Dimension] the denominator's dimension
+  # @return [Dimension] the normalized quotient
+  / :> Dimension -> Dimension
+  let /(other) = this * (other ^ -1)
+
+  # Raises a dimension to an integer power, including zero and negatives.
+  #
+  # @param exponent [Integer] the power
+  # @return [Dimension] the normalized powered dimension
+  ^ :> Integer -> Dimension
+  let ^(exponent) = Dimensions.fromPowers(
+    @powers.mapValues { |power| power * exponent }
+  )
+end
 # Traversal operations that every foldable collection gets for free.
 #
 # A type becomes +Foldable+ by implementing one method, +reduce+; the rest:
@@ -3413,7 +3672,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # condition. The same operation as +readLine+, under the name +IO.getLine+
   # uses.
   #
-  # @return [String?] the next line, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next line, or +None+ at end of file
   #
   # @example Walking a file line by line
   #   foul echo(handle: FileHandle<CanRead, W>) -> Void do
@@ -3432,7 +3691,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   #
   # Answers +None+ at end of file.
   #
-  # @return [String?] the next character, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next character, or +None+ at end of file
   #
   # @example
   #   let firstChar = handle.get.or("")
@@ -3442,7 +3701,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Reads the next line from the handle, without its newline. The same as
   # +getLine+, named for reading from a file rather than from a console.
   #
-  # @return [String?] the next line, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next line, or +None+ at end of file
   #
   # @example
   #   let header = handle.readLine.or("")
@@ -3457,7 +3716,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Reads from the current position, so calling it after a +readLine+ gives
   # the rest of the file rather than the whole of it.
   #
-  # @return [String?] the remaining contents, or +None+
+  # @return [Result<String, ReadError>] the remaining contents
   #
   # @example
   #   let body = handle.read.or("")
@@ -3473,7 +3732,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Unlike +read+, this accepts arbitrary binary data and cannot fail because
   # the input is not valid UTF-8. It starts at the handle's current position.
   #
-  # @return [Binary] the remaining bytes
+  # @return [Result<Binary, ReadError>] the remaining bytes
   #
   # @example Reading a file with an unknown encoding
   #   let payload = handle.readBytes.try
@@ -3687,6 +3946,24 @@ module FS do
     | ReadFailed(FilePath)
     | InvalidUtf8(FilePath, Integer)
 
+  # What a path names, as +FS.File.info+ reports it: a regular +:file+, a
+  # +:directory+, a +:symlink+ (the link itself, never what it points at), or
+  # +:other+ for devices, sockets and pipes.
+  type FileKind = :file | :directory | :symlink | :other
+
+  # What one +stat+ of a path says about it.
+  record FileInfo do
+    # Which kind of entry the path names.
+    kind : FileKind
+
+    # The size in bytes. For a symlink, the length of the path it holds.
+    size : Integer
+
+    # When the contents last changed, at UTC, to the whole second: the
+    # precision the BEAM reports.
+    modified : DateTime
+  end
+
   # Reading and writing files.
   #
   # A capability: every member reaches the real filesystem, so a test can
@@ -3709,7 +3986,7 @@ module FS do
     #
     # @param path [FilePath] the file to open
     # @param mode [FileModes] +Read+, +Write+, +Append+ or +ReadWrite+
-    # @return [Result<FileHandle, FileError>] the handle, or +OpenFailed+
+    # @return [Result<FileHandle<CanRead, CannotWrite>, FileError>] the handle, or +OpenFailed+
     #
     # @example Reading a file line by line
     #   match FS.File.open("log.txt", Read) do
@@ -4073,6 +4350,59 @@ module FS do
     # because it is not lexical: it asks the process where it is.
     absolute : FilePath -> String?
     foul absolute(path) = Kex.Intrinsic.File.absolute(path)
+
+    # The canonical form of +path+: absolute, with every +.+, +..+ and
+    # symlink resolved, like +realpath(3)+.
+    #
+    # Unlike +absolute+ this reads the filesystem, so a path that does not
+    # exist (or a symlink loop) is an error. Use it to keep reads and writes
+    # inside a directory: compare the real path's prefix, and neither +../+
+    # nor a symlink can escape.
+    #
+    # @param path [FilePath] the path to resolve
+    # @return [Result<String, FileError>] the canonical path, or +ReadFailed+
+    #
+    # @example
+    #   FS.File.canonical("/tmp/../etc")   # => Ok("/private/etc") on macOS
+    canonical : FilePath -> Result<String, FileError>
+    foul canonical(path) = Kex.Intrinsic.File.canonical(path)
+
+    # Whether +path+ is itself a symlink, without following it. A dangling
+    # link is still a symlink.
+    #
+    # @param path [FilePath] the path to inspect
+    # @return [Bool] +true+ for a symlink
+    #
+    # @example
+    #   FS.File.symlink?("current")   # => true
+    symlink? : FilePath -> Bool
+    foul symlink?(path) = Kex.Intrinsic.File.symlink?(path)
+
+    # The kind, size and modification time of +path+, read in one +lstat+.
+    #
+    # One call answers what +file?+, +directory?+, +symlink?+ and +size+
+    # would otherwise ask separately, which is what walking a tree or
+    # fingerprinting it for changes wants. A symlink is described as itself,
+    # not followed.
+    #
+    # @param path [FilePath] the path to inspect
+    # @return [Result<FileInfo, FileError>] what the path names, or
+    #   +ReadFailed+ when it cannot be read
+    #
+    # @example
+    #   FS.File.info("hello.txt").try.size   # => 6
+    #   FS.File.info("src").try.kind         # => :directory
+    #   FS.File.info("nowhere")              # => Error(ReadFailed("nowhere"))
+    #
+    # @example Noticing that a file changed
+    #   let before = FS.File.info(path).try
+    #   ...
+    #   let changed = FS.File.info(path).try != before
+    info : FilePath -> Result<FileInfo, FileError>
+    foul info(path) = match Kex.Intrinsic.File.info(path) do
+      Just((kind, size, modified)) => Ok(FileInfo { kind: kind, size: size, modified: DateTime.fromEpochSeconds(modified) })
+      None => Error(ReadFailed(path))
+    end
   end
 
   # Path arithmetic: joining, splitting, normalising and comparing paths.
@@ -4919,6 +5249,14 @@ private do
     end
 
     let allowComments = Kex.Intrinsic.Map.getWithDefault(options, allowCommentsKey(), false)
+    # On BEAM, OTP's own decoder builds the same value in a fraction of the
+    # time (kexhq/kex#333), JSONC included once its comments are blanked out
+    # (kexhq/kex#405). It answers None for anything it will not vouch for —
+    # invalid input, the tree-walker — and this parser runs.
+    let fast = allowComments then Kex.Intrinsic.Json.decodeCommented(text) else Kex.Intrinsic.Json.decode(text)
+    if let Just(value) = fast
+      return Ok(value)
+    end
     let cursor = skipIgnored(Input { input: text }, allowComments).try
     let (value, afterValue) = parseValue(cursor, allowComments).try
     let rest = skipIgnored(afterValue, allowComments).try
@@ -4953,25 +5291,40 @@ end
 #   JSON.parse(JSON.stringify({ a: 1 }))   # => Ok({ a: 1 })
 stringify : Any -> String
 let stringify(value: Any) -> String do
-  match Kex.Intrinsic.Kex.kind(value) do
-    :none => return "null"
-    :bool => return value then "true" else "false"
-    :integer => return "${value}"
-    :float => return "${value}"
-    :string => return encodeString(value)
-    :list => return "[${value.map(~stringify).join(",")}]"
-    :map => do
-      let fields = Kex.Intrinsic.Map.entries(value).map do |entry|
-        let (key, item) = entry
-        "${encodeString(objectKey(key))}:${stringify(item)}"
-      end
-      return "{${fields.join(",")}}"
-    end
-    _ => return "null"
+  # The BEAM encoder follows `stringifyValue` rule for rule (kexhq/kex#333);
+  # the tree-walker has none and answers None.
+  if let Just(text) = Kex.Intrinsic.Json.encode(value)
+    return text
   end
+  return stringifyValue(value)
 end
 
 private do
+  let stringifyValue(value: Any) -> String do
+    # An optional is JSON's nullable: `Just(x)` is `x`, as `None` is `null`.
+    # Without this a caller had to unwrap first, and the only spelling that
+    # type-checked was the meaningless `.or(None)`.
+    if let Just(inner) = value
+      return stringifyValue(inner)
+    end
+    match Kex.Intrinsic.Kex.kind(value) do
+      :none => return "null"
+      :bool => return value then "true" else "false"
+      :integer => return "${value}"
+      :float => return "${value}"
+      :string => return encodeString(value)
+      :list => return "[${value.map(~stringifyValue).join(",")}]"
+      :map => do
+        let fields = Kex.Intrinsic.Map.entries(value).map do |entry|
+          let (key, item) = entry
+          "${encodeString(objectKey(key))}:${stringifyValue(item)}"
+        end
+        return "{${fields.join(",")}}"
+      end
+      _ => return "null"
+    end
+  end
+
   # A JSON object key is a string, but a Kex map literal is written with ATOM
   # keys (`{ n: 1 }`): the shape most values being stringified actually have.
   # Rendering one gives `:n`, so drop the leading colon; anything else goes
@@ -5386,20 +5739,58 @@ end
 # The running toolchain, which backend, which version, which features.
 #
 #   Kex.BACKEND                  # => Interpreter
-#   Kex.Kernel.VERSION.release   # => "0.4.0"
-#   Kex.Feature.has?(Kex.FS)     # => true
+#   Kex.BACKEND.compiled?        # => false
+#   Kex.VERSION.release          # => "0.4.0"
+#   Kex.Feature.has?(Kex.FileSystem)   # => true
 module Kex do
   # Which backend is executing the program: the tree-walking +Interpreter+, or
   # the +Beam+ virtual machine.
   type Backend = Interpreter | Beam
 
+  make Backend do
+    # Whether this is the tree-walking interpreter.
+    #
+    # @return [Bool] +true+ for +Interpreter+
+    #
+    # @example
+    #   Kex.BACKEND.interpreted?   # => true under `kex -R file.kex`
+    interpreted? :> Bool
+    let interpreted? = this == Interpreter
+
+    # Whether this backend runs compiled code: today, the BEAM.
+    #
+    # @return [Bool] +true+ for every backend but the interpreter
+    #
+    # @example
+    #   Kex.BACKEND.compiled?   # => true under `kex file.kex`
+    compiled? :> Bool
+    let compiled? = this != Interpreter
+
+    # Whether this is the BEAM virtual machine. Processes, the web server
+    # and clustering need it.
+    #
+    # @return [Bool] +true+ for +Beam+
+    #
+    # @example
+    #   Kex.BACKEND.beam?   # => true under `kex file.kex`
+    beam? :> Bool
+    let beam? = this == Beam
+  end
+
   # An optional capability a build may or may not include. Ask about one with
   # +Kex.Feature.has?+ before relying on it.
-  type Feature = FS | Process
+  #
+  # +FileSystem+: the program can read and write the host's files (+FS+).
+  # +ExternalPrograms+: it can run other programs (+Process.run+,
+  # +Process.stream+), which the browser build cannot.
+  #
+  # Kex's own processes (+spawn+, +receive+) are not optional: every backend
+  # has them. Networking has its finer-grained report, +Net.Support.current+.
+  type Feature = FileSystem | ExternalPrograms
 
   # Which backend is executing this program.
   #
-  # +interpreted?+ and +underBeam?+ below are the readable way to ask.
+  # Its +interpreted?+, +compiled?+ and +beam?+ are the readable way to ask.
   #
   # @return [Backend] the running backend
   #
@@ -5408,131 +5799,194 @@ module Kex do
   BACKEND : Backend
   let BACKEND = Kex.Intrinsic.Kex.backend()
 
-  # Returns +true+ when running on the tree-walking interpreter.
+  # Build identity for the compiler and runtime executing this program:
+  # +Version+ and +VERSION+ below.
   #
-  # @return [Bool] +true+ under the interpreter
-  #
-  # @example
-  #   Kex.interpreted?   # => true under `kex file.kex`
-  let interpreted? = Kex.BACKEND == Kex.Interpreter
-
-  # Returns +true+ when running on the BEAM.
-  #
-  # The backend a program is on decides what is available: processes and the
-  # web server need the BEAM (+kex -R file.kex+).
+  # Useful in bug reports, generated artifacts, and compatibility checks where
+  # +Kex.BACKEND+ alone is not enough to identify the toolchain.
+  # The toolchain a program is running on. `kex --version` and the REPL
+  # banner report the same numbers.
   #
-  # @return [Bool] +true+ under the BEAM
+  # `revision` is the git commit the compiler was built from: `None` when
+  # it was built from a source archive rather than a checkout, which is why
+  # it is an Optional rather than a String.
   #
   # @example
-  #   Kex.underBeam?   # => true under `kex -R file.kex`
-  let underBeam? = Kex.BACKEND == Kex.Beam
+  #   Kex.VERSION.major        # => 0
+  #   Kex.VERSION.revision     # => Just("a1b2c3d")
+  #   Kex.VERSION.to(String)   # => "0.3.0 (a1b2c3d)"
+  record Version do
+    # The major version number.
+    major : Integer
 
-  # Build identity for the compiler and runtime executing this program.
-  #
-  # Useful in bug reports, generated artifacts, and compatibility checks where
-  # +Kex.BACKEND+ alone is not enough to identify the toolchain.
-  module Kernel do
-    # The toolchain a program is running on. `kex --version` and the REPL
-    # banner report the same numbers.
+    # The minor version number.
+    minor : Integer
+
+    # The patch version number.
+    patch : Integer
+
+    # The git commit the compiler was built from, or +None+ when it was
+    # built from a source archive rather than a checkout.
+    revision : String?
+
+    # The release channel: "" for a stable build, otherwise "rc.1",
+    # "beta.2", "prealpha.1": the part of VERSION after the dash.
+    preRelease : String = ""
+  end
+
+  make Version do
+    # The version's four values as a tuple, for destructuring.
+    #
+    # A tuple cannot carry accessors of its own: there is no named type for
+    # a `make` block to target, so the record is the value and this is the
+    # view.
     #
-    # `revision` is the git commit the compiler was built from: `None` when
-    # it was built from a source archive rather than a checkout, which is why
-    # it is an Optional rather than a String.
+    # @return [(Integer, Integer, Integer, String?)] major, minor, patch, revision
     #
     # @example
-    #   Kex.Kernel.VERSION.major        # => 0
-    #   Kex.Kernel.VERSION.revision     # => Just("a1b2c3d")
-    #   Kex.Kernel.VERSION.to(String)   # => "0.3.0 (a1b2c3d)"
-    record Version do
-      # The major version number.
-      major : Integer
-
-      # The minor version number.
-      minor : Integer
-
-      # The patch version number.
-      patch : Integer
-
-      # The git commit the compiler was built from, or +None+ when it was
-      # built from a source archive rather than a checkout.
-      revision : String?
-
-      # The release channel: "" for a stable build, otherwise "rc.1",
-      # "beta.2", "prealpha.1": the part of VERSION after the dash.
-      preRelease : String = ""
-    end
+    #   let (major, minor, patch, revision) = Kex.VERSION.tuple
+    #   major   # => 0
+    tuple : (Integer, Integer, Integer, String?)
+    let tuple = (this.major, this.minor, this.patch, this.revision)
 
-    make Version do
-      # The version's four values as a tuple, for destructuring.
-      #
-      # A tuple cannot carry accessors of its own: there is no named type for
-      # a `make` block to target, so the record is the value and this is the
-      # view.
-      #
-      # @return [(Integer, Integer, Integer, String?)] major, minor, patch, revision
-      #
-      # @example
-      #   let (major, minor, patch, revision) = Kex.Kernel.VERSION.tuple
-      #   major   # => 0
-      tuple : (Integer, Integer, Integer, String?)
-      let tuple = (this.major, this.minor, this.patch, this.revision)
-
-      # The three numbers, plus the pre-release channel when there is one.
-      #
-      # `0.4.0`, or `0.4.0-rc.1` on a pre-release build. What a version RANGE
-      # is matched against, so the channel has to be in it.
-      #
-      # @return [String] the release string
-      #
-      # @example
-      #   Kex.Kernel.VERSION.release   # => "0.4.0-alpha.2"
-      release : String
-      let release = @preRelease.empty? then "${this.major}.${this.minor}.${this.patch}" else "${this.major}.${this.minor}.${this.patch}-${@preRelease}"
-
-      # The release string with the build revision after it, when there is one.
-      #
-      # This is what +kex --version+ and the REPL banner print.
-      #
-      # `to(String)`: the language's conversion protocol, and what this
-      # should really be: is deliberately NOT defined here: a second
-      # `to(String)` implementation anywhere in the prelude breaks
-      # type-directed `to` dispatch for every prelude type on BEAM, so adding
-      # one here silently broke `3.kilo.watt.to(String)`. Pinned by
-      # spec/prelude_to_string_dispatch.kex; restore this as `to(String)` once
-      # that dispatcher is fixed.
-      #
-      # @return [String] the full version string
-      #
-      # @example
-      #   Kex.Kernel.VERSION.number   # => "0.4.0-alpha.2 (219e625)"
-      #
-      # @example Reporting the toolchain in a tool's output
-      #   IO.printLine("built with Kex ${Kex.Kernel.VERSION.number}")
-      number : String
-      let number = match this.revision do
-        Just(hash) => "${this.release} (${hash})"
-        None => this.release
-      end
-    end
+    # The three numbers, plus the pre-release channel when there is one.
+    #
+    # `0.4.0`, or `0.4.0-rc.1` on a pre-release build. What a version RANGE
+    # is matched against, so the channel has to be in it.
+    #
+    # @return [String] the release string
+    #
+    # @example
+    #   Kex.VERSION.release   # => "0.4.0-alpha.2"
+    release : String
+    let release = @preRelease.empty? then "${this.major}.${this.minor}.${this.patch}" else "${this.major}.${this.minor}.${this.patch}-${@preRelease}"
 
-    # This build's version.
+    # The release string with the build revision after it, when there is one.
+    #
+    # This is what +kex --version+ and the REPL banner print.
+    #
+    # `to(String)`: the language's conversion protocol, and what this
+    # should really be: is deliberately NOT defined here: a second
+    # `to(String)` implementation anywhere in the prelude breaks
+    # type-directed `to` dispatch for every prelude type on BEAM, so adding
+    # one here silently broke `3.kilo.watt.to(String)`. Pinned by
+    # spec/prelude_to_string_dispatch.kex; restore this as `to(String)` once
+    # that dispatcher is fixed.
     #
-    # @return [Version] the running toolchain's version
+    # @return [String] the full version string
     #
     # @example
-    #   Kex.Kernel.VERSION.major     # => 0
-    #   Kex.Kernel.VERSION.release   # => "0.4.0-alpha.2"
-    #
-    # @example Reporting the version in a tool's output
-    #   IO.printLine("built with Kex ${Kex.Kernel.VERSION.number}")
-    VERSION : Version
-    let VERSION = match Kex.Intrinsic.Kex.version() do
-      (major, minor, patch, revision) =>
-        Version { major: major, minor: minor, patch: patch, revision: revision,
-                  preRelease: Kex.Intrinsic.Kex.versionPreRelease() }
+    #   Kex.VERSION.number   # => "0.4.0-alpha.2 (219e625)"
+    #
+    # @example Reporting the toolchain in a tool's output
+    #   IO.printLine("built with Kex ${Kex.VERSION.number}")
+    number : String
+    let number = match this.revision do
+      Just(hash) => "${this.release} (${hash})"
+      None => this.release
     end
   end
 
+  # This build's version.
+  #
+  # @return [Version] the running toolchain's version
+  #
+  # @example
+  #   Kex.VERSION.major     # => 0
+  #   Kex.VERSION.release   # => "0.4.0-alpha.2"
+  #
+  # @example Reporting the version in a tool's output
+  #   IO.printLine("built with Kex ${Kex.VERSION.number}")
+  VERSION : Version
+  let VERSION = match Kex.Intrinsic.Kex.version() do
+    (major, minor, patch, revision) =>
+      Version { major: major, minor: minor, patch: patch, revision: revision,
+                preRelease: Kex.Intrinsic.Kex.versionPreRelease() }
+  end
+
+  # A compiled module loaded into the running program by +Kex.load+.
+  #
+  # For a program that decides at run time what code it needs: a site
+  # generator rendering a theme's templates, a plugin host. Compile the source
+  # with `kex --compile -o <dir>` once, then load the `.beam` and call it as
+  # often as needed, without starting another VM for every call
+  # (kexhq/kex#399).
+  #
+  # Every entry module is named after its file (`kex_<stem>.beam` for
+  # `<stem>.kex`), and so is everything declared at the top level of that
+  # file. A `let render = Template.html(Kex.embed(path))` written outside any
+  # `module` therefore lands in `kex_<stem>`, not in a module the file names;
+  # give each generated file a distinct name, or put the declaration inside a
+  # `module`, whose functions compile into `Kex.<Name>`.
+  #
+  # The BEAM backend only: under the interpreter, +Kex.load+ answers an error.
+  #
+  #   let theme = Kex.load("cache/kex_theme_3f2a.beam").try
+  #   let html = theme.call(:render, [context]).try
+  record LoadedModule do
+    # The module's BEAM name, e.g. +:kex_theme+ or +:"Kex.Theme"+.
+    name : Atom
+  end
+
+  # Loads the compiled module at +path+, replacing an older version of it
+  # that is already loaded. See +Kex.LoadedModule+.
+  #
+  # @param path [String] a `.beam` file written by `kex --compile`
+  # @return [Result<LoadedModule, String>] the module, or why it could not be
+  #   loaded
+  #
+  # @example
+  #   let theme = Kex.load("build/kex_theme.beam").try
+  load : String -> Result<LoadedModule, String>
+  foul load(path) = Kex.Intrinsic.Code.load(path).map { |name| LoadedModule { name: name } }
+
+  # The module already loaded under +name+, or +None+ when there is none.
+  #
+  # @param name [Atom] the module's BEAM name
+  # @return [LoadedModule?] the module
+  #
+  # @example Loading only once
+  #   let theme = Kex.loaded(:kex_theme).or(Kex.load(path).try)
+  loaded : Atom -> LoadedModule?
+  foul loaded(name) = Kex.Intrinsic.Code.loaded?(name) then Just(LoadedModule { name: name }) else None
+
+  make LoadedModule do
+    # Calls the module's function +function+ with +arguments+.
+    #
+    # A failure inside the call is an +Error+ describing it, not a crash of
+    # the caller, and so is a function the module does not export with that
+    # many arguments. A `foul` function takes one argument more than it
+    # declares, its capabilities, so call pure functions this way.
+    #
+    # @param function [Atom] the function's name
+    # @param arguments [[Any]] its arguments, in order
+    # @return [Result<Any, String>] what the function returned, or why the
+    #   call failed
+    #
+    # @example
+    #   theme.call(:render, [context])   # => Ok("<html>...")
+    call :> Atom -> [Any] -> Result<Any, String>
+    foul call(function, arguments) = Kex.Intrinsic.Code.call(@name, function, arguments)
+  end
+
+  # A non-cryptographic hash of any value: a non-negative +Integer+ below
+  # 2^32, the same for equal values.
+  #
+  # Cheap to compute over a whole structure, with no string built along the
+  # way, which suits fingerprinting data to notice when it changed. It is
+  # stable only within one running program: the number differs between the
+  # interpreter and the BEAM, and may change between Kex versions, so never
+  # store it or send it anywhere. Use +Digest+ for that, or for anything an
+  # adversary could choose collisions for.
+  #
+  # @param value [Any] the value to hash
+  # @return [Integer] the hash, from 0 up to 2^32 - 1
+  #
+  # @example Noticing that a project's files changed
+  #   let stamp = Kex.hash(paths.map { |path| (path, FS.File.info(path).try) })
+  hash : Any -> Integer
+  let hash(value) = Kex.Intrinsic.Kex.hash(value)
+
   # Which optional capabilities this build includes.
   #
   # Optional non-network capabilities in this build. Networking has its own
@@ -5544,7 +5998,7 @@ module Kex do
     # @return [Bool] +true+ when it is available
     #
     # @example
-    #   Kex.Feature.has?(Kex.FS)     # => true
+    #   Kex.Feature.has?(Kex.ExternalPrograms)   # => true, except in a browser
     #
     has? : Feature -> Bool
     let has?(f) = Kex.Intrinsic.Kex.featureHas?(f)
@@ -5554,7 +6008,7 @@ module Kex do
     # @return [[Feature]] the available capabilities
     #
     # @example
-    #   Kex.Feature.list   # => [FS]
+    #   Kex.Feature.list   # => [FileSystem, ExternalPrograms]
     list : [Feature]
     let list = Kex.Intrinsic.Kex.featureList()
   end
@@ -5568,7 +6022,7 @@ module Kex.Interface do
   #
   # The term is an ordinary tree of tuples, lists, atoms, integers and
   # strings, so it is walked with normal pattern matching and `Tuple.items`.
-  # This exists so that reading it needs no `Erlang.*` interop: it is the one
+  # This exists so that reading it needs no `BEAM.*` interop: it is the one
   # intentional entry point rather than a general term decoder.
   #
   # @param path [FS.FilePath] the compiled .beam file to read
@@ -5750,6 +6204,144 @@ module Kex.AST do
   parseExpression : String -> Result<Expression, ParseError>
   let parseExpression(source) = Kex.Intrinsic.AST.parseExpression(source)
 
+  # One token of a lossless syntax tree, exactly as written.
+  #
+  # Where +parse+ gives a program's meaning, +parseSyntax+ gives its text:
+  # nothing is normalised or dropped, so +toSource+ reprints the file byte for
+  # byte. It is the tree a formatter or a linter works on (kexhq/kex#136).
+  record SyntaxToken do
+    # The lexer's name for the token: +LowerIdent+, +Newline+, +Eof+, ...
+    kind : String
+
+    # The token exactly as written, quotes, escapes and underscores included.
+    text : String
+
+    # Everything between the previous token and this one: spaces, tabs and
+    # comments. A comment on a line of its own sits in front of the +Newline+
+    # that ends that line; whatever follows the last token belongs to +Eof+.
+    trivia : String
+  end
+
+  # One child of a +SyntaxNode+: a token, or a nested node.
+  type SyntaxElement = TokenElement(SyntaxToken) | NodeElement(SyntaxNode)
+
+  # A declaration, expression, pattern or type, holding its own tokens and
+  # nested nodes in source order.
+  #
+  #   let tree = Kex.AST.parseSyntax("# the answer\nlet x = 42\n").try
+  #   tree.kind                  # => "Program"
+  #   Kex.AST.toSource(tree)     # => "# the answer\nlet x = 42\n"
+  record SyntaxNode do
+    # What the parser built there: +FunctionDef+, +MethodCall+, +ListPattern+,
+    # ... The root is +Program+.
+    kind : String
+
+    # The node's tokens and nested nodes, in source order.
+    children : [SyntaxElement]
+  end
+
+  # Parses Kex source into its lossless syntax tree.
+  #
+  # @param source [String] the Kex source text
+  # @return [Result<SyntaxNode, ParseError>] the tree rooted at +Program+, or why it failed
+  #
+  # @example
+  #   Kex.AST.parseSyntax("let x = 1\n").map { |tree| tree.kind }   # => Ok("Program")
+  #   Kex.AST.parseSyntax("let x =").error?                         # => true
+  parseSyntax : String -> Result<SyntaxNode, ParseError>
+  let parseSyntax(source) = Kex.Intrinsic.AST.parseSyntax(source)
+
+  # Reprints a syntax tree as the source it was parsed from, byte for byte.
+  #
+  # Every node prints its own tokens and its nested nodes in order, never a
+  # slice of the original text, so a rearranged tree prints the rearranged
+  # program, its comments moving with it.
+  #
+  # @param node [SyntaxNode] a tree, or any node in one
+  # @return [String] the source the node covers, trivia included
+  #
+  # @example
+  #   let source = "let x = 1   # one\n"
+  #   Kex.AST.parseSyntax(source).map { |tree| Kex.AST.toSource(tree) }   # => Ok(source)
+  toSource : SyntaxNode -> String
+  let toSource(node) = node.children.map { |child| Kex.AST.elementSource(child) }.join("")
+
+  # The source of one child of a node: a token's trivia and text, or a nested
+  # node reprinted.
+  #
+  # @param element [SyntaxElement] the child
+  # @return [String] its source text
+  elementSource : SyntaxElement -> String
+  let elementSource(element) = match element do
+    TokenElement(token) => token.trivia + token.text
+    NodeElement(child) => Kex.AST.toSource(child)
+  end
+
+  # The comments written on their own lines directly above the child at
+  # +index+: the ones that belong to it, move with it when a formatter moves
+  # it, and hold a `# kex:disable-next-line` meant for it.
+  #
+  # A comment at the end of the previous line trails that line instead, and is
+  # not included.
+  #
+  # @param parent [SyntaxNode] the node holding the child
+  # @param index [Integer] the child's position in +parent.children+
+  # @return [[String]] the comment lines, top to bottom, each starting with +#+
+  #
+  # @example
+  #   let tree = Kex.AST.parseSyntax("let x = 1  # x\n# about y\nlet y = 2\n").try
+  #   Kex.AST.commentsBefore(tree, 3)   # => ["# about y"]
+  commentsBefore : SyntaxNode -> Integer -> [String]
+  let commentsBefore(parent, index) do
+    var comments: [String] = []
+    Kex.AST.linesBefore(parent, index).each do |line|
+      let text = line.trim
+      comments = comments + [text] if text.startsWith?("#")
+    end
+    return comments
+  end
+
+  # How many blank lines separate the child at +index+ from what precedes it.
+  #
+  # Kept as a count, not a flag: a formatter preserves one blank line between
+  # declarations and collapses longer runs, which needs to know how many there
+  # were.
+  #
+  # @param parent [SyntaxNode] the node holding the child
+  # @param index [Integer] the child's position in +parent.children+
+  # @return [Integer] the number of blank lines directly above the child
+  #
+  # @example
+  #   let tree = Kex.AST.parseSyntax("let x = 1\n\n\nlet y = 2\n").try
+  #   Kex.AST.blankLinesBefore(tree, 4)   # => 2
+  blankLinesBefore : SyntaxNode -> Integer -> Integer
+  let blankLinesBefore(parent, index) = Kex.AST.linesBefore(parent, index).filter { |line| line.trim.empty? }.count
+
+  # The whole lines between the child at +index+ and the code before it, as
+  # the trivia of the +Newline+ tokens that end them. The newline that ends the
+  # previous line of code is not one of them: what sits in front of it trails
+  # that code.
+  #
+  # @param parent [SyntaxNode] the node holding the child
+  # @param index [Integer] the child's position in +parent.children+
+  # @return [[String]] the lines, top to bottom, without their newlines
+  linesBefore : SyntaxNode -> Integer -> [String]
+  let linesBefore(parent, index) do
+    var position = index - 1
+    var lines: [String] = []
+    var scanning = true
+    while scanning && position >= 0 do
+      match parent.children.at(position) do
+        Just(TokenElement(token)) when token.kind == "Newline" => do
+          lines = [token.trivia] + lines
+          position = position - 1
+        end
+        _ => scanning = false
+      end
+    end
+    return position >= 0 then lines.drop(1) else lines
+  end
+
   # A type as it was written in source.
   #
   # +typeRefText+ renders one back to the source spelling.
@@ -6310,6 +6902,17 @@ make [Number] do
   let max = Kex.Intrinsic.List.max(this)
 end
 
+make [[Y]] do
+  # Flattens exactly one level of nesting.
+  #
+  # @return [[Y]]
+  #
+  # @example
+  #   [[1, 2], [3, 4]].flatten   # => [1, 2, 3, 4]
+  flatten :> [Y]
+  let flatten = Kex.Intrinsic.List.flatten(this)
+end
+
 make [X], implement: Enumerable, Foldable do
   # Returns the first element wrapped in +Just+, or +None+ if the list is empty.
   #
@@ -6481,9 +7084,9 @@ make [X], implement: Enumerable, Foldable do
   # Folds the list from the left, starting with +acc+ and combining each
   # element via +f+.
   #
-  # @param acc [Acc]   initial accumulator value
-  # @param f   [Acc -> X -> Acc]
-  # @return [Acc]
+  # @param acc [A]     initial accumulator value
+  # @param f   [A -> X -> A]
+  # @return [A]
   #
   # @example
   #   [1, 2, 3].reduce(0) { |acc, x| acc + x }   # => 6
@@ -6702,15 +7305,6 @@ make [X], implement: Enumerable, Foldable do
   zip :> [Y] -> [(X, Y)]
   let zip(other) = Kex.Intrinsic.List.zip(this, other)
 
-  # Flattens exactly one level of nesting. Only valid on lists of lists.
-  #
-  # @return [[Y]]
-  #
-  # @example
-  #   [[1, 2], [3, 4]].flatten   # => [1, 2, 3, 4]
-  flatten :> [X]
-  let flatten = Kex.Intrinsic.List.flatten(this)
-
   # Returns the elements sorted in ascending natural order.
   #
   # @return [[X]]
@@ -7894,6 +8488,15 @@ module Mock do
     foul file?(path) = this.cannedRead(path) != None
     foul directory?(path) = false
     foul absolute(path) = Just(path)
+    foul canonical(path) = match this.cannedRead(path) do
+      Just(_) => Ok(path)
+      None => Error(ReadFailed(path))
+    end
+    foul symlink?(path) = false
+    foul info(path) = match this.cannedRead(path) do
+      Just(content) => Ok(FileInfo { kind: :file, size: content.bytes.count, modified: DateTime.fromEpochSeconds(0) })
+      None => Error(ReadFailed(path))
+    end
 
     # A fake is a value, so there is nowhere for a write to go. Refusing is
     # the honest answer and the useful one: a test that did not expect a
@@ -8442,6 +9045,22 @@ module Headers do
   from : [(String, String)] -> Result<Headers, NetError>
   let from(entries) = Kex.Intrinsic.NetHTTP.headers(entries)
 
+  # Validates header names and values from unordered pairs, for the common
+  # case where every name is used once. Do not use this for `Set-Cookie` or
+  # any other field that legitimately repeats — a `Map` cannot hold a name
+  # twice, so unlike the list form above, a second value for the same name
+  # here does not add a second field; it silently replaces the first (see
+  # this module's own +Headers+ record doc for why that specific field
+  # cannot be folded into one entry). Reach for the ordered list form for
+  # anything that might repeat a name.
+  #
+  # @return [Result<Headers, NetError>] validated fields, or +Parse+
+  #
+  # @example Forwarding a set of request headers that are each sent once
+  #   Headers.from({ "Accept": "application/json", "X-Request-ID": requestId }).try
+  from : Map<String, String> -> Result<Headers, NetError>
+  let from(entries: Map<String, String>) = Kex.Intrinsic.NetHTTP.headers(entries.entries)
+
   # Parses CRLF- or LF-separated header fields.
   #
   # Use this at a protocol boundary when headers arrive as text. Application
@@ -8492,6 +9111,7 @@ end
 module Router do
   # @return [Router] a router with no routes
   # @example +Router.build.get("/health", { |request, context| Response.text(200, "ok") })+
+  build : Router
   let build = Router { routes: [] }
 end
 
@@ -8760,6 +9380,8 @@ end
 #   socket.close
 module Net.HTTP.WebSocket
 
+using Net.HTTP
+
 # A complete high-level WebSocket message. Fragmentation and ping/pong control
 # frames are handled by the connection runtime.
 #
@@ -8783,10 +9405,31 @@ record Session do
   subprotocol : String?
 end
 
-# An opaque RFC 6455 client connection. It does not reconnect automatically.
+# An opaque RFC 6455 connection, client- or server-side. It does not
+# reconnect automatically.
 type Connection
 
-# Constructors for high-level WebSocket client connections.
+# Subprotocols offered by an incoming upgrade request, in the order the peer
+# listed them.
+record Handshake do
+  subprotocols : [String] = []
+end
+
+# A server's decision after inspecting a +Handshake+.
+#
+# +Accept+ takes over the connection once the 101 response is sent: +handler+
+# runs with the negotiated server +Connection+, and its return value is
+# discarded. +headers+ are added to the 101 response; a name that manages the
+# handshake itself (+Upgrade+, +Connection+, +Sec-WebSocket-Accept+,
+# +Sec-WebSocket-Protocol+) is dropped rather than overridden. +subprotocol+
+# must be one +handshake.subprotocols+ actually offered, or +None+.
+#
+# +Reject+ answers with an ordinary buffered response instead, leaving the
+# connection as plain HTTP — a client requesting an unsupported subprotocol
+# might get +Response.text(426, "chat.v2 required")+, for instance.
+type Upgrade = Accept(Connection -> Void, Headers, String?) | Reject(Response<Binary>)
+
+# Constructors for high-level WebSocket connections, client- and server-side.
 module WebSocket do
   # Opens a +ws:+ or verified +wss:+ connection with default options.
   #
@@ -8811,6 +9454,32 @@ module WebSocket do
   #     maximumMessageBytes: 1024 * 1024
   #   }).try
   foul connect(url: String, options: ClientOptions) -> Result<Connection, NetError> = Kex.Intrinsic.NetWebSocket.connect(url, options)
+
+  # Decides whether to accept an incoming +Net.HTTP.Server+ upgrade request.
+  #
+  # Call from a route handler and return the result directly — it types as
+  # an ordinary +Response<Binary>+, and +Net.HTTP.Server+ recognizes what it
+  # actually is: a request that isn't a syntactically valid WebSocket
+  # handshake at all (wrong method, missing +Sec-WebSocket-Key+, unsupported
+  # +Sec-WebSocket-Version+) is answered automatically without calling
+  # +decide+; a valid one reaches +decide+ for an application decision.
+  #
+  # @param request [Request<Binary>] the route handler's own request
+  # @param decide [Handshake -> Upgrade] the accept/reject decision
+  # @return [Response<Binary>] the handler's response — an upgrade in
+  #   disguise on +Accept+, sent as given on +Reject+
+  #
+  # @example An authenticated, subprotocol-gated chat route
+  #   foul socketRoute(request: Request<Binary>, context: Context) -> Response<Binary> = WebSocket.upgrade(request) do |handshake|
+  #     if handshake.subprotocols.contains?("chat.v2")
+  #       let handler : Connection -> Void = { |socket| serveChat(socket) }
+  #       Accept(handler, Headers.empty, Just("chat.v2"))
+  #     else
+  #       Reject(Response.text(426, "chat.v2 required"))
+  #     end
+  #   end
+  #   let router = Router.build.get("/socket", ~socketRoute)
+  foul upgrade(request: Request<Binary>, decide: Handshake -> Upgrade) -> Response<Binary> = Kex.Intrinsic.NetWebSocket.upgrade(request, decide)
 end
 
 make Connection do
@@ -8839,6 +9508,32 @@ make Connection do
   #     end
   #   end
   foul receiveMessage() -> Result<Message, NetError> = Kex.Intrinsic.NetWebSocket.receiveMessage(this)
+  # `receiveMessage`, but the deadline is explicit rather than implicit in
+  # whether you passed an argument at all: +None+ waits exactly as long as
+  # a bare +receiveMessage+ does (as long as the peer stays connected —
+  # routinely indefinitely, for a WebSocket left open with nothing to say),
+  # and +Just(duration)+ gives up and answers +Timeout+ once +duration+
+  # elapses without a message.
+  #
+  # A real disconnect is still reported as +Closed+, not +Timeout+: the two
+  # are distinguishable, unlike a bare +receiveMessage+ that assumes a
+  # failed read always means the peer is gone (kexhq/kex#381).
+  #
+  # @param timeout [Duration?] how long to wait before giving up, or +None+
+  #   to wait as long as the peer stays connected
+  # @return [Result<Message, NetError>] the next data or close message, or
+  #   +Timeout+ if none arrived in time
+  #
+  # @example Prompting an otherwise-quiet client every 30 seconds
+  #   match connection.receiveMessage(timeout: Just(30.seconds)).try do
+  #     Text(text) => handleEvent(text)
+  #     _          => sendPing(connection)
+  #   end
+  #
+  # @example Being explicit that a wait has no deadline, rather than relying
+  #   on the zero-argument form's default
+  #   connection.receiveMessage(timeout: None)
+  foul receiveMessage(timeout: Duration?) -> Result<Message, NetError> = Kex.Intrinsic.NetWebSocket.receiveMessageWithin(this, timeout)
   # Returns handshake details negotiated with the server.
   #
   # @return [Session] the selected subprotocol, if any
@@ -9450,6 +10145,146 @@ module TLS do
   foul closed?(connection: TLSConnection) -> Bool = Kex.Intrinsic.NetTLS.closed?(connection)
 
 end
+# Distributed Kex: this BEAM node, and the other nodes it is connected to.
+#
+# A node is one running BEAM VM with a name. Once two nodes share a cookie and
+# are connected, a +Pid+ from one works on the other: +send+, +link+ and
+# +monitor+ cross the network unchanged, and so do typed +Process+ and
+# +Server+ handles.
+#
+# Name a node when starting it (`kex --sname a --cookie secret app.kex`), or
+# from inside the program with +Node.start+:
+#
+#   using Node
+#
+#   main do
+#     Node.connect(:b@myhost)
+#     Node.send(:b@myhost, :logger, (:hello, Node.self))
+#   end
+#
+# Node names are atoms: `:b@myhost` for a short name, the quoted
+# `:"b@host.example.com"` for one with dots, or `Atom.from(text)` for one
+# built at runtime.
+#
+# Both nodes need the same compiled code for anything that carries a function,
+# like a lambda or a record whose methods the receiver calls; +Node.spawn+
+# sends its block's code along. Plain data — numbers, strings, lists, tuples,
+# records — needs nothing.
+#
+# Backed by Kex.Intrinsic.Node on the BEAM. The tree-walk interpreter is always
+# a single, unnamed node.
+module Node do
+  # This node's name, or +:nonode@nohost+ when it is not distributed.
+  #
+  # @return [Atom] the node name
+  #
+  # @example
+  #   Node.self   # => :a@myhost
+  self : Atom
+  foul self = Kex.Intrinsic.Node.self
+
+  # Whether this node is distributed — started with a name, so other nodes
+  # can connect to it.
+  #
+  # @return [Bool] true once the node has a name
+  #
+  # @example
+  #   Node.alive?   # => false, unless started with --sname or Node.start
+  alive? : Bool
+  foul alive? = Kex.Intrinsic.Node.alive?
+
+  # The nodes this one is currently connected to, not including itself.
+  #
+  # @return [[Atom]] the connected node names
+  #
+  # @example
+  #   Node.list   # => [:b@myhost]
+  list : [Atom]
+  foul list = Kex.Intrinsic.Node.list
+
+  # Makes this node distributed under +name+, as `--sname`/`--name` would at
+  # startup. A +name+ whose host has a dot (`:"app@host.example.com"`) uses
+  # long names; anything else uses short names.
+  #
+  # @param name [Atom] the node name, like +:app+ or +:app@myhost+
+  # @return [Result<Atom, String>] the full node name, or why it could not start
+  #
+  # @example
+  #   Node.start(:app)   # => Ok(:app@myhost)
+  start : Atom -> Result<Atom, String>
+  foul start(name) = Kex.Intrinsic.Node.start(name)
+
+  # Stops distribution: the node drops its name and every connection.
+  #
+  # @return [Bool] whether it was distributed and has now stopped
+  stop : Bool
+  foul stop = Kex.Intrinsic.Node.stop
+
+  # Connects to the node named +node+. Both nodes must share a cookie.
+  #
+  # @param node [Atom] the node to connect to
+  # @return [Bool] whether the connection is up
+  #
+  # @example
+  #   Node.connect(:b@myhost)   # => true
+  connect : Atom -> Bool
+  foul connect(node) = Kex.Intrinsic.Node.connect(node)
+
+  # Drops the connection to +node+.
+  #
+  # @param node [Atom] the node to disconnect from
+  # @return [Bool] whether a connection was dropped
+  disconnect : Atom -> Bool
+  foul disconnect(node) = Kex.Intrinsic.Node.disconnect(node)
+
+  # Sets the cookie this node presents when connecting. Nodes connect only
+  # when their cookies match.
+  #
+  # @param cookie [String] the shared secret
+  # @return [Void]
+  setCookie : String -> Void
+  foul setCookie(cookie) = Kex.Intrinsic.Node.setCookie(cookie)
+
+  # Sends +message+ to the process registered as +name+ on +node+, unchanged.
+  # Like +Pid.send+, it never blocks and never fails.
+  #
+  # @param node [Atom] the node the process runs on
+  # @param name [Atom] the name it was registered under
+  # @param message [X] the message
+  # @return [Void]
+  #
+  # @example
+  #   Node.send(:b@myhost, :logger, (:info, "started"))
+  send : Atom -> Atom -> X -> Void
+  foul send(node, name, message) = Kex.Intrinsic.Node.send(node, name, message)
+
+  # The +Pid+ registered as +name+ on +node+, or +None+.
+  #
+  # @param node [Atom] the node to ask
+  # @param name [Atom] the registered name
+  # @return [Pid?] the process, or +None+
+  #
+  # @example
+  #   Node.whereIs(:b@myhost, :logger).map { |pid| pid.send(:flush) }
+  whereIs : Atom -> Atom -> Pid?
+  foul whereIs(node, name) = Kex.Intrinsic.Node.whereIs(node, name)
+
+  # Runs +block+ in a new process on +node+ and returns its +Pid+.
+  #
+  # The block is a function of THIS program. When +node+ has not loaded the
+  # module it belongs to, that module's compiled code is sent over and loaded
+  # first. A module +node+ already has is left as it is.
+  #
+  # @param node [Atom] where to run it
+  # @param block [Block<X>] the work
+  # @return [Pid] the new process
+  #
+  # @example
+  #   let me = Process.self
+  #   Node.spawn(:b@myhost) do me.send(Node.self) end
+  spawn : Atom -> Block<X> -> Pid
+  foul spawn(node, block) = Kex.Intrinsic.Node.spawn(node, block)
+end
 # Whole numbers, of arbitrary size.
 #
 # +Integer+ has no width limit: factorials and cryptographic moduli are
@@ -9564,7 +10399,13 @@ make Integer do
   #
   # @example Repeating an action
   #   retries.times { |_| attemptConnection }
+  #
+  # @example Repeating an action that needs no index
+  #   3.times do
+  #     IO.printLine("hi")
+  #   end
   times :> (Integer -> Void) -> Void
+  times :> Block<Void> -> Void
   let times(block) = Kex.Intrinsic.Integer.times(this, block)
 
   # Returns the integer unchanged. Present so that code written against
@@ -9810,6 +10651,151 @@ module Float do
   #   Float.parsePrefix("12.5kg")   # => Just((12.5, "kg"))
   parsePrefix : String -> (Float, String)?
   let parsePrefix(s) = Kex.Intrinsic.Float.parsePrefix(s)
+
+  # The largest finite +Float+.
+  #
+  # A Kex +Float+ is always finite, so there is no infinity to start from:
+  # this is the bound to use instead, say as the first "smallest so far".
+  #
+  # @return [Float] 1.7976931348623157e308
+  #
+  # @example
+  #   let smallest = readings.reduce(Float.MAX) { |low, x| x < low then x else low }
+  MAX : Float
+  let MAX = 1.7976931348623157e308
+
+  # The most negative finite +Float+: +-Float.MAX+. Not the smallest positive
+  # one, which some languages call MIN.
+  #
+  # @return [Float] -1.7976931348623157e308
+  MIN : Float
+  let MIN = -1.7976931348623157e308
+end
+
+# The bounds of the sized numeric types: +Int8.MAX+, +UInt64.MAX+,
+# +Float32.MIN+ and so on. +Integer+ has none: it is arbitrary-precision.
+# For a float type, +MIN+ is the most negative finite value, not the smallest
+# positive one.
+
+# The range of a 32-bit float.
+module Float32 do
+  # The largest Float32: 3.4028234663852886e38.
+  MAX : Float32
+  let MAX = 3.4028234663852886e38
+
+  # The most negative finite Float32: -3.4028234663852886e38.
+  MIN : Float32
+  let MIN = -3.4028234663852886e38
+end
+
+# The range of a 64-bit float, the same as a +Float+.
+module Float64 do
+  # The largest Float64: 1.7976931348623157e308.
+  MAX : Float64
+  let MAX = 1.7976931348623157e308
+
+  # The most negative finite Float64: -1.7976931348623157e308.
+  MIN : Float64
+  let MIN = -1.7976931348623157e308
+end
+
+# The range of a signed 8-bit integer.
+module Int8 do
+  # The largest Int8: 127.
+  MAX : Int8
+  let MAX = 127
+
+  # The smallest Int8: -128.
+  MIN : Int8
+  let MIN = -128
+end
+
+# The range of a signed 16-bit integer.
+module Int16 do
+  # The largest Int16: 32767.
+  MAX : Int16
+  let MAX = 32767
+
+  # The smallest Int16: -32768.
+  MIN : Int16
+  let MIN = -32768
+end
+
+# The range of a signed 32-bit integer.
+module Int32 do
+  # The largest Int32: 2147483647.
+  MAX : Int32
+  let MAX = 2147483647
+
+  # The smallest Int32: -2147483648.
+  MIN : Int32
+  let MIN = -2147483648
+end
+
+# The range of a signed 64-bit integer.
+module Int64 do
+  # The largest Int64: 9223372036854775807.
+  MAX : Int64
+  let MAX = 9223372036854775807
+
+  # The smallest Int64: -9223372036854775808.
+  MIN : Int64
+  let MIN = -9223372036854775808
+end
+
+# The range of an unsigned 8-bit integer: +UInt8+ is another name for +Byte+.
+module UInt8 do
+  # The largest UInt8: 255.
+  MAX : UInt8
+  let MAX = 255
+
+  # The smallest UInt8: 0.
+  MIN : UInt8
+  let MIN = 0
+end
+
+# The range of an unsigned 16-bit integer.
+module UInt16 do
+  # The largest UInt16: 65535.
+  MAX : UInt16
+  let MAX = 65535
+
+  # The smallest UInt16: 0.
+  MIN : UInt16
+  let MIN = 0
+end
+
+# The range of an unsigned 32-bit integer.
+module UInt32 do
+  # The largest UInt32: 4294967295.
+  MAX : UInt32
+  let MAX = 4294967295
+
+  # The smallest UInt32: 0.
+  MIN : UInt32
+  let MIN = 0
+end
+
+# The range of an unsigned 64-bit integer.
+module UInt64 do
+  # The largest UInt64: 18446744073709551615.
+  MAX : UInt64
+  let MAX = 18446744073709551615
+
+  # The smallest UInt64: 0.
+  MIN : UInt64
+  let MIN = 0
+end
+
+# The range of a +Byte+, Kex's unsigned 8-bit integer (also called +UInt8+).
+module Byte do
+  # The largest Byte: 255.
+  MAX : Byte
+  let MAX = 255
+
+  # The smallest Byte: 0.
+  MIN : Byte
+  let MIN = 0
 end
 
 # Reading a number out of text without deciding in advance which half of the
@@ -11202,7 +12188,7 @@ make Input do
   # use it where the grammar requires something to be there.
   #
   # @param f [Input -> Result<(T, Input), ParseError>] the parser to repeat
-  # @return [([T], Input)] the results and the cursor, or the first failure
+  # @return [Result<([T], Input), ParseError>] the results and the cursor, or the first failure
   #
   # @example
   #   Input { input: "abc" }.some { |p| p.charWhen(~alpha?) }
@@ -11223,7 +12209,7 @@ make Input do
   # the caret.
   #
   # @param expected [String] the literal that must be next
-  # @return [(String, Input)] the literal and the cursor, or an +Expected+ error
+  # @return [Result<(String, Input), ParseError>] the literal and the cursor, or an +Expected+ error
   #
   # @example
   #   Input { input: "abc" }.string("abc")   # => Ok(("abc", cursor at 3))
@@ -11279,7 +12265,7 @@ make Input do
   # they all started from.
   #
   # @param alts [[Input -> Result<(T, Input), ParseError>]] the parsers to try, in order
-  # @return [(T, Input)] the first success, or +NoMatch+
+  # @return [Result<(T, Input), ParseError>] the first success, or +NoMatch+
   #
   # @example
   #   cursor.choice([
@@ -11333,6 +12319,7 @@ end
 # declaration in that source file, not here.
 
 using Algebra
+using Atom
 using Binary
 using Blankable
 using Comparable
@@ -11398,7 +12385,7 @@ using Units
 
 # An opaque BEAM process identifier.
 #
-# Obtained from +Process.self+ or +Process.whereis+. Send it messages, link to
+# Obtained from +Process.self+ or +Process.whereIs+. Send it messages, link to
 # it, monitor it, or ask whether it is still alive.
 type Pid
 
@@ -11627,19 +12614,91 @@ module Process do
   register : Pid -> Atom -> Void
   foul register(pid, name) = Kex.Intrinsic.Process.register(pid, name)
 
+  # Registers the typed process +process+ under the atom +name+.
+  #
+  # @param process [Process<X>] the process to register
+  # @param name [Atom] the name to register it under
+  # @return [Void]
+  #
+  # @example
+  #   let logger = spawn do logLoop() end
+  #   Process.register(logger, :logger)
+  register : Process<X> -> Atom -> Void
+  foul register(process, name) = Kex.Intrinsic.Process.register(process, name)
+
   # Returns the +Pid+ registered under +name+, or +None+ when nothing is.
   #
   # @param name [Atom] the registered name
   # @return [Pid?] the process, or +None+
   #
   # @example
-  #   Process.whereis(:main)        # => Just(pid)
-  #   Process.whereis(:not_there)   # => None
+  #   Process.whereIs(:main)        # => Just(pid)
+  #   Process.whereIs(:not_there)   # => None
   #
   # @example Sending to a named process if it is there
-  #   Process.whereis(:logger).map { |pid| pid.send(message) }
-  whereis : Atom -> Pid?
-  foul whereis(name) = Kex.Intrinsic.Process.whereis(name)
+  #   Process.whereIs(:logger).map { |pid| pid.send(message) }
+  whereIs : Atom -> Pid?
+  foul whereIs(name) = Kex.Intrinsic.Process.whereIs(name)
+
+  # A named, typed slot of state that every process can read without asking
+  # another process for it.
+  #
+  # State kept in a +serving+ process is copied into the caller on every
+  # read, which is costly for a large value read by every request. A
+  # +Shared+ value is stored once for the whole node (on the BEAM, in
+  # +persistent_term+): reading it copies nothing, however large it is.
+  #
+  # The price is on the other side: replacing a value makes the runtime scan
+  # every process for references to the old one. So it suits state that is
+  # read constantly and written rarely, such as configuration or a loaded
+  # site, and not a counter.
+  #
+  # Get a handle with +Process.Shared.named+. The slot is identified by its
+  # name alone, so two handles with the same name are the same slot; the type
+  # parameter is what a handle promises to store and read back, so give every
+  # handle on one name the same one.
+  #
+  # @example Loading once, reading from every request handler
+  #   let site : Process.Shared<Site> = Process.Shared.named("site")
+  #   site.put(loadSite(root))
+  #   ...
+  #   let current = site.get.or(emptySite)
+  type Shared<X>
+
+  module Shared do
+    # The handle on the slot called +name+. Nothing is stored or read until
+    # +put+ or +get+.
+    #
+    # @param name [String] the slot's name
+    # @return [Process.Shared<X>] a handle on the slot
+    named : String -> Process.Shared<X>
+    let named(name) = Kex.Intrinsic.Shared.named(name)
+  end
+
+  make Shared<X> do
+    # Stores +value+, replacing whatever the slot held.
+    #
+    # Expensive: see +Process.Shared+.
+    #
+    # @param value [X] the value to store
+    # @return [Void]
+    put :> X -> Void
+    foul put(value) = Kex.Intrinsic.Shared.put(this, value)
+
+    # The stored value, or +None+ when nothing has been stored yet.
+    #
+    # Cheap, whatever the value's size.
+    #
+    # @return [X?] the stored value
+    get :> X?
+    foul get = Kex.Intrinsic.Shared.get(this)
+
+    # Empties the slot.
+    #
+    # @return [Bool] +true+ when it held a value
+    delete :> Bool
+    foul delete = Kex.Intrinsic.Shared.delete(this)
+  end
 end
 
 # What an external command left behind: its exit status and its output.
@@ -11935,10 +12994,278 @@ make Reference do
   demonitor :> Void
   let demonitor = Kex.Intrinsic.Process.demonitor(this)
 end
+# Random values for simulations, sampling, games, and reproducible tests.
+#
+# Import with +using Random+. Ordinary calls return a value directly;
+# a +Random.Generator+ returns +(value, nextGenerator)+. Reusing the same
+# generator replays the same draw. Pass its returned state to continue.
+#
+# @example Roll a die or initialize a weight
+#   using Random
+#   let roll = Random.integer(1..6)
+#   let weight = Random.float(-1.0..1.0)
+#
+# @example Reproduce a sequence
+#   let generator = Random.seeded(42)
+#   let (first, afterFirst) = generator.integer(1..6)
+#   let (second, afterSecond) = afterFirst.integer(1..6)
+#
+# These generators are not cryptographic; do not use their output for secrets.
+# +Random.secureBytes+ and +Random.token+ are, and are what secrets come from.
+module Random do
+  # Immutable state of a deterministic random sequence.
+  #
+  # Construct with +Random.seeded+ or +Random.fresh+. Each draw returns its
+  # value first and the advanced generator second. Equal seeds reproduce equal
+  # sequences for the same operations on both backends.
+  record Generator do
+    state : Integer = 0
+  end
+
+  # Starts a deterministic sequence. Any Integer seed is reduced modulo 2^64.
+  # @param seed [Integer] reproducible seed, including negative or large values
+  # @return [Generator] initial state; no draw has been consumed
+  let seeded(seed: Integer) -> Generator = Generator {
+    state: seed.modulo(18446744073709551616)
+  }
+
+  # Starts a generator using fresh host entropy.
+  # @return [Generator] initial state for a sequence that varies between runs
+  foul fresh -> Generator do
+    let high = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
+    let low = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
+    seeded(high * 4294967296 + low)
+  end
+
+  module Generator do
+    make Random.Generator do
+      # Draws an integer between both endpoints, with the advanced generator.
+      # The range must be ascending and contain at most 2^64 integers.
+      # A singleton range is valid and still consumes a draw.
+      # @param range [Range<Integer>] inclusive integer bounds
+      # @return [(Integer, Generator)] drawn integer and advanced state
+      # @example A reproducible die roll
+      #   let (roll, advanced) = Random.seeded(42).integer(1..6)
+      let integer(range: Range<Integer>) -> (Integer, Generator) = drawInteger(this, range)
+
+      # Draws a float from the lower bound inclusive to the upper bound exclusive.
+      # Defaults to +0.0..1.0+. Bounds must be finite and strictly ascending.
+      # @param range [Range<Float>] half-open floating-point bounds
+      # @return [(Float, Generator)] drawn float and advanced state
+      # @example Initialize a model weight
+      #   let (weight, advanced) = Random.seeded(42).float(-1.0..1.0)
+      let float(range: Range<Float>) -> (Float, Generator) = drawFloat(this, range)
+      let float -> (Float, Generator) = drawFloat(this, 0.0..1.0)
+
+      # Draws a fair Boolean and returns the advanced generator.
+      # @return [(Bool, Generator)] coin flip and advanced state
+      let boolean -> (Bool, Generator) = drawBoolean(this)
+
+      # Draws true with the supplied probability. Consumes one draw even at 0 or 1.
+      # @param probability [Float] probability from 0.0 through 1.0
+      # @return [(Bool, Generator)] outcome and advanced state
+      let chance?(probability: Float) -> (Bool, Generator) = drawChance(this, probability)
+
+      # Chooses an input position uniformly. Empty input returns None without a draw.
+      # @param items [[X]] values to choose from
+      # @return [(X?, Generator)] optional value and advanced state
+      let choice(items: [X]) -> (X?, Generator) = drawChoice(this, items)
+
+      # Selects input positions without replacement, in random order.
+      # Duplicate input values may appear more than once in the result.
+      # A count larger than the input selects every position; zero consumes no draws.
+      # @param items [[X]] population; unchanged by sampling
+      # @param count [Integer] nonnegative number of positions to select
+      # @return [([X], Generator)] selected values and advanced state
+      # @example Deal five cards reproducibly
+      #   let (hand, advanced) = Random.seeded(42).sample(cards, count: 5)
+      let sample(items: [X], count: Integer) -> ([X], Generator) = drawSample(this, items, count)
+
+      # Returns a random permutation, preserving duplicates and the input itself.
+      # Empty input consumes no draws.
+      # @param items [[X]] values to shuffle
+      # @return [([X], Generator)] permutation and advanced state
+      let shuffle(items: [X]) -> ([X], Generator) = drawSample(this, items, items.count)
+    end
+  end
+
+  # Draws an integer from an inclusive range using fresh entropy.
+  # @param range [Range<Integer>] ascending inclusive bounds, span at most 2^64
+  # @return [Integer] drawn value
+  foul integer(range: Range<Integer>) -> Integer do
+    let (value, _) = drawInteger(fresh, range)
+    value
+  end
+
+  # Draws a float; defaults to [0.0, 1.0). The upper bound is excluded.
+  # @param range [Range<Float>] finite, strictly ascending bounds
+  # @return [Float] drawn value
+  foul float(range: Range<Float> = 0.0..1.0) -> Float do
+    let (value, _) = drawFloat(fresh, range)
+    value
+  end
+
+  # Draws a fair coin flip using fresh entropy.
+  # @return [Bool] true or false with equal probability
+  foul boolean -> Bool do
+    let (value, _) = drawBoolean(fresh)
+    value
+  end
+
+  # Returns true with the supplied probability using fresh entropy.
+  # @param probability [Float] probability from 0.0 through 1.0
+  # @return [Bool] sampled outcome
+  foul chance?(probability: Float) -> Bool do
+    let (value, _) = drawChance(fresh, probability)
+    value
+  end
+
+  # Chooses a position uniformly, returning None for an empty input.
+  # @param items [[X]] values to choose from
+  # @return [X?] chosen value, if any
+  foul choice(items: [X]) -> X? do
+    let (value, _) = drawChoice(fresh, items)
+    value
+  end
+
+  # Samples positions without replacement; duplicate values remain possible.
+  # @param items [[X]] population
+  # @param count [Integer] nonnegative count; capped at the input size
+  # @return [[X]] values selected in random order
+  foul sample(items: [X], count: Integer) -> [X] do
+    let (value, _) = drawSample(fresh, items, count)
+    value
+  end
+
+  # Returns a random permutation using fresh entropy.
+  # @param items [[X]] values to shuffle
+  # @return [[X]] shuffled copy
+  foul shuffle(items: [X]) -> [X] do
+    let (value, _) = drawSample(fresh, items, items.count)
+    value
+  end
+
+  # Returns +count+ bytes from the operating system's cryptographically
+  # secure generator: the source for keys, session tokens and unguessable
+  # identifiers, which the generators above must never be used for.
+  #
+  # Nothing about it is reproducible, and there is no +Generator+ form.
+  #
+  # @param count [Integer] how many bytes; zero or less gives an empty binary
+  # @return [Binary] the random bytes
+  #
+  # @example A 256-bit key
+  #   let key = Random.secureBytes(32)
+  foul secureBytes(count: Integer) -> Binary = Kex.Intrinsic.Random.secureBytes(count)
+
+  # Returns an unguessable token: +bytes+ secure random bytes, as lowercase
+  # hex, so the text is twice as long as +bytes+.
+  #
+  # @param bytes [Integer] how many random bytes the token carries
+  # @return [String] the token
+  #
+  # @example A session identifier
+  #   let session = Random.token(32)   # => "9f86d081884c7d65..." (64 characters)
+  foul token(bytes: Integer = 32) -> String = secureBytes(bytes).hex
+
+  private do
+    let drawInteger(source: Generator, range: Range<Integer>) -> (Integer, Generator) do
+      let (low, high) = integerBounds(range)
+      integerBetween(source, low, high)
+    end
+
+    let drawFloat(source: Generator, range: Range<Float>) -> (Float, Generator) do
+      let (low, high) = floatBounds(range)
+      if !(low < high)
+        die("Random.float: bounds must be finite and strictly ascending")
+      end
+      let (word, advanced) = nextWord(source)
+      let unit = (Kex.Intrinsic.Bits.shiftRight(word, 11) * 1.0) / 9007199254740992.0
+      (Kex.Intrinsic.Float.scaleUnit(low, high, unit), advanced)
+    end
+
+    let drawBoolean(source: Generator) -> (Bool, Generator) do
+      let (word, advanced) = nextWord(source)
+      (Kex.Intrinsic.Bits.shiftRight(word, 63) == 1, advanced)
+    end
+
+    let drawChance(source: Generator, probability: Float) -> (Bool, Generator) do
+      if !(probability >= 0.0 && probability <= 1.0)
+        die("Random.chance?: probability must be between 0.0 and 1.0")
+      end
+      let (value, advanced) = drawFloat(source, 0.0..1.0)
+      (value < probability, advanced)
+    end
+
+    let drawChoice(source: Generator, items: [X]) -> (X?, Generator) do
+      return (None, source) if items.empty?
+      let (index, advanced) = below(source, items.count)
+      (items.at(index), advanced)
+    end
+
+    let drawSample(source: Generator, items: [X], count: Integer) -> ([X], Generator) do
+      if count < 0
+        die("Random.sample: count must not be negative")
+      end
+      var pool = items
+      var selected: [X] = []
+      var generator = source
+      while !pool.empty? && selected.count < count do
+        let (index, advanced) = below(generator, pool.count)
+        generator = advanced
+        selected.push!(pool.at(index).try)
+        pool = pool.take(index) + pool.drop(index + 1)
+      end
+      (selected, generator)
+    end
+
+    integerBetween : Generator -> Integer -> Integer -> (Integer, Generator)
+    let integerBetween(generator, low, high) do
+      if low > high
+        die("Random.integer: lower bound must not exceed upper bound")
+      end
+      let (value, advanced) = below(generator, high - low + 1)
+      (low + value, advanced)
+    end
+
+    integerBounds : Range<Integer> -> (Integer, Integer)
+    let integerBounds(range) = Kex.Intrinsic.Range.bounds(range)
+
+    floatBounds : Range<Float> -> (Float, Float)
+    let floatBounds(range) = Kex.Intrinsic.Range.bounds(range)
+
+    # SplitMix64's arithmetic stays private; public operations expose values.
+    nextWord : Generator -> (Integer, Generator)
+    let nextWord(generator: Generator) -> (Integer, Generator) do
+      let mask = 18446744073709551615
+      let advanced = Kex.Intrinsic.Bits.and(generator.state + 0x9e3779b97f4a7c15, mask)
+      let spread1 = Kex.Intrinsic.Bits.xor(advanced, Kex.Intrinsic.Bits.shiftRight(advanced, 30))
+      let mixed1 = Kex.Intrinsic.Bits.and(spread1 * 0xbf58476d1ce4e5b9, mask)
+      let spread2 = Kex.Intrinsic.Bits.xor(mixed1, Kex.Intrinsic.Bits.shiftRight(mixed1, 27))
+      let mixed2 = Kex.Intrinsic.Bits.and(spread2 * 0x94d049bb133111eb, mask)
+      let word = Kex.Intrinsic.Bits.xor(mixed2, Kex.Intrinsic.Bits.shiftRight(mixed2, 31))
+      (word, Generator { state: advanced })
+    end
+
+    below : Generator -> Integer -> (Integer, Generator)
+    let below(generator: Generator, bound: Integer) -> (Integer, Generator) do
+      let maximum = 18446744073709551616
+      if bound <= 0 || bound > maximum
+        die("Random.integer: range must contain between 1 and 2^64 integers")
+      end
+      let (word, advanced) = nextWord(generator)
+      let limit = maximum - maximum.modulo(bound)
+      return (word.modulo(bound), advanced) if word < limit
+      below(advanced, bound)
+    end
+  end
+end
 # A span between two bounds, written +(1..10)+ or +('a'..'z')+.
 #
-# A range stores only its two endpoints and computes everything else from
-# them, so +(1..1000000)+ costs nothing to make. Both ends are included.
+# A range stores its endpoints on both backends without building a list.
+# Integer and character ranges can be enumerated with both ends included.
+# Float ranges describe continuous bounds, for example +(-1.0..1.0)+ for
+# random sampling; they cannot be enumerated without an explicit step.
 #
 #   (1..5).items          # => [1, 2, 3, 4, 5]
 #   (1..5).sum            # => 15
@@ -12022,11 +13349,8 @@ make Range, implement: Enumerable, Foldable do
   # @example
   #   (3..7).first   # => Just(3)
   # The list operations, over the materialized items. A range is an ordered
-  # collection, so `(1..5).first` and `(1..5).length` are questions it can
-  # answer, and on the BEAM backend, where a range IS its item list, they
-  # already worked. Only the walker rejected them ("Undefined method: first
-  # for Range"), so every one of these was a backend divergence rather than a
-  # deliberate restriction.
+  # collection, so +(1..5).first+ and +(1..5).length+ operate on its
+  # materialized elements. Floating bounds do not define such a collection.
   first :> A?
   let first = this.items.first
 
@@ -14251,10 +15575,13 @@ type Node = Text(String)
 type Tag = Scalar(String)
          | Tags([String])
 
-# Why a template's text could not be scanned, and where.
+# Why a template's text could not be scanned or rendered, and where (or,
+# for `render`/`renderParsed`, what stopped it).
 type TemplateError = UnterminatedTag(Integer)
                     | UnterminatedFrontmatter
                     | MalformedFrontmatterLine(String)
+                    | UndefinedVariable(String)
+                    | UnsupportedControl(String)
 
 # One entry from a `params: [...]` frontmatter list: a name, and its
 # optional `: Type` annotation. `type` is raw text: `""` for a bare name,
@@ -14346,6 +15673,86 @@ let escapeHtml(text: String) -> String do
       .replace("'", "&#39;")
 end
 
+# Renders an already-scanned template's holes from a runtime `context`,
+# `<%= %>` HTML-escaped and `<%== %>` raw, same as `Template.html`/
+# `Template.text` do at compile time — but there is no runtime evaluator for
+# `<% ... %>` CONTROL regions here. Evaluating a `<% if … %>`/`<% match … %>`/
+# a block loop chosen at run time means evaluating arbitrary Kex source
+# picked at run time, which is its own design decision (kexhq/kex#335) and
+# not what this covers: a template using one reports `UnsupportedControl`
+# with the region's text rather than silently doing nothing with it, so the
+# gap is loud, not a template that quietly renders wrong.
+#
+# This is for what `Template.html(Kex.embed(path))` cannot do at all — a
+# template file chosen while the program is running, not baked in at compile
+# time — for the shape of template that does not need control flow: a
+# subject line, a notification body, a plain-text substitution. A template
+# with real control flow still needs compiling in (`Kex.embed`), or a hole
+# it does not have: turning `Parsed#nodes` into a fuller runtime evaluator is
+# further work this only lays the groundwork for.
+#
+# `<%= %>`/`<%== %>` names are looked up VERBATIM (trimmed of surrounding
+# whitespace) in `context` — `dep.name` in a template needs a `"dep.name"`
+# key, not field access into a `dep` key's value. Splitting a dotted hole
+# into a real field path is, again, further work.
+#
+# @param parsed [Parsed] a template already scanned by `Template.scan`
+# @param context [{String: String}] a value for every `<%= %>`/`<%== %>`
+#   hole the template uses, keyed by the hole's exact (trimmed) text
+# @return [Result<String, TemplateError>] the rendered text, or why not
+#
+# @example
+#   let parsed = Template.scan("Hi <%= name %>!").try
+#   Template.renderParsed(parsed, { "name": "<Ada>" })
+#   # => Ok("Hi &lt;Ada&gt;!")
+#
+# @example A hole `context` does not cover
+#   Template.renderParsed(Template.scan("<%= missing %>").try, {})
+#   # => Error(UndefinedVariable("missing"))
+#
+# @example Control flow is refused, not silently skipped
+#   Template.renderParsed(Template.scan("<% if x %>y<% end %>").try, {})
+#   # => Error(UnsupportedControl("if x"))
+let renderParsed(parsed: Parsed, context: {String: String}) -> Result<String, TemplateError> do
+  var out = ""
+  var i = 0
+  loop do
+    break if i >= parsed.nodes.count
+    match parsed.nodes.at(i).or(Text("")) do
+      Text(text) => out = "${out}${text}"
+      Interpolate(name) => do
+        let value = context.get(name.trim)
+        return Error(UndefinedVariable(name.trim)) if value == None
+        out = "${out}${escapeHtml(value.or(""))}"
+      end
+      InterpolateRaw(name) => do
+        let value = context.get(name.trim)
+        return Error(UndefinedVariable(name.trim)) if value == None
+        out = "${out}${value.or("")}"
+      end
+      Comment(_) => ()
+      Control(body) => return Error(UnsupportedControl(body))
+    end
+    i = i + 1
+  end
+  Ok(out)
+end
+
+# `Template.scan(source).try` then `renderParsed` — see its doc comment for
+# what this does and, as importantly, what it refuses to do.
+#
+# @param source [String] the template's full text, scanned fresh
+# @param context [{String: String}] see `renderParsed`
+# @return [Result<String, TemplateError>] the rendered text, or why not
+#
+# @example
+#   Template.render("Hi <%= name %>!", { "name": "Ada" })
+#   # => Ok("Hi Ada!")
+let render(source: String, context: {String: String}) -> Result<String, TemplateError> do
+  let parsed = scan(source).try
+  renderParsed(parsed, context)
+end
+
 private do
   # True when `cursor` sits at the very start of the input and that line is
   # exactly `---`: the only place a frontmatter block may open.
@@ -14375,17 +15782,21 @@ private do
   # A cursor advanced to the next `\n` (not past it), and the text skipped.
   #
   # Hand-rolled rather than `Input#takeWhile`: see `scanText`'s comment on why.
+  #
+  # Tracks the run's start position and slices once at the end, rather than
+  # building it one `Char` at a time with `push!`: pushing to a `var` list
+  # rebinds it to a freshly copied list every call (kexhq/kex#379), so a
+  # character-at-a-time accumulation of an N-character line cost O(N^2), not
+  # O(N). One slice is O(N) total regardless of how many lines are scanned.
   let scanLine(cursor: Input) -> (String, Input) do
     var cur = cursor
-    var chars: [Char] = []
+    let start = cur.pos
     loop do
       break if cur.peek == None
       break if cur.peek == Just('\n')
-      let Just(ch) = cur.peek
-      chars.push!(ch)
       cur.advance!
     end
-    (chars.join(""), cur)
+    (cur.input.chars.drop(start).take(cur.pos - start).join(""), cur)
   end
 
   # A line's text with any trailing `\r` dropped, for a source that mixes
@@ -14516,23 +15927,31 @@ private do
   # collides with `List#takeWhile`, and calling it through an `Input` receiver
   # sends overload resolution down the wrong path (`json.kex`'s own scanners
   # hit the same thing and avoid it the same way).
+  #
+  # Tracks each run's start position and slices it out whole, rather than
+  # pushing one `Char` at a time: see `scanLine`'s comment on why that was
+  # quadratic (kexhq/kex#379). `<%%` still needs a per-occurrence split (it
+  # folds three input characters into two output ones), but that split is as
+  # rare as `<%%` itself, not once per character of ordinary text.
   let scanText(cursor: Input) -> (String, Input) do
     var cur = cursor
-    var chars: [Char] = []
+    var pieces: [String] = []
+    var runStart = cur.pos
     loop do
       break if cur.peek == None
       break if atTagOpen?(cur)
       if cur.peek == Just('<') && cur.peekAt(1) == Just('%') && cur.peekAt(2) == Just('%')
-        chars.push!('<')
-        chars.push!('%')
+        pieces.push!(cur.input.chars.drop(runStart).take(cur.pos - runStart).join(""))
+        pieces.push!("<%")
         cur.advanceBy!(3)
+        runStart = cur.pos
       else
-        let Just(ch) = cur.peek
-        chars.push!(ch)
         cur.advance!
+        ()
       end
     end
-    (chars.join(""), cur)
+    pieces.push!(cur.input.chars.drop(runStart).take(cur.pos - runStart).join(""))
+    (pieces.join(""), cur)
   end
 
   # Strips trailing spaces and tabs (not newlines): the indentation a `<%-`
@@ -14616,16 +16035,17 @@ private do
 
   # Reads a tag's body up to its closer, `%>` or `-%>`. Answers the raw text,
   # whether the closer trims the following newline, and the cursor past it.
+  #
+  # Slices the body out once at the closer, rather than pushing one `Char` at
+  # a time — see `scanLine`'s comment on why that was quadratic
+  # (kexhq/kex#379).
   let scanTagBody(cursor: Input) -> Result<(String, Bool, Input), TemplateError> do
     let start = cursor.pos
     var cur = cursor
-    var chars: [Char] = []
     loop do
       return Error(UnterminatedTag(start)) if cur.peek == None
-      return Ok((chars.join(""), true, cur.advanceBy(3))) if cur.peek == Just('-') && cur.peekAt(1) == Just('%') && cur.peekAt(2) == Just('>')
-      return Ok((chars.join(""), false, cur.advanceBy(2))) if cur.peek == Just('%') && cur.peekAt(1) == Just('>')
-      let Just(ch) = cur.peek
-      chars.push!(ch)
+      return Ok((cur.input.chars.drop(start).take(cur.pos - start).join(""), true, cur.advanceBy(3))) if cur.peek == Just('-') && cur.peekAt(1) == Just('%') && cur.peekAt(2) == Just('>')
+      return Ok((cur.input.chars.drop(start).take(cur.pos - start).join(""), false, cur.advanceBy(2))) if cur.peek == Just('%') && cur.peekAt(1) == Just('>')
       cur.advance!
     end
   end
@@ -15466,10 +16886,10 @@ module Time do
   #   Time.daysFromCivil(1970, 1, 1)   # => 0
   #   Time.daysFromCivil(2026, 7, 30)  # => 20664
   let daysFromCivil(year: Integer, month: Integer, day: Integer) -> Integer do
-    let y = if month <= 2 then year - 1 else year end
-    let era = if y < 0 then (y - 399) / 400 else y / 400 end
+    let y = month <= 2 then year - 1 else year
+    let era = y < 0 then (y - 399) / 400 else y / 400
     let yoe = y - era * 400
-    let mp = if month > 2 then month - 3 else month + 9 end
+    let mp = month > 2 then month - 3 else month + 9
     let doy = (153 * mp + 2) / 5 + day - 1
     let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy
     return era * 146097 + doe - 719468
@@ -15486,15 +16906,15 @@ module Time do
   #   Time.civilFromDays(20664).iso   # => "2026-07-30"
   let civilFromDays(epochDay: Integer) -> Date do
     let z = epochDay + 719468
-    let era = if z < 0 then (z - 146096) / 146097 else z / 146097 end
+    let era = z < 0 then (z - 146096) / 146097 else z / 146097
     let doe = z - era * 146097
     let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365
     let y = yoe + era * 400
     let doy = doe - (365 * yoe + yoe / 4 - yoe / 100)
     let mp = (5 * doy + 2) / 153
     let day = doy - (153 * mp + 2) / 5 + 1
-    let month = if mp < 10 then mp + 3 else mp - 9 end
-    let year = if month <= 2 then y + 1 else y end
+    let month = mp < 10 then mp + 3 else mp - 9
+    let year = month <= 2 then y + 1 else y
     return Date { year: year, month: month, day: day }
   end
 
@@ -15629,8 +17049,8 @@ module Time do
   let formatOffset(offset: Duration) -> String do
     let total = offset.wholeSeconds
     return "Z" if total == 0
-    let sign = if total < 0 then "-" else "+" end
-    let magnitude = if total < 0 then 0 - total else total end
+    let sign = total < 0 then "-" else "+"
+    let magnitude = total < 0 then 0 - total else total
     return "${sign}${Time.pad2(magnitude / 3600)}:${Time.pad2(magnitude.modulo(3600) / 60)}"
   end
 
@@ -16170,7 +17590,7 @@ make Duration do
   #
   # @example
   #   (1.hours - 90.minutes).abs.wholeMinutes   # => 30
-  let abs -> Duration = Duration { seconds: if this.seconds < 0.0 then 0.0 - this.seconds else this.seconds end }
+  let abs -> Duration = Duration { seconds: this.seconds < 0.0 then 0.0 - this.seconds else this.seconds }
 
   # Returns +true+ when the span is exactly zero.
   #
@@ -16542,9 +17962,9 @@ make Period, implement: Inspectable, Showable do
   #   2.months.iso             # => "P2M"
   let iso -> String do
     return "P0D" if this.zero?
-    let years = if this.years != 0 then "${this.years}Y" else "" end
-    let months = if this.months != 0 then "${this.months}M" else "" end
-    let days = if this.days != 0 then "${this.days}D" else "" end
+    let years = this.years != 0 then "${this.years}Y" else ""
+    let months = this.months != 0 then "${this.months}M" else ""
+    let days = this.days != 0 then "${this.days}D" else ""
     return "P${years}${months}${days}"
   end
 end
@@ -16708,7 +18128,7 @@ make Date, implement: Inspectable, Showable do
     let month = total.modulo(12) + 1
     let year = (total - total.modulo(12)) / 12
     let last = Time.daysInValidMonth(year, month)
-    let day = if this.day > last then last else this.day end
+    let day = this.day > last then last else this.day
     return Date { year: year, month: month, day: day }
   end
 
@@ -17592,7 +19012,7 @@ make Type do
     # A function reads as its signature: `String -> String`, `foul () -> Void`.
     if this.name == "Function" && this.args.count > 0
       let arrow = this.args.map(&.to(String)).join(" -> ")
-      let signature = if this.args.count == 1 then "() -> ${arrow}" else arrow end
+      let signature = this.args.count == 1 then "() -> ${arrow}" else arrow
       return "foul ${signature}" if this.pure == false
       return signature
     end
@@ -17918,11 +19338,21 @@ make Float do
   end
 end
 
-make Measure do
+make Measure, implement: Showable do
   let factor -> Float = this.unit.factor
   let kind -> Atom = this.unit.kind
   let symbol -> String = this.unit.symbol
   let to(String) -> String = "${this.value} ${this.unit.symbol}"
+
+  # Renders the measure as its value and unit, so +IO.printLine+ and
+  # interpolation show +5.0 W+ rather than the record's fields. Inspecting
+  # it (the REPL's echo, +inspected+) still shows the record itself.
+  #
+  # @return [String] the value and the unit's symbol
+  #
+  # @example
+  #   "drawn: ${1.volt * 5.ampere}"   # => "drawn: 5.0 W"
+  let showValue -> String = this.to(String)
   # Formatting into a target display unit deliberately has NO prelude clause.
   # A unit module (Units.SI, Units.Data, ...) supplies `to(String, in:)` for
   # the units it owns, and reaching one requires importing it. A catch-all
@@ -18990,6 +20420,21 @@ module Query do
   from : [(String, String?)] -> Query
   let from(entries) = Query { entries: entries }
 
+  # Builds a query from unordered key/value pairs, for the common case where
+  # every key is used once. A `Map` cannot hold "tag" twice, so — unlike the
+  # list form above — repeating a key here does not add a second field; it
+  # silently keeps only one value for it. Reach for the ordered list form
+  # instead of this one for anything that legitimately repeats a key, such
+  # as `?tag=kex&tag=beam`.
+  #
+  # @param entries [Map<String, String?>] decoded key/value pairs, one per key
+  # @return [Query] the query
+  #
+  # @example Building filters that each use a distinct key
+  #   Query.from({ "sort": Just("name"), "debug": None })
+  from : Map<String, String?> -> Query
+  let from(entries: Map<String, String?>) = Query { entries: entries.entries }
+
   # Parses generic URI query encoding; ++ remains a literal plus.
   #
   # @param text [String] encoded query text without the leading question mark
@@ -19012,6 +20457,21 @@ module Form do
   from : [(String, String)] -> Form
   let from(entries) = Kex.Intrinsic.URI.formFrom(entries)
 
+  # Builds a form from unordered key/value pairs, for the common case where
+  # every field name is used once. A `Map` cannot hold a name twice, so —
+  # unlike the list form above — a repeated field name here does not add a
+  # second entry; it silently keeps only one value for it. Reach for the
+  # ordered list form instead of this one for anything that legitimately
+  # repeats a field name, such as several same-named checkboxes.
+  #
+  # @param entries [Map<String, String>] decoded form fields, one per name
+  # @return [Form] the form
+  #
+  # @example Preparing a login request body
+  #   Form.from({ "email": email, "password": password }).encode
+  from : Map<String, String> -> Form
+  let from(entries: Map<String, String>) = Kex.Intrinsic.URI.formFrom(entries.entries)
+
   # Parses form encoding where ++ represents a space.
   #
   # @param text [String] an +application/x-www-form-urlencoded+ body