@playfast/reform-proof 0.1.0 → 1.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@playfast/reform-proof",
   "playbook": "./playbook",
-  "version": "0.1.0",
+  "version": "1.0.1",
   "type": "module",
   "description": "Headless testing toolkit for reform — drive a scene's compositions and assert on the props they compute, with no DOM, timers, or text matching.",
   "keywords": [

package/src/engine.ts

@@ -1,4 +1,15 @@
-import { Array as Arr, Cause, Effect, Layer, Match, ManagedRuntime, Option, Record as Rec } from 'effect'
+import {
+  Array as Arr,
+  Cause,
+  Effect,
+  Layer,
+  ManagedRuntime,
+  Match,
+  MutableRef,
+  Option,
+  Record as Rec,
+  Ref,
+} from 'effect'
 import { yieldWrapGet } from 'effect/Utils'
 import { AssertionFailed, UnknownAction, UnknownSlot } from './errors'
 import {
@@ -8,11 +19,14 @@ import {
   Composition,
   type CompositionClass,
   type CompositionService,
+  type Instrumentation,
   isFeatureBinding,
   isStructure,
+  noopInstrumentation,
   publish,
   type RenderEnv,
   type Scene,
+  sceneInstrumentation,
   type SlotChild,
   type SlotClass,
   type SlotFill,
@@ -77,23 +91,26 @@ const eventsOf = (structure: Structure<UiContract>): Record<string, Trigger<unkn
 export interface Sink {
   readonly api: CaptureSinkApi
   readonly captures: ReadonlyArray<UiCapture>
+  /** The scene's profiling hooks — render spans record here (noop unless `profileScene`d). */
+  readonly instrumentation: Instrumentation
   reset(): void
 }
 
-export const makeSink = (): Sink => {
-  // A const holder whose array we swap on reset (no reassigned binding).
-  const state: { captures: UiCapture[] } = { captures: [] }
+export const makeSink = (instrumentation: Instrumentation = noopInstrumentation): Sink => {
+  // CaptureSink.record is synchronous, so this uses MutableRef rather than Ref.
+  const captures = MutableRef.make<UiCapture[]>([])
   return {
     api: {
       record: (capture) => {
-        state.captures = [...state.captures, capture]
+        MutableRef.update(captures, (current) => [...current, capture])
       },
     },
     get captures() {
-      return state.captures
+      return MutableRef.get(captures)
     },
+    instrumentation,
     reset: () => {
-      state.captures = []
+      MutableRef.set(captures, [])
     },
   }
 }
@@ -135,10 +152,11 @@ interface NodeRef {
   readonly index: number
 }
 
-/** Settle progress: the previous fingerprint and how many renders remain. */
+/** Settle progress: the previous fingerprint, remaining renders, and early-stop state. */
 interface SettleProgress {
   readonly previous: string
   readonly remaining: number
+  readonly stable: boolean
 }
 
 /** One step of the driver's generator pump: the value to feed in and the frame index. */
@@ -147,184 +165,220 @@ interface PumpStep {
   readonly index: number
 }
 
-export const makeFacade = (
-  runtime: ManagedRuntime.ManagedRuntime<RuntimeServices, never>,
+// A slot's child is a plain composition or a `FeatureBinding`. A proof drives the
+// composition the feature mounts; for a `default` feature that composition's logic
+// is already live (its eager `.live` was merged into the scene by `provide`), so
+// unwrapping is all that's needed. (Driving a `lazy` feature — load gap +
+// placeholders — is the proof host's Part B increment; until then a scene wires
+// features as `default`, the eagerly-resolvable form.)
+const childComposition = (child: SlotChild): CompositionClass<unknown> =>
+  isFeatureBinding(child) ? child.composition : child
+
+/** A composition's declared slot map, defaulting to an empty record when it declares none. */
+const slotsOf = (comp: CompositionClass<unknown>): Record<string, SlotClass> =>
+  Option.getOrElse(Option.fromNullable(comp.manifest.slots), () => ({}))
+
+// Narrow an erased slot value to a `SlotFill` by its discriminant. `Structure<
+// UiContract>` erases its per-slot fill types at this boundary, so recover them
+// structurally before traversing.
+const isSlotFill = (candidate: unknown): candidate is SlotFill<unknown> =>
+  typeof candidate === 'object' &&
+  candidate !== null &&
+  '_tag' in candidate &&
+  (candidate._tag === 'Each' || candidate._tag === 'One' || candidate._tag === 'Absent')
+
+const structureFills = (structure: Structure<UiContract>): Record<string, SlotFill<unknown>> =>
+  Rec.fromEntries(
+    Rec.toEntries(structure.slots).flatMap(([slotName, fillValue]) =>
+      isSlotFill(fillValue) ? [[slotName, fillValue] as const] : [],
+    ),
+  )
+
+// Slot bindings (`provide(slot, composition)`) are static, so resolve the whole
+// child tree once, up front — keeping `renderTree` and slot navigation
+// synchronous (no nested runtime drive).
+const collectBindings = Effect.fn('collectBindings')(function* (
   root: CompositionClass<unknown>,
-  sink: Sink,
-  // Records every event name dispatched through the facade, so a proof's
-  // requirement-declared event coverage can be verified after the body runs.
-  dispatched: Set<string>,
-): { readonly facade: AnyFacade; readonly settle: Effect.Effect<void, never, CompositionService> } => {
-  // Slot bindings (`provide(slot, composition)`) are static, so resolve the
-  // whole child tree once, up front — keeping `renderTree` and slot navigation
-  // synchronous (no nested runtime drive).
+): Effect.fn.Return<Map<SlotClass, CompositionClass<unknown>>, never, SlotChild> {
   const bindings = new Map<SlotClass, CompositionClass<unknown>>()
-  // A slot's child is a plain composition or a `FeatureBinding`. A proof drives the
-  // composition the feature mounts; for a `default` feature that composition's logic
-  // is already live (its eager `.live` was merged into the scene by `provide`), so
-  // unwrapping is all that's needed. (Driving a `lazy` feature — load gap +
-  // placeholders — is the proof host's Part B increment; until then a scene wires
-  // features as `default`, the eagerly-resolvable form.)
-  const childComposition = (child: SlotChild): CompositionClass<unknown> =>
-    isFeatureBinding(child) ? child.composition : child
-  const slotClassesOf = (comp: CompositionClass<unknown>): ReadonlyArray<SlotClass> =>
-    Option.fromNullable(comp.manifest.slots).pipe(
-      Option.map((slots) => Object.values(slots)),
-      Option.getOrElse(() => []),
+  const walk: (comp: CompositionClass<unknown>) => Effect.Effect<void, never, SlotChild> = Effect.fn(
+    'collectBindings.walk',
+  )(function* (comp: CompositionClass<unknown>): Effect.fn.Return<void, never, SlotChild> {
+    yield* Effect.forEach(Rec.values(slotsOf(comp)), (slotClass) =>
+      Effect.gen(function* () {
+        if (bindings.has(slotClass)) {
+          return
+        }
+        const child = childComposition(yield* slotClass.tag)
+        bindings.set(slotClass, child)
+        yield* walk(child)
+      }),
     )
-  const bindChild = Effect.fn('bindChild')(function* (
-    slotClass: SlotClass,
-  ): Effect.fn.Return<void, never, SlotChild> {
-    const child = childComposition(yield* slotClass.tag)
-    bindings.set(slotClass, child)
-    yield* collect(child)
   })
-  const collect: (comp: CompositionClass<unknown>) => Effect.Effect<void, never, SlotChild> =
-    Effect.fn('collect')(function* (
-      comp: CompositionClass<unknown>,
-    ): Effect.fn.Return<void, never, SlotChild> {
-      yield* Effect.forEach(slotClassesOf(comp), (slotClass) =>
-        bindings.has(slotClass) ? Effect.void : bindChild(slotClass),
-      )
-    })
-  runtime.runSync(collect(root))
-
-  // Render one mounted composition, returning the children its fills enqueue. Every
-  // composition returns a `Structure` (no view is ever executed — the proof is
-  // view-free / React-free): read its computed props straight off the value, record
-  // them + the events it carries into the sink (so the facade, `triggerOf`, and
-  // navigation work uniformly), and walk its slot FILLS to enqueue children.
-  const renderMounted = Effect.fn('renderMounted')(function* (
-    mounted: Mounted,
-  ): Effect.fn.Return<ReadonlyArray<Mounted>, never, CompositionService> {
-    const service = yield* mounted.comp.tag
-    const env: RenderEnv = { props: mounted.props, tracker: { add: () => {} } }
-    const frame = yield* Composition.render(service, env)
-    if (!isStructure(frame)) {
-      return yield* Effect.dieMessage(
-        `reform-proof: composition ${uiNameOf(mounted.comp)} did not return a Structure`,
-      )
-    }
-    return driveStructure(mounted.comp, frame, mounted.key)
+  yield* walk(root)
+  return bindings
+})
+
+// Expand one slot fill into the children to render next. `Each` mounts one child
+// per keyed item with that item's props and key; `One` mounts a single child
+// under a synthesized singleton key; `Absent` mounts nothing.
+const enqueueFill = (
+  slotName: string,
+  fill: SlotFill<unknown>,
+  child: CompositionClass<unknown>,
+): ReadonlyArray<Mounted> =>
+  Match.value(fill).pipe(
+    Match.when({ _tag: 'Each' }, (each) =>
+      each.items.map((entry) => ({
+        comp: child,
+        props: entry.props,
+        key: Option.some(entry.key),
+      })),
+    ),
+    Match.when({ _tag: 'One' }, (oneFill) => [
+      { comp: child, props: oneFill.props, key: Option.some(`${slotName}.0`) },
+    ]),
+    Match.when({ _tag: 'Absent' }, () => []),
+    Match.exhaustive,
+  )
+
+// Consume a `Structure` frame: record computed props and event triggers, then
+// enqueue one child per slot fill with the per-item props the fill carries.
+const driveStructure = (
+  comp: CompositionClass<unknown>,
+  structure: Structure<UiContract>,
+  key: Option.Option<string>,
+  sink: Sink,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+): ReadonlyArray<Mounted> => {
+  sink.api.record({
+    name: uiNameOf(comp),
+    props: structure.props,
+    events: eventsOf(structure),
+    ...(Option.isSome(key) ? { key: key.value } : {}),
+  })
+  const fills = structureFills(structure)
+  return Rec.toEntries(slotsOf(comp)).flatMap(([slotName, slotClass]) => {
+    const child = bindings.get(slotClass)
+    const fill = fills[slotName]
+    return child === undefined || fill === undefined ? [] : enqueueFill(slotName, fill, child)
   })
+}
 
-  // One breadth-first render of a whole level. Each mounted node reports its
-  // `(props, events)` to the sink and yields the next level of children, so a
-  // single recursive sweep renders everything.
-  const renderLevel: (frontier: ReadonlyArray<Mounted>) => Effect.Effect<void, never, CompositionService> =
-    Effect.fn('renderLevel')(function* (
-      frontier: ReadonlyArray<Mounted>,
-    ): Effect.fn.Return<void, never, CompositionService> {
-      if (frontier.length === 0) {
-        return
-      }
-      const levels = yield* Effect.forEach(frontier, (mounted) => renderMounted(mounted))
-      yield* renderLevel(levels.flat())
-    })
+// Render one mounted composition, returning the children its fills enqueue. Every
+// composition returns a `Structure` (no view is ever executed — the proof is
+// view-free / React-free).
+const renderMounted = Effect.fn('renderMounted')(function* (
+  mounted: Mounted,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  sink: Sink,
+): Effect.fn.Return<ReadonlyArray<Mounted>, never, CompositionService> {
+  const service = yield* mounted.comp.tag
+  const env: RenderEnv = { props: mounted.props, tracker: { add: () => {} } }
+  const endRenderSpan = sink.instrumentation.uiRendered(uiNameOf(mounted.comp))
+  const frame = yield* Composition.render(service, env)
+  endRenderSpan()
+  if (!isStructure(frame)) {
+    return yield* Effect.dieMessage(
+      `reform-proof: composition ${uiNameOf(mounted.comp)} did not return a Structure`,
+    )
+  }
+  return driveStructure(mounted.comp, frame, mounted.key, sink, bindings)
+})
 
-  // Consume a `Structure` frame: record the node's computed props (the structure
-  // value already holds them — the proof never derives them from a view) AND the
-  // event triggers it carries on `structure.events` (plan 03b), then enqueue one
-  // child per slot fill with the per-item props the fill carries. Recording the
-  // events into the capture the same way the view path does means `triggerOf` /
-  // `app.actions` resolve identically for Structure frames; the index-keyed enqueue
-  // order matches the legacy node walk.
-  const driveStructure = (
-    comp: CompositionClass<unknown>,
-    structure: Structure<UiContract>,
-    key: Option.Option<string>,
-  ): ReadonlyArray<Mounted> => {
-    sink.api.record({
-      name: uiNameOf(comp),
-      props: structure.props,
-      events: eventsOf(structure),
-      ...(Option.isSome(key) ? { key: key.value } : {}),
-    })
-    const fills: Record<string, SlotFill<unknown>> = structure.slots
-    return Rec.toEntries(fills).flatMap(([slotName, fill]) => {
-      const slotClass = comp.manifest.slots?.[slotName]
-      const child = slotClass && bindings.get(slotClass)
-      return child === undefined ? [] : enqueueFill(slotName, fill, child)
-    })
+// One breadth-first render of a whole level. Each mounted node reports its
+// `(props, events)` to the sink and yields the next level of children.
+const renderLevel: (
+  frontier: ReadonlyArray<Mounted>,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  sink: Sink,
+) => Effect.Effect<void, never, CompositionService> = Effect.fn('renderLevel')(function* (
+  frontier: ReadonlyArray<Mounted>,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  sink: Sink,
+): Effect.fn.Return<void, never, CompositionService> {
+  if (frontier.length === 0) {
+    return
   }
+  const levels = yield* Effect.forEach(frontier, (mounted) => renderMounted(mounted, bindings, sink))
+  yield* renderLevel(levels.flat(), bindings, sink)
+})
 
-  // Expand one slot fill into the children to render next. `Each` mounts one
-  // child per keyed item with that item's props and key; `One` mounts a single
-  // child under a synthesized singleton key; `Absent` mounts nothing (the
-  // data-driven `cond && …`). The key rides each `Mounted` so the child's capture
-  // can record it, letting the facade select by key (`byKey`).
-  const enqueueFill = (
-    slotName: string,
-    fill: SlotFill<unknown>,
-    child: CompositionClass<unknown>,
-  ): ReadonlyArray<Mounted> =>
-    Match.value(fill).pipe(
-      Match.when({ _tag: 'Each' }, (each) =>
-        each.items.map((entry) => ({
-          comp: child,
-          props: entry.props,
-          key: Option.some(entry.key),
-        })),
-      ),
-      Match.when({ _tag: 'One' }, (oneFill) => [
-        { comp: child, props: oneFill.props, key: Option.some(`${slotName}.0`) },
-      ]),
-      Match.when({ _tag: 'Absent' }, () => []),
-      Match.exhaustive,
-    )
+const renderTree = Effect.fn('renderTree')(function* (
+  root: CompositionClass<unknown>,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  sink: Sink,
+): Effect.fn.Return<void, never, CompositionService> {
+  sink.reset()
+  yield* renderLevel([{ comp: root, props: {}, key: Option.none() }], bindings, sink)
+})
 
-  const renderTree: Effect.Effect<void, never, CompositionService> = Effect.gen(function* () {
-    sink.reset()
-    yield* renderLevel([{ comp: root, props: {}, key: Option.none() }])
-  })
+const capturesFor = (sink: Sink, name: string): ReadonlyArray<UiCapture> =>
+  sink.captures.filter((capture) => capture.name === name)
 
-  const capturesFor = (name: string): ReadonlyArray<UiCapture> =>
-    sink.captures.filter((capture) => capture.name === name)
-
-  // A cheap fingerprint of the rendered tree; when two successive renders match,
-  // the engine has stopped producing new state and the read is safe.
-  const fingerprint = (): string =>
-    // oxlint-disable-next-line reform-rules/no-json-parse-stringify -- structural fixpoint fingerprint of the captured tree; not Schema-typed data
-    JSON.stringify(sink.captures.map((capture) => [capture.name, capture.props]))
-
-  // Re-render until the tree is stable for two consecutive renders, or give up.
-  const settleFrom: (progress: SettleProgress) => Effect.Effect<void, never, CompositionService> =
-    Effect.fn('settleFrom')(function* (
-      progress: SettleProgress,
-    ): Effect.fn.Return<void, never, CompositionService> {
-      if (progress.remaining === 0) {
-        return
-      }
-      yield* settleDrain
-      yield* Effect.sleep(SETTLE_STEP)
-      yield* renderTree
-      const current = fingerprint()
-      if (current === progress.previous) {
-        return
-      }
-      yield* settleFrom({ previous: current, remaining: progress.remaining - 1 })
-    })
-  const settle: Effect.Effect<void, never, CompositionService> = Effect.gen(function* () {
-    yield* settleDrain
-    yield* renderTree
-    yield* settleFrom({ previous: fingerprint(), remaining: SETTLE_MAX_RENDERS })
-  })
+// A cheap fingerprint of the rendered tree; when two successive renders match,
+// the engine has stopped producing new state and the read is safe.
+const fingerprint = (sink: Sink): string =>
+  // oxlint-disable-next-line reform-rules/no-json-parse-stringify -- structural fixpoint fingerprint of the captured tree; not Schema-typed data
+  JSON.stringify(sink.captures.map((capture) => [capture.name, capture.props]))
+
+const settleTree = Effect.fn('settleTree')(function* (
+  root: CompositionClass<unknown>,
+  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  sink: Sink,
+): Effect.fn.Return<void, never, CompositionService> {
+  yield* settleDrain
+  yield* renderTree(root, bindings, sink)
+  yield* Effect.iterate(
+    { previous: fingerprint(sink), remaining: SETTLE_MAX_RENDERS, stable: false },
+    {
+      while: (progress: SettleProgress) => !progress.stable && progress.remaining > 0,
+      body: (progress) =>
+        Effect.gen(function* () {
+          yield* settleDrain
+          yield* Effect.sleep(SETTLE_STEP)
+          yield* renderTree(root, bindings, sink)
+          const current = fingerprint(sink)
+          return {
+            previous: current,
+            remaining: progress.remaining - 1,
+            stable: current === progress.previous,
+          }
+        }),
+    },
+  )
+})
+
+const makeFacadeEffect = Effect.fn('makeFacadeEffect')(function* (
+  root: CompositionClass<unknown>,
+  sink: Sink,
+  // Records every event name dispatched through the facade, so a proof's
+  // requirement-declared event coverage can be verified after the body runs.
+  dispatched: Set<string>,
+): Effect.fn.Return<
+  { readonly facade: AnyFacade; readonly settle: Effect.Effect<void, never, CompositionService> },
+  never,
+  SlotChild
+> {
+  const bindings = yield* collectBindings(root)
+  const settle = settleTree(root, bindings, sink)
+  const rerender = renderTree(root, bindings, sink)
 
   const triggerOf = (ref: NodeRef, event: string): Effect.Effect<Trigger<unknown>> =>
-    Option.match(Option.fromNullable(capturesFor(ref.name)[ref.index]?.events[event]), {
+    Option.match(Option.fromNullable(capturesFor(sink, ref.name)[ref.index]?.events[event]), {
       onNone: () =>
         Effect.dieMessage(
           new UnknownAction({
             composition: ref.name,
             action: event,
-            rendered: capturesFor(ref.name).length,
+            rendered: capturesFor(sink, ref.name).length,
           }).message,
         ),
       onSome: Effect.succeed,
     })
 
   const propsFor = (ref: NodeRef): Effect.Effect<unknown, never, CompositionService> =>
-    Effect.map(renderTree, () => capturesFor(ref.name)[ref.index]?.props)
+    Effect.map(rerender, () => capturesFor(sink, ref.name)[ref.index]?.props)
 
   const nodeFacade = (ref: NodeRef, comp: CompositionClass<unknown>): AnyFacade => ({
     props: propsFor(ref),
@@ -347,7 +401,7 @@ export const makeFacade = (
     actions: keyed(
       (event): Action =>
         (payload) =>
-          renderTree.pipe(
+          rerender.pipe(
             Effect.flatMap(() => triggerOf(ref, event)),
             Effect.flatMap((trigger) =>
               Effect.sync(() => {
@@ -365,7 +419,7 @@ export const makeFacade = (
   })
 
   const slotFacade = (parent: CompositionClass<unknown>, slotName: string): AnySlotFacade => {
-    const slotClass = parent.manifest.slots?.[slotName]
+    const slotClass = slotsOf(parent)[slotName]
     const child = slotClass && bindings.get(slotClass)
     if (child === undefined) {
       // oxlint-disable-next-line reform-rules/no-throw -- proof navigated to an undeclared slot: programmer error surfaced as a defect during generator-time proxy access
@@ -373,24 +427,24 @@ export const makeFacade = (
     }
     const childName = uiNameOf(child)
     const atIndex = (index: number): Effect.Effect<AnyFacade, never, CompositionService> =>
-      Effect.as(renderTree, nodeFacade({ name: childName, index }, child))
+      Effect.as(rerender, nodeFacade({ name: childName, index }, child))
     const first = nodeFacade({ name: childName, index: 0 }, child)
     // The render index of the child whose structure-fill `key` matches (plan 06).
     // Keys ride on the capture from `each`'s `key` (or a singleton `one` key), so
     // selection is by stable identity, not render order — `none` when no fill carries it.
     const indexOfKey = (key: string): Option.Option<number> =>
-      Arr.findFirstIndex(capturesFor(childName), (capture) => capture.key === key)
+      Arr.findFirstIndex(capturesFor(sink, childName), (capture) => capture.key === key)
     return {
       first: atIndex(0),
       at: atIndex,
-      all: Effect.map(renderTree, () =>
-        capturesFor(childName).map((_capture, index) => nodeFacade({ name: childName, index }, child)),
+      all: Effect.map(rerender, () =>
+        capturesFor(sink, childName).map((_capture, index) => nodeFacade({ name: childName, index }, child)),
       ),
       // Select the one child mounted under `key` (the `each` item key). Re-renders
       // first so the fill keys reflect the latest frame, then resolves its facade;
       // dies with `UnknownSlot` (key in the slot position) when no fill carries it.
       byKey: (key) =>
-        Effect.flatMap(renderTree, () =>
+        Effect.flatMap(rerender, () =>
           Option.match(indexOfKey(key), {
             onNone: () =>
               Effect.dieMessage(
@@ -402,13 +456,13 @@ export const makeFacade = (
       // Every child whose computed props satisfy `predicate`. Re-renders, then maps
       // the matching captures back to their facades by render index.
       where: (predicate) =>
-        Effect.map(renderTree, () =>
-          capturesFor(childName).flatMap((capture, index) =>
+        Effect.map(rerender, () =>
+          capturesFor(sink, childName).flatMap((capture, index) =>
             predicate(capture.props) ? [nodeFacade({ name: childName, index }, child)] : [],
           ),
         ),
       // How many children this slot mounted this frame — the fill length.
-      count: Effect.map(renderTree, () => capturesFor(childName).length),
+      count: Effect.map(rerender, () => capturesFor(sink, childName).length),
       // Used directly, a slot behaves as its first instance.
       props: first.props,
       expectProps: first.expectProps,
@@ -419,7 +473,15 @@ export const makeFacade = (
   }
 
   return { facade: nodeFacade({ name: uiNameOf(root), index: 0 }, root), settle }
-}
+})
+
+export const makeFacade = (
+  runtime: ManagedRuntime.ManagedRuntime<RuntimeServices, never>,
+  root: CompositionClass<unknown>,
+  sink: Sink,
+  dispatched: Set<string>,
+): { readonly facade: AnyFacade; readonly settle: Effect.Effect<void, never, CompositionService> } =>
+  runtime.runSync(makeFacadeEffect(root, sink, dispatched))
 
 /** Declared-but-never-dispatched events for a proof's requirement (coverage). */
 const missingCoverage = (proof: Proof, dispatched: Set<string>): ReadonlyArray<string> =>
@@ -428,22 +490,21 @@ const missingCoverage = (proof: Proof, dispatched: Set<string>): ReadonlyArray<s
     onSome: (declared) => declared.map(String).filter((event) => !dispatched.has(event)),
   })
 
-/**
- * Run one proof against a fresh runtime, returning its pass/fail result. Each
- * proof gets its own isolated environment, so nothing leaks between proofs. Boots
- * the scene as the host would, settles, then runs the proof body to completion.
- */
-export const executeProof = async (proof: Proof): Promise<ProofResult> => {
-  const sink = makeSink()
-  const runtime = ManagedRuntime.make(proofLayer(proof.scene, sink))
+const bootScene = (scene: Scene): Effect.Effect<void, never, Bus> =>
+  Effect.forEach(
+    Option.getOrElse(Option.fromNullable(scene.boot), () => []),
+    (event) => publish('High', event),
+  ).pipe(Effect.asVoid)
+
+const executeProofEffect = Effect.fn('executeProofEffect')(function* (
+  proof: Proof,
+  sink: Sink,
+): Effect.fn.Return<ProofResult, never, RuntimeServices> {
   const dispatched = new Set<string>()
   const statement = proof.requirement.manifest.statement
-  const program = Effect.gen(function* () {
-    const { facade, settle } = makeFacade(runtime, proof.scene.composition, sink, dispatched)
-    yield* Effect.forEach(
-      Option.getOrElse(Option.fromNullable(proof.scene.boot), () => []),
-      (event) => publish('High', event),
-    )
+  return yield* Effect.gen(function* () {
+    const { facade, settle } = yield* makeFacadeEffect(proof.scene.composition, sink, dispatched)
+    yield* bootScene(proof.scene)
     yield* settle
     yield* Effect.gen(() => proof.body(facade))
     const missing = missingCoverage(proof, dispatched)
@@ -456,31 +517,38 @@ export const executeProof = async (proof: Proof): Promise<ProofResult> => {
       Effect.succeed({ requirement: statement, ok: false, error: messageOf(Cause.squash(cause)) }),
     ),
   )
-  const report = await runtime.runPromise(program)
-  await runtime.dispose()
-  return report
+})
+
+/**
+ * Run one proof against a fresh runtime, returning its pass/fail result. Each
+ * proof gets its own isolated environment, so nothing leaks between proofs. Boots
+ * the scene as the host would, settles, then runs the proof body to completion.
+ */
+export const executeProof = async (proof: Proof): Promise<ProofResult> => {
+  const sink = makeSink(sceneInstrumentation(proof.scene))
+  return Effect.runPromise(executeProofEffect(proof, sink).pipe(Effect.provide(proofLayer(proof.scene, sink))))
 }
 
 /**
  * Drive one proof a step at a time, recording a `StepFrame` after each yielded
- * effect settles. Reuses the same makeFacade runtime/facade/settle as
- * `executeProof`, but instead of handing the body to `Effect.gen` (which runs it
- * to completion), it pumps the generator by hand — `gen.next(value)` yields the
- * next effect, we run it on the live runtime, snapshot the sink, and feed the
+ * effect settles. Reuses the same facade/settle engine as `executeProof`, but
+ * instead of handing the body to `Effect.gen` (which runs it to completion), it
+ * pumps the generator by hand — `gen.next(value)` yields the next effect, the
+ * active proof layer runs it, then the driver snapshots the sink and feeds the
  * result back. So the editor gets the per-step timeline with no change to the
  * proof authoring API.
  */
-export const driveProof = async (proof: Proof): Promise<DriveResult> => {
-  const sink = makeSink()
-  const runtime = ManagedRuntime.make(proofLayer(proof.scene, sink))
-  const collected: { frames: ReadonlyArray<StepFrame> } = { frames: [] }
+const driveProofEffect = Effect.fn('driveProofEffect')(function* (
+  proof: Proof,
+  sink: Sink,
+): Effect.fn.Return<DriveResult, never, RuntimeServices> {
+  const frames = yield* Ref.make<ReadonlyArray<StepFrame>>([])
   const statement = proof.requirement.manifest.statement
   // The driver's per-frame timeline does not enforce coverage; collect into a
-  // throwaway set so `makeFacade`'s contract is satisfied.
+  // throwaway set so `makeFacadeEffect`'s contract is satisfied.
   const dispatched = new Set<string>()
-  const record = (index: number): void => {
-    collected.frames = [...collected.frames, { index, captures: [...sink.captures] }]
-  }
+  const record = (index: number): Effect.Effect<void> =>
+    Ref.update(frames, (current) => [...current, { index, captures: [...sink.captures] }])
   // Pump the generator: run each yielded effect on the runtime, snapshot, recur.
   const pump = Effect.fn('pump')(function* (
     generator: ReturnType<Proof['body']>,
@@ -491,30 +559,31 @@ export const driveProof = async (proof: Proof): Promise<DriveResult> => {
       return
     }
     const output = yield* yieldWrapGet(next.value)
-    yield* Effect.sync(() => record(step.index))
+    yield* record(step.index)
     yield* pump(generator, { input: output, index: step.index + 1 })
   })
-  const program = Effect.gen(function* () {
-    const { facade, settle } = makeFacade(runtime, proof.scene.composition, sink, dispatched)
-    yield* Effect.forEach(
-      Option.getOrElse(Option.fromNullable(proof.scene.boot), () => []),
-      (event) => publish('High', event),
-    )
+  return yield* Effect.gen(function* () {
+    const { facade, settle } = yield* makeFacadeEffect(proof.scene.composition, sink, dispatched)
+    yield* bootScene(proof.scene)
     yield* settle
-    yield* Effect.sync(() => record(0))
+    yield* record(0)
     yield* pump(proof.body(facade), { input: undefined, index: 1 })
-    return { requirement: statement, frames: collected.frames, ok: true }
+    return { requirement: statement, frames: yield* Ref.get(frames), ok: true }
   }).pipe(
     Effect.catchAllCause((cause) =>
-      Effect.succeed({
-        requirement: statement,
-        frames: collected.frames,
-        ok: false,
-        error: messageOf(Cause.squash(cause)),
-      }),
+      Ref.get(frames).pipe(
+        Effect.map((collected) => ({
+          requirement: statement,
+          frames: collected,
+          ok: false,
+          error: messageOf(Cause.squash(cause)),
+        })),
+      ),
     ),
   )
-  const timeline = await runtime.runPromise(program)
-  await runtime.dispose()
-  return timeline
+})
+
+export const driveProof = async (proof: Proof): Promise<DriveResult> => {
+  const sink = makeSink(sceneInstrumentation(proof.scene))
+  return Effect.runPromise(driveProofEffect(proof, sink).pipe(Effect.provide(proofLayer(proof.scene, sink))))
 }