@melite/estate-drafts 0.0.0-stage → 0.1.5-pre-alpha

package/lib/bench.js

@@ -0,0 +1,1941 @@
+
+//
+// The bench doc IS a draft doc (same domain, same table, id
+// "bench-<session>") plus a `bench` block: { rev, log } — the
+// append-only revision log both authors walk. HTTP vocabulary is
+// dead with the gateway: birth/load refuse as RemoteError codes,
+// never status payloads.
+//
+// Laws carried over (the bench rework's, unchanged):
+//   CAS — ensure-with-stages takes expect_rev; a moved bench refuses
+//   loud (bench/cas-conflict carries current_rev), never merges.
+//   APPEND-ONLY LOG — load appends a revert-carrying entry; history
+//   is never rewritten (patch/undo arms land in later strokes).
+//   AUTHORSHIP — every entry carries author ("agent"|"user").
+import { unwrapItemArrays } from '@melite/comfyui-card-kit';
+import { benchDraftIdOf, BIRTH_STRIP_KEYS, LOAD_CARRY_KEYS, normalizeBenchStage, SELF_NAMED_FAMILIES, stripKeys } from '@melite/contracts/benchStage';
+import { RemoteError } from "@deepseek-ai/dsh-typert-protocol";
+import { trailDedupe } from "./trail.js";
+
+
+
+
+
+
+
+
+
+
+import { BENCH_DRAFT_RE, RESTORED_PROVENANCE_SPELLING, SESSION_RE } from "@melite/contracts/benchStage";
+import { RESTORED_PROVENANCE } from "./remote.js";
+export { SESSION_RE };
+function benchIdOf(session) {
+    return benchDraftIdOf(session);
+}
+const AUTHORS = ["agent", "user"];
+function authorOk(v) {
+    return v === "agent" || v === "user";
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function benchBlockOf(doc) {
+    const raw = doc["bench"];
+    if (isRecord(raw) &&
+        typeof raw["rev"] === "number" &&
+        Array.isArray(raw["log"])) {
+        return { rev: raw["rev"], log: raw["log"] };
+    }
+    return { rev: 0, log: [] };
+}
+function stagesOf(doc) {
+    // The domain schema promises stages is an array of id-carrying
+    // objects (DraftDocSchema), but nothing enforces the promise on
+    // this path — a doc written behind the domain's back (an older
+    // door, a hand edit) reads back as it was written, and a reader
+    // that trusted the promise crashed on a null row. The read
+    // projection owns the guarantee: only record rows ride, and a
+    // row's id is read where it is used, never assumed.
+    const stages = doc["stages"];
+    if (!Array.isArray(stages))
+        return [];
+    return stages.filter((s) => isRecord(s));
+}
+
+
+
+
+
+
+
+function seedStateOf(row) {
+    // Post-normalize rows ALWAYS carry a record params (normalizeStages
+    // replaces junk/missing params with {}) — no re-defense here.
+    const seed = row["params"]["seed"];
+    if (typeof seed === "number" && seed !== -1)
+        return `${row["id"]} seed ${seed} (pinned)`;
+    if (seed === -1)
+        return `${row["id"]} seed random`;
+    return `${row["id"]} seed absent`;
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export function mintStageId(rows, body) {
+    if (typeof body["id"] === "string" && body["id"] !== "")
+        return body["id"];
+    return nextStageId(highestStageSuffix(rows), takenStageIds(rows));
+}
+/** THE HIGHEST `s_<n>` ON THE BENCH, or -1 when there is none (the
+ *  ONE arithmetic; both id producers take it).
+ *
+ *  It was written twice — once in the write door's mint and once in
+ *  the load path's dedupe — and the identity wall caught the second
+ *  copy on its first run, which is the wall doing precisely its job.
+ *  A formula that decides what a stage is called belongs in one
+ *  place; the two callers differ only in what they do with the
+ *  answer. */
+function highestStageSuffix(rows) {
+    let max = -1;
+    for (const row of rows) {
+        const m = /^s_(\d+)$/.exec(String(row["id"] ?? ""));
+        if (m !== null && Number(m[1]) > max)
+            max = Number(m[1]);
+    }
+    return max;
+}
+/** The next free `s_<n>` at or above `max + 1`, skipping any id the
+ *  caller already holds. The writer's mint and the loader's repair
+ *  both ask this, so "the next id" means one thing in this file. */
+function nextStageId(max, taken) {
+    let n = max;
+    let fresh;
+    do {
+        n += 1;
+        fresh = "s_" + String(n);
+    } while (taken.has(fresh));
+    return fresh;
+}
+/** The ids already spoken for on the bench — every stage's own. A
+ *  mint that skips these cannot collide with a row the caller has
+ *  not seen yet. */
+function takenStageIds(rows) {
+    const taken = new Set();
+    for (const row of rows) {
+        const id = row["id"];
+        if (typeof id === "string")
+            taken.add(id);
+    }
+    return taken;
+}
+/** Birth defaults per the composer's law (id, inputs, provenance)
+ *  with the runner's object inputs. */
+export function normalizeStages(stagesIn, author) {
+    if (!Array.isArray(stagesIn))
+        return [];
+    const kept = stagesIn.filter((s) => isRecord(s));
+    // which rows arrived with their OWN id (the dedupe's pass-1 set)
+    const arrivedWithId = kept.map((s) => typeof s["id"] === "string");
+    const normalized = kept
+        .map((s, idx) => {
+        // THE PARAMS-SHAPE REFUSAL (commission 015, §6 finding 5):
+        // normalizeBenchStage heals a non-record params to {} — the
+        // right law for a doc already on disk, but at the WRITE door
+        // that heal minted a stage from the card's knobs WRAPPED IN AN
+        // ARRAY with empty params instead of refusing, the bench door
+        // looser than the card it stages. The judgment runs on the
+        // UNWRAPPED value (the wire's `{item:[…]}` spelling resolves to
+        // the same bare array); the add and patch doors carry the same
+        // law.
+        const rawParams = wireParams(s["params"]);
+        if (rawParams !== undefined && !isRecord(rawParams)) {
+            const named = s["id"];
+            throw new RemoteError("bench/bad-body", "stage " + (typeof named === "string" && named !== "" ? named : "#" + idx) +
+                ": params must be an object (got " + (Array.isArray(rawParams) ? "an array — the card's knobs, not a list of them" : typeof rawParams) +
+                "); a wire that cannot be read is refused here, not healed", {});
+        }
+        // THE ONE NORMALIZATION (benchStage.ts — the contract): id
+        // fill, DERIVED engine, run-memory strip, run-media path heal,
+        // the self-naming model strip, inputs/params/outputs defaults.
+        
+        // GUI's row, the agent's row and a restored row became three
+        // different documents.
+        const row = normalizeBenchStage(s, idx);
+        // the load arm's rows cross the same remote encoding — the
+        // store-seat unwrap applies here too (wireParams law)
+        row["params"] = wireParams(row["params"]);
+        
+        // audit's CRITICAL-1): provenance 'restored' is how the model
+        // REPAIR law knows a row came off an archive. Unconditionally
+        // stamping the author here erased it on every load, so a
+        // design-era row (params.model naming the card, an unboarded
+        // family) refused at its next admission with no repair — the
+        // one job the coordinate exists for. The author's own rows are
+        // stamped as before; a restored row keeps its mark.
+        // THE COORDINATE HAS TWO SPELLINGS, AND BOTH ARE KEPT (the
+        
+        // to judge its stored rows: the stamp respected the WIRE string
+        // and silently overwrote the in-process SYMBOL, so a
+        // server-armed restore lost its mark on the very path that
+        // exists to carry it). A coordinate with one spelling on the
+        // wire and another in memory is two facts wearing one name —
+        // the stamp respects both, and the door that mints the symbol
+        // is the only producer of it.
+        if (row["provenance"] !== RESTORED_PROVENANCE_SPELLING
+            && row["provenance"] !== RESTORED_PROVENANCE) {
+            row["provenance"] = author;
+        }
+        return row;
+    });
+    // THE SECOND PASS (the identity audit's A3). The map above is
+    // left exactly as it was; the uniqueness law is a separate step so
+    // the contract's positional fill stays the contract's.
+    return dedupeStageIds(normalized, arrivedWithId);
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+function dedupeStageIds(rows, arrivedWithId) {
+    // PASS 1 — the author's ids, reserved before anything is moved. An
+    // explicit id is never the one that gives way.
+    const named = [];
+    for (const [i, row] of rows.entries()) {
+        if (arrivedWithId[i] === true && typeof row["id"] === "string")
+            named.push(row);
+    }
+    const taken = takenStageIds(named);
+    // PASS 2 — only a FILLED id may be moved, and only when it is
+    // already spoken for. The next free id comes from the same
+    // arithmetic the write door mints with (highestStageSuffix), so a
+    // load and an add cannot disagree about what "next" means.
+    let max = highestStageSuffix(named);
+    for (const [i, row] of rows.entries()) {
+        if (arrivedWithId[i] === true)
+            continue;
+        // the id here is normalizeBenchStage's fill — always a string
+        // (a doc's non-string id heals to the minted form before this
+        // pass, so only a filled id rides)
+        const id = row["id"];
+        if (!taken.has(id)) {
+            taken.add(id);
+            continue;
+        }
+        let fresh;
+        do {
+            max += 1;
+            fresh = "s_" + String(max);
+        } while (taken.has(fresh));
+        row["id"] = fresh;
+        taken.add(fresh);
+    }
+    return rows;
+}
+const ENSURE_KEYS = ["session", "stages", "intent", "author", "expect_rev", "overwrite"];
+function refuseUnknown(body, allowed) {
+    const unknown = Object.keys(body).filter((k) => !allowed.includes(k));
+    if (unknown.length > 0) {
+        throw new RemoteError("bench/bad-body", "unknown bench key(s): " +
+            unknown.sort().join(", ") +
+            " (want " +
+            allowed.join(", ") +
+            ")", {});
+    }
+}
+/** ensure — create the bench (birth: rev 0, empty log) or LOAD onto
+ *  it (replace stages, snapshot inverse; a non-empty bench demands
+ *  overwrite: true — the overwrite law). The only arm that may
+ *  create; everything else refuses a missing bench. */
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+function syncIntent(doc, before, after) {
+    const cur = typeof doc["intent"] === "string" ? doc["intent"] : "";
+    if (cur === "" || cur === "bench")
+        return;
+    const prevCards = new Set();
+    for (const row of before) {
+        const c = row["card"];
+        if (typeof c === "string" && c !== "")
+            prevCards.add(c);
+    }
+    if (!prevCards.has(cur))
+        return;
+    const nextCards = new Set();
+    for (const row of after) {
+        const c = row["card"];
+        if (typeof c === "string" && c !== "")
+            nextCards.add(c);
+    }
+    if (nextCards.has(cur))
+        return;
+    for (let i = after.length - 1; i >= 0; i--) {
+        const c = after[i]["card"];
+        if (typeof c === "string" && c !== "") {
+            doc["intent"] = c;
+            return;
+        }
+    }
+}
+export async function ensureBench(drafts, body, admit) {
+    refuseUnknown(body, ENSURE_KEYS);
+    const session = body["session"];
+    if (typeof session !== "string" || !SESSION_RE.test(session)) {
+        throw new RemoteError("bench/bad-session", "bad session key (want [A-Za-z0-9_-]{1,64})", {});
+    }
+    const draftId = benchIdOf(session);
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const rec = drafts.table("docs").get(draftId);
+    if (rec === undefined) {
+        const stagesIn = Array.isArray(body["stages"]) ? body["stages"] : [];
+        // THE JUDGE SEES THE STORED ROW — BIRTH TOO (the walls audit,
+        
+        // the RAW body and then stored the NORMALIZED rows, so the
+        // "shaped first, then judged" comment above was false for the
+        // birth path. Two different objects were in play: a raw body row
+        // was judged, and a normalized one was stored — the exact law the
+        // load arm had already been fixed for. The birth arm now judges
+        // `born`, the very rows it is about to put on disk.
+        const born = normalizeStages(stagesIn, author);
+        for (const row of born)
+            stripKeys(row, BIRTH_STRIP_KEYS);
+        admitStages(admit, born);
+        // A BENCH IS BORN CLEAN OF ARCHIVES (the cross-bench history
+        
+        // wand restores onto fresh sessions carrying stage rows from a
+        // FOREIGN bench's run snapshot; archives (history,
+        // resultParams, runStatus, resolved — the observe state THIS
+        // bench's own runs earn) never survive a birth. The one lawful
+        // birth memory is `result` — the wand's preview stamp for the
+        // ran card. The LOAD arm keeps the stage memory law whole
+        // (same-id carry + fill-never-clobber).
+        admitWiringList(born, session);
+        const doc = {
+            draft_id: draftId,
+            intent: typeof body["intent"] === "string" ? body["intent"] : "bench",
+            stages: born,
+            status: "ready",
+            createdAt: Date.now(),
+            completedAt: null,
+            bench: { rev: 0, log: [] },
+        };
+        await drafts.table("docs").put(draftId, {
+            updated_at: Math.floor(Date.now() / 1000),
+            doc: doc,
+        });
+        return {
+            draft_id: draftId,
+            session,
+            rev: 0,
+            intent: doc["intent"],
+            stages: doc["stages"],
+            created: true,
+        };
+    }
+    const doc = rec.doc;
+    const block = benchBlockOf(doc);
+    if (body["stages"] === undefined) {
+        return {
+            draft_id: draftId,
+            session,
+            rev: block.rev,
+            intent: doc["intent"],
+            stages: doc["stages"],
+            created: false,
+        };
+    }
+    const expect = body["expect_rev"];
+    if (typeof expect !== "number") {
+        throw new RemoteError("bench/cas-conflict", "expect_rev is required (the CAS law)", { current_rev: block.rev });
+    }
+    if (expect !== block.rev) {
+        throw new RemoteError("bench/cas-conflict", "bench moved: rev is " + block.rev + ", caller held " + expect, { current_rev: block.rev, expect_rev: expect });
+    }
+    const before = stagesOf(doc);
+    
+    // image card with a wholesale load): replacing a NON-EMPTY bench
+    // is a destructive act and must say so. expect_rev proves the
+    // caller read the bench, not that the user agreed to lose it —
+    // pass overwrite: true to confirm (flow landings and the
+    // gallery's draft-click already do; the undo log still records
+    // stages_before either way).
+    if (before.length > 0 && body["overwrite"] !== true) {
+        throw new RemoteError("bench/overwrite-required", "bench holds " + before.length + " stage(s) at rev " + block.rev +
+            " — a wholesale load would discard them; confirm with overwrite: true, " +
+            "or grow the bench with add_stage / patch, or undo if this was a mistake", { current_rev: block.rev, stages: before.length });
+    }
+    // (the no-leak law: admit on the LOCAL normalized list, assign to
+    // the cached doc only after the gates pass.)
+    const staged = normalizeStages(body["stages"], author);
+    // THE JUDGED VIEW IS THE STORED VIEW (the bench audit's gap 11,
+    
+    // normalized rows — the unwrap, the media heal and the self-naming
+    // strip all landed AFTER the judgment, so a body the normalizer
+    // would have healed could still be refused. The rows are shaped
+    // first, then judged — the order add uses.
+    admitStages(admit, staged);
+    
+    // does it never track history?"): a stage's OUTPUT MEMORY — its
+    // landed result and archived history — belongs to the STAGE'S
+    // IDENTITY, not to the doc revision it happened to land in. A
+    // wholesale load rebuilding the bench with the SAME stage ids
+    // (a chat agent re-loading the card the operator is iterating
+    // on) CARRIES the memory forward: result, runStatus, history,
+    // resultParams ride from the outgoing row onto the incoming row
+    // of the same id. A genuinely new stage id starts clean. The
+    // bench is composed state; the gallery is the stage's own.
+    // THE LOAD ARM'S CARRY LIST (the contract's, benchStage.ts): a
+    // wholesale load onto the SAME stage ids carries the memory the
+    // bench itself earned — the stage's own result/status/history/
+    // resultParams. Named in the contract beside the birth strip (the
+    // two are complements: birth STRIPS, load CARRIES) so the two arms
+    // can never be edited apart.
+    const MEMORY_KEYS = LOAD_CARRY_KEYS;
+    for (const row of staged) {
+        const prev = before.find((b) => b["id"] === row["id"]);
+        if (prev === undefined)
+            continue;
+        for (const key of MEMORY_KEYS) {
+            if (prev[key] !== undefined && row[key] === undefined) {
+                // THE TRAIL HEAL AT CARRY (trail-defect-hunt §6): a memory
+                // carry of history passes through the one-row-per-run dedup —
+                // a pre-law duplicated trail (the operator's re-add wound,
+                // one run under two url spellings) never fossilises forward
+                // through load.
+                row[key] = key === "history" && Array.isArray(prev[key])
+                    ? trailDedupe(prev[key])
+                    : prev[key];
+            }
+        }
+    }
+    admitWiringList(staged, session);
+    doc["stages"] = staged;
+    syncIntent(doc, before, staged);
+    if (typeof body["intent"] === "string")
+        doc["intent"] = body["intent"];
+    const entry = {
+        author,
+        kind: "load",
+        summary: "load " + stagesOf(doc).length + " stages | " + staged.map(seedStateOf).join(" | "),
+        inverse: { stages_before: before },
+        rev: block.rev + 1,
+        at: Math.floor(Date.now() / 1000),
+    };
+    block.rev = entry.rev;
+    block.log.push(entry);
+    doc["bench"] = block;
+    await drafts.table("docs").put(draftId, {
+        updated_at: Math.floor(Date.now() / 1000),
+        doc: doc,
+    });
+    return {
+        draft_id: draftId,
+        session,
+        rev: block.rev,
+        intent: doc["intent"],
+        stages: doc["stages"],
+        created: false,
+    };
+}
+/** get — one session's bench block as the served row. */
+export function getBench(drafts, session) {
+    if (!SESSION_RE.test(session)) {
+        throw new RemoteError("bench/bad-session", "bad session key (want [A-Za-z0-9_-]{1,64})", {});
+    }
+    const draftId = benchIdOf(session);
+    const rec = drafts.table("docs").get(draftId);
+    if (rec === undefined) {
+        throw new RemoteError("bench/not-found", "no such bench: " + session, {
+            session,
+        });
+    }
+    const doc = rec.doc;
+    
+    // report: a bench doc born BEFORE the bench/self-wire law
+    // persisted its crime and served silently until a run tripped a
+    // generic wall). Scoped NARROW, by design: the read path is
+    // deliberately tolerant of loose-but-harmless shapes (junk cells
+    // and dead wires are refused with precise voices at the run door
+    // and at the next write door; the patch-tolerance laws pin that
+    // they serve). ONE crime is refused HERE, and it is the one that
+    // composes degenerately with no other voice: a SELF-WIRE, which is
+    // a cycle, and which the run's generic no-FromStage message hid.
+    //
+    
+    // this gate also refused a wire to a DEAD STAGE. It never did, and
+    // the code below says why it must not — crafted-undo docs may hold
+    // one legitimately between mutations, and serve must not brick the
+    // bench a fix needs to open. The law was correct and the comment
+    // was the thing that drifted; a reader auditing against the prose
+    // would have gone looking for a check that does not exist.)
+    //
+    // Whatever wrote the doc — an older door, a hand edit — the store
+    // is held at read for that one crime.
+    if (Array.isArray(doc["stages"])) {
+        for (const st of doc["stages"]) {
+            if (typeof st !== "object" || st === null)
+                continue;
+            const row = st;
+            const id = typeof row["id"] === "string" ? row["id"] : undefined;
+            const ins = row["inputs"];
+            if (typeof ins !== "object" || ins === null || Array.isArray(ins))
+                continue;
+            for (const [chan, ref] of Object.entries(ins)) {
+                const rr = ref;
+                if (typeof rr !== "object" || rr === null || typeof rr["stage"] !== "string")
+                    continue;
+                const up = rr["stage"];
+                if (id !== undefined && up === id) {
+                    throw new RemoteError("bench/self-wire", "input '" + chan + "' wires its own stage '" + id + "' — a cycle composes nothing. " +
+                        "This wire predates the bench door's self-wire law and persisted; clear it (rewire the input with no source, or wire a real prior stage).", { session, stage: id, input: chan });
+                }
+                // A wire to a stage NOT on the bench (its source removed
+                // later, or a crafted-log doc) stays the write doors' and
+                // the run door's voice — crafted-undo docs may hold one
+                // legitimately between mutations (bench-undo's inverse
+                // table); serve must not brick the bench a fix needs to
+                // open.
+            }
+        }
+    }
+    const block = benchBlockOf(doc);
+    return {
+        draft_id: draftId,
+        session,
+        rev: block.rev,
+        intent: doc["intent"],
+        stages: doc["stages"],
+        log: block.log.map((e) => ({
+            rev: e.rev,
+            at: e.at,
+            author: e.author,
+            kind: e.kind,
+            ...(e.stage !== undefined ? { stage: e.stage } : {}),
+            ...(e.summary !== undefined ? { summary: e.summary } : {}),
+            ...(e.reverted !== undefined ? { reverted: e.reverted } : {}),
+        })),
+    };
+}
+async function loadBench(drafts, session) {
+    if (!SESSION_RE.test(session)) {
+        throw new RemoteError("bench/bad-session", "bad session key (want [A-Za-z0-9_-]{1,64})", {});
+    }
+    const draftId = benchIdOf(session);
+    let rec = drafts.table("docs").get(draftId);
+    if (rec === undefined) {
+        // THE BIRTH (stroke 46g, the operator's "is this a forever fix?"):
+        // a conversation's bench is born at its FIRST write — never a
+        // refusal. rev 0, empty stages, the session's own id.
+        // THE BIRTH CARRIES EVERY REQUIRED KEY (the typed-seam audit,
+        
+        // completedAt, and this literal left all three to a cast — so a
+        // reader that validated the record would have refused the estate's
+        // own first bench. The birth is a DRAFT: status "draft", created
+        // now, completed null.
+        const born = Math.floor(Date.now() / 1000);
+        const doc0 = {
+            draft_id: draftId,
+            status: "draft",
+            createdAt: born,
+            completedAt: null,
+            intent: "",
+            stages: [],
+            bench: { rev: 0, log: [] },
+        };
+        await drafts.table("docs").put(draftId, {
+            updated_at: born,
+            doc: doc0,
+        });
+        rec = drafts.table("docs").get(draftId);
+        if (rec === undefined) {
+            throw new RemoteError("bench/not-found", "could not birth bench: " + session, { session });
+        }
+    }
+    const doc = rec.doc;
+    return { draftId, doc, block: benchBlockOf(doc) };
+}
+/** The CAS law, one voice (missing expect_rev refuses too). */
+function casCheck(block, expect, session) {
+    if (typeof expect !== "number") {
+        throw new RemoteError("bench/cas-conflict", "expect_rev is required (the CAS law)", { current_rev: block.rev });
+    }
+    if (expect !== block.rev) {
+        throw new RemoteError("bench/cas-conflict", "bench " +
+            session +
+            " moved: rev is " +
+            block.rev +
+            ", caller held " +
+            expect, { current_rev: block.rev, expect_rev: expect });
+    }
+    return block.rev;
+}
+/** Append one entry + persist; returns the new rev. */
+async function appendAndSave(drafts, loaded, entry) {
+    const full = {
+        ...entry,
+        rev: loaded.block.rev + 1,
+        at: Math.floor(Date.now() / 1000),
+    };
+    loaded.block.rev = full.rev;
+    loaded.block.log.push(full);
+    loaded.doc["bench"] = loaded.block;
+    await drafts.table("docs").put(loaded.draftId, {
+        updated_at: Math.floor(Date.now() / 1000),
+        doc: loaded.doc,
+    });
+    return full.rev;
+}
+function stageRow(doc, stageId) {
+    // Schema law (see stagesOf): the projection keeps only record
+    // rows — a junk row in the stored doc never crashes the find.
+    const stages = stagesOf(doc);
+    return stages.find((st) => st["id"] === stageId) ?? null;
+}
+const PATCH_KEYS = ["stage", "params", "result", "runStatus", "expect_rev", "author"];
+
+
+
+
+
+
+
+
+
+export async function patchBench(drafts, session, body, admit, migrate) {
+    refuseUnknown(body, PATCH_KEYS);
+    if ("result" in body || "runStatus" in body) {
+        throw new RemoteError("bench/bad-body", "run outcomes ride the drafts/patch door (result/runStatus refused on the bench verb — it authors params only)", {});
+    }
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const stageId = body["stage"];
+    if (typeof stageId !== "string") {
+        throw new RemoteError("bench/bad-body", "stage is required", {});
+    }
+    const st = stageRow(loaded.doc, stageId);
+    if (st === null) {
+        throw new RemoteError("bench/stage-not-found", "stage not found: " + stageId, { session, stage: stageId });
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const before = {};
+    const added = [];
+    const paramsIn = wireParams(body["params"]);
+    if (paramsIn !== undefined) {
+        if (!isRecord(paramsIn)) {
+            throw new RemoteError("bench/bad-body", "params must be an object", {});
+        }
+        
+        // view is a NEW object — a refused admission must not leave the
+        // patch's writes on the domain's cached doc (the live record is
+        // assigned only after every gate passes).
+        const cur = isRecord(st["params"])
+            ? { ...st["params"] }
+            : {};
+        for (const k of Object.keys(paramsIn)) {
+            if (Object.prototype.hasOwnProperty.call(cur, k))
+                before[k] = cur[k];
+            else
+                added.push(k);
+            
+            // can't unset a param — a lane switch forced remove_stage +
+            // add_stage where one clear-semantics patch would do"). The
+            // drafts door has ALWAYS deleted null keys (JSON Merge Patch
+            // law, draft.ts's own doc: "null params values ride VERBATIM —
+            // the door's JSON Merge Patch arm deletes those keys"); this
+            // door landed them as literal nulls instead — a key that could
+            // never be cleared, only overwritten. Null now deletes here
+            // too: one law, two doors. The inverse restores from
+            // params_before, so undo resurrects a deleted key.
+            const v = paramsIn[k];
+            if (v === null)
+                delete cur[k];
+            else
+                cur[k] = v;
+        }
+        // admission on the MERGED view (the row's card + the params the
+        // NEXT run would compose — a patch that lands poison is as bad
+        // as an add that lands it). NO PROVENANCE RIDES (the audit's
+        // GAP 3): the restored carve is LOAD-TIME grace — "the archive
+        // loads; the run teaches" — and forwarding it here made the
+        // grace sticky: a restored row patched under restore law
+        // FOREVER, so a human actively editing a pre-law row never met
+        // today's law. A patch is a live compose act; it judges with
+        // the DECL the next run will compose from.
+        // THE STORED ROW IS THE JUDGED ROW (the bench audit's gap 3,
+        
+        // raw one, so a doc written by patch held a self-naming model
+        // key that add/load never store — and the next door to read that
+        // row (a group, an undo) judged a different object than the one
+        // on disk. The merge strips before judging AND before storing:
+        // one row, one view.
+        
+        // incident — live on :3088): the merge above is where a lane
+        // switch assembles its view, and BEFORE this seat the switch
+        // REFUSED itself — the prior lane's members (voice on
+        // CustomVoice) ride the merged view, the new lane's surface
+        // (VoiceDesign) does not take them, and the admission refused
+        // "drop it or switch lane" while the form HIDES the row on the
+        // new lane: the named cure unclickable, the switch unlandable,
+        // the studio wedged between "the studio shows your edit; the
+        // bench does not". The registry drops the stale carry here —
+        // BEFORE the strip, the admission, and the store, so the row
+        // that lands is the row the next run composes (one view, every
+        // seat). The undo contract: undoing the switch restores the
+        // axes, not the dropped members — the author re-picks on the
+        // lane they return to.
+        const migrated = migrate !== undefined && isRecord(st["params"])
+            ? migrate(typeof st["card"] === "string" ? st["card"] : "", cur, st["params"])
+            : cur;
+        const stored = strippedForAdmission(typeof st["card"] === "string" ? st["card"] : "", migrated);
+        // THE COMPOUND IS JUDGED BY ITS MEMBERS HERE TOO (the walls
+        
+        // belongs to a compound judged the COMPOUND ROW as a whole, and
+        // the literal "group" — a card no model board knows — reached the
+        // board and refused the operator's own patch. A group's patch
+        // is a patch of a MEMBER, so the members cross the door and the
+        // compound never does.)
+        if (st["card"] === GROUP_CARD && Array.isArray(st["children"])) {
+            admitRestored(admit, st, isRecord(st["params"]) ? st["params"] : {});
+        }
+        else {
+            admitStage(admit, st["card"], stored, undefined);
+        }
+        // THE WIRING ADMISSION (phantom-wire cure): a params patch can
+        // orphan a spell (drop the $image binding while the wire stays)
+        // or strand a wire (introduce $image with no channel) — the
+        // merged pair admits together, exactly as the run consumes them.
+        admitWiring(st, stored, isRecord(st["inputs"]) ? st["inputs"] : {}, 
+        // (the domain schema pins stages[].id: string with
+        // backup-and-skip at read — a nullish id never reaches here)
+        stagesOf(loaded.doc).map((r) => String(r["id"])), stageId, session, 
+        // THE UN-WEDGE LAW at the patch seat: patch touches params,
+        // never inputs — a pre-broken input ref (already dead before
+        // this patch) tolerates so the row's OTHER knobs stay
+        // editable; the merged params×inputs law still judges what
+        // the patch itself can create (an orphaned spell refuses).
+        toleratedByRow([st], liveIdsOf(stagesOf(loaded.doc))).get(stageId));
+        st["params"] = stored;
+    }
+    if (paramsIn === undefined) {
+        throw new RemoteError("bench/bad-body", "nothing to patch (params)", {});
+    }
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "patch",
+        stage: stageId,
+        summary: "patch " + Object.keys(paramsIn).sort().join(","),
+        inverse: { stage: stageId, params_before: before, params_added: added },
+    });
+    return {
+        draft_id: loaded.draftId,
+        session,
+        rev: newRev,
+        stage: stageId,
+        patched: Object.keys(paramsIn).sort(),
+    };
+}
+const ADD_KEYS = ["id", "card", "engine", "params", "inputs", "outputs", "expected", "expect_rev", "author"];
+
+
+
+
+
+
+
+
+const wireParams = (v) => (isRecord(v) ? unwrapItemArrays(v) : v);
+/** Admit one RESTORED stage state (the undo arms): the same seat,
+ *  NO restored carve — the audit's GAP 6 caught the lie: the comment
+ *  claimed no exemption while the call forwarded the very
+ *  provenance string the load seat's carve matches, so an undo on a
+ *  restored row judged nothing at all. Undo rewrites live-authored
+ *  state; it is judged like any other write, with no provenance. A
+ *  stage with no card row (an mcp or flow id) is not this seat's
+ *  business. */
+function admitRestored(admit, stage, params) {
+    if (admit === undefined)
+        return;
+    const card = stage["card"];
+    if (typeof card !== 'string' || card === '')
+        return;
+    // A RESTORED COMPOUND IS JUDGED BY ITS MEMBERS (the bench audit's
+    // gap 9): the literal "group" card names nothing the model board
+    // knows, so an undo that reinserted a group row (or a snapshot
+    // restore) refused the bench's own state — an undo bricked by
+    // what the group door had just built. The members cross the same
+    // door they crossed when they were picked.
+    if (card === GROUP_CARD && Array.isArray(stage["children"])) {
+        for (const child of stage["children"]) {
+            if (!isRecord(child))
+                continue;
+            admitRestored(admit, child, isRecord(child["params"]) ? child["params"] : {});
+        }
+        return;
+    }
+    // THE STRIPPED VIEW, LIKE EVERY OTHER SEAT (the bench audit's gap
+    
+    // {model: <own card>} — which normalizeBenchStage strips at store
+    // and which add/patch admit through the stripped view — was
+    // REFUSED here as an unknown model. One admission means one view:
+    // the restored row is judged exactly as it would be written.
+    admit(card, strippedForAdmission(card, params), undefined);
+}
+
+
+
+
+
+export function strippedForAdmission(card, params) {
+    const judged = { ...params };
+    if (judged["model"] === card && !SELF_NAMED_FAMILIES.has(card)) {
+        delete judged["model"];
+    }
+    return judged;
+}
+function admitStage(admit, card, params, provenance = undefined) {
+    if (admit === undefined)
+        return;
+    if (typeof card !== "string" || card === "")
+        return;
+    
+    // add sailed past admission entirely) — admit the card against
+    // empty params; the model check passes vacuous, the card check
+    // still bites. Every caller hands this seat a record: the load and
+    // birth arms pass normalizeStages' rows, whose params normalizeBenchStage
+    // has already healed to {} when the doc carried anything else, and the
+    // patch arm passes strippedForAdmission's own copy.
+    admit(card, strippedForAdmission(card, params), provenance);
+}
+/** The compound row's card literal — the bench's own shape, never a
+ *  declared card. Named once so every seat that must exempt a
+ *  compound says the same word (the load arm below). */
+const GROUP_CARD = "group";
+/** Admission over a wholesale stage list (the load arm — every row
+ *  passes the same door an add passes). Both callers hand it
+ *  normalizeStages' own output, which keeps only records, so a row
+ *  here is a record and the members of a compound are its own. */
+function admitStages(admit, stages) {
+    if (admit === undefined || !Array.isArray(stages))
+        return;
+    for (const s of stages) {
+        // THE COMPOUND IS NOT A CARD (the bench audit's gap 9,
+        
+        // "group" and whose members ride in `children` — so loading the
+        // bench's own read-back asked the model board about a card that
+        // does not exist ("no registered card definition"), and an undo
+        // of such a load bricked on the bench's own prior state. The
+        // compound is judged by its MEMBERS: the same door each member
+        // crossed when it was picked (the compound-no-blind-spot law,
+        // stated on the way back in).
+        if (s["card"] === GROUP_CARD && Array.isArray(s["children"])) {
+            admitStages(admit, s["children"]);
+            continue;
+        }
+        admitStage(admit, s["card"], s["params"], s["provenance"]);
+    }
+}
+
+// The bench's wiring vocabulary is the RUN's: `inputs` name channels,
+// params bind them via `$channel` spells (rewriteSpells is the
+// consumer — a string param starting with "$" IS a spell). Three
+
+// run time, far from the write that caused them:
+//   a) a channel no param spells (dead wire — the agent's
+//      inputs:{image:{stage,...}} with no $image anywhere);
+//   b) a spell no channel binds (runs refuse at rewriteSpells);
+//   c) an upstream stage id that is not on the bench (the mint
+//      mints s_N; "stage-1" never existed).
+// All three now refuse AT WRITE TIME, named.
+/** Collect the `$channel` spell names a params body carries
+ *  (rewriteSpells semantics verbatim: a string STARTING with "$" is
+ *  one spell named slice(1) — "costs $5" is text, "$image" is a
+ *  spell). */
+function spellsOf(params, out = new Set()) {
+    if (typeof params === "string") {
+        if (params.startsWith("$"))
+            out.add(params.slice(1));
+    }
+    else if (Array.isArray(params)) {
+        for (const v of params)
+            spellsOf(v, out);
+    }
+    else if (typeof params === "object" && params !== null) {
+        for (const v of Object.values(params))
+            spellsOf(v, out);
+    }
+    return out;
+}
+/** One wiring binding's declared shape: {stage, output} (FromStage),
+ *  {initial} (the request's initial), or anything else (garbage —
+ *  the run maps only these two). */
+function wireUpstreamOf(ref) {
+    if (typeof ref !== "object" || ref === null || Array.isArray(ref))
+        return {};
+    const r = ref;
+    if (typeof r["stage"] === "string")
+        return { stage: r["stage"] };
+    if (typeof r["initial"] === "string")
+        return { initial: true };
+    return {};
+}
+/** The wiring admission over ONE row (params = the MERGED view the
+ *  next run composes; inputs = the MERGED wiring; liveIds = the
+ *  bench's stage ids after the write; selfId = the row's own id —
+ *  self-wiring is a cycle, refused). Throws bench/* named. */
+export function admitWiring(row, params, inputs, liveIds, selfId, session, tolerate) {
+    const spells = spellsOf(params);
+    for (const [chan, ref] of Object.entries(inputs)) {
+        const up = wireUpstreamOf(ref);
+        if (up.stage === undefined && up.initial !== true) {
+            throw new RemoteError("bench/bad-wire", "input '" + chan + "' is neither {stage, output} nor {initial} — the run maps only those two shapes", { session, stage: selfId, input: chan });
+        }
+        if (up.stage !== undefined) {
+            if (up.stage === selfId) {
+                throw new RemoteError("bench/self-wire", "input '" + chan + "' wires its own stage '" + selfId + "' — a cycle composes nothing", { session, stage: selfId, input: chan });
+            }
+            
+            // refusal fires only for a dangle the VERB CREATES. A ref the
+            // row already carried toward an ALREADY-DEAD stage (an
+            // interleaved write birthed it; no door admits creating it)
+            // passes through `tolerate` — the run door names it, and the
+            // cure doors (rewire-clear, remove, clear) must never refuse
+            // on the very state they cure. Creation still refuses LOUD.
+            if (!liveIds.includes(up.stage) && !(tolerate !== undefined && tolerate.has(up.stage))) {
+                throw new RemoteError("bench/wire-stage-not-found", "input '" + chan + "' wires stage '" + up.stage + "' — no such stage on the bench (live: " +
+                    (liveIds.join(", ") || "none") + ")", { session, stage: selfId, input: chan, live: liveIds });
+            }
+        }
+        if (!spells.has(chan)) {
+            throw new RemoteError("bench/dead-wire", "input '" + chan + "' is bound by no '$" + chan + "' spell in params — the wiring would feed nothing " +
+                "(bind it, e.g. params: {image: \"$" + chan + "\"}, or drop the wire)", { session, stage: selfId, input: chan });
+        }
+    }
+    // NOTE: the reverse (a $spell with no channel) is NOT a write-time
+    // refusal — it is a legal INTERMEDIATE state (spell first, wire
+    // second; the two-step construction). The run refuses a stray
+    // spell LOUD at merge (rewriteSpells' own voice), so nothing is
+    // silent either way.
+}
+/** Wiring admission over a wholesale stage list (the load arm —
+ *  every row checks against the list it lands in). Both call sites
+ *  pass normalizeStages() output — non-arrays collapse to [] there,
+ *  non-record rows filter out, and every surviving row carries a
+ *  string id plus record params/inputs (the coerce arms at
+ *  normalizeStages) — so no re-defense here. */
+/** The live ids of a stage list (group children included — they
+ *  keep their stage ids under the compound). */
+function liveIdsOf(stages) {
+    const out = new Set();
+    for (const r of stages) {
+        out.add(String(r["id"] ?? ""));
+        if (r["card"] === GROUP_CARD && Array.isArray(r["children"])) {
+            for (const child of r["children"]) {
+                if (isRecord(child))
+                    out.add(String(child["id"] ?? ""));
+            }
+        }
+    }
+    return out;
+}
+/** The un-wedge law's tolerance table: for every row in the list
+ *  being JUDGED, the upstreams it wires that are absent from the
+ *  PRE-verb live set — refs the verb did not create (they were
+ *  already dead, or ride a restored snapshot the log itself
+ *  recorded) and must not be refused for. Keyed by row/child id.
+ *
+ *  The walk is over the JUDGED rows (not the pre rows): a verb
+ *  like clear leaves no pre rows at all, and undo restores rows
+ *  the pre state doesn't hold — the ref a row CARRIES is the
+ *  thing to classify, against what was live before the verb. A
+ *  ref newly introduced by a verb (rewire's `from`, a patch's
+ *  spell changes) never rides this table: those seats build their
+ *  tolerate sets from the PRE ROW's own inputs, so a fresh dead
+ *  target stays strict. */
+/** Exported for the drafts seat (audit S-S1): the un-wedge table is
+ *  the same law at every author seat. */
+export function toleratedByRow(stages, preLive) {
+    const out = new Map();
+    const rowOf = (r, id) => {
+        const inputs = r["inputs"];
+        if (!isRecord(inputs))
+            return;
+        for (const ref of Object.values(inputs)) {
+            const up = wireUpstreamOf(ref);
+            if (up.stage !== undefined && !preLive.has(up.stage)) {
+                const set = out.get(id);
+                if (set !== undefined)
+                    set.add(up.stage);
+                else
+                    out.set(id, new Set([up.stage]));
+            }
+        }
+    };
+    for (const r of stages) {
+        const id = String(r["id"] ?? "");
+        rowOf(r, id);
+        if (r["card"] === GROUP_CARD && Array.isArray(r["children"])) {
+            for (const child of r["children"]) {
+                if (isRecord(child))
+                    rowOf(child, String(child["id"] ?? ""));
+            }
+        }
+    }
+    return out;
+}
+function admitWiringList(stages, session, tolerate) {
+    
+    // survivor walk — feeds the LIVE doc list, whose rows predate the
+    // normalize contract's guarantees whenever the doc predates it. A
+    // row without record params/inputs judges over {} (vacuous pass),
+    // never crashes the door; the normalized callers are unaffected.
+    // (records themselves are the projection's guarantee — stagesOf
+    // keeps only record rows and normalizeStages filters its own — so
+    // no re-defense of record-ness here)
+    const liveIds = stages
+        .map((r) => String(r["id"] ?? ""));
+    // THE UN-WEDGE TOLERANCE: the map (per row id) carries the refs
+    // that pre-date the verb — the walk refuses only the danglings
+    // THIS verb creates; refs already dead before it pass through
+    // (the run door's voice — see admitWiring's tolerate law). Each
+    // seat states its own base for toleratedByRow.
+    const tolerateAll = tolerate;
+    for (const r of stages) {
+        // THE COMPOUND'S OWN WIRES ARE JUDGED (the bench audit's gap 7,
+        
+        // walk passed over it vacuously — a wire hidden INSIDE a group
+        // survived a remove of the stage it pointed at, and ungroup then
+        // spilled the phantom onto the flat bench with nothing left to
+        // catch it. The walk descends: the compound is judged, and so is
+        // every child, against the same live set.
+        admitWiring(r, isRecord(r["params"]) ? r["params"] : {}, isRecord(r["inputs"]) ? r["inputs"] : {}, liveIds, String(r["id"] ?? ""), session, tolerateAll?.get(String(r["id"] ?? "")));
+        if (r["card"] === GROUP_CARD && Array.isArray(r["children"])) {
+            for (const child of r["children"]) {
+                if (!isRecord(child))
+                    continue;
+                admitWiring(child, isRecord(child["params"]) ? child["params"] : {}, isRecord(child["inputs"]) ? child["inputs"] : {}, liveIds, String(child["id"] ?? ""), session, tolerateAll?.get(String(child["id"] ?? "")));
+            }
+        }
+    }
+}
+/** add_stage — append a card stage with optional wiring (the
+ *  runner's input convention rides the row). */
+export async function addStageBench(drafts, session, body, admit) {
+    refuseUnknown(body, ADD_KEYS);
+    const loadedForAdmit = await loadBench(drafts, session);
+    casCheck(loadedForAdmit.block, body["expect_rev"], session);
+    // THE JUDGED VIEW IS THE STORED VIEW (the bench audit's gap 11,
+    
+    // normalized row — so the unwrap, the legacy-media heal and the
+    // default overlay were applied AFTER the judgment, and the door
+    // could refuse a row the normalizer would have healed (or admit one
+    // it would have reshaped). The row is shaped FIRST, then judged —
+    // the same order every other door uses.
+    const cardForRow = body["card"];
+    if (typeof cardForRow !== "string" || cardForRow === "") {
+        throw new RemoteError("bench/bad-body", "card is required", {});
+    }
+    // THE ONE MINT, AND NOW IT IS ONE CALL (the identity audit's
+    
+    // producer of the value" directly above a function that called the
+    // producer TWICE — once for the row handed to admission, once for
+    // the row stored below. They agree today only because both read the
+    // same unmutated doc; any future edit between them, or a change to
+    // one formula, reopens the judged-vs-stored split this comment
+    // claimed to have closed. The value is bound ONCE and both doors
+    // read it, so the sentence is now true rather than aspirational.
+    //
+    // (See mintStageId for why the formula is max+1 and not the count.)
+    const stageIdForAdmit = mintStageId(stagesOf(loadedForAdmit.doc), body);
+    // A MALFORMED `inputs` CONTAINER REFUSES (the audit's fail-open).
+    // `isRecord(...) ? ... : {}` treats a non-record `inputs` exactly
+    // like an absent one: the caller is told the stage was added, no
+    // wire is stored, and the loss surfaces much later as a missing
+    // required param at run time. A bad BINDING already refuses
+    // (bench/bad-wire) and rewire's non-record `from` already refuses
+    // (bench/bad-body) — the container was the one shape that failed
+    // open. The READ path stays tolerant on purpose (a doc already on
+    // disk is not the caller's mistake, and the serve/run doors judge
+    // it there); this is the door where the caller can still be told.
+    const rawInputs = body["inputs"];
+    if (rawInputs !== undefined && !isRecord(rawInputs)) {
+        throw new RemoteError("bench/bad-body", "stage " + JSON.stringify(stageIdForAdmit) +
+            ": inputs must be an object of channel → {stage, output} | {initial} (got " +
+            typeof rawInputs +
+            "); a wire that cannot be read is refused here, not dropped", {});
+    }
+    // A MALFORMED `params` CONTAINER REFUSES (the same fail-open the
+    // `inputs` container closed above — commission 015, §6 finding 5):
+    // `isRecord(...) ? ... : {}` treated a non-record `params` exactly
+    // like an absent one, so the card's knobs wrapped in an array
+    // minted a stage with EMPTY params instead of refusing. The patch
+    
+    // refuses at its own row admission — one law, every write door.
+    const rawParams = wireParams(body["params"]);
+    if (rawParams !== undefined && !isRecord(rawParams)) {
+        throw new RemoteError("bench/bad-body", "stage " + JSON.stringify(stageIdForAdmit) + ": params must be an object (got " +
+            (Array.isArray(rawParams) ? "an array — the card's knobs, not a list of them" : typeof rawParams) +
+            "); a wire that cannot be read is refused here, not dropped", {});
+    }
+    const admitted = normalizeBenchStage({
+        id: stageIdForAdmit,
+        card: cardForRow,
+        ...(typeof body["engine"] === "string" && body["engine"] !== "" ? { engine: body["engine"] } : {}),
+        ...(rawParams !== undefined ? { params: rawParams } : {}),
+        ...(isRecord(body["inputs"]) ? { inputs: body["inputs"] } : {}),
+        ...(isRecord(body["outputs"]) ? { outputs: body["outputs"] } : {}),
+    }, stageIdForAdmit);
+    admitStage(admit, admitted["card"], admitted["params"]);
+    const loaded = loadedForAdmit;
+    // (the card was already refused at the top of this door when it is
+    // not a non-empty string — the bound value here is one)
+    const card = body["card"];
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    
+    // ("s_" + stages.length) collides the moment any stage was ever
+    // removed — [s_0..s_9] minus nine leaves s_1, and the count says
+    // s_1 again. The mint takes MAX numeric suffix + 1 over the live
+    // rows, so a fresh id is fresh against the bench AS IT STANDS.
+    // THE STORED ROW'S ID IS THE ADMITTED ROW'S ID (the one mint,
+    // above): read the bound value, never call the producer again.
+    const stageId = stageIdForAdmit;
+    if (stageRow(loaded.doc, stageId) !== null) {
+        throw new RemoteError("bench/duplicate-stage", "stage id already on the bench: " + stageId, { session, stage: stageId });
+    }
+    
+    // arm hand-rolled the whole row, so a stage added here kept a dead
+    // `/v1/assets/runs` path unhealed, skipped the self-naming strip,
+    // and defaulted `outputs` by a SECOND law). One writer shapes a
+    // stage row: normalizeBenchStage. `expected` rides on top, exactly
+    // as it does on every other arm.
+    const row = normalizeBenchStage({
+        id: stageId,
+        card,
+        ...(typeof body["engine"] === "string" && body["engine"] !== "" ? { engine: body["engine"] } : {}),
+        ...(rawParams !== undefined ? { params: rawParams } : {}),
+        ...(isRecord(body["inputs"]) ? { inputs: body["inputs"] } : {}),
+        ...(isRecord(body["outputs"]) ? { outputs: body["outputs"] } : {}),
+    }, stageId);
+    row["provenance"] = author;
+    if (isRecord(body["expected"]))
+        row["expected"] = body["expected"];
+    // THE WIRING ADMISSION (phantom-wire cure) — BEFORE the push: the
+    // row's wiring admits against a PROJECTED live set (current ids +
+    // this row's). Never push-then-check: the loaded doc is the
+    // domain's cached object, and a refusal after the push LEAKS the
+    
+    // adds persisted as s_1/s_2 on the next good write — a refusal
+    // that lies). Mutate only after every gate passes.
+    admitWiring(row, row["params"], row["inputs"], [...stages.map((r) => String(r["id"] ?? "")), stageId], stageId, session);
+    stages.push(row);
+    loaded.doc["stages"] = stages;
+    // add_stage never syncs the intent (the orphaning law): a pure
+    // add grows the card set — a label true before stays true after.
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "add_stage",
+        stage: stageId,
+        summary: "add " + card,
+        inverse: { stage: stageId },
+    });
+    return { draft_id: loaded.draftId, session, rev: newRev, stage: stageId };
+}
+const REMOVE_KEYS = ["stage", "expect_rev", "author"];
+const REORDER_KEYS = ["stage", "to", "expect_rev", "author", "after"];
+
+
+
+
+
+
+
+
+
+
+
+
+
+export async function reorderBench(drafts, session, body) {
+    refuseUnknown(body, REORDER_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const stageId = body["stage"];
+    if (typeof stageId !== "string") {
+        throw new RemoteError("bench/bad-body", "stage is required", {});
+    }
+    const toRaw = body["to"];
+    if (typeof toRaw !== "number" || !Number.isInteger(toRaw) || toRaw < 0) {
+        throw new RemoteError("bench/bad-body", "to must be a non-negative integer index", {});
+    }
+    const afterRaw = body["after"];
+    if (afterRaw !== undefined && typeof afterRaw !== "string") {
+        throw new RemoteError("bench/bad-body", "after must be a stage id string when present", {});
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    const from = stages.findIndex((s) => s["id"] === stageId);
+    if (from < 0) {
+        throw new RemoteError("bench/stage-not-found", "stage not found: " + stageId, { session, stage: stageId });
+    }
+    // anchor resolution: re-derive the target from the id the press
+    // SAW, not the numeric slot it guessed. Unchanged list → the same
+    // `to` the press sent (identity, never a behavior change); a
+    // shifted list → the drop's intent survives the shift.
+    let toTarget = toRaw;
+    if (afterRaw !== undefined) {
+        const anchor = stages.findIndex((s) => s["id"] === afterRaw);
+        if (anchor < 0) {
+            throw new RemoteError("bench/anchor-gone", "the card you dropped after is gone — drop again", { session, anchor: afterRaw });
+        }
+        toTarget = anchor;
+    }
+    const [row] = stages.splice(from, 1);
+    const to = Math.min(toTarget, stages.length);
+    stages.splice(to, 0, row);
+    loaded.doc["stages"] = stages;
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "reorder",
+        stage: stageId,
+        summary: "reorder " + String(row["card"] ?? stageId),
+        inverse: { stage: stageId, from, to, ...(afterRaw !== undefined ? { after: afterRaw } : {}) },
+    });
+    return { draft_id: loaded.draftId, session, rev: newRev, stage: stageId, from, to };
+}
+const GROUP_KEYS = ["stages", "expect_rev", "author"];
+
+
+
+
+
+
+export async function groupBench(drafts, session, body, admit = undefined) {
+    refuseUnknown(body, GROUP_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const idsRaw = body["stages"];
+    if (!Array.isArray(idsRaw) || idsRaw.length < 2
+        || !idsRaw.every((x) => typeof x === "string")) {
+        throw new RemoteError("bench/bad-body", "stages must be an array of 2+ stage ids", {});
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    // bench order (the ids arrive selection-order; the compound is the
+    // bench's own order — the old law: "the compound parent lands at the
+    // FIRST member's position, childIds in array order")
+    const ids = idsRaw;
+    const picked = [];
+    for (const st of stages) {
+        if (ids.includes(String(st["id"])))
+            picked.push(st);
+    }
+    if (picked.length !== ids.length) {
+        throw new RemoteError("bench/stage-not-found", "group: unknown stage id(s) — have " + String(picked.length) + " of " + String(ids.length), { session, stage: ids.join(",") });
+    }
+    const firstIndex = stages.indexOf(picked[0]);
+    
+    // audit's rows 1+4): a compound row renders as one tile and its
+    // children leave the flat bench — patch cannot reach inside it, so
+    // a row parked before a law tightened would sit inside the group
+    // judged by NOTHING until ungroup spilled it back. The picked rows
+    // walk the same admission an add walks BEFORE they leave the flat
+    // bench — the group is a write like every other write, and a
+    // refusal here names the child the way add_stage would.
+    for (const row of picked) {
+        admitRestored(admit, row, isRecord(row["params"])
+            ? row["params"]
+            : {});
+    }
+    
+    // — the direction the first cut of this gate still missed): the
+    // run's wiring walk (benchWiring in the runs registry) reads the
+    // FLAT stage list only, so a member's wire dies the moment the
+    // member leaves it — whether it pointed at another member or at a
+    // bystander. Parking it is a silent run-time starvation, so the
+    // door refuses and names the cure (ungroup first, or drop the wire).
+    for (const row of picked) {
+        const ins = row["inputs"];
+        if (isRecord(ins) && Object.keys(ins).length > 0) {
+            throw new RemoteError("bench/grouped-row-wired", "stage " + String(row["id"]) + " carries a wire (" + Object.keys(ins).join(", ") +
+                ") — grouping hides it from the run, which wires only the flat bench; ungroup it first, or drop the wire", { session, stage: String(row["id"]) });
+        }
+    }
+    // THE SURVIVORS RE-JUDGED, AND THE WIRES TOO (the bench audit's
+    
+    // wire another member carried now points at a stage that is no
+    // longer addressable — a state remove_stage refuses and rewire
+    // refuses to create. Grouping admitted it silently, because this
+    // arm only judged the picked rows' models. The post-move bench is
+    // judged as a whole, on a copy, before the splice lands (the
+    // survivor law remove established, now applied to the other door
+    // that moves rows).
+    const afterGroup = stages.filter((r) => !picked.includes(r));
+    const compoundProbe = {
+        id: "g_probe",
+        card: GROUP_CARD,
+        children: picked,
+    };
+    afterGroup.splice(Math.min(firstIndex, afterGroup.length), 0, compoundProbe);
+    // THE UN-WEDGE LAW at the group seat: rows keep the refs they
+    // carried; only the grouping changes. Judged against the pre live set.
+    admitWiringList(afterGroup, session, toleratedByRow(afterGroup, liveIdsOf(stages)));
+    for (const row of picked) {
+        // picked rows ARE stages members (built from the walk above) —
+        // splice by identity, no guard.
+        stages.splice(stages.indexOf(row), 1);
+    }
+    // id from the doc's own coordinates (rev + count) — no global RNG
+    // dependency; unique per append by construction (rev advances).
+    const gid = "g_r" + String(loaded.block.rev) + "c" + String(picked.length) + "_" + String(stages.length);
+    const compound = {
+        id: gid,
+        card: GROUP_CARD,
+        children: picked,
+    };
+    stages.splice(Math.min(firstIndex, stages.length), 0, compound);
+    loaded.doc["stages"] = stages;
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "group",
+        stage: gid,
+        summary: "group " + String(ids.length) + " stages",
+        inverse: { stage: gid, index: firstIndex, children: picked },
+    });
+    return { draft_id: loaded.draftId, session, rev: newRev, stage: gid };
+}
+const UNGROUP_KEYS = ["stage", "expect_rev", "author"];
+/** ungroup — the compound's door: spill the children back at the
+ *  compound's index, in their stored order. */
+export async function ungroupBench(drafts, session, body, admit = undefined) {
+    refuseUnknown(body, UNGROUP_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const stageId = body["stage"];
+    if (typeof stageId !== "string") {
+        throw new RemoteError("bench/bad-body", "stage is required", {});
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    const idx = stages.findIndex((s) => s["id"] === stageId);
+    if (idx < 0 || stages[idx]["card"] !== GROUP_CARD) {
+        throw new RemoteError("bench/stage-not-found", "ungroup: no group stage " + stageId, { session, stage: stageId });
+    }
+    const compound = stages[idx];
+    const children = compound["children"];
+    const rows = Array.isArray(children)
+        ? children
+        : [];
+    
+    // the children re-enter the flat bench as patchable rows — every
+    // other re-entry (undo-patch, undo-remove, load) walks admission,
+    // and this door was the one place a pre-law row could come back
+    // judged by nothing. Judged BEFORE the splice; a refusal keeps the
+    // compound intact and names the child.
+    for (const row of rows) {
+        admitRestored(admit, row, isRecord(row["params"])
+            ? row["params"]
+            : {});
+    }
+    // THE SPILLED BENCH IS JUDGED AS A WHOLE (the bench audit's gap 6,
+    
+    // compound hid — or a wire to a member that the group removed from
+    // the flat bench — comes back as a PHANTOM, a state add, rewire and
+    // remove all refuse. Judged on a copy, before the splice.
+    const afterSpill = stages.filter((r) => r !== compound);
+    afterSpill.splice(Math.min(idx, afterSpill.length), 0, ...rows);
+    // THE UN-WEDGE LAW at the ungroup seat (same as group's).
+    admitWiringList(afterSpill, session, toleratedByRow(afterSpill, liveIdsOf(stages)));
+    stages.splice(idx, 1);
+    stages.splice(Math.min(idx, stages.length), 0, ...rows);
+    loaded.doc["stages"] = stages;
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "ungroup",
+        stage: stageId,
+        summary: "ungroup " + String(rows.length) + " stages",
+        inverse: { row: compound, index: idx },
+    });
+    return { draft_id: loaded.draftId, session, rev: newRev, stage: stageId };
+}
+/** remove_stage — splice one stage out (the inverse carries row +
+ *  index for undo). */
+export async function removeStageBench(drafts, session, body) {
+    refuseUnknown(body, REMOVE_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const stageId = body["stage"];
+    if (typeof stageId !== "string") {
+        throw new RemoteError("bench/bad-body", "stage is required", {});
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    const idx = stages.findIndex((s) => s["id"] === stageId);
+    if (idx < 0) {
+        throw new RemoteError("bench/stage-not-found", "stage not found: " + stageId, { session, stage: stageId });
+    }
+    const row = stages[idx];
+    const before = [...stages];
+    
+    // 5): removing a stage rewrites every row that wired it — the
+    // survivor now holds bench/wire-stage-not-found, a state the
+    // rewire door REFUSES to create. Door parity demands the removal
+    // refuse it too (drop the wire first, or keep the stage). The
+    // survivors' wiring walks the same law on a COPY, BEFORE the
+    // splice — a refused removal leaks nothing (stagesOf returns the
+    // doc's own array; the splice is the write, and it lands last).
+    admitWiringList(stages.filter((_r, i) => i !== idx), session, 
+    // THE UN-WEDGE LAW at the remove seat: the survivors are judged
+    // against the PRE-removal live set — this removal refuses only
+    // the danglings IT creates (a survivor wiring the removed
+    // stage); a survivor's PRE-EXISTING dead ref (born by an
+    // interleaved write, refused by no door that admits creating
+    // it) passes through, else NO remove could ever land and the
+    
+    // clear or delete from the bench").
+    toleratedByRow(stages.filter((_r, i) => i !== idx), liveIdsOf(stages)));
+    stages.splice(idx, 1);
+    loaded.doc["stages"] = stages;
+    syncIntent(loaded.doc, before, stages);
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "remove_stage",
+        stage: stageId,
+        summary: "remove " + String(row["card"] ?? stageId),
+        inverse: { stage: stageId, row, index: idx },
+    });
+    return { draft_id: loaded.draftId, session, rev: newRev, stage: stageId };
+}
+const CLEAR_KEYS = ["expect_rev", "author"];
+
+
+
+
+
+
+
+export async function clearBench(drafts, session, body) {
+    refuseUnknown(body, CLEAR_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const stages = stagesOf(loaded.doc);
+    const before = [...stages];
+    stages.length = 0;
+    loaded.doc["stages"] = stages;
+    syncIntent(loaded.doc, before, stages);
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "clear",
+        summary: "clear " + String(before.length) + " stages",
+        inverse: { stages_before: before },
+    });
+    return {
+        draft_id: loaded.draftId,
+        session,
+        rev: newRev,
+        cleared: before.length,
+    };
+}
+const REWIRE_KEYS = ["stage", "input", "from", "expect_rev", "author"];
+/** rewire — set or clear one input binding. from:
+ *  {stage, output} | {initial: "image"} | absent → clear. */
+export async function rewireBench(drafts, session, body) {
+    refuseUnknown(body, REWIRE_KEYS);
+    const loaded = await loadBench(drafts, session);
+    casCheck(loaded.block, body["expect_rev"], session);
+    const stageId = body["stage"];
+    const input = body["input"];
+    if (typeof stageId !== "string" || typeof input !== "string") {
+        throw new RemoteError("bench/bad-body", "stage and input are required", {});
+    }
+    const st = stageRow(loaded.doc, stageId);
+    if (st === null) {
+        throw new RemoteError("bench/stage-not-found", "stage not found: " + stageId, { session, stage: stageId });
+    }
+    const author = authorOk(body["author"])
+        ? body["author"]
+        : "agent";
+    const from = body["from"];
+    if (from !== undefined && !isRecord(from)) {
+        throw new RemoteError("bench/bad-body", "from must be {stage,output} | {initial} | absent", {});
+    }
+    const inputs = isRecord(st["inputs"])
+        ? { ...st["inputs"] }
+        : {};
+    const before = Object.prototype.hasOwnProperty.call(st["inputs"] === undefined ? {} : st["inputs"], input)
+        ? st["inputs"][input]
+        : undefined;
+    if (from === undefined)
+        delete inputs[input];
+    else
+        inputs[input] = from;
+    
+    // the CANDIDATE wiring (a copy, never the live record: a refusal
+    // must not leak the write into the domain's cached doc) admits
+    // against the row's params and the live bench BEFORE anything
+    // moves (a channel nothing spells, an upstream that doesn't
+    // exist — all refuse here, named, instead of starving compose at
+    // run time).
+    admitWiring(st, isRecord(st["params"]) ? st["params"] : {}, inputs, 
+    // (the domain schema pins stages[].id: string with
+    // backup-and-skip at read — a nullish id never reaches here)
+    stagesOf(loaded.doc).map((r) => String(r["id"])), stageId, session, 
+    // THE UN-WEDGE LAW at the rewire seat: the tolerate table is
+    // built from the PRE ROW's own inputs — a ref the rewire
+    // NEWLY sets (its `from`) never rides it, so wiring a dead
+    // stage still refuses (the phantom-wire cure stands), while
+    // the row's other pre-broken inputs tolerate so rewiring one
+    // wire on a wounded row never wedges.
+    toleratedByRow([st], liveIdsOf(stagesOf(loaded.doc))).get(stageId));
+    st["inputs"] = inputs;
+    const inverse = { stage: stageId, input };
+    if (before !== undefined)
+        inverse["before"] = before;
+    else
+        inverse["added"] = true;
+    const newRev = await appendAndSave(drafts, loaded, {
+        author,
+        kind: "rewire",
+        stage: stageId,
+        summary: "wire " + input,
+        inverse,
+    });
+    return {
+        draft_id: loaded.draftId,
+        session,
+        rev: newRev,
+        stage: stageId,
+        input,
+    };
+}
+const UNDO_KEYS = ["n", "author", "expect_rev"];
+/** undo — walk the log tail, skip already-reverted entries and
+ *  entries the author filter excludes, apply inverses
+ *  newest-first, append ONE undo entry carrying the pre-undo
+ *  snapshot. Undo entries are NEVER candidates — a plain undo
+ *  walks ACTIONS (targeting them would ping-pong). */
+export async function undoBench(drafts, session, body, admit) {
+    refuseUnknown(body, UNDO_KEYS);
+    const loaded = await loadBench(drafts, session);
+    // THE FENCE IS NOT OPTIONAL (audit W-E2): undo reverts writes —
+    // exactly the mutations the CAS law fences. It was the only verb
+    // that skipped the check when expect_rev was absent, so an
+    // un-read revert raced any concurrent writer and silently
+    // double-applied. Same voice as every verb: absent expect_rev
+    // refuses bench/cas-conflict with current_rev.
+    casCheck(loaded.block, body["expect_rev"], session);
+    const n = typeof body["n"] === "number" &&
+        Number.isInteger(body["n"]) &&
+        body["n"] > 0
+        ? body["n"]
+        : 1;
+    const filter = authorOk(body["author"])
+        ? body["author"]
+        : null;
+    // The already-reverted set (union of every undo entry's reverted).
+    const revertedSet = new Set();
+    for (const e of loaded.block.log) {
+        if (e.kind === "undo" && Array.isArray(e.reverted)) {
+            for (const r of e.reverted)
+                revertedSet.add(r);
+        }
+    }
+    const targets = [];
+    for (let i = loaded.block.log.length - 1; i >= 0 && targets.length < n; i--) {
+        const e = loaded.block.log[i];
+        if (e.kind === "undo")
+            continue;
+        if (revertedSet.has(e.rev))
+            continue;
+        if (filter !== null && e.author !== filter)
+            continue;
+        targets.push(e);
+    }
+    if (targets.length === 0) {
+        throw new RemoteError("bench/nothing-to-undo", "nothing to undo" + (filter !== null ? " (author " + filter + ")" : ""), {});
+    }
+    const stagesBefore = stagesOf(loaded.doc);
+    // THE MULTI-TARGET UNDO IS ATOMIC (the bench audit's gap 2,
+    
+    // so `undo {n: 2}` where the first target reverts cleanly and the
+    // second refuses left the first one's change in the live document
+    // with no rev and no log — a refused write that mutated, through
+    // the door whose whole job is repair. The inverses now run against
+    // a DEEP COPY and the swap happens only when every target applied
+    // (copy-on-judge, at the shape's own scale: an undo either lands
+    // whole or not at all).
+    const undoDoc = structuredClone(loaded.doc);
+    for (const e of targets)
+        applyInverse(undoDoc, e, admit, session);
+    // THE UNDOED BENCH IS WIRE-JUDGED WHOLE (the bench audit's gaps 4
+    
+    // the wiring half of a write was undo's blind spot: an undo-patch
+    // restored params that stranded a spell the wire still fed (a dead
+    // wire the forward patch refuses), and undo-remove/group/ungroup/
+    
+    // bench. One walk over the RESULT covers every arm at once — the
+    // survivor law remove established, applied to the repair door.
+    
+    // wedge), with the resurrection line drawn by ROW, not by ref: a
+    // row that was already on the bench before the undo (or rides an
+    // undone CLEAR's recorded snapshot — clear's promise is that undo
+    // restores EVERYTHING, wounds included; the run door names them,
+    // the cure doors exist) keeps its pre-existing dead refs. A row
+    // the undo RESURRECTS through any other arm (remove's inverse,
+    // group's spill) judges STRICT — the phantom the forward doors
+    // refuse must not launder back through undo (gap 5 stands). Refs
+    // the undo itself orphans (a stage live before, gone after) still
+    // refuse LOUD.
+    (() => {
+        const baseRows = [...stagesBefore];
+        for (const e of targets) {
+            const inv = e.inverse ?? {};
+            if (e.kind === "clear" && Array.isArray(inv["stages_before"])) {
+                for (const row of inv["stages_before"]) {
+                    if (isRecord(row))
+                        baseRows.push(row);
+                }
+            }
+        }
+        const baseIds = liveIdsOf(baseRows);
+        // THE TRAIL HEAL AT UNDO (trail-defect-hunt §6): a reinserted
+        // pre-law row's duplicated history never rides back in — same
+        // dedup the load carry applies.
+        for (const r of stagesOf(undoDoc)) {
+            if (Array.isArray(r["history"]))
+                r["history"] = trailDedupe(r["history"]);
+        }
+        const restored = stagesOf(undoDoc);
+        admitWiringList(restored, session, toleratedByRow(restored.filter((r) => baseIds.has(String(r["id"] ?? ""))), baseIds));
+    })();
+    loaded.doc = undoDoc;
+    const undone = targets
+        .map((e) => e.rev)
+        .sort((a, b) => a - b);
+    const newRev = await appendAndSave(drafts, loaded, {
+        author: filter === "user" ? "user" : "agent",
+        kind: "undo",
+        summary: "undo r" + undone.join(",r"),
+        inverse: { stages_before: stagesBefore },
+        reverted: undone,
+    });
+    return {
+        draft_id: loaded.draftId,
+        session,
+        rev: newRev,
+        undone,
+        stages: loaded.doc["stages"],
+    };
+}
+/** Apply one entry's inverse payload to the doc (best-effort per
+ *  entry; a stage an undo already removed is skipped loudly-free —
+ *  the snapshot entries carry the coarse fallback). */
+function applyInverse(doc, e, admit, session = "") {
+    const inv = isRecord(e.inverse)
+        ? e.inverse
+        : {};
+    const stages = stagesOf(doc);
+    if (e.kind === "patch") {
+        const st = stageRow(doc, String(inv["stage"] ?? e.stage ?? ""));
+        if (st === null)
+            return;
+        
+        // live record, so a refused undo left the poisoned merge in the
+        // doc's cached record before the throw. Judge the copy, THEN
+        // assign; a refusal leaves the bench exactly as it was.
+        const cur = isRecord(st["params"])
+            ? { ...st["params"] }
+            : {};
+        const before = isRecord(inv["params_before"])
+            ? inv["params_before"]
+            : {};
+        for (const k of Object.keys(before))
+            cur[k] = before[k];
+        const added = inv["params_added"];
+        if (Array.isArray(added)) {
+            for (const k of added)
+                delete cur[k];
+        }
+        
+        // inverse restores params wholesale, so without this an undo was
+        // the laundering path — plant a poison through a door that is not
+        // judged, patch it clean, then undo back onto the poison. The
+        // restored state walks the same composed admission BEFORE it
+        // lands, and NO restored exemption applies: these were
+        // live-authored states, so re-judging is safe and a refusal is
+        // loud.
+        admitRestored(admit, st, cur);
+        st["params"] = cur;
+        return;
+    }
+    if (e.kind === "add_stage") {
+        const idx = stages.findIndex((s) => s["id"] === inv["stage"]);
+        if (idx >= 0)
+            stages.splice(idx, 1);
+        doc["stages"] = stages;
+        return;
+    }
+    if (e.kind === "remove_stage") {
+        const row = inv["row"];
+        const idx = typeof inv["index"] === "number" ? inv["index"] : stages.length;
+        // THE REINSERTED ROW IS JUDGED (the audit's GAP 4): an inverse
+        // row that left the doc before a law tightened re-enters here
+        // with NO seat looking at it — the laundering path the patch
+        // arm closed, reopened one verb over. Admission BEFORE the
+        // splice: a refusal names the row and the doc keeps its stages.
+        if (isRecord(row)) {
+            admitRestored(admit, row, isRecord(row["params"])
+                ? row["params"]
+                : {});
+            stages.splice(Math.min(idx, stages.length), 0, row);
+        }
+        doc["stages"] = stages;
+        return;
+    }
+    if (e.kind === "group") {
+        // undo(group) = ungroup: drop the compound row, spill children at
+        // its index (bench order preserved inside the row).
+        const idx = stages.findIndex((s) => s["id"] === inv["stage"]);
+        const children = inv["children"];
+        // (the inverse is a payload the log recorded, never a promise —
+        // junk members degrade loudly-free: only record rows re-enter)
+        const rows = Array.isArray(children)
+            ? children.filter((r) => isRecord(r))
+            : [];
+        
+        // audit's row 1): the children re-enter the flat bench from the
+        // INVERSE — a payload the log recorded, never a row the doors
+        // just judged — so an inverse carrying pre-law poison laundered
+        // straight back onto the bench. Every child walks admission
+        // BEFORE the splice; a refusal leaves the compound standing.
+        for (const row of rows) {
+            admitRestored(admit, row, isRecord(row["params"])
+                ? row["params"]
+                : {});
+        }
+        if (idx >= 0) {
+            stages.splice(idx, 1);
+            stages.splice(Math.min(idx, stages.length), 0, ...rows);
+            doc["stages"] = stages;
+        }
+        return;
+    }
+    if (e.kind === "ungroup") {
+        // undo(ungroup) = re-group: splice the children back out, insert
+        // the compound row at the recorded index.
+        const row = inv["row"];
+        if (!isRecord(row))
+            return;
+        const children = row["children"];
+        // (the inverse's members ride as the log recorded them — only
+        // record rows re-enter; junk degrades loudly-free)
+        const members = Array.isArray(children)
+            ? children.filter((c) => isRecord(c))
+            : [];
+        if (members.length > 0) {
+            
+            // row 2): the compound hides its children from every patch
+            // door — re-parking an inverse row re-opens the blind spot the
+            // group door closed. Children walk admission BEFORE the
+            // compound forms; a refusal aborts the undo whole.
+            for (const child of members) {
+                admitRestored(admit, child, isRecord(child["params"])
+                    ? child["params"]
+                    : {});
+            }
+            for (const child of members) {
+                const idx = stages.findIndex((s) => s["id"] === child["id"]);
+                if (idx >= 0)
+                    stages.splice(idx, 1);
+            }
+        }
+        const back = typeof inv["index"] === "number"
+            ? Math.min(inv["index"], stages.length)
+            : stages.length;
+        stages.splice(back, 0, row);
+        doc["stages"] = stages;
+        return;
+    }
+    if (e.kind === "reorder") {
+        // the inverse of a move is the move back: splice out at the CURRENT
+        // (post-move) position, reinsert at the ORIGINAL index (clamped).
+        const idx = stages.findIndex((s) => s["id"] === inv["stage"]);
+        if (idx >= 0) {
+            const [row] = stages.splice(idx, 1);
+            const back = typeof inv["from"] === "number"
+                ? Math.min(inv["from"], stages.length)
+                : stages.length;
+            stages.splice(back, 0, row);
+            doc["stages"] = stages;
+        }
+        return;
+    }
+    if (e.kind === "rewire") {
+        // (stageRow matches by identity of the string — the row it
+        // returns carries exactly this id, never a nullish one)
+        const stageId = String(inv["stage"] ?? "");
+        const st = stageRow(doc, stageId);
+        if (st === null)
+            return;
+        // COPY-ON-JUDGE (the write-seat audit's row 6, second half): the
+        // restored inputs are judged on a COPY and assigned only after
+        // the verdict — the first cut mutated `st["inputs"]` in place
+        // before the throw, so a REFUSED undo still leaked the dead wire
+        // into the doc. No judgment path mutates what it has not yet
+        // accepted.
+        const inputs = {
+            ...(isRecord(st["inputs"])
+                ? st["inputs"]
+                : {}),
+        };
+        const input = String(inv["input"] ?? "");
+        if (inv["added"] === true)
+            delete inputs[input];
+        else if ("before" in inv)
+            inputs[input] = inv["before"];
+        
+        // audit's row 6): the inverse restores a wire the rewire door
+        // judged when it was CUT — but the bench has moved since (the
+        // upstream stage may be gone, the $spell may have left params),
+        // and rewireBench refuses to create exactly this state. Undo
+        // walks the same wiring law over the RESTORED view BEFORE the
+        // assignment; a refusal aborts the undo.
+        admitWiring(st, isRecord(st["params"]) ? st["params"] : {}, inputs, 
+        // (records are stagesOf's guarantee; an id-less row rides as "")
+        stages
+            .map((s) => String(s["id"] ?? "")), stageId, session);
+        st["inputs"] = inputs;
+        return;
+    }
+    // load/clear: the coarse fallbacks — restore the snapshot. (Undo
+    // entries are never walk candidates — the skip at the top
+    // guarantees it — so no "undo" disjunct here.)
+    const snapshot = e.kind === "load" || e.kind === "clear" ? inv["stages_before"] : undefined;
+    if (Array.isArray(snapshot)) {
+        // THE SNAPSHOT IS JUDGED (the audit's GAP 4, the load arm): a
+        // coarse fallback that assigns stages wholesale re-enters every
+        // row with no seat looking — same laundering path as the
+        // remove_stage arm, coarser. Judge every row BEFORE the
+        // assignment; a refusal leaves the live bench untouched.
+        for (const row of snapshot) {
+            if (!isRecord(row))
+                continue;
+            admitRestored(admit, row, isRecord(row["params"])
+                ? row["params"]
+                : {});
+        }
+        doc["stages"] = snapshot;
+    }
+}
+let benchChangeSeam = null;
+/** Install the seam (the plugin does this with its Context; tests do
+ *  it with their own). Pass null to detach. */
+export function setBenchChangeSeam(seam) {
+    benchChangeSeam = seam;
+}
+/** Detach the seam ONLY if `seam` is still the installed one — the
+ *  ownership stamp that keeps dispose honest: a fiber that installed
+ *  EARLIER (a newer install displaced it) detaches nothing, so the
+ *  live seam survives the older fiber's unwind.
+ * @param seam - the seam instance the caller installed.
+ */
+export function clearBenchChangeSeam(seam) {
+    if (benchChangeSeam === seam)
+        benchChangeSeam = null;
+}
+
+
+
+
+
+
+
+
+export function onBenchChange(fn) {
+    if (benchChangeSeam === null) {
+        throw new Error("estate-drafts: no bench change seam installed — the plugin installs it in apply(), tests call setBenchChangeSeam()");
+    }
+    return benchChangeSeam.on((session) => {
+        try {
+            fn(session);
+        }
+        catch (listenerError) {
+            // listenerError: the contract keeps a subscriber's fault from
+            // breaking the write, but the fault is not silence — the row
+            // names it like the runs seam's own wrap does
+            console.warn("[estate-drafts] bench change listener refused for session " +
+                JSON.stringify(session) + ":", listenerError);
+        }
+    });
+}
+/** Fire the write event — the remote layer calls this after every
+ *  successful bench write (the door seam: every in-process and
+ *  host-routed write crosses the remote arms). */
+export function notifyBenchChange(session) {
+    benchChangeSeam?.emit(session);
+}
+/** The public notify (the drafts-patch door writes bench docs from
+ *  remote.ts — outside this module; it fires this with the session
+ *  parsed from the bench-shaped draft id). */
+export function notifyBenchDocWrite(draftId) {
+    const m = BENCH_DRAFT_RE.exec(draftId);
+    if (m !== null)
+        notifyBenchChange(m[1]);
+}
+//# sourceMappingURL=bench.js.map