@mark1russell7/coeval 0.17.0 → 0.18.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/coeval",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "coeval: the kernel of declarative languages. Documents in envelopes, a ladder that finds the evaluator, kind contracts, compiled plans, a static kit, a formula kit and a run side with capabilities.",
   "type": "module",
   "main": "./build/index.js",
@@ -15,7 +15,8 @@
   "files": [
     "build",
     "src",
-    "!src/**/*.test.ts"
+    "!src/**/*.test.ts",
+    "!src/**/*.test-support.ts"
   ],
   "sideEffects": false,
   "license": "MIT",

package/src/conform.ts

@@ -33,7 +33,7 @@ import { type Definitions, STD_DEFINITIONS } from "./reference.ts";
 import { STD_EVALUATORS } from "./stdlib.ts";
 import { sameValue } from "./agree.ts";
 import { declaredTruthOf } from "./formula.ts";
-import { membersOf, typeIssues, typeText } from "./types.ts";
+import { falseCovers, membersOf, typeIssues, typeText } from "./types.ts";
 import { type Random, random } from "./generate.ts";
 import { type Kind, type LazyRule, type Shape, type World, type WorldEntry, effectsOfVerb, isKind, isNamespace, lookupKind } from "./world.ts";
 
@@ -60,8 +60,10 @@ import { type Kind, type LazyRule, type Shape, type World, type WorldEntry, effe
  * - `agree`: compiled code gives the result of its definition for the reference interpreter.
  * - `truth`: the own `truthy` of a formula profile gives `true` or `false` for each member of its `truthType` (D86).
  *   Only `formula.if`, `formula.and` and `formula.or` of the formula kit get this check.
+ * - `cover`: each sample of a covered domain of the machine is in one domain of each cover of the domain (D94). Each
+ *   evaluator and each runner gets this check, because `fits` trusts the covers for each program.
  */
-export type Obligation = "C1" | "C2" | "C3" | "C4" | "C5" | "C6" | "C7" | "C8" | "local" | "agree" | "truth";
+export type Obligation = "C1" | "C2" | "C3" | "C4" | "C5" | "C6" | "C7" | "C8" | "local" | "agree" | "truth" | "cover";
 
 /** The probe of a finding: the document, the result of each probe part, the capabilities and the handler. */
 export interface ConformProbe {
@@ -136,7 +138,7 @@ export interface ConformOptions {
 }
 
 /** The order of the obligations in the list of findings. */
-const ORDER: readonly Obligation[] = ["C1", "C2", "C3", "C4", "C5", "C6", "C7", "C8", "local", "agree", "truth"];
+const ORDER: readonly Obligation[] = ["C1", "C2", "C3", "C4", "C5", "C6", "C7", "C8", "local", "agree", "truth", "cover"];
 
 /** A function in the results of the probe parts. It gives the count of its arguments. */
 const PROBE_FN = (...args: readonly unknown[]): number => args.length;
@@ -1032,7 +1034,8 @@ function examine(env: Env, sample: Sample, contract: Contract): void {
 /**
  * This function checks the declared truth of a profile (D86). The function `truthy` must give `true` or `false` for
  * each member of `truthType`, and it must not throw. The members come from the lists `values` of the domains of the
- * type. A type without such a list gets the values of the results of the palette that are its members.
+ * type. A type without such a list gets its members from the results of the palette and from the samples of the
+ * domains (D99).
  */
 function checkTruth(env: Env, code: unknown, probe: (value: unknown) => ConformProbe): void {
   const truth = declaredTruthOf(code);
@@ -1057,6 +1060,27 @@ function checkTruth(env: Env, code: unknown, probe: (value: unknown) => ConformP
   }
 }
 
+/**
+ * This function checks the covers of the domains of the machine from samples (D94). Each sample of a covered domain
+ * must be in one domain of each valid cover. The samples of a domain come from its list `values`. A domain without
+ * that list gets its members from the palette and from the samples of the domains, as for the check `truth`.
+ */
+function checkCovers(env: Env, probe: (value: unknown) => ConformProbe): void {
+  const domains = env.machine.domains;
+  if (domains === undefined) return;
+  const palette = env.results.flatMap((result) => (result.ok ? [result.value] : []));
+  const samples: Record<string, readonly unknown[]> = {};
+  for (const [name, domain] of Object.entries(domains)) if (domain.covers !== undefined) samples[name] = membersOf(name, domains, palette);
+  const found = falseCovers(domains, samples)[0];
+  if (found === undefined) return;
+  report(
+    env,
+    "cover",
+    `The member ${valueText(found.value)} of the domain ${found.domain} is in no domain of its cover ${found.cover.join(", ")}. The check of types trusts the cover, thus it is unsound for ${found.domain}.`,
+    () => probe(found.value),
+  );
+}
+
 /**
  * This function examines one evaluator or runner of a machine against the obligations of host code (K92, D36). It
  * starts the code directly, without the kernel, with probe parts and a probe runtime. It generates probe documents from
@@ -1067,7 +1091,8 @@ function checkTruth(env: Env, code: unknown, probe: (value: unknown) => ConformP
  * compiled code with its definition. The finding of an obligation names the first probe that breaks it. An empty list
  * means that each probe conforms.
  *
- * The check `truth` tests the declared truth of a formula profile (D86).
+ * The check `truth` tests the declared truth of a formula profile (D86). The check `cover` tests the covers of the
+ * domains of the machine from samples (D94).
  *
  * @param machine - The machine with the code and the world of the kinds.
  * @param name - The name of the evaluator or of the runner. A runner wins over an evaluator of the same name.
@@ -1110,11 +1135,12 @@ export function conforms(machine: Machine, name: string, options: ConformOptions
       examine(env, sample, contract);
     }
   }
-  // A probe of the truth gives the member to each part of the first probe document.
-  checkTruth(env, code, (value) =>
+  // A probe of the truth or of a cover gives the value to each part of the first probe document.
+  const probeWith = (value: unknown): ConformProbe =>
     first === undefined
       ? { type: typeName(types[0] as TypeRef), doc: { type: types[0] as TypeRef, value: null }, results: {}, waits: [], caps: NO_CAPS, running: runner }
-      : probeOf(first, { results: first.split.parts.map(() => ok(value)), waits: [], caps: NO_CAPS, running: runner }),
-  );
+      : probeOf(first, { results: first.split.parts.map(() => ok(value)), waits: [], caps: NO_CAPS, running: runner });
+  checkTruth(env, code, probeWith);
+  checkCovers(env, probeWith);
   return ORDER.filter((obligation) => env.found.has(obligation)).map((obligation) => env.found.get(obligation) as Finding);
 }

package/src/evaluate.ts

@@ -1053,6 +1053,11 @@ class Session implements Runtime {
   private list: Effect[] | undefined;
   tick = 0;
   nextId = 0;
+  /**
+   * The count of the drives without a wait that are active at this time. In a run, an effect under such a drive does
+   * not reach the host (RUN.HELD).
+   */
+  held = 0;
   current: Building | undefined;
   readonly holder: Building | undefined;
   /**
@@ -1265,6 +1270,13 @@ class Session implements Runtime {
     if ("ok" in made) return made;
     const perform = this.perform;
     if (!this.running || perform === undefined) return this.answer(made, place);
+    if (this.held > 0) {
+      // The parent cannot wait for the answer of the host, thus the host does not get the effect (RUN.HELD).
+      made.outcome = fail("#CALC!", heldReason(made.kind), { place });
+      // The drive stops at this wait, and gives the #CALC! of the runner.
+      yield HELD;
+      return made.outcome;
+    }
     let done: unknown;
     try {
       done = perform(made);
@@ -1452,6 +1464,21 @@ export function waitedReason(kindText: string): string {
   return `${kindText} waits for effects, and its parent cannot wait. Give the parent a runner.`;
 }
 
+/**
+ * This function gives the reason of an effect that a run does not give to the host: the parent of its runner cannot
+ * wait (RUN.HELD). The plan and the reference give the same reason.
+ *
+ * @param kind - The kind of the effect.
+ * @returns The reason.
+ */
+export function heldReason(kind: Cap): string {
+  const text = typeof kind === "string" ? kind : kind.join(".");
+  return `The parent of the runner cannot wait, thus the host does not get the effect ${text}.`;
+}
+
+/** The wait of an effect that a run does not give to the host. A drive without a wait stops at it (RUN.HELD). */
+const HELD: Promise<unknown> = /* @__PURE__ */ Promise.resolve(undefined);
+
 /** This function drives steps that cannot wait. A step that waits stops the steps, and gives `#CALC!`. */
 function drive(steps: Steps, kindText: string): Result {
   const step = steps.next();
@@ -2148,10 +2175,19 @@ function placedRun(inner: RunCode, place: readonly Key[], name: string): RunCode
 /**
  * This function gives the code of a runner under a parent that cannot wait: its steps, driven without a wait. An
  * evaluation and a run both drive them (RUN.DRIVE-NESTED). Only a step that really waits gives `#CALC!`, at the place
- * of the runner, where the error started (RUN.WAIT).
+ * of the runner, where the error started (RUN.WAIT). In a run, an effect under the runner does not reach the host,
+ * because the parent cannot wait for its answer (RUN.HELD).
  */
 function runnerCode(run: RunCode, place: readonly Key[], kindText: string): Code {
-  return (ctx, rt) => placed(drive(run(ctx, rt), kindText), place);
+  return (ctx, rt) => {
+    if (!rt.running || !(rt instanceof Session)) return placed(drive(run(ctx, rt), kindText), place);
+    rt.held += 1;
+    try {
+      return placed(drive(run(ctx, rt), kindText), place);
+    } finally {
+      rt.held -= 1;
+    }
+  };
 }
 
 /**

package/src/formula.ts

@@ -31,6 +31,8 @@ export type ExtFn = (data: Json, context: Context, domains?: Readonly<Record<str
  * - `lazy`: the operations that evaluate their arguments themselves.
  * - `ext`: the extensions of the namespace `ext`, by their name. The kit has `ext.undefined`, `ext.number` and
  *   `ext.domain`.
+ * - `extTypes`: the value type of each extension of `ext`, by its name, for a check of types (TYPE.EXT, D103). An
+ *   extension without an entry gives `unknown` (TYPE.GRADUAL). An entry for a standard extension has no effect.
  * - `truthy`: the truth of a value for `if`, `and` and `or`. `undefined` is an error `#VALUE!`. The default
  *   accepts only `true` and `false`.
  * - `truthType`: the value type of a truth for the own `truthy`, for a check of types (TYPE.TRUTH, D81). A test of
@@ -54,12 +56,13 @@ export type ExtFn = (data: Json, context: Context, domains?: Readonly<Record<str
  *
  * A check of types trusts the signatures. Each operation must give a member of the result of each signature that
  * its arguments match. The hook `check` must keep each result in that type. The function `truthy` must give a truth
- * for each member of `truthType`.
+ * for each member of `truthType`. Each extension must give a member of its type in `extTypes`.
  */
 export interface FormulaProfile {
   readonly ops?: Readonly<Record<string, OpFn>> | ((name: string) => OpFn | undefined);
   readonly lazy?: Readonly<Record<string, LazyOp>>;
   readonly ext?: Readonly<Record<string, ExtFn>>;
+  readonly extTypes?: Readonly<Record<string, ValueType>>;
   readonly truthy?: (value: unknown) => boolean | undefined;
   readonly truthType?: ValueType;
   readonly otherwise?: unknown;
@@ -272,7 +275,7 @@ function paramsOf(value: unknown): readonly string[] {
 /**
  * This function makes the type rules of the formula kit for one profile (TYPE.SYNTH, D25). Each evaluator of the kit
  * holds its rule. The rules read the rules of the profile that change a type: `truthy`, `truthType`, `logic`,
- * `otherwise`, `omit` and `sigs`.
+ * `otherwise`, `omit`, `sigs` and `extTypes`.
  */
 function formulaTypes(profile: FormulaProfile): Readonly<Record<string, TypeRule>> {
   // The default truth needs a truth value. An own truth needs its declared type, or nothing without a declaration (D81).
@@ -510,7 +513,14 @@ function formulaTypes(profile: FormulaProfile): Readonly<Record<string, TypeRule
       synth: (input) => {
         const name = nameOf(input);
         const own = profile.ext !== undefined && Object.hasOwn(profile.ext, name);
-        if (own) return "unknown";
+        if (own) {
+          // The declared type is a contract. A type with a problem gives unknown, thus one problem gives one issue (D103).
+          const types = profile.extTypes;
+          const declared = types !== undefined && Object.hasOwn(types, name) ? types[name] : undefined;
+          if (declared === undefined) return "unknown";
+          const type = input.contract(declared, `type of ext.${name} in extTypes`);
+          return typeIssues(type, input.machine.domains).length > 0 ? "unknown" : type;
+        }
         // The standard extensions give the values that JSON cannot write, thus each has a base type (D48).
         if (name === "undefined") return "undefined";
         if (name === "number") return "number";
@@ -580,6 +590,7 @@ const PROFILE_KEYS = /* @__PURE__ */ Object.freeze([
   "ops",
   "lazy",
   "ext",
+  "extTypes",
   "truthy",
   "truthType",
   "otherwise",

package/src/merge.ts

@@ -89,7 +89,7 @@ function same(a: unknown, b: unknown): boolean {
 
 /**
  * Two domains are the same when they are one object. They are also the same when they have the same test `is`,
- * parents, summary, steps, codec, list of values and covers. Thus two languages that give one test under one name give one
+ * parents, summary, steps, codec, list of values, samples and covers. Thus two languages that give one test under one name give one
  * domain. Two codecs are the same when they have the same functions `encode` and `decode` (D80).
  */
 function sameDomain(a: Domain, b: Domain): boolean {
@@ -102,6 +102,7 @@ function sameDomain(a: Domain, b: Domain): boolean {
     steps: same(a.steps ?? {}, b.steps ?? {}),
     codec: same(a.codec ?? null, b.codec ?? null),
     values: same(a.values ?? null, b.values ?? null),
+    samples: same(a.samples ?? null, b.samples ?? null),
     covers: same(a.covers ?? [], b.covers ?? []),
   };
   return Object.values(fields).every(Boolean);
@@ -123,8 +124,8 @@ export interface DomainExtension {
 /**
  * This function makes a part of a merge that adds parents, steps or covers to a domain of an earlier part
  * (TYPE.PARENTS). An example is a domain of another language. The part reads the domain from the merge before it
- * (`prev`). It gives a copy with the same test, summary, codec and list of values, and it names `["domains", name]`
- * in `replaces` (D17).
+ * (`prev`). It gives a copy with the same test, summary, codec, list of values and samples, and it names
+ * `["domains", name]` in `replaces` (D17).
  * A domain of the kernel that the earlier parts do not name comes from `STD_DOMAINS`.
  *
  * An extension does not change the codec. Thus each member keeps its document (D80).
@@ -158,6 +159,8 @@ export function extendDomain(name: string, more: DomainExtension): (prev: Machin
       codec: found.codec,
       // A new parent only adds a test, thus the list of values stays complete (TYPE.FITS-FINITE).
       values: found.values,
+      // A sample outside the new line does not count, thus the samples stay (D99).
+      samples: found.samples,
       // A new parent only adds a test, thus each cover stays true (TYPE.FITS-COVER). A new cover is a claim of the extension.
       covers: covers.length === 0 ? undefined : covers,
     };

package/src/reference.ts

@@ -21,6 +21,7 @@ import {
   type Steps,
   type StopSignal,
   JOURNAL,
+  heldReason,
   makeContext,
   permits,
   placeText,
@@ -110,6 +111,8 @@ interface Env {
   readonly verb: string;
   /** The scope of the code that evaluates at this time. `all` changes it for each item. */
   scope: Scope;
+  /** The count of the drives without a wait that are active. In a run, an effect under one does not reach the host (RUN.HELD). */
+  held: number;
   /** The record of the reads. A nested evaluation for an equation of a tree keeps the record of its tree. */
   readonly reading: Reading | undefined;
 }
@@ -309,6 +312,12 @@ function* causeAndWait(env: Env, ctx: Context, kind: Cap, payload: unknown, plac
   if ("ok" in effect) return effect;
   const perform = env.perform;
   if (perform === undefined) return (effect.outcome = ok(payload));
+  if (env.held > 0) {
+    // The parent cannot wait for the answer of the host, thus the host does not get the effect (RUN.HELD).
+    effect.outcome = fail("#CALC!", heldReason(kind), { place });
+    yield Promise.resolve(undefined);
+    return effect.outcome;
+  }
   let given: unknown;
   try {
     given = perform(effect);
@@ -382,7 +391,16 @@ function evaluateSeen(env: Env, seen: Seen, at: At): Result {
   const { chosen } = seen;
   const { place } = at;
   if ("gap" in chosen) return fail("#NOEVAL", chosen.gap, { place });
-  if ("runner" in chosen) return drive(runSeen(env, seen, at, chosen.runner), place, seen.kindText);
+  if ("runner" in chosen) {
+    if (!env.running) return drive(runSeen(env, seen, at, chosen.runner), place, seen.kindText);
+    // In a run, an effect under this drive does not reach the host (RUN.HELD).
+    env.held += 1;
+    try {
+      return drive(runSeen(env, seen, at, chosen.runner), place, seen.kindText);
+    } finally {
+      env.held -= 1;
+    }
+  }
   const input = evalInput(env, seen, at);
   try {
     return placed(chosen.evaluator(input), place);
@@ -655,6 +673,7 @@ function envOf(machine: Machine, options: ReferenceOptions, running: boolean, ro
     running,
     verb: options.verb ?? "eval",
     scope: { prefix: "", counts: new Map(), alls: 0 },
+    held: 0,
     reading: outer ?? (options.reads === undefined ? undefined : { list: options.reads, root }),
   };
 }

package/src/replay.ts

@@ -230,7 +230,8 @@ export interface ReplayErrorJson {
   /**
    * The JSON form of a cause without a term document that is a list or a plain record with an exception at some depth
    * (RUN.REPLAY-CAUSE-PARTS, D87). It is a list of parts, the part `record` or the part `share`. The index 0 of `loop` is its
-   * first exception, and the index 0 of `share` is its first list or record.
+   * first exception, and the index 0 of `share` is its first list or record. Since D101, a list or a record cause that
+   * holds a container at two places is also `causeParts` (RUN.REPLAY-SHARED-VALUES).
    */
   readonly causeParts?: ReplayCausePartsJson;
   /** The names of the items of `causeParts` without a form, for example `cause.send`. This list is only a note. */
@@ -251,13 +252,18 @@ export type ReplayCausePartsJson = readonly ReplayPartsJson[] | { readonly recor
 export interface ReplayExceptionJson {
   readonly name: string;
   readonly message: string;
-  /** The term documents of the own fields of the exception that `encodeValue` writes, for example `code` or `errno`. */
+  /**
+   * The term documents of the own fields of the exception that `encodeValue` writes, for example `code` or `errno`. A list
+   * or a plain record that two places of the error share is in `parts` (RUN.REPLAY-SHARED-VALUES, D101).
+   */
   readonly fields?: Readonly<Record<string, Json>>;
   /**
    * The own enumerable fields without a term document that are an exception, a list or a plain record (RUN.REPLAY-FIELDS,
    * D78, D82). An example is a list `errors` on an `Error`. A list is a list of parts, and a record is the part `record`.
    * Each exception in them has the rule of a cause. A container without a form in it is a name in `dropped`. A container
    * that an earlier place holds is the part `share` (D88).
+   *
+   * Since D101, a shared container with a term document is in `parts` too, and so is each container that holds it.
    */
   readonly parts?: Readonly<Record<string, ReplayPartsJson>>;
   /**
@@ -279,7 +285,8 @@ export interface ReplayExceptionJson {
   readonly loop?: number;
   /**
    * The JSON form of a cause without a term document that is a list or a plain record with an exception at some depth
-   * (RUN.REPLAY-CAUSE-PARTS, D87). Each exception in it has the rule of a cause, also a `loop`.
+   * (RUN.REPLAY-CAUSE-PARTS, D87). Each exception in it has the rule of a cause, also a `loop`. Since D100, a list or a
+   * record without an exception is also `causeParts` when an item has a form (RUN.REPLAY-CAUSE-ITEMS).
    */
   readonly causeParts?: ReplayCausePartsJson;
 }
@@ -371,7 +378,10 @@ interface Holder {
   /** The name for `dropped` when no item of the container has a form. */
   readonly name: string;
   readonly list: boolean;
-  /** The value `true` marks a hidden list of a standard class. It keeps its marks also without a form (D78). */
+  /**
+   * The value `true` marks a hidden list of a standard class. It keeps its marks also without a form (D78). It also marks
+   * a shared container with a term document, thus an empty container keeps its form (D101).
+   */
   keep: boolean;
   /** The keys of a record in the order of the keys. A list has no keys. */
   readonly keys: readonly string[];
@@ -385,7 +395,10 @@ interface ExceptionTask {
   readonly name: string;
   /** The value `true` marks a value that `encodeValue` cannot write, thus the walk does not try again. */
   readonly tried: boolean;
-  /** The value `false` marks a cause. A cause is a container only when it holds an exception at some depth (D87). */
+  /**
+   * The value `false` marks the cause of an error value. It is a container only when it holds an exception at some depth
+   * (D87). The cause of an exception is a container as a field is (D100).
+   */
   readonly nest: boolean;
   /** The value `true` marks a hidden list of a standard class. It is always a container of parts (D77). */
   readonly keep: boolean;
@@ -421,9 +434,66 @@ function holdsHole(value: unknown): boolean {
   return false;
 }
 
+/**
+ * This function gives the lists and the plain records that the walk of `causeJson` keeps as containers of parts, also
+ * with a term document (D101). Such a container is at two places of the walk, or it holds such a container at some depth.
+ * It reads the values as the walk does: the fields of an exception, its hidden fields and its cause, and the items of a
+ * container. A term document gives a copy at each place, thus a shared container cannot be one.
+ */
+function sharedOf(root: unknown): ReadonlySet<object> {
+  const seen = new Set<object>();
+  const twice: object[] = [];
+  // The containers that hold each container. A container on the way to a shared container is a container of parts too.
+  const owners = new Map<object, object[]>();
+  const stack: [unknown, object | undefined][] = [[root, undefined]];
+  for (let next = stack.pop(); next !== undefined; next = stack.pop()) {
+    const [at, owner] = next;
+    if (typeof at !== "object" || at === null) continue;
+    const container = Array.isArray(at) || isRecord(at);
+    if (!container && !(at instanceof Error)) continue;
+    if (container && owner !== undefined) {
+      const list = owners.get(at);
+      if (list === undefined) owners.set(at, [owner]);
+      else list.push(owner);
+    }
+    if (seen.has(at)) {
+      if (container) twice.push(at);
+      continue;
+    }
+    seen.add(at);
+    if (Array.isArray(at)) {
+      for (let item = 0; item < at.length; item += 1) if (Object.hasOwn(at, item)) stack.push([readField(at, item), at]);
+    } else if (container) {
+      for (const key of Object.keys(at)) stack.push([readField(at, key), at]);
+    } else {
+      // An exception is never a term document of the walk, thus it is not an owner.
+      for (const key of Object.keys(at)) if (!ownField(key)) stack.push([readField(at, key), undefined]);
+      for (const key of HIDDEN) if (Object.getOwnPropertyDescriptor(at, key)?.enumerable === false) stack.push([readField(at, key), undefined]);
+      if (Object.hasOwn(at, "cause")) stack.push([readField(at, "cause"), undefined]);
+    }
+  }
+  const shared = new Set<object>();
+  for (let at = twice.pop(); at !== undefined; at = twice.pop()) {
+    if (shared.has(at)) continue;
+    shared.add(at);
+    for (const owner of owners.get(at) ?? []) twice.push(owner);
+  }
+  return shared;
+}
+
+/**
+ * This function tells if the walk of `causeJson` keeps a value with a term document as a container of parts (D101). The
+ * value is in the set of `sharedOf`. A member of a domain stays a term document, because its codec makes it again.
+ */
+function wholeOf(shared: ReadonlySet<object>, value: unknown, term: Json): boolean {
+  if (typeof value !== "object" || value === null || !shared.has(value)) return false;
+  const type = isRecord(term) ? term["type"] : undefined;
+  return !(Array.isArray(type) && type[0] === "ext" && type[1] === "domain");
+}
+
 /**
  * This function tells if a list or a plain record holds an exception at some depth (D87). It reads the items as the
- * walk of `causeJson` does, thus a cause container with an exception gets a form.
+ * walk of `causeJson` does, thus a container cause of an error value with an exception gets a form.
  */
 function holdsException(value: unknown): boolean {
   const seen = new Set<object>();
@@ -492,13 +562,15 @@ function keptOf(keys: readonly string[], built: readonly Built[]): [string, Repl
  *
  * The walk gives each exception an index in the order of a depth-first walk. It takes the fields in `parts` in the
  * order of their keys, the hidden fields in the order of `HIDDEN`, then the cause (D78). A list or a plain record
- * without a term document is a container of parts, with its items in their order (D82). A cause is a container only
- * when it holds an exception (D87). A value that is an earlier exception of the walk is its index in `loop` (D77).
+ * without a term document is a container of parts, with its items in their order (D82). The cause of an error value
+ * is a container only when it holds an exception (D87). The cause of an exception is a container as a field is (D100).
+ * A value that is an earlier exception of the walk is its index in `loop` (D77).
  *
- * A container that an earlier place holds is its index in `share`, also a container that holds itself (D88). The walk is
- * a loop, thus a long chain does not overflow the stack.
+ * A container that an earlier place holds is its index in `share`, also a container that holds itself (D88). A container
+ * of `sharedOf` is a container of parts also with a term document, thus each share gives one object (D101). The value
+ * `tried` marks a root that `encodeValue` cannot write. The walk is a loop, thus a long chain does not overflow the stack.
  */
-function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson {
+function causeJson(machine: Pick<Machine, "domains">, root: unknown, shared: ReadonlySet<object>, tried: boolean): CauseJson {
   // The nodes and the containers in the order of the walk. Each item of a node or of a container comes later.
   const items: (ExceptionNode | Holder)[] = [];
   const index = new Map<unknown, number>();
@@ -530,12 +602,14 @@ function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson
     const at = items.length;
     index.set(current, index.size);
     const fields: [string, Json][] = [];
-    const linked: [string, unknown][] = [];
+    // The value `true` marks a field without a term document. A shared container has one, and the walk writes it (D101).
+    const linked: [string, unknown, boolean][] = [];
     for (const key of Object.keys(current)) {
       if (ownField(key)) continue;
       const value = readField(current, key);
       const term = value === MISSING ? undefined : termOrNothing(machine, value);
-      if (term === undefined) linked.push([key, value]);
+      if (term === undefined) linked.push([key, value, true]);
+      else if (wholeOf(shared, value, term)) linked.push([key, value, false]);
       else fields.push([key, term]);
     }
     const head = { name: String(current.name), message: String(current.message), ...(fields.length === 0 ? {} : { fields: Object.fromEntries(fields) }) };
@@ -543,11 +617,11 @@ function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson
     items.push(node);
     const children: ExceptionTask[] = [];
     for (let place = 0; place < linked.length; place += 1) {
-      const [key, value] = linked[place] as [string, unknown];
+      const [key, value, without] = linked[place] as [string, unknown, boolean];
       const put = (part: Part): void => {
         node.parts[place] = part;
       };
-      children.push({ value, name: key, tried: true, nest: true, keep: false, put });
+      children.push({ value, name: key, tried: without, nest: true, keep: false, put });
     }
     for (const key of HIDDEN) {
       if (Object.getOwnPropertyDescriptor(current, key)?.enumerable !== false) continue;
@@ -564,7 +638,8 @@ function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson
       const put = (part: Part): void => {
         node.cause = part;
       };
-      children.push({ value: current.cause, name: "cause", tried: false, nest: false, keep: false, put });
+      // The cause of an exception keeps each item with a form, also without an exception in it (D100).
+      children.push({ value: current.cause, name: "cause", tried: false, nest: true, keep: false, put });
     }
     later(children);
     return at;
@@ -573,7 +648,7 @@ function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson
   tasks.push({
     value: root,
     name: "cause",
-    tried: true,
+    tried,
     nest: false,
     keep: false,
     put: (part) => {
@@ -591,20 +666,23 @@ function causeJson(machine: Pick<Machine, "domains">, root: unknown): CauseJson
       task.put({ loop });
       continue;
     }
+    const container = Array.isArray(value) || isRecord(value);
+    const held = container ? holders.get(value) : undefined;
+    if (held !== undefined) {
+      // A container that an earlier place holds, also a container that holds itself, is a share (D88, D101).
+      if (task.keep) (items[held] as Holder).keep = true;
+      task.put({ same: held, name: task.name });
+      continue;
+    }
     const term = task.tried || task.keep ? undefined : termOrNothing(machine, value);
-    if (term !== undefined) task.put({ value: term });
+    // A shared container with a term document is a container of parts, and it always has a form (D101).
+    const whole = term !== undefined && wholeOf(shared, value, term);
+    if (term !== undefined && !whole) task.put({ value: term });
     else if (value instanceof Error) task.put({ node: open(value) });
-    else if ((Array.isArray(value) || isRecord(value)) && (task.nest || holdsException(value))) {
-      const held = holders.get(value);
-      if (held === undefined) {
-        const children: ExceptionTask[] = [];
-        task.put({ holder: hold(task.name, value, task.keep, children) });
-        later(children);
-      } else {
-        // A container that an earlier place holds, also a container that holds itself, is a share (D88).
-        if (task.keep) (items[held] as Holder).keep = true;
-        task.put({ same: held, name: task.name });
-      }
+    else if (container && (whole || task.nest || holdsException(value))) {
+      const children: ExceptionTask[] = [];
+      task.put({ holder: hold(task.name, value as object, task.keep || whole, children) });
+      later(children);
     } else task.put({ none: task.name });
   }
   const { formed, shares } = formsOf(items);
@@ -718,14 +796,20 @@ function errorJson(machine: Pick<Machine, "domains">, error: EvalError, what: ()
   const base = { code: error.code, reason: error.reason, ...(error.place === undefined ? {} : { place: error.place }) };
   if (!Object.hasOwn(error, "cause")) return base;
   const cause: unknown = error.cause;
+  const shared = sharedOf(cause);
+  let term: Json | undefined;
+  let failure: unknown;
   try {
-    return { ...base, cause: encodeValue(machine, cause) };
-  } catch (failure) {
-    // An exception, or a list or a record with an exception, is a best effort (D76, D87). Each other cause is a refusal.
-    const { link, names } = causeJson(machine, cause);
-    if (link === undefined) throw new TypeError(`encodeLog cannot write the cause of ${what()}: ${messageOf(failure)}`);
-    return { ...base, ...link, ...(names.length === 0 ? {} : { dropped: names }) };
+    term = encodeValue(machine, cause);
+  } catch (thrown) {
+    failure = thrown;
   }
+  // A cause that holds a shared container is a container of parts, thus each place keeps one object (D101).
+  if (term !== undefined && !wholeOf(shared, cause, term)) return { ...base, cause: term };
+  // An exception, or a list or a record with an exception, is a best effort (D76, D87). Each other cause is a refusal.
+  const { link, names } = causeJson(machine, cause, shared, term === undefined);
+  if (link === undefined) throw new TypeError(`encodeLog cannot write the cause of ${what()}: ${messageOf(failure)}`);
+  return { ...base, ...link, ...(names.length === 0 ? {} : { dropped: names }) };
 }
 
 /**
@@ -743,8 +827,12 @@ function errorJson(machine: Pick<Machine, "domains">, error: EvalError, what: ()
  *   (RUN.REPLAY-FIELDS, D78, D82). An item of a list without a form is the mark `dropped` at its place.
  * - A cause without a term document that is a list or a plain record with an exception is in `causeParts`
  *   (RUN.REPLAY-CAUSE-PARTS, D87). The rule is the same for the cause of an exception and of an error value.
+ * - The cause of an exception is also in `causeParts` without an exception in it, when an item has a form
+ *   (RUN.REPLAY-CAUSE-ITEMS, D100). Each item without a form is a name in `dropped`, for example `cause.send`.
  * - A list or a record of parts that an earlier place of one error holds is the part `share` with its index
  *   (RUN.REPLAY-SHARED, D88). This rule also covers a container that holds itself.
+ * - A list or a plain record with a term document that two places of one error share is a container of parts
+ *   (RUN.REPLAY-SHARED-VALUES, D101). Each later place is a share. A member of a domain stays a term document.
  * - An outcome that the log does not have stays absent.
  *
  * @param machine - The machine of the run, or only its domains.