@kexhq/kex 0.4.0-beta.3 → 0.4.0-beta.4

package/dist/kex_repl_wasm.data

@@ -171,6 +171,50 @@ make [A], implement: Monoid do
   #   groups.reduce([]) { |acc, g| acc.combine(g) }
   let combine(other: This) -> This = this + other
 end
+# Atoms: the +:name+ values. An atom is its own name — two atoms with the same
+# text are the same value, and comparing them is as cheap as comparing numbers.
+#
+#   :ok
+#   :b@localhost                  # an interior `@` is part of a bare atom
+#   :"b@host.example.com"         # the quoted form spells any text
+#
+# Most atoms are written in the source. From text:
+#
+#   "hello".as(Atom)     # at compile time, from a literal
+#   Atom.from(text)      # at run time, making the atom — a node name, say
+#   text.to(Atom)        # at run time, only an atom that already exists: Atom?
+#
+# and +string+ gives the text back.
+module Atom do
+  # Returns the atom whose name is +text+.
+  #
+  # On the BEAM atoms are never freed, and a node holds at most about a
+  # million. Build atoms from a bounded set of names — node names, config
+  # keys — never from untrusted input; +text.to(Atom)+ is the safe form for
+  # that, since it only finds atoms that already exist.
+  #
+  # @param text [String] the atom's name
+  # @return [Atom] the atom
+  #
+  # @example
+  #   Atom.from("ok") == :ok                # => true
+  #   Atom.from("app@${host}")              # => :"app@myhost"
+  from : String -> Atom
+  let from(text) = Kex.Intrinsic.Atom.from(text)
+end
+
+make Atom do
+  # Returns the atom's name as text, without the leading colon. Total, like
+  # +Char.string+: every atom has a name.
+  #
+  # @return [String] the name
+  #
+  # @example
+  #   :ok.string                    # => "ok"
+  #   :"b@host.example.com".string  # => "b@host.example.com"
+  string :> String
+  let string = Kex.Intrinsic.Atom.name(this)
+end
 # An opaque, immutable sequence of bytes. A +Binary+ never implicitly becomes
 # text.
 #
@@ -312,6 +356,31 @@ make Binary, implement: Showable, Inspectable do
   #   data.at(-1)   # => None
   let at(index: Integer) -> Byte? = Kex.Intrinsic.Binary.at(this, index)
 
+  # The byte at +index+, counting from zero. The same as +at+, matching the
+  # +get+ that +List+ and +String+ carry.
+  #
+  # @param index [Integer] the position to read
+  # @return [Byte?] the byte, or +None+ when the index is outside the binary
+  #
+  # @example
+  #   Binary.fromBytes([104, 105]).get(1)   # => Just(105)
+  #   Binary.fromBytes([104, 105]).get(9)   # => None
+  get :> Integer -> Byte?
+  let get(index) = this.at(index)
+
+  # The byte at +index+, or +default+ when the index is outside the binary.
+  # The total form of +get+: the byte comes back unwrapped.
+  #
+  # @param index [Integer] the position to read
+  # @param default [Byte] the value to use when out of range
+  # @return [Byte] the byte, or +default+
+  #
+  # @example
+  #   Binary.fromBytes([104, 105]).get(0, 0)   # => 104
+  #   Binary.fromBytes([104, 105]).get(9, 0)   # => 0
+  get :> Integer -> Byte -> Byte
+  let get(index, default) = this.at(index).or(default)
+
   # The first +count+ bytes.
   #
   # Clamped at both ends, like the list operations: a +count+ of zero or less
@@ -1108,11 +1177,7 @@ module Console do
   enabled? : Bool
   let enabled? = Kex.Intrinsic.Console.enabled?
 end
-# Runs bounded retries with a reusable schedule.
-#
-# +Retry.run+ executes the block immediately. An +Ok+ stops the run; an
-# +Error+ schedules another attempt. When attempts or total sleep run out,
-# the last error is returned unchanged. Runtime faults are not caught.
+# Retry an operation after it returns an error.
 #
 # @example Retry a request and handle the final result
 #   using Control.Retry
@@ -1126,22 +1191,116 @@ end
 #     Error(error) => IO.printLine(error.message)
 #   end
 #
-# HTTP responses, including 429 and 503, are +Ok(response)+. Automatic
-# retries handle request failures, not response statuses. Use +again+ and
-# +done+ to classify responses or stop on permanent errors. Repeat writes
-# only when the application makes them safe, for example with idempotency
-# keys. A schedule bounds retry sleep, not the operation's execution time;
-# configure request timeouts separately.
+# @example Fixed delays: three waits of 250 milliseconds
+#   let schedule = Retry.Schedule {
+#     attempts: 4, delay: 250.milliseconds, backoff: 1.0,
+#     maximumDelay: 250.milliseconds, jitter: 0.0
+#   }
+#   Retry.run(schedule: schedule) do
+#     Error("not ready")
+#   end
+#   # => Error("not ready"), after four calls and 750 ms of sleep
+#
+# @example Exponential delays: 200, 400, 800, 1600 milliseconds
+#   let schedule = Retry.Schedule {
+#     attempts: 5, delay: 200.milliseconds, backoff: 2.0,
+#     maximumDelay: 5.seconds, jitter: 0.0
+#   }
+#   Retry.run(schedule: schedule) do
+#     Error("busy")
+#   end
+#   # => Error("busy"), after five calls and three seconds of sleep
+#
+# @example Capped delays: 500 ms, 1 s, 2 s, 2 s, 2 s
+#   Retry.Schedule {
+#     attempts: 6, delay: 500.milliseconds, backoff: 2.0,
+#     maximumDelay: 2.seconds, jitter: 0.0
+#   }
+#
+# @example Use one schedule for two requests
+#   using Net.HTTP
+#   let schedule = Retry.Schedule { attempts: 5 }
+#   let inventory = Retry.run(schedule: schedule) do
+#     HTTP.get("https://api.example.com/inventory")
+#   end
+#   let orders = Retry.run(schedule: schedule) do
+#     HTTP.get("https://api.example.com/orders")
+#   end
+#   # Each request gets up to five attempts, independently.
+#
+# @example Set retry options directly
+#   Retry.run(attempts: 5, delay: 200.milliseconds, jitter: 0.0) do
+#     Ok("ready")
+#   end
+#   # => Ok("ready")
+#
+# @example Limit the time spent sleeping
+#   Retry.run(
+#     attempts: 5, delay: 1.seconds, backoff: 2.0,
+#     jitter: 0.0, maximumTotalDelay: Just(2.seconds)
+#   ) do
+#     Error("busy")
+#   end
+#   # => Error("busy"), two calls and one second of sleep
+#
+# @example Test jitter without waiting
+#   Retry.run(
+#     attempts: 2, delay: 4.seconds, jitter: 0.25,
+#     sleeper: { |wait| Assert.equal(wait, 3.seconds) },
+#     random: { 0.0 }
+#   ) do
+#     Error("temporary")
+#   end
+#   # => Error("temporary"), two calls and one fake sleep
+#
+# @example Report progress
+#   using Net.HTTP
+#   Retry.run(attempts: 5, onRetry: { |info|
+#     let progress = "retrying ${info.nextAttempt}/${info.maximumAttempts}"
+#     IO.printLine("${progress} in ${info.delay.seconds} seconds")
+#   }) do
+#     HTTP.get("https://api.example.com/inventory")
+#   end
+#
+# @example Retry temporary HTTP failures and selected statuses
+#   using Net
+#   using Net.HTTP
+#   let schedule = Retry.Schedule { attempts: 5 }
+#   let outcome = Retry.run(schedule: schedule) do
+#     let result = HTTP.get("https://api.example.com/inventory")
+#     match result do
+#       Error(error) => if error.kind == Timeout || error.kind == Connect
+#         Retry.again(result)
+#       else
+#         Retry.done(result)
+#       end
+#       Ok(response) => if [429, 502, 503, 504].contains?(response.status.code)
+#         Retry.again(result)
+#       else
+#         Retry.done(result)
+#       end
+#     end
+#   end
+#   match outcome do
+#     Done(result) => IO.printLine(result)
+#     Again(last) => IO.printLine("retry budget exhausted: ${last}")
+#   end
 module Control.Retry
 
-# Provides automatic error retries and explicit retry decisions.
+# +run+ calls the block immediately. +Ok+ stops; +Error+ waits and retries.
+# When the schedule runs out, it returns the last error unchanged.
+# Use +again+ and +done+ when your application needs to choose what to retry.
+#
+# HTTP 429 and 503 responses are +Ok(response)+, so retrying those statuses
+# requires an explicit decision. For writes, make sure repeating the request
+# is safe, for example by using an idempotency key. Set request timeouts
+# separately: the schedule limits sleep, not time spent inside the operation.
 module Retry do
-  # Describes the timing and limits of one execution of +run+.
+  # Timing and attempt limits for +run+.
   #
-  # All fields are optional. Defaults allow three attempts with exponential
-  # backoff from 100 milliseconds, capped at 5 seconds, with 20% jitter.
-  # Creating a schedule performs no work. It is immutable configuration:
-  # each run starts a fresh attempt count and delay sequence.
+  # Defaults: three attempts, starting with a 100 ms wait, doubling up to
+  # 5 seconds, with 20% jitter. All fields are optional.
+  # A schedule holds settings. Reusing it starts each run from attempt one.
   #
   # * +attempts+: maximum executions, including the first; default 3.
   # * +delay+: initial base wait; default 100 milliseconds.
@@ -1152,42 +1311,6 @@ module Retry do
   #   Operation execution time is excluded. A wait that exceeds the remaining
   #   allowance ends the run without sleeping or calling the operation again.
   #
-  # @example Fixed delays: three waits of 250 milliseconds
-  #   let schedule = Retry.Schedule {
-  #     attempts: 4, delay: 250.milliseconds, backoff: 1.0,
-  #     maximumDelay: 250.milliseconds, jitter: 0.0
-  #   }
-  #   Retry.run(schedule: schedule) do
-  #     Error("not ready")
-  #   end
-  #   # => Error("not ready"), after four calls and 750 ms of sleep
-  #
-  # @example Exponential delays: 200, 400, 800, 1600 milliseconds
-  #   let schedule = Retry.Schedule {
-  #     attempts: 5, delay: 200.milliseconds, backoff: 2.0,
-  #     maximumDelay: 5.seconds, jitter: 0.0
-  #   }
-  #   Retry.run(schedule: schedule) do
-  #     Ok("ready")
-  #   end
-  #   # => Ok("ready"), immediately, without sleeping
-  #
-  # @example Capped delays: 500 ms, 1 s, 2 s, 2 s, 2 s
-  #   Retry.Schedule {
-  #     attempts: 6, delay: 500.milliseconds, backoff: 2.0,
-  #     maximumDelay: 2.seconds, jitter: 0.0
-  #   }
-  #
-  # @example Share settings, not an attempt budget
-  #   using Net.HTTP
-  #   let schedule = Retry.Schedule { attempts: 5 }
-  #   let inventory = Retry.run(schedule: schedule) do
-  #     HTTP.get("https://api.example.com/inventory")
-  #   end
-  #   let orders = Retry.run(schedule: schedule) do
-  #     HTTP.get("https://api.example.com/orders")
-  #   end
-  #   # Each request gets up to five attempts, independently.
   record Schedule do
     # Maximum executions including the initial call. Default: 3.
     # Values below 1 are treated as 1: the initial call always happens.
@@ -1211,36 +1334,31 @@ module Retry do
     maximumTotalDelay : Duration? = None
   end
 
-  # Carries an explicit decision and the last application value.
+  # Whether to retry, together with the last result.
   # +Done(value)+ means the block stopped deliberately. +Again(value)+
   # returned by +run+ means the schedule was exhausted before completion.
-  # Neither form wraps the application value in an additional +Result+.
+  # The value inside can be any application result, including an +Error+.
   type Decision<X> = Again(X) | Done(X)
 
-  # Requests another attempt if the schedule allows it.
+  # Retry this operation if the schedule has room for another attempt.
   #
   # @param value [X] the last outcome, retained if the schedule is exhausted
   # @return [Decision<X>] +Again(value)+
-  # @example Polling an application job
-  #   Retry.again("pending")
   again : X -> Decision<X>
   let again(value) = Again(value)
 
-  # Stops immediately, even when the application value represents failure.
+  # Stop now. The supplied value may be a success or a permanent failure.
   #
   # @param value [X] the final application outcome
   # @return [Decision<X>] +Done(value)+
-  # @example Stop on invalid credentials without retrying
-  #   Retry.done(Error("invalid credentials"))
   done : X -> Decision<X>
   let done(value) = Done(value)
 
-  # Describes a retry that is about to wait and then execute another attempt.
+  # Progress passed to +onRetry+ before the next wait.
   #
-  # Passed to +onRetry+ only after the last outcome requests a retry and
-  # the schedule permits it. There is no notification for the initial call,
-  # success, explicit completion, or exhaustion. Reporting does not consume
-  # attempts. Durations describe scheduled sleep, not wall-clock elapsed time.
+  # The callback runs only when another attempt is allowed. It does not run
+  # for the first call, a successful result, +done+, or exhaustion.
+  # Durations count scheduled sleep; they exclude time spent in the operation.
   #
   # * +attempt+: the just-completed attempt, starting at 1.
   # * +nextAttempt+: the attempt that follows the upcoming wait.
@@ -1266,23 +1384,25 @@ module Retry do
     result : X
   end
 
-  # Runs a fresh operation until it succeeds, stops, or exhausts its schedule.
+  # Call the block until it succeeds, returns +done+, or runs out of attempts or sleep time.
   #
   # The first attempt is immediate. Every later attempt follows one sleep.
   # There is no sleep after success or the final error. Named timing options
   # override the corresponding schedule field for this execution only.
   #
-  # An ordinary block returns +Result<X, E>+: +Ok+ stops, +Error+ retries,
-  # and exhaustion returns the last +Error+ unchanged. An explicit block
-  # returns +Decision<X>+: +Done+ stops, +Again+ retries, and exhaustion
-  # returns the last +Again+. Match the returned decision to distinguish
-  # completion from exhaustion. Use one form consistently within a block.
+  # Return a +Result+ from the block for automatic retries: +Ok+ stops and
+  # +Error+ retries. If no more retries are allowed, +run+ returns the last error.
   #
-  # Finite settings are normalized: attempts below one become one, negative
+  # Return +done(value)+ or +again(value)+ to make the decision yourself.
+  # The final +Done+ means the block chose to stop; +Again+ means it wanted
+  # another try but the schedule ran out. Use one return form throughout the
+  # block. Runtime faults propagate; they are not retried.
+  #
+  # Out-of-range settings are adjusted: attempts below one become one, negative
   # durations become zero, backoff below one becomes one, jitter and random
   # samples are clamped to 0..1. Non-finite Float settings are unsupported.
   #
-  # @param operation [Block<X>] fresh Result or Decision on each attempt
+  # @param operation [Block<X>] called again for each attempt; returns Result or Decision
   # @param schedule [Schedule] reusable settings; defaults to +Schedule {}+
   # @param attempts [Integer] total attempts; defaults to the schedule field
   # @param delay [Duration] initial wait; defaults to the schedule field
@@ -1293,65 +1413,7 @@ module Retry do
   # @param sleeper [Duration -> Void] defaults to real +Task.sleep+
   # @param random [Block<Float>] defaults to secure backend sampling in 0..1
   # @param onRetry [Info<X> -> Void] reports an allowed retry; defaults to no action
-  # @return [X] first Ok/Done or last Error/Again, without extra wrapping
-  #
-  # @example Named options without constructing a schedule
-  #   Retry.run(attempts: 5, delay: 200.milliseconds, jitter: 0.0) do
-  #     Ok("ready")
-  #   end
-  #   # => Ok("ready")
-  #
-  # @example Stop before a wait exceeds the total sleep budget
-  #   Retry.run(
-  #     attempts: 5, delay: 1.seconds, backoff: 2.0,
-  #     jitter: 0.0, maximumTotalDelay: Just(2.seconds)
-  #   ) do
-  #     Error("busy")
-  #   end
-  #   # => Error("busy"), two calls and one second of sleep
-  #
-  # @example Test jitter without waiting
-  #   Retry.run(
-  #     attempts: 2, delay: 4.seconds, jitter: 0.25,
-  #     sleeper: { |wait| Assert.equal(wait, 3.seconds) },
-  #     random: { 0.0 }
-  #   ) do
-  #     Error("temporary")
-  #   end
-  #   # => Error("temporary"), two calls and one fake sleep
-  #
-  # @example Report progress to a user or log
-  #   using Net.HTTP
-  #   Retry.run(attempts: 5, onRetry: { |info|
-  #     let progress = "retrying ${info.nextAttempt}/${info.maximumAttempts}"
-  #     IO.printLine("${progress} in ${info.delay.seconds} seconds")
-  #   }) do
-  #     HTTP.get("https://api.example.com/inventory")
-  #   end
-  #
-  # @example Retry temporary HTTP failures and selected statuses
-  #   using Net
-  #   using Net.HTTP
-  #   let schedule = Retry.Schedule { attempts: 5 }
-  #   let outcome = Retry.run(schedule: schedule) do
-  #     let result = HTTP.get("https://api.example.com/inventory")
-  #     match result do
-  #       Error(error) => if error.kind == Timeout || error.kind == Connect
-  #         Retry.again(result)
-  #       else
-  #         Retry.done(result)
-  #       end
-  #       Ok(response) => if [429, 502, 503, 504].contains?(response.status.code)
-  #         Retry.again(result)
-  #       else
-  #         Retry.done(result)
-  #       end
-  #     end
-  #   end
-  #   match outcome do
-  #     Done(result) => IO.printLine(result)
-  #     Again(last) => IO.printLine("retry budget exhausted: ${last}")
-  #   end
+  # @return [X] first Ok/Done, or last Error/Again when retries run out
   #
   # +Done(Error(...))+ means the application stopped on a permanent error.
   # +Again(Ok(response))+ means an unacceptable HTTP status persisted until
@@ -1422,12 +1484,12 @@ module Retry do
         return result
       end
       let fraction = clamp(schedule.jitter, 0.0, 1.0)
-      let sample = if fraction == 0.0 then 0.5 else clamp(random(), 0.0, 1.0) end
+      let sample = fraction == 0.0 then 0.5 else clamp(random(), 0.0, 1.0)
       let sleepSeconds = boundedDelay(schedule, base * (1.0 + (sample * 2.0 - 1.0) * fraction))
       let nextElapsed = elapsed + sleepSeconds
       let allowed = match schedule.maximumTotalDelay do
         None => true
-        Just(limit) => nextElapsed <= (if limit.seconds < 0.0 then 0.0 else limit.seconds end)
+        Just(limit) => nextElapsed <= (limit.seconds < 0.0 then 0.0 else limit.seconds)
       end
       if !allowed
         return result
@@ -1442,7 +1504,7 @@ module Retry do
         result: result
       })
       sleeper(Duration { seconds: sleepSeconds })
-      let factor = if schedule.backoff < 1.0 then 1.0 else schedule.backoff end
+      let factor = schedule.backoff < 1.0 then 1.0 else schedule.backoff
       let nextBase = boundedDelay(schedule, base * factor)
       attempt(schedule, sleeper, random, onRetry, operation, number + 1, nextBase, nextElapsed)
     end
@@ -3610,7 +3672,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # condition. The same operation as +readLine+, under the name +IO.getLine+
   # uses.
   #
-  # @return [String?] the next line, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next line, or +None+ at end of file
   #
   # @example Walking a file line by line
   #   foul echo(handle: FileHandle<CanRead, W>) -> Void do
@@ -3629,7 +3691,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   #
   # Answers +None+ at end of file.
   #
-  # @return [String?] the next character, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next character, or +None+ at end of file
   #
   # @example
   #   let firstChar = handle.get.or("")
@@ -3639,7 +3701,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Reads the next line from the handle, without its newline. The same as
   # +getLine+, named for reading from a file rather than from a console.
   #
-  # @return [String?] the next line, or +None+ at end of file
+  # @return [Result<String?, ReadError>] the next line, or +None+ at end of file
   #
   # @example
   #   let header = handle.readLine.or("")
@@ -3654,7 +3716,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Reads from the current position, so calling it after a +readLine+ gives
   # the rest of the file rather than the whole of it.
   #
-  # @return [String?] the remaining contents, or +None+
+  # @return [Result<String, ReadError>] the remaining contents
   #
   # @example
   #   let body = handle.read.or("")
@@ -3670,7 +3732,7 @@ make FileHandle<CanRead, W>, implement: Readable do
   # Unlike +read+, this accepts arbitrary binary data and cannot fail because
   # the input is not valid UTF-8. It starts at the handle's current position.
   #
-  # @return [Binary] the remaining bytes
+  # @return [Result<Binary, ReadError>] the remaining bytes
   #
   # @example Reading a file with an unknown encoding
   #   let payload = handle.readBytes.try
@@ -3884,6 +3946,24 @@ module FS do
     | ReadFailed(FilePath)
     | InvalidUtf8(FilePath, Integer)
 
+  # What a path names, as +FS.File.info+ reports it: a regular +:file+, a
+  # +:directory+, a +:symlink+ (the link itself, never what it points at), or
+  # +:other+ for devices, sockets and pipes.
+  type FileKind = :file | :directory | :symlink | :other
+
+  # What one +stat+ of a path says about it.
+  record FileInfo do
+    # Which kind of entry the path names.
+    kind : FileKind
+
+    # The size in bytes. For a symlink, the length of the path it holds.
+    size : Integer
+
+    # When the contents last changed, at UTC, to the whole second: the
+    # precision the BEAM reports.
+    modified : DateTime
+  end
+
   # Reading and writing files.
   #
   # A capability: every member reaches the real filesystem, so a test can
@@ -3906,7 +3986,7 @@ module FS do
     #
     # @param path [FilePath] the file to open
     # @param mode [FileModes] +Read+, +Write+, +Append+ or +ReadWrite+
-    # @return [Result<FileHandle, FileError>] the handle, or +OpenFailed+
+    # @return [Result<FileHandle<CanRead, CannotWrite>, FileError>] the handle, or +OpenFailed+
     #
     # @example Reading a file line by line
     #   match FS.File.open("log.txt", Read) do
@@ -4297,6 +4377,32 @@ module FS do
     #   FS.File.symlink?("current")   # => true
     symlink? : FilePath -> Bool
     foul symlink?(path) = Kex.Intrinsic.File.symlink?(path)
+
+    # The kind, size and modification time of +path+, read in one +lstat+.
+    #
+    # One call answers what +file?+, +directory?+, +symlink?+ and +size+
+    # would otherwise ask separately, which is what walking a tree or
+    # fingerprinting it for changes wants. A symlink is described as itself,
+    # not followed.
+    #
+    # @param path [FilePath] the path to inspect
+    # @return [Result<FileInfo, FileError>] what the path names, or
+    #   +ReadFailed+ when it cannot be read
+    #
+    # @example
+    #   FS.File.info("hello.txt").try.size   # => 6
+    #   FS.File.info("src").try.kind         # => :directory
+    #   FS.File.info("nowhere")              # => Error(ReadFailed("nowhere"))
+    #
+    # @example Noticing that a file changed
+    #   let before = FS.File.info(path).try
+    #   ...
+    #   let changed = FS.File.info(path).try != before
+    info : FilePath -> Result<FileInfo, FileError>
+    foul info(path) = match Kex.Intrinsic.File.info(path) do
+      Just((kind, size, modified)) => Ok(FileInfo { kind: kind, size: size, modified: DateTime.fromEpochSeconds(modified) })
+      None => Error(ReadFailed(path))
+    end
   end
 
   # Path arithmetic: joining, splitting, normalising and comparing paths.
@@ -5144,12 +5250,12 @@ private do
 
     let allowComments = Kex.Intrinsic.Map.getWithDefault(options, allowCommentsKey(), false)
     # On BEAM, OTP's own decoder builds the same value in a fraction of the
-    # time (kexhq/kex#333). It answers None for anything it will not vouch
-    # for — invalid input, JSONC, the tree-walker — and this parser runs.
-    if !allowComments
-      if let Just(value) = Kex.Intrinsic.Json.decode(text)
-        return Ok(value)
-      end
+    # time (kexhq/kex#333), JSONC included once its comments are blanked out
+    # (kexhq/kex#405). It answers None for anything it will not vouch for —
+    # invalid input, the tree-walker — and this parser runs.
+    let fast = allowComments then Kex.Intrinsic.Json.decodeCommented(text) else Kex.Intrinsic.Json.decode(text)
+    if let Just(value) = fast
+      return Ok(value)
     end
     let cursor = skipIgnored(Input { input: text }, allowComments).try
     let (value, afterValue) = parseValue(cursor, allowComments).try
@@ -5633,20 +5739,58 @@ end
 # The running toolchain, which backend, which version, which features.
 #
 #   Kex.BACKEND                  # => Interpreter
-#   Kex.Kernel.VERSION.release   # => "0.4.0"
-#   Kex.Feature.has?(Kex.FS)     # => true
+#   Kex.BACKEND.compiled?        # => false
+#   Kex.VERSION.release          # => "0.4.0"
+#   Kex.Feature.has?(Kex.FileSystem)   # => true
 module Kex do
   # Which backend is executing the program: the tree-walking +Interpreter+, or
   # the +Beam+ virtual machine.
   type Backend = Interpreter | Beam
 
+  make Backend do
+    # Whether this is the tree-walking interpreter.
+    #
+    # @return [Bool] +true+ for +Interpreter+
+    #
+    # @example
+    #   Kex.BACKEND.interpreted?   # => true under `kex -R file.kex`
+    interpreted? :> Bool
+    let interpreted? = this == Interpreter
+
+    # Whether this backend runs compiled code: today, the BEAM.
+    #
+    # @return [Bool] +true+ for every backend but the interpreter
+    #
+    # @example
+    #   Kex.BACKEND.compiled?   # => true under `kex file.kex`
+    compiled? :> Bool
+    let compiled? = this != Interpreter
+
+    # Whether this is the BEAM virtual machine. Processes, the web server
+    # and clustering need it.
+    #
+    # @return [Bool] +true+ for +Beam+
+    #
+    # @example
+    #   Kex.BACKEND.beam?   # => true under `kex file.kex`
+    beam? :> Bool
+    let beam? = this == Beam
+  end
+
   # An optional capability a build may or may not include. Ask about one with
   # +Kex.Feature.has?+ before relying on it.
-  type Feature = FS | Process
+  #
+  # +FileSystem+: the program can read and write the host's files (+FS+).
+  # +ExternalPrograms+: it can run other programs (+Process.run+,
+  # +Process.stream+), which the browser build cannot.
+  #
+  # Kex's own processes (+spawn+, +receive+) are not optional: every backend
+  # has them. Networking has its finer-grained report, +Net.Support.current+.
+  type Feature = FileSystem | ExternalPrograms
 
   # Which backend is executing this program.
   #
-  # +interpreted?+ and +underBeam?+ below are the readable way to ask.
+  # Its +interpreted?+, +compiled?+ and +beam?+ are the readable way to ask.
   #
   # @return [Backend] the running backend
   #
@@ -5655,131 +5799,194 @@ module Kex do
   BACKEND : Backend
   let BACKEND = Kex.Intrinsic.Kex.backend()
 
-  # Returns +true+ when running on the tree-walking interpreter.
+  # Build identity for the compiler and runtime executing this program:
+  # +Version+ and +VERSION+ below.
   #
-  # @return [Bool] +true+ under the interpreter
-  #
-  # @example
-  #   Kex.interpreted?   # => true under `kex file.kex`
-  let interpreted? = Kex.BACKEND == Kex.Interpreter
-
-  # Returns +true+ when running on the BEAM.
-  #
-  # The backend a program is on decides what is available: processes and the
-  # web server need the BEAM (+kex -R file.kex+).
+  # Useful in bug reports, generated artifacts, and compatibility checks where
+  # +Kex.BACKEND+ alone is not enough to identify the toolchain.
+  # The toolchain a program is running on. `kex --version` and the REPL
+  # banner report the same numbers.
   #
-  # @return [Bool] +true+ under the BEAM
+  # `revision` is the git commit the compiler was built from: `None` when
+  # it was built from a source archive rather than a checkout, which is why
+  # it is an Optional rather than a String.
   #
   # @example
-  #   Kex.underBeam?   # => true under `kex -R file.kex`
-  let underBeam? = Kex.BACKEND == Kex.Beam
+  #   Kex.VERSION.major        # => 0
+  #   Kex.VERSION.revision     # => Just("a1b2c3d")
+  #   Kex.VERSION.to(String)   # => "0.3.0 (a1b2c3d)"
+  record Version do
+    # The major version number.
+    major : Integer
 
-  # Build identity for the compiler and runtime executing this program.
-  #
-  # Useful in bug reports, generated artifacts, and compatibility checks where
-  # +Kex.BACKEND+ alone is not enough to identify the toolchain.
-  module Kernel do
-    # The toolchain a program is running on. `kex --version` and the REPL
-    # banner report the same numbers.
+    # The minor version number.
+    minor : Integer
+
+    # The patch version number.
+    patch : Integer
+
+    # The git commit the compiler was built from, or +None+ when it was
+    # built from a source archive rather than a checkout.
+    revision : String?
+
+    # The release channel: "" for a stable build, otherwise "rc.1",
+    # "beta.2", "prealpha.1": the part of VERSION after the dash.
+    preRelease : String = ""
+  end
+
+  make Version do
+    # The version's four values as a tuple, for destructuring.
+    #
+    # A tuple cannot carry accessors of its own: there is no named type for
+    # a `make` block to target, so the record is the value and this is the
+    # view.
     #
-    # `revision` is the git commit the compiler was built from: `None` when
-    # it was built from a source archive rather than a checkout, which is why
-    # it is an Optional rather than a String.
+    # @return [(Integer, Integer, Integer, String?)] major, minor, patch, revision
     #
     # @example
-    #   Kex.Kernel.VERSION.major        # => 0
-    #   Kex.Kernel.VERSION.revision     # => Just("a1b2c3d")
-    #   Kex.Kernel.VERSION.to(String)   # => "0.3.0 (a1b2c3d)"
-    record Version do
-      # The major version number.
-      major : Integer
-
-      # The minor version number.
-      minor : Integer
-
-      # The patch version number.
-      patch : Integer
-
-      # The git commit the compiler was built from, or +None+ when it was
-      # built from a source archive rather than a checkout.
-      revision : String?
-
-      # The release channel: "" for a stable build, otherwise "rc.1",
-      # "beta.2", "prealpha.1": the part of VERSION after the dash.
-      preRelease : String = ""
-    end
+    #   let (major, minor, patch, revision) = Kex.VERSION.tuple
+    #   major   # => 0
+    tuple : (Integer, Integer, Integer, String?)
+    let tuple = (this.major, this.minor, this.patch, this.revision)
 
-    make Version do
-      # The version's four values as a tuple, for destructuring.
-      #
-      # A tuple cannot carry accessors of its own: there is no named type for
-      # a `make` block to target, so the record is the value and this is the
-      # view.
-      #
-      # @return [(Integer, Integer, Integer, String?)] major, minor, patch, revision
-      #
-      # @example
-      #   let (major, minor, patch, revision) = Kex.Kernel.VERSION.tuple
-      #   major   # => 0
-      tuple : (Integer, Integer, Integer, String?)
-      let tuple = (this.major, this.minor, this.patch, this.revision)
-
-      # The three numbers, plus the pre-release channel when there is one.
-      #
-      # `0.4.0`, or `0.4.0-rc.1` on a pre-release build. What a version RANGE
-      # is matched against, so the channel has to be in it.
-      #
-      # @return [String] the release string
-      #
-      # @example
-      #   Kex.Kernel.VERSION.release   # => "0.4.0-alpha.2"
-      release : String
-      let release = @preRelease.empty? then "${this.major}.${this.minor}.${this.patch}" else "${this.major}.${this.minor}.${this.patch}-${@preRelease}"
-
-      # The release string with the build revision after it, when there is one.
-      #
-      # This is what +kex --version+ and the REPL banner print.
-      #
-      # `to(String)`: the language's conversion protocol, and what this
-      # should really be: is deliberately NOT defined here: a second
-      # `to(String)` implementation anywhere in the prelude breaks
-      # type-directed `to` dispatch for every prelude type on BEAM, so adding
-      # one here silently broke `3.kilo.watt.to(String)`. Pinned by
-      # spec/prelude_to_string_dispatch.kex; restore this as `to(String)` once
-      # that dispatcher is fixed.
-      #
-      # @return [String] the full version string
-      #
-      # @example
-      #   Kex.Kernel.VERSION.number   # => "0.4.0-alpha.2 (219e625)"
-      #
-      # @example Reporting the toolchain in a tool's output
-      #   IO.printLine("built with Kex ${Kex.Kernel.VERSION.number}")
-      number : String
-      let number = match this.revision do
-        Just(hash) => "${this.release} (${hash})"
-        None => this.release
-      end
-    end
+    # The three numbers, plus the pre-release channel when there is one.
+    #
+    # `0.4.0`, or `0.4.0-rc.1` on a pre-release build. What a version RANGE
+    # is matched against, so the channel has to be in it.
+    #
+    # @return [String] the release string
+    #
+    # @example
+    #   Kex.VERSION.release   # => "0.4.0-alpha.2"
+    release : String
+    let release = @preRelease.empty? then "${this.major}.${this.minor}.${this.patch}" else "${this.major}.${this.minor}.${this.patch}-${@preRelease}"
 
-    # This build's version.
+    # The release string with the build revision after it, when there is one.
+    #
+    # This is what +kex --version+ and the REPL banner print.
+    #
+    # `to(String)`: the language's conversion protocol, and what this
+    # should really be: is deliberately NOT defined here: a second
+    # `to(String)` implementation anywhere in the prelude breaks
+    # type-directed `to` dispatch for every prelude type on BEAM, so adding
+    # one here silently broke `3.kilo.watt.to(String)`. Pinned by
+    # spec/prelude_to_string_dispatch.kex; restore this as `to(String)` once
+    # that dispatcher is fixed.
     #
-    # @return [Version] the running toolchain's version
+    # @return [String] the full version string
     #
     # @example
-    #   Kex.Kernel.VERSION.major     # => 0
-    #   Kex.Kernel.VERSION.release   # => "0.4.0-alpha.2"
-    #
-    # @example Reporting the version in a tool's output
-    #   IO.printLine("built with Kex ${Kex.Kernel.VERSION.number}")
-    VERSION : Version
-    let VERSION = match Kex.Intrinsic.Kex.version() do
-      (major, minor, patch, revision) =>
-        Version { major: major, minor: minor, patch: patch, revision: revision,
-                  preRelease: Kex.Intrinsic.Kex.versionPreRelease() }
+    #   Kex.VERSION.number   # => "0.4.0-alpha.2 (219e625)"
+    #
+    # @example Reporting the toolchain in a tool's output
+    #   IO.printLine("built with Kex ${Kex.VERSION.number}")
+    number : String
+    let number = match this.revision do
+      Just(hash) => "${this.release} (${hash})"
+      None => this.release
     end
   end
 
+  # This build's version.
+  #
+  # @return [Version] the running toolchain's version
+  #
+  # @example
+  #   Kex.VERSION.major     # => 0
+  #   Kex.VERSION.release   # => "0.4.0-alpha.2"
+  #
+  # @example Reporting the version in a tool's output
+  #   IO.printLine("built with Kex ${Kex.VERSION.number}")
+  VERSION : Version
+  let VERSION = match Kex.Intrinsic.Kex.version() do
+    (major, minor, patch, revision) =>
+      Version { major: major, minor: minor, patch: patch, revision: revision,
+                preRelease: Kex.Intrinsic.Kex.versionPreRelease() }
+  end
+
+  # A compiled module loaded into the running program by +Kex.load+.
+  #
+  # For a program that decides at run time what code it needs: a site
+  # generator rendering a theme's templates, a plugin host. Compile the source
+  # with `kex --compile -o <dir>` once, then load the `.beam` and call it as
+  # often as needed, without starting another VM for every call
+  # (kexhq/kex#399).
+  #
+  # Every entry module is named after its file (`kex_<stem>.beam` for
+  # `<stem>.kex`), and so is everything declared at the top level of that
+  # file. A `let render = Template.html(Kex.embed(path))` written outside any
+  # `module` therefore lands in `kex_<stem>`, not in a module the file names;
+  # give each generated file a distinct name, or put the declaration inside a
+  # `module`, whose functions compile into `Kex.<Name>`.
+  #
+  # The BEAM backend only: under the interpreter, +Kex.load+ answers an error.
+  #
+  #   let theme = Kex.load("cache/kex_theme_3f2a.beam").try
+  #   let html = theme.call(:render, [context]).try
+  record LoadedModule do
+    # The module's BEAM name, e.g. +:kex_theme+ or +:"Kex.Theme"+.
+    name : Atom
+  end
+
+  # Loads the compiled module at +path+, replacing an older version of it
+  # that is already loaded. See +Kex.LoadedModule+.
+  #
+  # @param path [String] a `.beam` file written by `kex --compile`
+  # @return [Result<LoadedModule, String>] the module, or why it could not be
+  #   loaded
+  #
+  # @example
+  #   let theme = Kex.load("build/kex_theme.beam").try
+  load : String -> Result<LoadedModule, String>
+  foul load(path) = Kex.Intrinsic.Code.load(path).map { |name| LoadedModule { name: name } }
+
+  # The module already loaded under +name+, or +None+ when there is none.
+  #
+  # @param name [Atom] the module's BEAM name
+  # @return [LoadedModule?] the module
+  #
+  # @example Loading only once
+  #   let theme = Kex.loaded(:kex_theme).or(Kex.load(path).try)
+  loaded : Atom -> LoadedModule?
+  foul loaded(name) = Kex.Intrinsic.Code.loaded?(name) then Just(LoadedModule { name: name }) else None
+
+  make LoadedModule do
+    # Calls the module's function +function+ with +arguments+.
+    #
+    # A failure inside the call is an +Error+ describing it, not a crash of
+    # the caller, and so is a function the module does not export with that
+    # many arguments. A `foul` function takes one argument more than it
+    # declares, its capabilities, so call pure functions this way.
+    #
+    # @param function [Atom] the function's name
+    # @param arguments [[Any]] its arguments, in order
+    # @return [Result<Any, String>] what the function returned, or why the
+    #   call failed
+    #
+    # @example
+    #   theme.call(:render, [context])   # => Ok("<html>...")
+    call :> Atom -> [Any] -> Result<Any, String>
+    foul call(function, arguments) = Kex.Intrinsic.Code.call(@name, function, arguments)
+  end
+
+  # A non-cryptographic hash of any value: a non-negative +Integer+ below
+  # 2^32, the same for equal values.
+  #
+  # Cheap to compute over a whole structure, with no string built along the
+  # way, which suits fingerprinting data to notice when it changed. It is
+  # stable only within one running program: the number differs between the
+  # interpreter and the BEAM, and may change between Kex versions, so never
+  # store it or send it anywhere. Use +Digest+ for that, or for anything an
+  # adversary could choose collisions for.
+  #
+  # @param value [Any] the value to hash
+  # @return [Integer] the hash, from 0 up to 2^32 - 1
+  #
+  # @example Noticing that a project's files changed
+  #   let stamp = Kex.hash(paths.map { |path| (path, FS.File.info(path).try) })
+  hash : Any -> Integer
+  let hash(value) = Kex.Intrinsic.Kex.hash(value)
+
   # Which optional capabilities this build includes.
   #
   # Optional non-network capabilities in this build. Networking has its own
@@ -5791,7 +5998,7 @@ module Kex do
     # @return [Bool] +true+ when it is available
     #
     # @example
-    #   Kex.Feature.has?(Kex.FS)     # => true
+    #   Kex.Feature.has?(Kex.ExternalPrograms)   # => true, except in a browser
     #
     has? : Feature -> Bool
     let has?(f) = Kex.Intrinsic.Kex.featureHas?(f)
@@ -5801,7 +6008,7 @@ module Kex do
     # @return [[Feature]] the available capabilities
     #
     # @example
-    #   Kex.Feature.list   # => [FS]
+    #   Kex.Feature.list   # => [FileSystem, ExternalPrograms]
     list : [Feature]
     let list = Kex.Intrinsic.Kex.featureList()
   end
@@ -5815,7 +6022,7 @@ module Kex.Interface do
   #
   # The term is an ordinary tree of tuples, lists, atoms, integers and
   # strings, so it is walked with normal pattern matching and `Tuple.items`.
-  # This exists so that reading it needs no `Erlang.*` interop: it is the one
+  # This exists so that reading it needs no `BEAM.*` interop: it is the one
   # intentional entry point rather than a general term decoder.
   #
   # @param path [FS.FilePath] the compiled .beam file to read
@@ -6877,9 +7084,9 @@ make [X], implement: Enumerable, Foldable do
   # Folds the list from the left, starting with +acc+ and combining each
   # element via +f+.
   #
-  # @param acc [Acc]   initial accumulator value
-  # @param f   [Acc -> X -> Acc]
-  # @return [Acc]
+  # @param acc [A]     initial accumulator value
+  # @param f   [A -> X -> A]
+  # @return [A]
   #
   # @example
   #   [1, 2, 3].reduce(0) { |acc, x| acc + x }   # => 6
@@ -8286,6 +8493,10 @@ module Mock do
       None => Error(ReadFailed(path))
     end
     foul symlink?(path) = false
+    foul info(path) = match this.cannedRead(path) do
+      Just(content) => Ok(FileInfo { kind: :file, size: content.bytes.count, modified: DateTime.fromEpochSeconds(0) })
+      None => Error(ReadFailed(path))
+    end
 
     # A fake is a value, so there is nowhere for a write to go. Refusing is
     # the honest answer and the useful one: a test that did not expect a
@@ -8900,6 +9111,7 @@ end
 module Router do
   # @return [Router] a router with no routes
   # @example +Router.build.get("/health", { |request, context| Response.text(200, "ok") })+
+  build : Router
   let build = Router { routes: [] }
 end
 
@@ -9933,6 +10145,146 @@ module TLS do
   foul closed?(connection: TLSConnection) -> Bool = Kex.Intrinsic.NetTLS.closed?(connection)
 
 end
+# Distributed Kex: this BEAM node, and the other nodes it is connected to.
+#
+# A node is one running BEAM VM with a name. Once two nodes share a cookie and
+# are connected, a +Pid+ from one works on the other: +send+, +link+ and
+# +monitor+ cross the network unchanged, and so do typed +Process+ and
+# +Server+ handles.
+#
+# Name a node when starting it (`kex --sname a --cookie secret app.kex`), or
+# from inside the program with +Node.start+:
+#
+#   using Node
+#
+#   main do
+#     Node.connect(:b@myhost)
+#     Node.send(:b@myhost, :logger, (:hello, Node.self))
+#   end
+#
+# Node names are atoms: `:b@myhost` for a short name, the quoted
+# `:"b@host.example.com"` for one with dots, or `Atom.from(text)` for one
+# built at runtime.
+#
+# Both nodes need the same compiled code for anything that carries a function,
+# like a lambda or a record whose methods the receiver calls; +Node.spawn+
+# sends its block's code along. Plain data — numbers, strings, lists, tuples,
+# records — needs nothing.
+#
+# Backed by Kex.Intrinsic.Node on the BEAM. The tree-walk interpreter is always
+# a single, unnamed node.
+module Node do
+  # This node's name, or +:nonode@nohost+ when it is not distributed.
+  #
+  # @return [Atom] the node name
+  #
+  # @example
+  #   Node.self   # => :a@myhost
+  self : Atom
+  foul self = Kex.Intrinsic.Node.self
+
+  # Whether this node is distributed — started with a name, so other nodes
+  # can connect to it.
+  #
+  # @return [Bool] true once the node has a name
+  #
+  # @example
+  #   Node.alive?   # => false, unless started with --sname or Node.start
+  alive? : Bool
+  foul alive? = Kex.Intrinsic.Node.alive?
+
+  # The nodes this one is currently connected to, not including itself.
+  #
+  # @return [[Atom]] the connected node names
+  #
+  # @example
+  #   Node.list   # => [:b@myhost]
+  list : [Atom]
+  foul list = Kex.Intrinsic.Node.list
+
+  # Makes this node distributed under +name+, as `--sname`/`--name` would at
+  # startup. A +name+ whose host has a dot (`:"app@host.example.com"`) uses
+  # long names; anything else uses short names.
+  #
+  # @param name [Atom] the node name, like +:app+ or +:app@myhost+
+  # @return [Result<Atom, String>] the full node name, or why it could not start
+  #
+  # @example
+  #   Node.start(:app)   # => Ok(:app@myhost)
+  start : Atom -> Result<Atom, String>
+  foul start(name) = Kex.Intrinsic.Node.start(name)
+
+  # Stops distribution: the node drops its name and every connection.
+  #
+  # @return [Bool] whether it was distributed and has now stopped
+  stop : Bool
+  foul stop = Kex.Intrinsic.Node.stop
+
+  # Connects to the node named +node+. Both nodes must share a cookie.
+  #
+  # @param node [Atom] the node to connect to
+  # @return [Bool] whether the connection is up
+  #
+  # @example
+  #   Node.connect(:b@myhost)   # => true
+  connect : Atom -> Bool
+  foul connect(node) = Kex.Intrinsic.Node.connect(node)
+
+  # Drops the connection to +node+.
+  #
+  # @param node [Atom] the node to disconnect from
+  # @return [Bool] whether a connection was dropped
+  disconnect : Atom -> Bool
+  foul disconnect(node) = Kex.Intrinsic.Node.disconnect(node)
+
+  # Sets the cookie this node presents when connecting. Nodes connect only
+  # when their cookies match.
+  #
+  # @param cookie [String] the shared secret
+  # @return [Void]
+  setCookie : String -> Void
+  foul setCookie(cookie) = Kex.Intrinsic.Node.setCookie(cookie)
+
+  # Sends +message+ to the process registered as +name+ on +node+, unchanged.
+  # Like +Pid.send+, it never blocks and never fails.
+  #
+  # @param node [Atom] the node the process runs on
+  # @param name [Atom] the name it was registered under
+  # @param message [X] the message
+  # @return [Void]
+  #
+  # @example
+  #   Node.send(:b@myhost, :logger, (:info, "started"))
+  send : Atom -> Atom -> X -> Void
+  foul send(node, name, message) = Kex.Intrinsic.Node.send(node, name, message)
+
+  # The +Pid+ registered as +name+ on +node+, or +None+.
+  #
+  # @param node [Atom] the node to ask
+  # @param name [Atom] the registered name
+  # @return [Pid?] the process, or +None+
+  #
+  # @example
+  #   Node.whereIs(:b@myhost, :logger).map { |pid| pid.send(:flush) }
+  whereIs : Atom -> Atom -> Pid?
+  foul whereIs(node, name) = Kex.Intrinsic.Node.whereIs(node, name)
+
+  # Runs +block+ in a new process on +node+ and returns its +Pid+.
+  #
+  # The block is a function of THIS program. When +node+ has not loaded the
+  # module it belongs to, that module's compiled code is sent over and loaded
+  # first. A module +node+ already has is left as it is.
+  #
+  # @param node [Atom] where to run it
+  # @param block [Block<X>] the work
+  # @return [Pid] the new process
+  #
+  # @example
+  #   let me = Process.self
+  #   Node.spawn(:b@myhost) do me.send(Node.self) end
+  spawn : Atom -> Block<X> -> Pid
+  foul spawn(node, block) = Kex.Intrinsic.Node.spawn(node, block)
+end
 # Whole numbers, of arbitrary size.
 #
 # +Integer+ has no width limit: factorials and cryptographic moduli are
@@ -10299,6 +10651,151 @@ module Float do
   #   Float.parsePrefix("12.5kg")   # => Just((12.5, "kg"))
   parsePrefix : String -> (Float, String)?
   let parsePrefix(s) = Kex.Intrinsic.Float.parsePrefix(s)
+
+  # The largest finite +Float+.
+  #
+  # A Kex +Float+ is always finite, so there is no infinity to start from:
+  # this is the bound to use instead, say as the first "smallest so far".
+  #
+  # @return [Float] 1.7976931348623157e308
+  #
+  # @example
+  #   let smallest = readings.reduce(Float.MAX) { |low, x| x < low then x else low }
+  MAX : Float
+  let MAX = 1.7976931348623157e308
+
+  # The most negative finite +Float+: +-Float.MAX+. Not the smallest positive
+  # one, which some languages call MIN.
+  #
+  # @return [Float] -1.7976931348623157e308
+  MIN : Float
+  let MIN = -1.7976931348623157e308
+end
+
+# The bounds of the sized numeric types: +Int8.MAX+, +UInt64.MAX+,
+# +Float32.MIN+ and so on. +Integer+ has none: it is arbitrary-precision.
+# For a float type, +MIN+ is the most negative finite value, not the smallest
+# positive one.
+
+# The range of a 32-bit float.
+module Float32 do
+  # The largest Float32: 3.4028234663852886e38.
+  MAX : Float32
+  let MAX = 3.4028234663852886e38
+
+  # The most negative finite Float32: -3.4028234663852886e38.
+  MIN : Float32
+  let MIN = -3.4028234663852886e38
+end
+
+# The range of a 64-bit float, the same as a +Float+.
+module Float64 do
+  # The largest Float64: 1.7976931348623157e308.
+  MAX : Float64
+  let MAX = 1.7976931348623157e308
+
+  # The most negative finite Float64: -1.7976931348623157e308.
+  MIN : Float64
+  let MIN = -1.7976931348623157e308
+end
+
+# The range of a signed 8-bit integer.
+module Int8 do
+  # The largest Int8: 127.
+  MAX : Int8
+  let MAX = 127
+
+  # The smallest Int8: -128.
+  MIN : Int8
+  let MIN = -128
+end
+
+# The range of a signed 16-bit integer.
+module Int16 do
+  # The largest Int16: 32767.
+  MAX : Int16
+  let MAX = 32767
+
+  # The smallest Int16: -32768.
+  MIN : Int16
+  let MIN = -32768
+end
+
+# The range of a signed 32-bit integer.
+module Int32 do
+  # The largest Int32: 2147483647.
+  MAX : Int32
+  let MAX = 2147483647
+
+  # The smallest Int32: -2147483648.
+  MIN : Int32
+  let MIN = -2147483648
+end
+
+# The range of a signed 64-bit integer.
+module Int64 do
+  # The largest Int64: 9223372036854775807.
+  MAX : Int64
+  let MAX = 9223372036854775807
+
+  # The smallest Int64: -9223372036854775808.
+  MIN : Int64
+  let MIN = -9223372036854775808
+end
+
+# The range of an unsigned 8-bit integer: +UInt8+ is another name for +Byte+.
+module UInt8 do
+  # The largest UInt8: 255.
+  MAX : UInt8
+  let MAX = 255
+
+  # The smallest UInt8: 0.
+  MIN : UInt8
+  let MIN = 0
+end
+
+# The range of an unsigned 16-bit integer.
+module UInt16 do
+  # The largest UInt16: 65535.
+  MAX : UInt16
+  let MAX = 65535
+
+  # The smallest UInt16: 0.
+  MIN : UInt16
+  let MIN = 0
+end
+
+# The range of an unsigned 32-bit integer.
+module UInt32 do
+  # The largest UInt32: 4294967295.
+  MAX : UInt32
+  let MAX = 4294967295
+
+  # The smallest UInt32: 0.
+  MIN : UInt32
+  let MIN = 0
+end
+
+# The range of an unsigned 64-bit integer.
+module UInt64 do
+  # The largest UInt64: 18446744073709551615.
+  MAX : UInt64
+  let MAX = 18446744073709551615
+
+  # The smallest UInt64: 0.
+  MIN : UInt64
+  let MIN = 0
+end
+
+# The range of a +Byte+, Kex's unsigned 8-bit integer (also called +UInt8+).
+module Byte do
+  # The largest Byte: 255.
+  MAX : Byte
+  let MAX = 255
+
+  # The smallest Byte: 0.
+  MIN : Byte
+  let MIN = 0
 end
 
 # Reading a number out of text without deciding in advance which half of the
@@ -11691,7 +12188,7 @@ make Input do
   # use it where the grammar requires something to be there.
   #
   # @param f [Input -> Result<(T, Input), ParseError>] the parser to repeat
-  # @return [([T], Input)] the results and the cursor, or the first failure
+  # @return [Result<([T], Input), ParseError>] the results and the cursor, or the first failure
   #
   # @example
   #   Input { input: "abc" }.some { |p| p.charWhen(~alpha?) }
@@ -11712,7 +12209,7 @@ make Input do
   # the caret.
   #
   # @param expected [String] the literal that must be next
-  # @return [(String, Input)] the literal and the cursor, or an +Expected+ error
+  # @return [Result<(String, Input), ParseError>] the literal and the cursor, or an +Expected+ error
   #
   # @example
   #   Input { input: "abc" }.string("abc")   # => Ok(("abc", cursor at 3))
@@ -11768,7 +12265,7 @@ make Input do
   # they all started from.
   #
   # @param alts [[Input -> Result<(T, Input), ParseError>]] the parsers to try, in order
-  # @return [(T, Input)] the first success, or +NoMatch+
+  # @return [Result<(T, Input), ParseError>] the first success, or +NoMatch+
   #
   # @example
   #   cursor.choice([
@@ -11822,6 +12319,7 @@ end
 # declaration in that source file, not here.
 
 using Algebra
+using Atom
 using Binary
 using Blankable
 using Comparable
@@ -11887,7 +12385,7 @@ using Units
 
 # An opaque BEAM process identifier.
 #
-# Obtained from +Process.self+ or +Process.whereis+. Send it messages, link to
+# Obtained from +Process.self+ or +Process.whereIs+. Send it messages, link to
 # it, monitor it, or ask whether it is still alive.
 type Pid
 
@@ -12116,19 +12614,91 @@ module Process do
   register : Pid -> Atom -> Void
   foul register(pid, name) = Kex.Intrinsic.Process.register(pid, name)
 
+  # Registers the typed process +process+ under the atom +name+.
+  #
+  # @param process [Process<X>] the process to register
+  # @param name [Atom] the name to register it under
+  # @return [Void]
+  #
+  # @example
+  #   let logger = spawn do logLoop() end
+  #   Process.register(logger, :logger)
+  register : Process<X> -> Atom -> Void
+  foul register(process, name) = Kex.Intrinsic.Process.register(process, name)
+
   # Returns the +Pid+ registered under +name+, or +None+ when nothing is.
   #
   # @param name [Atom] the registered name
   # @return [Pid?] the process, or +None+
   #
   # @example
-  #   Process.whereis(:main)        # => Just(pid)
-  #   Process.whereis(:not_there)   # => None
+  #   Process.whereIs(:main)        # => Just(pid)
+  #   Process.whereIs(:not_there)   # => None
   #
   # @example Sending to a named process if it is there
-  #   Process.whereis(:logger).map { |pid| pid.send(message) }
-  whereis : Atom -> Pid?
-  foul whereis(name) = Kex.Intrinsic.Process.whereis(name)
+  #   Process.whereIs(:logger).map { |pid| pid.send(message) }
+  whereIs : Atom -> Pid?
+  foul whereIs(name) = Kex.Intrinsic.Process.whereIs(name)
+
+  # A named, typed slot of state that every process can read without asking
+  # another process for it.
+  #
+  # State kept in a +serving+ process is copied into the caller on every
+  # read, which is costly for a large value read by every request. A
+  # +Shared+ value is stored once for the whole node (on the BEAM, in
+  # +persistent_term+): reading it copies nothing, however large it is.
+  #
+  # The price is on the other side: replacing a value makes the runtime scan
+  # every process for references to the old one. So it suits state that is
+  # read constantly and written rarely, such as configuration or a loaded
+  # site, and not a counter.
+  #
+  # Get a handle with +Process.Shared.named+. The slot is identified by its
+  # name alone, so two handles with the same name are the same slot; the type
+  # parameter is what a handle promises to store and read back, so give every
+  # handle on one name the same one.
+  #
+  # @example Loading once, reading from every request handler
+  #   let site : Process.Shared<Site> = Process.Shared.named("site")
+  #   site.put(loadSite(root))
+  #   ...
+  #   let current = site.get.or(emptySite)
+  type Shared<X>
+
+  module Shared do
+    # The handle on the slot called +name+. Nothing is stored or read until
+    # +put+ or +get+.
+    #
+    # @param name [String] the slot's name
+    # @return [Process.Shared<X>] a handle on the slot
+    named : String -> Process.Shared<X>
+    let named(name) = Kex.Intrinsic.Shared.named(name)
+  end
+
+  make Shared<X> do
+    # Stores +value+, replacing whatever the slot held.
+    #
+    # Expensive: see +Process.Shared+.
+    #
+    # @param value [X] the value to store
+    # @return [Void]
+    put :> X -> Void
+    foul put(value) = Kex.Intrinsic.Shared.put(this, value)
+
+    # The stored value, or +None+ when nothing has been stored yet.
+    #
+    # Cheap, whatever the value's size.
+    #
+    # @return [X?] the stored value
+    get :> X?
+    foul get = Kex.Intrinsic.Shared.get(this)
+
+    # Empties the slot.
+    #
+    # @return [Bool] +true+ when it held a value
+    delete :> Bool
+    foul delete = Kex.Intrinsic.Shared.delete(this)
+  end
 end
 
 # What an external command left behind: its exit status and its output.
@@ -12424,413 +12994,278 @@ make Reference do
   demonitor :> Void
   let demonitor = Kex.Intrinsic.Process.demonitor(this)
 end
-# Pseudorandom values: integers, floats, choices, and shuffles.
+# Random values for simulations, sampling, games, and reproducible tests.
 #
-# Opt-in: nothing here is in scope until `using Random`, which brings both
-# the seeded generator and the ambient conveniences into scope at once.
+# Import with +using Random+. Ordinary calls return a value directly;
+# a +Random.Generator+ returns +(value, nextGenerator)+. Reusing the same
+# generator replays the same draw. Pass its returned state to continue.
 #
+# @example Roll a die or initialize a weight
 #   using Random
+#   let roll = Random.integer(1..6)
+#   let weight = Random.float(-1.0..1.0)
 #
-#   main do
-#     IO.printLine(Random.between(1, 6))
-#     IO.printLine(Random.shuffle(["a", "b", "c"]))
-#   end
-#
-# Two layers, for two needs. `Rng` is a small deterministic generator with
-# explicit state: the same seed answers the same sequence on every run and
-# on both backends, which is what makes randomized code testable. `Random`
-# is the ambient convenience layer over it: each call draws fresh entropy
-# from the host, so answers differ between runs.
-#
-#   let rng = Rng.seeded(42)
-#   let (roll, next) = rng.nextBounded(6)   # 0..5, then keep going with next
-#   Random.integer(6)                       # 0..5, fresh entropy, foul
+# @example Reproduce a sequence
+#   let generator = Random.seeded(42)
+#   let (first, afterFirst) = generator.integer(1..6)
+#   let (second, afterSecond) = afterFirst.integer(1..6)
 #
-# The generator is SplitMix64: tiny, fast, and good enough for modelling,
-# games, sampling, shuffling, and randomized tests. It is NOT cryptographic:
-# its state follows directly from its output, so never use it for secrets,
-# tokens, or anything an adversary gets to see. The ambient layer draws its
-# seeds from the host's secure source, but one secure seed does not make
-# the stream that follows secure.
-
-# The state of a deterministic generator: one 64-bit word.
-#
-# A value, not a handle: every step answers a new `Rng` alongside its
-# output, and the old one keeps answering what it always did. Thread the
-# answer forward and the sequence is reproducible from its seed.
-#
-#   let rng = Rng.seeded(42)
-#   let (a, rng) = rng.nextUint64
-#   let (b, rng) = rng.nextUint64   # same `a` and `b` on every run
-#
-# Build one with +Rng.seeded+ rather than by hand: the record literal does
-# no range reduction, and every step here assumes a state inside
-# 0..2^64 - 1.
-record Rng do
-  state : Integer = 0
-end
-
-# Constructors and constants for the deterministic +Rng+. The draws
-# themselves are methods in the +make+ block below, so every one answers
-# to Uniform Function Call Syntax: +rng.nextBounded(6)+.
-module Rng do
-  # One past the largest representable state: all arithmetic here is
-  # modulo 2^64, keeping the word closed under the mixing below. Also the
-  # largest exclusive bound one 64-bit draw can cover directly.
+# These generators are not cryptographic; do not use their output for secrets.
+# +Random.secureBytes+ and +Random.token+ are, and are what secrets come from.
+module Random do
+  # Immutable state of a deterministic random sequence.
   #
-  # Public because the +make+ block below lives outside this module and
-  # reaches it by qualification.
-  let maxBound = 18446744073709551616
-
-  # The SplitMix64 odd increment: every addition steps the state by a
-  # different odd multiple, so even a seed of 0 walks the whole space.
-  let gamma = 0x9e3779b97f4a7c15
+  # Construct with +Random.seeded+ or +Random.fresh+. Each draw returns its
+  # value first and the advanced generator second. Equal seeds reproduce equal
+  # sequences for the same operations on both backends.
+  record Generator do
+    state : Integer = 0
+  end
 
-  # The two xor-shift/multiply mixing constants.
-  let mixA = 0xbf58476d1ce4e5b9
-  let mixB = 0x94d049bb133111eb
+  # Starts a deterministic sequence. Any Integer seed is reduced modulo 2^64.
+  # @param seed [Integer] reproducible seed, including negative or large values
+  # @return [Generator] initial state; no draw has been consumed
+  let seeded(seed: Integer) -> Generator = Generator {
+    state: seed.modulo(18446744073709551616)
+  }
 
-  # Builds a generator from any integer seed.
-  #
-  # The seed is reduced modulo 2^64, so negative seeds and huge ones are
-  # fine: every integer names a generator, and equal integers name the
-  # same one.
-  #
-  # @param seed [Integer] any integer; equal seeds answer equal sequences
-  # @return [Rng] the generator
-  #
-  # @example
-  #   let (word, _) = Rng.seeded(42).nextUint64
-  #   word   # => 13679457532755275413, always
-  #
-  # @example Reproducible sampling in a test
-  #   let (pick, _) = Rng.seeded(7).choice(["a", "b", "c"])
-  seeded : Integer -> Rng
-  let seeded(seed: Integer) -> Rng do
-    return Rng { state: seed.modulo(Rng.maxBound) }
+  # Starts a generator using fresh host entropy.
+  # @return [Generator] initial state for a sequence that varies between runs
+  foul fresh -> Generator do
+    let high = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
+    let low = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
+    seeded(high * 4294967296 + low)
+  end
+
+  module Generator do
+    make Random.Generator do
+      # Draws an integer between both endpoints, with the advanced generator.
+      # The range must be ascending and contain at most 2^64 integers.
+      # A singleton range is valid and still consumes a draw.
+      # @param range [Range<Integer>] inclusive integer bounds
+      # @return [(Integer, Generator)] drawn integer and advanced state
+      # @example A reproducible die roll
+      #   let (roll, advanced) = Random.seeded(42).integer(1..6)
+      let integer(range: Range<Integer>) -> (Integer, Generator) = drawInteger(this, range)
+
+      # Draws a float from the lower bound inclusive to the upper bound exclusive.
+      # Defaults to +0.0..1.0+. Bounds must be finite and strictly ascending.
+      # @param range [Range<Float>] half-open floating-point bounds
+      # @return [(Float, Generator)] drawn float and advanced state
+      # @example Initialize a model weight
+      #   let (weight, advanced) = Random.seeded(42).float(-1.0..1.0)
+      let float(range: Range<Float>) -> (Float, Generator) = drawFloat(this, range)
+      let float -> (Float, Generator) = drawFloat(this, 0.0..1.0)
+
+      # Draws a fair Boolean and returns the advanced generator.
+      # @return [(Bool, Generator)] coin flip and advanced state
+      let boolean -> (Bool, Generator) = drawBoolean(this)
+
+      # Draws true with the supplied probability. Consumes one draw even at 0 or 1.
+      # @param probability [Float] probability from 0.0 through 1.0
+      # @return [(Bool, Generator)] outcome and advanced state
+      let chance?(probability: Float) -> (Bool, Generator) = drawChance(this, probability)
+
+      # Chooses an input position uniformly. Empty input returns None without a draw.
+      # @param items [[X]] values to choose from
+      # @return [(X?, Generator)] optional value and advanced state
+      let choice(items: [X]) -> (X?, Generator) = drawChoice(this, items)
+
+      # Selects input positions without replacement, in random order.
+      # Duplicate input values may appear more than once in the result.
+      # A count larger than the input selects every position; zero consumes no draws.
+      # @param items [[X]] population; unchanged by sampling
+      # @param count [Integer] nonnegative number of positions to select
+      # @return [([X], Generator)] selected values and advanced state
+      # @example Deal five cards reproducibly
+      #   let (hand, advanced) = Random.seeded(42).sample(cards, count: 5)
+      let sample(items: [X], count: Integer) -> ([X], Generator) = drawSample(this, items, count)
+
+      # Returns a random permutation, preserving duplicates and the input itself.
+      # Empty input consumes no draws.
+      # @param items [[X]] values to shuffle
+      # @return [([X], Generator)] permutation and advanced state
+      let shuffle(items: [X]) -> ([X], Generator) = drawSample(this, items, items.count)
+    end
   end
 
-end
-
-# The draws on an +Rng+. Each answers its draw alongside the generator
-# that follows it, so state threads through a chain of calls. All are
-# methods, so Uniform Function Call Syntax reaches every one.
-make Rng do
-  # Draws one 64-bit unsigned word and the generator that follows it.
-  #
-  # This is the primitive everything else here is built on: the raw
-  # SplitMix64 output, uniformly spread over 0..2^64 - 1. Pure arithmetic
-  # over unbounded integers with an explicit mask, so both backends agree
-  # bit for bit with the reference C.
-  #
-  # @return [(Integer, Rng)] the word and the next generator
-  #
-  # @example
-  #   let (word, next) = Rng.seeded(0).nextUint64
-  #   word   # => 16294208416658607535
-  nextUint64 :> (Integer, Rng)
-  let nextUint64 do
-    let mask = Rng.maxBound - 1
-    let advanced = Kex.Intrinsic.Bits.and(@state + Rng.gamma, mask)
-    let spread1 = Kex.Intrinsic.Bits.xor(advanced, Kex.Intrinsic.Bits.shiftRight(advanced, 30))
-    let mixed1 = Kex.Intrinsic.Bits.and(spread1 * Rng.mixA, mask)
-    let spread2 = Kex.Intrinsic.Bits.xor(mixed1, Kex.Intrinsic.Bits.shiftRight(mixed1, 27))
-    let mixed2 = Kex.Intrinsic.Bits.and(spread2 * Rng.mixB, mask)
-    let output = Kex.Intrinsic.Bits.xor(mixed2, Kex.Intrinsic.Bits.shiftRight(mixed2, 31))
-    return (output, Rng { state: advanced })
+  # Draws an integer from an inclusive range using fresh entropy.
+  # @param range [Range<Integer>] ascending inclusive bounds, span at most 2^64
+  # @return [Integer] drawn value
+  foul integer(range: Range<Integer>) -> Integer do
+    let (value, _) = drawInteger(fresh, range)
+    value
   end
 
-  # Draws a uniform integer in 0..bound-1 and the generator that follows.
-  #
-  # Uses rejection sampling rather than a bare remainder, so small bounds
-  # are not biased toward small answers: draws that would tilt the range
-  # are discarded and redrawn. Dies when +bound+ is not positive or does
-  # not fit in one 64-bit word.
-  #
-  # @param bound [Integer] the exclusive upper bound, 1..2^64
-  # @return [(Integer, Rng)] the draw and the next generator
-  #
-  # @example
-  #   let (roll, _) = Rng.seeded(42).nextBounded(6)   # => 0..5
-  #
-  # @example Rolling again with the threaded state
-  #   var rng = Rng.seeded(42)
-  #   let (first, advanced) = rng.nextBounded(6)
-  #   rng = advanced
-  nextBounded :> Integer -> (Integer, Rng)
-  let nextBounded(bound: Integer) -> (Integer, Rng) do
-    if bound <= 0
-      die("Rng.nextBounded: bound must be positive, got ${bound}")
-    end
-    if bound > Rng.maxBound
-      die("Rng.nextBounded: bound does not fit in 64 bits")
-    end
-    let (draw, advanced) = this.nextUint64
-    # Draws at or above this limit would make some residues likelier than
-    # others; there is always less than one bound's worth of them, so the
-    # expected number of redraws stays below two.
-    let limit = Rng.maxBound - Rng.maxBound.modulo(bound)
-    return (draw.modulo(bound), advanced) if draw < limit
-    return advanced.nextBounded(bound)
+  # Draws a float; defaults to [0.0, 1.0). The upper bound is excluded.
+  # @param range [Range<Float>] finite, strictly ascending bounds
+  # @return [Float] drawn value
+  foul float(range: Range<Float> = 0.0..1.0) -> Float do
+    let (value, _) = drawFloat(fresh, range)
+    value
   end
 
-  # Draws a uniform float in 0.0..1.0 and the generator that follows.
-  #
-  # Takes the top 53 bits of one word: exactly what a double's mantissa
-  # holds, so every representable value in range is reachable and 1.0
-  # itself never comes out.
-  #
-  # @return [(Float, Rng)] the draw and the next generator
-  #
-  # @example
-  #   let (unit, _) = Rng.seeded(42).nextFloat   # => 0.0..1.0
-  nextFloat :> (Float, Rng)
-  let nextFloat do
-    let (draw, advanced) = this.nextUint64
-    # Into a float by multiplication, not conversion: `* 1.0` is the
-    # typed idiom (`Duration.seconds` is built the same way).
-    let mantissa = Kex.Intrinsic.Bits.shiftRight(draw, 11) * 1.0
-    return (mantissa / 9007199254740992.0, advanced)
+  # Draws a fair coin flip using fresh entropy.
+  # @return [Bool] true or false with equal probability
+  foul boolean -> Bool do
+    let (value, _) = drawBoolean(fresh)
+    value
   end
 
-  # Draws a fair coin flip and the generator that follows.
-  #
-  # Reads the top bit of one word rather than the bottom one, which is
-  # the bit a multiply-mixed generator decorrelates fastest.
-  #
-  # @return [(Bool, Rng)] the flip and the next generator
-  #
-  # @example
-  #   let (heads, _) = Rng.seeded(42).nextBoolean
-  nextBoolean :> (Bool, Rng)
-  let nextBoolean do
-    let (draw, advanced) = this.nextUint64
-    return (Kex.Intrinsic.Bits.shiftRight(draw, 63) == 1, advanced)
+  # Returns true with the supplied probability using fresh entropy.
+  # @param probability [Float] probability from 0.0 through 1.0
+  # @return [Bool] sampled outcome
+  foul chance?(probability: Float) -> Bool do
+    let (value, _) = drawChance(fresh, probability)
+    value
   end
 
-  # Shuffles a list into a new order, answering the generator that follows.
-  #
-  # A selection shuffle: each position draws uniformly among the elements
-  # not yet placed, so every permutation is equally likely. The input is
-  # untouched; shuffling an empty list answers an empty list.
-  #
-  # @param items [[A]] the elements to order
-  # @return [([A], Rng)] the shuffled elements and the next generator
-  #
-  # @example
-  #   let (order, _) = Rng.seeded(42).shuffle([1, 2, 3])
-  shuffle :> [A] -> ([A], Rng)
-  let shuffle(items: [A]) -> ([A], Rng) do
-    var pool = items
-    var out: [A] = []
-    var state = this
-    while !pool.empty? do
-      let (index, advanced) = state.nextBounded(pool.count)
-      state = advanced
-      # `index` is below `pool.count` by construction, so `None` is
-      # unreachable; `die` says what the typechecker cannot.
-      let picked = match pool.at(index) do
-        Just(x) => x
-        None => die("Rng.shuffle: unreachable empty draw")
-      end
-      out.push!(picked)
-      pool = pool.take(index) + pool.drop(index + 1)
-    end
-    return (out, state)
+  # Chooses a position uniformly, returning None for an empty input.
+  # @param items [[X]] values to choose from
+  # @return [X?] chosen value, if any
+  foul choice(items: [X]) -> X? do
+    let (value, _) = drawChoice(fresh, items)
+    value
   end
 
-  # Draws +n+ distinct elements in random order, with the next generator.
-  #
-  # Shuffles and takes the front: uniform over every ordered +n+-subset.
-  # Asking for more than the list holds answers the whole list shuffled;
-  # asking for none answers an empty list. Dies for a negative +n+.
-  #
-  # @param items [[A]] the elements to draw from
-  # @param n [Integer] how many to draw, 0 or more
-  # @return [([A], Rng)] the drawn elements and the next generator
-  #
-  # @example
-  #   let (hand, _) = Rng.seeded(42).sample([1, 2, 3, 4, 5], 2)
-  #   hand.count   # => 2
-  sample :> [A] -> Integer -> ([A], Rng)
-  let sample(items: [A], n: Integer) -> ([A], Rng) do
-    if n < 0
-      die("Rng.sample: count must not be negative, got ${n}")
-    end
-    let (order, advanced) = this.shuffle(items)
-    return (order.take(n), advanced)
+  # Samples positions without replacement; duplicate values remain possible.
+  # @param items [[X]] population
+  # @param count [Integer] nonnegative count; capped at the input size
+  # @return [[X]] values selected in random order
+  foul sample(items: [X], count: Integer) -> [X] do
+    let (value, _) = drawSample(fresh, items, count)
+    value
   end
 
-  # Draws one element uniformly, or +None+ from an empty list.
-  #
-  # The only fallible draw here, and the failure carries no information
-  # worth an error type: an empty list has no element to give, whatever
-  # the seed, so +None+ is the whole story.
-  #
-  # @param items [[A]] the elements to draw from
-  # @return [(A?, Rng)] the drawn element, if any, and the next generator
-  #
-  # @example
-  #   let (pick, _) = Rng.seeded(42).choice(["a", "b", "c"])
-  #   ["a", "b", "c"].contains?(pick.or(""))   # => true
-  choice :> [A] -> (A?, Rng)
-  let choice(items: [A]) -> (A?, Rng) do
-    return (None, this) if items.empty?
-    let (index, advanced) = this.nextBounded(items.count)
-    return (items.at(index), advanced)
+  # Returns a random permutation using fresh entropy.
+  # @param items [[X]] values to shuffle
+  # @return [[X]] shuffled copy
+  foul shuffle(items: [X]) -> [X] do
+    let (value, _) = drawSample(fresh, items, items.count)
+    value
   end
-end
 
-# Ambient randomness: fresh host entropy on every call.
-#
-# Each function here draws its own seed from the host's secure source and
-# runs the deterministic core above on it, so answers differ between runs
-# the way the clock differs between reads. That is why every one is
-# +foul+: the same call with the same arguments may answer differently.
-#
-# Reach for +Rng+ instead when the answers must repeat: seeded simulation,
-# property tests, anything asserting on a particular draw.
-module Random do
-  # Builds a generator from fresh host entropy.
+  # Returns +count+ bytes from the operating system's cryptographically
+  # secure generator: the source for keys, session tokens and unguessable
+  # identifiers, which the generators above must never be used for.
   #
-  # The entry point for hand-threaded flows that still vary between runs:
-  # seed once here, then draw purely from the answer.
+  # Nothing about it is reproducible, and there is no +Generator+ form.
   #
-  # @return [Rng] a generator seeded from the host's secure source
+  # @param count [Integer] how many bytes; zero or less gives an empty binary
+  # @return [Binary] the random bytes
   #
-  # @example
-  #   var rng = Random.fresh()
-  #   let (roll, advanced) = rng.nextBounded(6)
-  #   rng = advanced
-  foul fresh() -> Rng do
-    let high = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
-    let low = Math.floor(Kex.Intrinsic.Retry.randomUnit() * 4294967296.0)
-    return Rng.seeded(high * 4294967296 + low)
-  end
+  # @example A 256-bit key
+  #   let key = Random.secureBytes(32)
+  foul secureBytes(count: Integer) -> Binary = Kex.Intrinsic.Random.secureBytes(count)
 
-  # Builds a generator from any integer seed. The deterministic entry:
-  # the same seed replays the same sequence, which is what tests want.
+  # Returns an unguessable token: +bytes+ secure random bytes, as lowercase
+  # hex, so the text is twice as long as +bytes+.
   #
-  # @param seed [Integer] any integer; equal seeds answer equal sequences
-  # @return [Rng] the generator
+  # @param bytes [Integer] how many random bytes the token carries
+  # @return [String] the token
   #
-  # @example
-  #   let (roll, _) = Random.seeded(42).nextBounded(6)
-  seeded : Integer -> Rng
-  let seeded(seed: Integer) -> Rng = Rng.seeded(seed)
+  # @example A session identifier
+  #   let session = Random.token(32)   # => "9f86d081884c7d65..." (64 characters)
+  foul token(bytes: Integer = 32) -> String = secureBytes(bytes).hex
 
-  # Returns a uniform float in 0.0..1.0. Never answers 1.0 itself.
-  #
-  # @return [Float] the draw
-  #
-  # @example Scaling into a range
-  #   let jitter = Random.float() * maxJitter
-  foul float() -> Float do
-    let (value, _) = Random.fresh().nextFloat
-    return value
-  end
+  private do
+    let drawInteger(source: Generator, range: Range<Integer>) -> (Integer, Generator) do
+      let (low, high) = integerBounds(range)
+      integerBetween(source, low, high)
+    end
 
-  # Returns a uniform integer in 0..bound-1. Dies unless +bound+ is
-  # positive and fits in 64 bits.
-  #
-  # @param bound [Integer] the exclusive upper bound, 1..2^64
-  # @return [Integer] the draw
-  #
-  # @example
-  #   Random.integer(6)    # => 0..5, like a die minus one
-  foul integer(bound: Integer) -> Integer do
-    let (value, _) = Random.fresh().nextBounded(bound)
-    return value
-  end
+    let drawFloat(source: Generator, range: Range<Float>) -> (Float, Generator) do
+      let (low, high) = floatBounds(range)
+      if !(low < high)
+        die("Random.float: bounds must be finite and strictly ascending")
+      end
+      let (word, advanced) = nextWord(source)
+      let unit = (Kex.Intrinsic.Bits.shiftRight(word, 11) * 1.0) / 9007199254740992.0
+      (Kex.Intrinsic.Float.scaleUnit(low, high, unit), advanced)
+    end
 
-  # Returns a uniform integer in +low+..+high+, endpoints included. Dies
-  # unless +low+ is below +high+ and the span fits in 64 bits.
-  #
-  # @param low [Integer] the smallest answer
-  # @param high [Integer] the largest answer
-  # @return [Integer] the draw
-  #
-  # @example
-  #   Random.between(1, 6)   # => a die roll
-  foul between(low: Integer, high: Integer) -> Integer do
-    if low > high
-      die("Random.between: low must not exceed high, got ${low}..${high}")
+    let drawBoolean(source: Generator) -> (Bool, Generator) do
+      let (word, advanced) = nextWord(source)
+      (Kex.Intrinsic.Bits.shiftRight(word, 63) == 1, advanced)
     end
-    return low + Random.integer(high - low + 1)
-  end
 
-  # Returns a fair coin flip.
-  #
-  # @return [Bool] the flip
-  #
-  # @example
-  #   if Random.boolean() then IO.printLine("heads") else IO.printLine("tails") end
-  foul boolean() -> Bool do
-    let (value, _) = Random.fresh().nextBoolean
-    return value
-  end
+    let drawChance(source: Generator, probability: Float) -> (Bool, Generator) do
+      if !(probability >= 0.0 && probability <= 1.0)
+        die("Random.chance?: probability must be between 0.0 and 1.0")
+      end
+      let (value, advanced) = drawFloat(source, 0.0..1.0)
+      (value < probability, advanced)
+    end
 
-  # Returns +true+ with probability +p+: a coin weighted by its argument.
-  # Dies unless +p+ is inside 0.0..1.0.
-  #
-  # @param p [Float] the chance of +true+, 0.0..1.0
-  # @return [Bool] +true+ with probability +p+
-  #
-  # @example
-  #   Random.chance?(0.25)   # => true about one call in four
-  #
-  # @example Simulating a failure rate
-  #   if Random.chance?(0.01) then Error("flaky") else Ok(send(request)) end
-  foul chance?(p: Float) -> Bool do
-    if p < 0.0 || p > 1.0
-      die("Random.chance?: chance must be inside 0.0..1.0, got ${p}")
+    let drawChoice(source: Generator, items: [X]) -> (X?, Generator) do
+      return (None, source) if items.empty?
+      let (index, advanced) = below(source, items.count)
+      (items.at(index), advanced)
     end
-    return Random.float() < p
-  end
 
-  # Returns a uniformly drawn element, or +None+ from an empty list.
-  #
-  # @param items [[A]] the elements to draw from
-  # @return [A?] the drawn element, if any
-  #
-  # @example
-  #   Random.choice(["heads", "tails"])   # => Just("heads") or Just("tails")
-  foul choice(items: [A]) -> A? do
-    let (value, _) = Random.fresh().choice(items)
-    return value
-  end
+    let drawSample(source: Generator, items: [X], count: Integer) -> ([X], Generator) do
+      if count < 0
+        die("Random.sample: count must not be negative")
+      end
+      var pool = items
+      var selected: [X] = []
+      var generator = source
+      while !pool.empty? && selected.count < count do
+        let (index, advanced) = below(generator, pool.count)
+        generator = advanced
+        selected.push!(pool.at(index).try)
+        pool = pool.take(index) + pool.drop(index + 1)
+      end
+      (selected, generator)
+    end
 
-  # Returns +n+ distinct elements in random order. Asking for more than
-  # the list holds answers the whole list shuffled. Dies for a
-  # negative +n+.
-  #
-  # @param items [[A]] the elements to draw from
-  # @param n [Integer] how many to draw, 0 or more
-  # @return [[A]] the drawn elements
-  #
-  # @example
-  #   Random.sample(["a", "b", "c", "d"], 2)   # => two of the four
-  foul sample(items: [A], n: Integer) -> [A] do
-    let (value, _) = Random.fresh().sample(items, n)
-    return value
-  end
+    integerBetween : Generator -> Integer -> Integer -> (Integer, Generator)
+    let integerBetween(generator, low, high) do
+      if low > high
+        die("Random.integer: lower bound must not exceed upper bound")
+      end
+      let (value, advanced) = below(generator, high - low + 1)
+      (low + value, advanced)
+    end
 
-  # Returns the elements in a uniformly random order.
-  #
-  # @param items [[A]] the elements to order
-  # @return [[A]] the shuffled elements
-  #
-  # @example
-  #   Random.shuffle([1, 2, 3, 4])   # => the four, in a random order
-  foul shuffle(items: [A]) -> [A] do
-    let (value, _) = Random.fresh().shuffle(items)
-    return value
+    integerBounds : Range<Integer> -> (Integer, Integer)
+    let integerBounds(range) = Kex.Intrinsic.Range.bounds(range)
+
+    floatBounds : Range<Float> -> (Float, Float)
+    let floatBounds(range) = Kex.Intrinsic.Range.bounds(range)
+
+    # SplitMix64's arithmetic stays private; public operations expose values.
+    nextWord : Generator -> (Integer, Generator)
+    let nextWord(generator: Generator) -> (Integer, Generator) do
+      let mask = 18446744073709551615
+      let advanced = Kex.Intrinsic.Bits.and(generator.state + 0x9e3779b97f4a7c15, mask)
+      let spread1 = Kex.Intrinsic.Bits.xor(advanced, Kex.Intrinsic.Bits.shiftRight(advanced, 30))
+      let mixed1 = Kex.Intrinsic.Bits.and(spread1 * 0xbf58476d1ce4e5b9, mask)
+      let spread2 = Kex.Intrinsic.Bits.xor(mixed1, Kex.Intrinsic.Bits.shiftRight(mixed1, 27))
+      let mixed2 = Kex.Intrinsic.Bits.and(spread2 * 0x94d049bb133111eb, mask)
+      let word = Kex.Intrinsic.Bits.xor(mixed2, Kex.Intrinsic.Bits.shiftRight(mixed2, 31))
+      (word, Generator { state: advanced })
+    end
+
+    below : Generator -> Integer -> (Integer, Generator)
+    let below(generator: Generator, bound: Integer) -> (Integer, Generator) do
+      let maximum = 18446744073709551616
+      if bound <= 0 || bound > maximum
+        die("Random.integer: range must contain between 1 and 2^64 integers")
+      end
+      let (word, advanced) = nextWord(generator)
+      let limit = maximum - maximum.modulo(bound)
+      return (word.modulo(bound), advanced) if word < limit
+      below(advanced, bound)
+    end
   end
 end
 # A span between two bounds, written +(1..10)+ or +('a'..'z')+.
 #
-# A range stores only its two endpoints and computes everything else from
-# them, so +(1..1000000)+ costs nothing to make. Both ends are included.
+# A range stores its endpoints on both backends without building a list.
+# Integer and character ranges can be enumerated with both ends included.
+# Float ranges describe continuous bounds, for example +(-1.0..1.0)+ for
+# random sampling; they cannot be enumerated without an explicit step.
 #
 #   (1..5).items          # => [1, 2, 3, 4, 5]
 #   (1..5).sum            # => 15
@@ -12914,11 +13349,8 @@ make Range, implement: Enumerable, Foldable do
   # @example
   #   (3..7).first   # => Just(3)
   # The list operations, over the materialized items. A range is an ordered
-  # collection, so `(1..5).first` and `(1..5).length` are questions it can
-  # answer, and on the BEAM backend, where a range IS its item list, they
-  # already worked. Only the walker rejected them ("Undefined method: first
-  # for Range"), so every one of these was a backend divergence rather than a
-  # deliberate restriction.
+  # collection, so +(1..5).first+ and +(1..5).length+ operate on its
+  # materialized elements. Floating bounds do not define such a collection.
   first :> A?
   let first = this.items.first
 
@@ -16454,10 +16886,10 @@ module Time do
   #   Time.daysFromCivil(1970, 1, 1)   # => 0
   #   Time.daysFromCivil(2026, 7, 30)  # => 20664
   let daysFromCivil(year: Integer, month: Integer, day: Integer) -> Integer do
-    let y = if month <= 2 then year - 1 else year end
-    let era = if y < 0 then (y - 399) / 400 else y / 400 end
+    let y = month <= 2 then year - 1 else year
+    let era = y < 0 then (y - 399) / 400 else y / 400
     let yoe = y - era * 400
-    let mp = if month > 2 then month - 3 else month + 9 end
+    let mp = month > 2 then month - 3 else month + 9
     let doy = (153 * mp + 2) / 5 + day - 1
     let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy
     return era * 146097 + doe - 719468
@@ -16474,15 +16906,15 @@ module Time do
   #   Time.civilFromDays(20664).iso   # => "2026-07-30"
   let civilFromDays(epochDay: Integer) -> Date do
     let z = epochDay + 719468
-    let era = if z < 0 then (z - 146096) / 146097 else z / 146097 end
+    let era = z < 0 then (z - 146096) / 146097 else z / 146097
     let doe = z - era * 146097
     let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365
     let y = yoe + era * 400
     let doy = doe - (365 * yoe + yoe / 4 - yoe / 100)
     let mp = (5 * doy + 2) / 153
     let day = doy - (153 * mp + 2) / 5 + 1
-    let month = if mp < 10 then mp + 3 else mp - 9 end
-    let year = if month <= 2 then y + 1 else y end
+    let month = mp < 10 then mp + 3 else mp - 9
+    let year = month <= 2 then y + 1 else y
     return Date { year: year, month: month, day: day }
   end
 
@@ -16617,8 +17049,8 @@ module Time do
   let formatOffset(offset: Duration) -> String do
     let total = offset.wholeSeconds
     return "Z" if total == 0
-    let sign = if total < 0 then "-" else "+" end
-    let magnitude = if total < 0 then 0 - total else total end
+    let sign = total < 0 then "-" else "+"
+    let magnitude = total < 0 then 0 - total else total
     return "${sign}${Time.pad2(magnitude / 3600)}:${Time.pad2(magnitude.modulo(3600) / 60)}"
   end
 
@@ -17158,7 +17590,7 @@ make Duration do
   #
   # @example
   #   (1.hours - 90.minutes).abs.wholeMinutes   # => 30
-  let abs -> Duration = Duration { seconds: if this.seconds < 0.0 then 0.0 - this.seconds else this.seconds end }
+  let abs -> Duration = Duration { seconds: this.seconds < 0.0 then 0.0 - this.seconds else this.seconds }
 
   # Returns +true+ when the span is exactly zero.
   #
@@ -17530,9 +17962,9 @@ make Period, implement: Inspectable, Showable do
   #   2.months.iso             # => "P2M"
   let iso -> String do
     return "P0D" if this.zero?
-    let years = if this.years != 0 then "${this.years}Y" else "" end
-    let months = if this.months != 0 then "${this.months}M" else "" end
-    let days = if this.days != 0 then "${this.days}D" else "" end
+    let years = this.years != 0 then "${this.years}Y" else ""
+    let months = this.months != 0 then "${this.months}M" else ""
+    let days = this.days != 0 then "${this.days}D" else ""
     return "P${years}${months}${days}"
   end
 end
@@ -17696,7 +18128,7 @@ make Date, implement: Inspectable, Showable do
     let month = total.modulo(12) + 1
     let year = (total - total.modulo(12)) / 12
     let last = Time.daysInValidMonth(year, month)
-    let day = if this.day > last then last else this.day end
+    let day = this.day > last then last else this.day
     return Date { year: year, month: month, day: day }
   end
 
@@ -18580,7 +19012,7 @@ make Type do
     # A function reads as its signature: `String -> String`, `foul () -> Void`.
     if this.name == "Function" && this.args.count > 0
       let arrow = this.args.map(&.to(String)).join(" -> ")
-      let signature = if this.args.count == 1 then "() -> ${arrow}" else arrow end
+      let signature = this.args.count == 1 then "() -> ${arrow}" else arrow
       return "foul ${signature}" if this.pure == false
       return signature
     end
@@ -18906,11 +19338,21 @@ make Float do
   end
 end
 
-make Measure do
+make Measure, implement: Showable do
   let factor -> Float = this.unit.factor
   let kind -> Atom = this.unit.kind
   let symbol -> String = this.unit.symbol
   let to(String) -> String = "${this.value} ${this.unit.symbol}"
+
+  # Renders the measure as its value and unit, so +IO.printLine+ and
+  # interpolation show +5.0 W+ rather than the record's fields. Inspecting
+  # it (the REPL's echo, +inspected+) still shows the record itself.
+  #
+  # @return [String] the value and the unit's symbol
+  #
+  # @example
+  #   "drawn: ${1.volt * 5.ampere}"   # => "drawn: 5.0 W"
+  let showValue -> String = this.to(String)
   # Formatting into a target display unit deliberately has NO prelude clause.
   # A unit module (Units.SI, Units.Data, ...) supplies `to(String, in:)` for
   # the units it owns, and reaching one requires importing it. A catch-all