@playfast/reform-proof 1.0.1 → 1.2.0

package/src/engine.ts

@@ -1,104 +1,206 @@
 import {
   Array as Arr,
   Cause,
+  Context,
   Effect,
   Layer,
   ManagedRuntime,
   Match,
   MutableRef,
   Option,
+  Order,
   Record as Rec,
   Ref,
 } from 'effect'
 import { yieldWrapGet } from 'effect/Utils'
 import { AssertionFailed, UnknownAction, UnknownSlot } from './errors'
 import {
-  Bus,
-  CaptureSink,
-  type CaptureSinkApi,
+  type CapturedScene,
   Composition,
   type CompositionClass,
   type CompositionService,
-  type Instrumentation,
+  type FeatureLoadFailed,
   isFeatureBinding,
+  isSlot,
   isStructure,
-  noopInstrumentation,
+  makeAppRuntime,
   publish,
-  type RenderEnv,
-  type Scene,
+  type RuntimeHandle,
   sceneInstrumentation,
-  type SlotChild,
-  type SlotClass,
   type SlotFill,
   type Structure,
   type Trigger,
-  type UiCapture,
   type UiContract,
 } from '@playfast/reform'
+import {
+  type AnyComposition,
+  type AnyFeatureBinding,
+  type AnyScene,
+  type AnySlot,
+  type AnySlotChild,
+  Bus,
+  type CapturedRender,
+  CaptureSink,
+  type CaptureSinkApi,
+  type Instrumentation,
+  noopInstrumentation,
+} from '@playfast/reform/internal'
 import { matchProps } from './index'
-import type { Action, DriveResult, Facade, Proof, ProofResult, SlotFacade, StepFrame } from './index'
-
-// reform-proof engine — the headless renderer the proof system runs on. It drives the
-// real reduce loop through a capturing FACADE: no DOM, no React, no view eval — each
-// composition returns a `Structure`, and the engine reads props/events/fills off the
-// data. `executeProof`/`driveProof` are the two seams the `ProofRunner` layer exposes
-// (see ./runner): run a proof to completion, or step it a frame at a time.
-
-/** An erased facade — the runtime shape before the contract type is re-attached. */
-type AnyFacade = Facade<UiContract>
-type AnySlotFacade = SlotFacade<UiContract>
-
-// The drain loop, channels, RPC, and reducers run on forked fibers, so a
-// dispatched event takes an unknown number of ticks to flow through. Each poll
-// first drains COOPERATIVELY — a burst of `yieldNow` lets those forked fibers
-// cascade (event → channel → procedure → in-memory RPC → fact → reducer) with no
-// real time — so a synchronous flow reaches its final state within one poll. A
-// real-time `sleep` is still paid each poll to remain the correctness authority
-// for a genuinely time-delayed client (the cooperative drain alone could read a
-// flow waiting on a real timer as falsely "stable" and settle early). The render
-// then re-runs until the captured tree stops changing, bounded so a stuck flow
-// fails fast instead of hanging.
+import type {
+  DriveResult,
+  Facade,
+  Proof,
+  ProofCase,
+  ProductComposition,
+  ProofResult,
+  SlotFacade,
+  SlotFacadesOf,
+  StepFrame,
+} from './index'
+import { formatFingerprint } from './fingerprint'
+
+type RenderRuntime = Pick<RuntimeHandle, 'dispatch' | 'instrumentation' | 'readOption'>
+
+type HostRuntime = Pick<
+  RuntimeHandle,
+  'dispatch' | 'instrumentation' | 'mountAnyFeature' | 'readOption'
+>
+
+type RuntimeRootComposition<
+  Identifier,
+  P,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  N extends string,
+  Identity,
+> = CompositionClass<P, C, S, N, Identity> & {
+  readonly tag: Context.Tag<Identifier, CompositionService<P, C>>
+}
+
+interface MountedFacadeErasure {
+  readonly props: Effect.Effect<unknown, never, never>
+  readonly expectProps: (partial: unknown) => Effect.Effect<void, never, never>
+  readonly actions: Readonly<
+    Record<string, (payload: unknown) => Effect.Effect<unknown, never, never>>
+  >
+  readonly slots: Readonly<Record<string, MountedSlotFacadeErasure>>
+  readonly frame: Effect.Effect<void, never, never>
+}
+
+interface MountedSlotFacadeErasure extends MountedFacadeErasure {
+  readonly first: Effect.Effect<MountedFacadeErasure, never, never>
+  readonly at: (index: number) => Effect.Effect<MountedFacadeErasure, never, never>
+  readonly all: Effect.Effect<ReadonlyArray<MountedFacadeErasure>, never, never>
+  readonly byKey: (key: string) => Effect.Effect<MountedFacadeErasure, never, never>
+  readonly where: (
+    predicate: (props: unknown) => boolean,
+  ) => Effect.Effect<ReadonlyArray<MountedFacadeErasure>, never, never>
+  readonly count: Effect.Effect<number, never, never>
+}
+
+interface MountedFacadeHandleErasure {
+  readonly facade: {
+    readonly props: Effect.Effect<unknown, never, never>
+    readonly expectProps: (partial: never) => Effect.Effect<void, never, never>
+    readonly actions: object
+    readonly slots: object
+    readonly frame: Effect.Effect<void, never, never>
+  }
+  readonly settle: Effect.Effect<void, never, never>
+}
+
+type Settlement = Effect.Effect<void, never, never>
+type SettleBoundary = (settlement: Settlement) => Settlement
+
+const directSettle: SettleBoundary = (settlement) => settlement
+
+// Cooperative yields flush synchronous fibers; the real-time sleep prevents a
+// genuinely delayed flow from looking stable between renders.
 const SETTLE_DRAIN = 30
 const SETTLE_STEP = '1 milli'
 const SETTLE_MAX_RENDERS = 100
 
-/** Cooperatively run forked engine fibers to a fixpoint without advancing real time. */
 const settleDrain = Effect.yieldNow().pipe(Effect.repeatN(SETTLE_DRAIN))
 
-// A keyed view backed by a getter — the only place dynamic keys are needed.
 const keyed = <V>(get: (key: string) => V): Record<string, V> => {
   const target: Record<string, V> = Object.create(null)
   return new Proxy(target, { get: (_target, key) => get(String(key)) })
 }
 
-/** Surface an unknown failure/defect as the message string a result DTO carries. */
 const messageOf = (error: unknown): string =>
   error instanceof Error ? error.message : String(error)
 
-const uiNameOf = (comp: CompositionClass<unknown>): string => comp.manifest.ui.manifest.name
+const uiNameOf = (comp: AnyComposition): string => comp.manifest.ui.manifest.name
 
-// The event triggers a `Structure` frame carries (plan 03b). At the erased
-// `UiContract` boundary the contract's event map is `Record<never, never>`, so
-// each value is `never` — assignable to `Trigger<unknown>` without a cast — and an
-// omitted `events` defaults to the empty map. This is the structure-path analog of
-// the view path's `capture.events`.
+// UiContract erases event values to never, so this boundary needs no assertion.
 const eventsOf = (structure: Structure<UiContract>): Record<string, Trigger<unknown>> => ({
   ...structure.events,
 })
 
-// Engine SPI (Sink/makeSink/RuntimeServices/proofLayer/makeFacade) — exported for
-// @playfast/reform-drive, which builds the no-ceremony scene driver on the same core.
+interface ExpectedProps {
+  readonly actual: unknown
+  readonly expected: unknown
+}
+
+const expectMatchingProps = ({
+  actual,
+  expected,
+}: ExpectedProps): Effect.Effect<void, never, never> =>
+  Option.match(Option.fromNullable(matchProps({ actual, expected })), {
+    onNone: () => Effect.void,
+    onSome: (detail) => Effect.dieMessage(new AssertionFailed({ detail }).message),
+  })
+
+const invalidCompositionProps = (composition: AnyComposition): string =>
+  `reform-proof: invalid props for composition ${composition.manifest.name}`
+
+const renderCompositionRuntime = (
+  runtime: RenderRuntime,
+  composition: AnyComposition,
+  props: unknown,
+): Structure<UiContract> =>
+  composition.capture(
+    <P, C extends UiContract, S extends ReadonlyArray<unknown>, N extends string, Identity>(
+      exact: CompositionClass<P, C, S, N, Identity>,
+    ): Structure<UiContract> => {
+      const resolved = Option.flatMap(exact.parseProps(props), (parsed) =>
+        Option.map(runtime.readOption(exact.tag), (service) => ({
+          parsed,
+          service,
+        })),
+      )
+      return Option.match(resolved, {
+        onNone: () => Effect.runSync(Effect.dieMessage(invalidCompositionProps(composition))),
+        onSome: ({ parsed, service }) => {
+          const frame = Effect.runSync(
+            Composition.render(service, {
+              props: parsed,
+              tracker: { add: () => {} },
+            }),
+          )
+          if (isStructure(frame)) {
+            return frame
+          }
+          return Effect.runSync(
+            Effect.dieMessage(
+              `reform-proof: composition ${composition.manifest.name} did not return a Structure`,
+            ),
+          )
+        },
+      })
+    },
+  )
+
 export interface Sink {
   readonly api: CaptureSinkApi
-  readonly captures: ReadonlyArray<UiCapture>
-  /** The scene's profiling hooks — render spans record here (noop unless `profileScene`d). */
+  readonly captures: ReadonlyArray<CapturedRender>
   readonly instrumentation: Instrumentation
   reset(): void
 }
 
 export const makeSink = (instrumentation: Instrumentation = noopInstrumentation): Sink => {
   // CaptureSink.record is synchronous, so this uses MutableRef rather than Ref.
-  const captures = MutableRef.make<UiCapture[]>([])
+  const captures = MutableRef.make<CapturedRender[]>([])
   return {
     api: {
       record: (capture) => {
@@ -115,72 +217,196 @@ export const makeSink = (instrumentation: Instrumentation = noopInstrumentation)
   }
 }
 
-export type RuntimeServices = CompositionService | SlotChild | Bus
-
-/**
- * Build a proof's runtime layer: the scene's closed wiring with the capture sink
- * merged in, so `Ui`'s `serviceOption(CaptureSink)` finds it and records each
- * render (absent in production, the same layer renders to React). The scene's
- * `provide` is typed to the host-read subset (`MountedServices`); a proof also
- * resolves slot-binding tags (`CompositionClass`), which the same closed layer
- * supplies at runtime — restate that broader `RuntimeServices` surface here. This
- * is the one erasure boundary, the same seam the react host crosses when it reads
- * a slot tag with the requirement erased.
- */
-export const proofLayer = (scene: Scene, sink: Sink): Layer.Layer<RuntimeServices, never, never> => {
-  // oxlint-disable-next-line reform-rules/no-type-assertion -- the one erasure boundary: the scene's host-read `MountedServices` layer widens to the broader `RuntimeServices` a proof resolves
-  const sceneLayer = scene.provide.reduce((merged, layer) => Layer.merge(merged, layer)) as unknown as Layer.Layer<
-    RuntimeServices,
-    never,
-    never
-  >
-  return Layer.provideMerge(sceneLayer, Layer.succeed(CaptureSink, sink.api))
+export type MountedSlotFacadesOf<C extends UiContract> = SlotFacadesOf<C, never>
+
+export type MountedFacade<C extends UiContract> = Facade<C, never>
+
+export type MountedSlotFacade<C extends UiContract> = SlotFacade<C, never>
+
+export const proofLayer = <
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
+  sink: Sink,
+): Layer.Layer<Services | CaptureSink, never, never> => {
+  const sceneLayer = scene.provide.reduce((merged, layer) => Layer.merge(merged, layer))
+  return Layer.merge(sceneLayer, Layer.succeed(CaptureSink, sink.api))
+}
+
+const missingRuntimeBus = (): never =>
+  Effect.runSync(Effect.dieMessage('reform-proof: scene does not provide Bus'))
+
+const renderRuntimeFromContext = <Services>(
+  context: Context.Context<Services>,
+  instrumentation: Instrumentation,
+): RenderRuntime => {
+  const bus = Context.getOption(context, Bus)
+  return {
+    dispatch: (priority, event) =>
+      Option.match(bus, {
+        onNone: missingRuntimeBus,
+        onSome: (service) =>
+          Effect.runSync(publish(priority, event).pipe(Effect.provideService(Bus, service))),
+      }),
+    instrumentation,
+    readOption: (tag) => Context.getOption(context, tag),
+  }
 }
 
-/** A composition queued to render, with the props its parent handed it. On the
- *  structure path it also carries the slot-fill `key` it was mounted under, so the
- *  facade can select a child by key (`byKey`); the legacy Node path omits it. */
 interface Mounted {
-  readonly comp: CompositionClass<unknown>
+  readonly comp: AnyComposition
   readonly props: unknown
+  readonly ref: NodeRef
+}
+
+interface SlotInstanceRef {
+  readonly name: string
+  readonly index: number
   readonly key: Option.Option<string>
+  readonly keyOccurrence: number
 }
 
-/** A rendered node addressed by its composition ui-name and render index. */
 interface NodeRef {
   readonly name: string
-  readonly index: number
+  readonly parent: Option.Option<NodeRef>
+  readonly slot: Option.Option<SlotInstanceRef>
 }
 
-/** Settle progress: the previous fingerprint, remaining renders, and early-stop state. */
+interface NodeCapture {
+  readonly ref: NodeRef
+  readonly capture: CapturedRender
+}
+
+interface CaptureLookup {
+  readonly captures: ReadonlyArray<NodeCapture>
+  record(ref: NodeRef, capture: CapturedRender): void
+  reset(): void
+}
+
+const makeCaptureLookup = (): CaptureLookup => {
+  const captures = MutableRef.make<ReadonlyArray<NodeCapture>>([])
+  return {
+    get captures() {
+      return MutableRef.get(captures)
+    },
+    record: (ref, capture) => {
+      MutableRef.update(captures, (current) => [...current, { ref, capture }])
+    },
+    reset: () => {
+      MutableRef.set(captures, [])
+    },
+  }
+}
+
+const sameSlotInstance = (expected: SlotInstanceRef, actual: SlotInstanceRef): boolean =>
+  expected.name === actual.name &&
+  Option.match(expected.key, {
+    onNone: () => expected.index === actual.index,
+    onSome: (key) =>
+      expected.keyOccurrence === actual.keyOccurrence && Option.contains(actual.key, key),
+  })
+
+const sameNodeRef = (expected: NodeRef, actual: NodeRef): boolean =>
+  expected.name === actual.name &&
+  Option.match(expected.parent, {
+    onNone: () => Option.isNone(actual.parent) && Option.isNone(actual.slot),
+    onSome: (expectedParent) =>
+      Option.isSome(actual.parent) &&
+      Option.isSome(expected.slot) &&
+      Option.isSome(actual.slot) &&
+      sameNodeRef(expectedParent, actual.parent.value) &&
+      sameSlotInstance(expected.slot.value, actual.slot.value),
+  })
+
+const rootRef = (root: AnyComposition): NodeRef => ({
+  name: uiNameOf(root),
+  parent: Option.none(),
+  slot: Option.none(),
+})
+
+const nodeCaptureFor = (lookup: CaptureLookup, ref: NodeRef): Option.Option<CapturedRender> =>
+  Option.map(
+    Arr.findFirst(lookup.captures, (entry) => sameNodeRef(ref, entry.ref)),
+    (entry) => entry.capture,
+  )
+
+const slotCapturesFor = (
+  lookup: CaptureLookup,
+  parent: NodeRef,
+  slotName: string,
+): ReadonlyArray<NodeCapture> =>
+  lookup.captures.filter(
+    (entry) =>
+      Option.isSome(entry.ref.parent) &&
+      Option.isSome(entry.ref.slot) &&
+      sameNodeRef(parent, entry.ref.parent.value) &&
+      entry.ref.slot.value.name === slotName,
+  )
+
 interface SettleProgress {
   readonly previous: string
   readonly remaining: number
   readonly stable: boolean
 }
 
-/** One step of the driver's generator pump: the value to feed in and the frame index. */
+const ensureSettled = (progress: SettleProgress): Effect.Effect<void, never, never> => {
+  if (progress.stable) {
+    return Effect.void
+  }
+  return Effect.dieMessage(`reform-proof: tree did not settle after ${SETTLE_MAX_RENDERS} renders`)
+}
+
 interface PumpStep {
   readonly input: unknown
   readonly index: number
 }
 
-// A slot's child is a plain composition or a `FeatureBinding`. A proof drives the
-// composition the feature mounts; for a `default` feature that composition's logic
-// is already live (its eager `.live` was merged into the scene by `provide`), so
-// unwrapping is all that's needed. (Driving a `lazy` feature — load gap +
-// placeholders — is the proof host's Part B increment; until then a scene wires
-// features as `default`, the eagerly-resolvable form.)
-const childComposition = (child: SlotChild): CompositionClass<unknown> =>
-  isFeatureBinding(child) ? child.composition : child
+const childComposition = (child: AnySlotChild): AnyComposition =>
+  isFeatureBinding(child) ? child.capture<AnyComposition>((binding) => binding.composition) : child
+
+const isUnknownRecord = (candidate: unknown): candidate is Record<string, unknown> =>
+  typeof candidate === 'object' && candidate !== null && !Array.isArray(candidate)
+
+const slotsOf = (comp: AnyComposition): Record<string, AnySlot> =>
+  comp.capture<Record<string, AnySlot>>((exact) => {
+    if (!('slots' in exact.manifest)) {
+      return {}
+    }
+    const candidate: unknown = exact.manifest.slots
+    if (!isUnknownRecord(candidate)) {
+      return {}
+    }
+    return Rec.fromEntries(
+      Rec.toEntries(candidate).flatMap(
+        ([name, slotDefinition]): ReadonlyArray<readonly [string, AnySlot]> =>
+          isSlot(slotDefinition) ? [[name, slotDefinition]] : [],
+      ),
+    )
+  })
 
-/** A composition's declared slot map, defaulting to an empty record when it declares none. */
-const slotsOf = (comp: CompositionClass<unknown>): Record<string, SlotClass> =>
-  Option.getOrElse(Option.fromNullable(comp.manifest.slots), () => ({}))
+interface RuntimeSlotRead {
+  readonly runtime: RenderRuntime
+  readonly slotDefinition: AnySlot
+  readonly parent: AnyComposition
+}
 
-// Narrow an erased slot value to a `SlotFill` by its discriminant. `Structure<
-// UiContract>` erases its per-slot fill types at this boundary, so recover them
-// structurally before traversing.
+const readRuntimeSlotChild = ({ runtime, slotDefinition, parent }: RuntimeSlotRead): AnySlotChild =>
+  slotDefinition.capture<AnySlotChild>((exact) =>
+    Option.match(runtime.readOption(exact.provider), {
+      onNone: () =>
+        Effect.runSync(
+          Effect.dieMessage(`reform-proof: slot provider missing in ${uiNameOf(parent)}`),
+        ),
+      onSome: (child) => child,
+    }),
+  )
+
+// UiContract erases per-slot fill types here, so recover them by discriminant.
 const isSlotFill = (candidate: unknown): candidate is SlotFill<unknown> =>
   typeof candidate === 'object' &&
   candidate !== null &&
@@ -189,156 +415,207 @@ const isSlotFill = (candidate: unknown): candidate is SlotFill<unknown> =>
 
 const structureFills = (structure: Structure<UiContract>): Record<string, SlotFill<unknown>> =>
   Rec.fromEntries(
-    Rec.toEntries(structure.slots).flatMap(([slotName, fillValue]) =>
-      isSlotFill(fillValue) ? [[slotName, fillValue] as const] : [],
+    Rec.toEntries(structure.slots).flatMap(
+      ([slotName, fillValue]): ReadonlyArray<readonly [string, SlotFill<unknown>]> =>
+        isSlotFill(fillValue) ? [[slotName, fillValue]] : [],
     ),
   )
 
-// Slot bindings (`provide(slot, composition)`) are static, so resolve the whole
-// child tree once, up front — keeping `renderTree` and slot navigation
-// synchronous (no nested runtime drive).
-const collectBindings = Effect.fn('collectBindings')(function* (
-  root: CompositionClass<unknown>,
-): Effect.fn.Return<Map<SlotClass, CompositionClass<unknown>>, never, SlotChild> {
-  const bindings = new Map<SlotClass, CompositionClass<unknown>>()
-  const walk: (comp: CompositionClass<unknown>) => Effect.Effect<void, never, SlotChild> = Effect.fn(
-    'collectBindings.walk',
-  )(function* (comp: CompositionClass<unknown>): Effect.fn.Return<void, never, SlotChild> {
-    yield* Effect.forEach(Rec.values(slotsOf(comp)), (slotClass) =>
-      Effect.gen(function* () {
-        if (bindings.has(slotClass)) {
-          return
-        }
-        const child = childComposition(yield* slotClass.tag)
-        bindings.set(slotClass, child)
-        yield* walk(child)
-      }),
-    )
-  })
-  yield* walk(root)
-  return bindings
-})
-
-// Expand one slot fill into the children to render next. `Each` mounts one child
-// per keyed item with that item's props and key; `One` mounts a single child
-// under a synthesized singleton key; `Absent` mounts nothing.
 const enqueueFill = (
+  parent: NodeRef,
   slotName: string,
   fill: SlotFill<unknown>,
-  child: CompositionClass<unknown>,
+  child: AnyComposition,
 ): ReadonlyArray<Mounted> =>
   Match.value(fill).pipe(
     Match.when({ _tag: 'Each' }, (each) =>
-      each.items.map((entry) => ({
+      each.items.map((entry, index) => ({
         comp: child,
         props: entry.props,
-        key: Option.some(entry.key),
+        ref: {
+          name: uiNameOf(child),
+          parent: Option.some(parent),
+          slot: Option.some({
+            name: slotName,
+            index,
+            key: Option.some(entry.key),
+            keyOccurrence: each.items
+              .slice(0, index)
+              .filter((candidate) => candidate.key === entry.key).length,
+          }),
+        },
       })),
     ),
     Match.when({ _tag: 'One' }, (oneFill) => [
-      { comp: child, props: oneFill.props, key: Option.some(`${slotName}.0`) },
+      {
+        comp: child,
+        props: oneFill.props,
+        ref: {
+          name: uiNameOf(child),
+          parent: Option.some(parent),
+          slot: Option.some({
+            name: slotName,
+            index: 0,
+            key: Option.some(`${slotName}.0`),
+            keyOccurrence: 0,
+          }),
+        },
+      },
     ]),
     Match.when({ _tag: 'Absent' }, () => []),
     Match.exhaustive,
   )
 
-// Consume a `Structure` frame: record computed props and event triggers, then
-// enqueue one child per slot fill with the per-item props the fill carries.
 const driveStructure = (
-  comp: CompositionClass<unknown>,
+  comp: AnyComposition,
   structure: Structure<UiContract>,
-  key: Option.Option<string>,
+  ref: NodeRef,
   sink: Sink,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  lookup: CaptureLookup,
+  bindings: ReadonlyMap<AnySlot, AnyComposition>,
 ): ReadonlyArray<Mounted> => {
-  sink.api.record({
+  const key = Option.flatMap(ref.slot, (instance) => instance.key)
+  const capture: CapturedRender = {
     name: uiNameOf(comp),
     props: structure.props,
     events: eventsOf(structure),
     ...(Option.isSome(key) ? { key: key.value } : {}),
-  })
+  }
+  sink.api.record(capture)
+  lookup.record(ref, capture)
   const fills = structureFills(structure)
   return Rec.toEntries(slotsOf(comp)).flatMap(([slotName, slotClass]) => {
     const child = bindings.get(slotClass)
     const fill = fills[slotName]
-    return child === undefined || fill === undefined ? [] : enqueueFill(slotName, fill, child)
+    return child === undefined || fill === undefined ? [] : enqueueFill(ref, slotName, fill, child)
   })
 }
 
-// Render one mounted composition, returning the children its fills enqueue. Every
-// composition returns a `Structure` (no view is ever executed — the proof is
-// view-free / React-free).
-const renderMounted = Effect.fn('renderMounted')(function* (
+const fingerprint = (lookup: CaptureLookup): string =>
+  formatFingerprint(lookup.captures.map(({ ref, capture }) => [ref, capture.props]))
+
+export function makeFacade<
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  runtime: ManagedRuntime.ManagedRuntime<Services | CaptureSink, never>,
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
+  sink: Sink,
+  dispatched: Set<string>,
+): {
+  readonly facade: Facade<C, never>
+  readonly settle: Effect.Effect<void, never, never>
+} {
+  const context = runtime.runSync(Effect.context<Services | CaptureSink>())
+  return makeMountedFacade(
+    renderRuntimeFromContext(context, sink.instrumentation),
+    scene.composition,
+    sink,
+    dispatched,
+    (settlement) => Effect.promise(() => runtime.runPromise(settlement)),
+  )
+}
+
+const collectRuntimeBindings = (
+  root: AnyComposition,
+  runtime: RenderRuntime,
+): Map<AnySlot, AnyComposition> => {
+  const bindings = new Map<AnySlot, AnyComposition>()
+  const walk = (comp: AnyComposition): void => {
+    Rec.values(slotsOf(comp)).forEach((slotClass) => {
+      if (bindings.has(slotClass)) {
+        return
+      }
+      const child = childComposition(
+        readRuntimeSlotChild({
+          runtime,
+          slotDefinition: slotClass,
+          parent: comp,
+        }),
+      )
+      bindings.set(slotClass, child)
+      walk(child)
+    })
+  }
+  walk(root)
+  return bindings
+}
+
+const renderMountedRuntime = (
+  runtime: RenderRuntime,
   mounted: Mounted,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  bindings: ReadonlyMap<AnySlot, AnyComposition>,
   sink: Sink,
-): Effect.fn.Return<ReadonlyArray<Mounted>, never, CompositionService> {
-  const service = yield* mounted.comp.tag
-  const env: RenderEnv = { props: mounted.props, tracker: { add: () => {} } }
+  lookup: CaptureLookup,
+): ReadonlyArray<Mounted> => {
   const endRenderSpan = sink.instrumentation.uiRendered(uiNameOf(mounted.comp))
-  const frame = yield* Composition.render(service, env)
+  const frame = renderCompositionRuntime(runtime, mounted.comp, mounted.props)
   endRenderSpan()
-  if (!isStructure(frame)) {
-    return yield* Effect.dieMessage(
-      `reform-proof: composition ${uiNameOf(mounted.comp)} did not return a Structure`,
-    )
-  }
-  return driveStructure(mounted.comp, frame, mounted.key, sink, bindings)
-})
+  return driveStructure(mounted.comp, frame, mounted.ref, sink, lookup, bindings)
+}
 
-// One breadth-first render of a whole level. Each mounted node reports its
-// `(props, events)` to the sink and yields the next level of children.
-const renderLevel: (
+const renderLevelRuntime = (
+  runtime: RenderRuntime,
   frontier: ReadonlyArray<Mounted>,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+  bindings: ReadonlyMap<AnySlot, AnyComposition>,
   sink: Sink,
-) => Effect.Effect<void, never, CompositionService> = Effect.fn('renderLevel')(function* (
-  frontier: ReadonlyArray<Mounted>,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
-  sink: Sink,
-): Effect.fn.Return<void, never, CompositionService> {
+  lookup: CaptureLookup,
+): void => {
   if (frontier.length === 0) {
     return
   }
-  const levels = yield* Effect.forEach(frontier, (mounted) => renderMounted(mounted, bindings, sink))
-  yield* renderLevel(levels.flat(), bindings, sink)
-})
+  const levels = frontier.map((mounted) =>
+    renderMountedRuntime(runtime, mounted, bindings, sink, lookup),
+  )
+  renderLevelRuntime(runtime, levels.flat(), bindings, sink, lookup)
+}
 
-const renderTree = Effect.fn('renderTree')(function* (
-  root: CompositionClass<unknown>,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+const renderTreeRuntime = (
+  runtime: RenderRuntime,
+  root: AnyComposition,
+  bindings: ReadonlyMap<AnySlot, AnyComposition>,
   sink: Sink,
-): Effect.fn.Return<void, never, CompositionService> {
-  sink.reset()
-  yield* renderLevel([{ comp: root, props: {}, key: Option.none() }], bindings, sink)
-})
-
-const capturesFor = (sink: Sink, name: string): ReadonlyArray<UiCapture> =>
-  sink.captures.filter((capture) => capture.name === name)
-
-// A cheap fingerprint of the rendered tree; when two successive renders match,
-// the engine has stopped producing new state and the read is safe.
-const fingerprint = (sink: Sink): string =>
-  // oxlint-disable-next-line reform-rules/no-json-parse-stringify -- structural fixpoint fingerprint of the captured tree; not Schema-typed data
-  JSON.stringify(sink.captures.map((capture) => [capture.name, capture.props]))
+  lookup: CaptureLookup,
+): Effect.Effect<void, never, never> =>
+  Effect.sync(() => {
+    sink.reset()
+    lookup.reset()
+    renderLevelRuntime(
+      runtime,
+      [{ comp: root, props: {}, ref: rootRef(root) }],
+      bindings,
+      sink,
+      lookup,
+    )
+  })
 
-const settleTree = Effect.fn('settleTree')(function* (
-  root: CompositionClass<unknown>,
-  bindings: ReadonlyMap<SlotClass, CompositionClass<unknown>>,
+const settleTreeRuntime = Effect.fn('settleTreeRuntime')(function* (
+  runtime: RenderRuntime,
+  root: AnyComposition,
+  bindings: ReadonlyMap<AnySlot, AnyComposition>,
   sink: Sink,
-): Effect.fn.Return<void, never, CompositionService> {
+  lookup: CaptureLookup,
+): Effect.fn.Return<void, never, never> {
   yield* settleDrain
-  yield* renderTree(root, bindings, sink)
-  yield* Effect.iterate(
-    { previous: fingerprint(sink), remaining: SETTLE_MAX_RENDERS, stable: false },
+  yield* renderTreeRuntime(runtime, root, bindings, sink, lookup)
+  const progress = yield* Effect.iterate(
+    {
+      previous: fingerprint(lookup),
+      remaining: SETTLE_MAX_RENDERS,
+      stable: false,
+    },
     {
       while: (progress: SettleProgress) => !progress.stable && progress.remaining > 0,
       body: (progress) =>
         Effect.gen(function* () {
           yield* settleDrain
           yield* Effect.sleep(SETTLE_STEP)
-          yield* renderTree(root, bindings, sink)
-          const current = fingerprint(sink)
+          yield* renderTreeRuntime(runtime, root, bindings, sink, lookup)
+          const current = fingerprint(lookup)
           return {
             previous: current,
             remaining: progress.remaining - 1,
@@ -347,123 +624,153 @@ const settleTree = Effect.fn('settleTree')(function* (
         }),
     },
   )
+  yield* ensureSettled(progress)
 })
 
-const makeFacadeEffect = Effect.fn('makeFacadeEffect')(function* (
-  root: CompositionClass<unknown>,
+function makeMountedFacade<
+  P,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  N extends string,
+  Identity,
+>(
+  runtime: RenderRuntime,
+  root: CompositionClass<P, C, S, N, Identity>,
   sink: Sink,
-  // Records every event name dispatched through the facade, so a proof's
-  // requirement-declared event coverage can be verified after the body runs.
   dispatched: Set<string>,
-): Effect.fn.Return<
-  { readonly facade: AnyFacade; readonly settle: Effect.Effect<void, never, CompositionService> },
-  never,
-  SlotChild
-> {
-  const bindings = yield* collectBindings(root)
-  const settle = settleTree(root, bindings, sink)
-  const rerender = renderTree(root, bindings, sink)
-
-  const triggerOf = (ref: NodeRef, event: string): Effect.Effect<Trigger<unknown>> =>
-    Option.match(Option.fromNullable(capturesFor(sink, ref.name)[ref.index]?.events[event]), {
-      onNone: () =>
-        Effect.dieMessage(
-          new UnknownAction({
-            composition: ref.name,
-            action: event,
-            rendered: capturesFor(sink, ref.name).length,
-          }).message,
-        ),
-      onSome: Effect.succeed,
-    })
+  settleBoundary: SettleBoundary,
+): {
+  readonly facade: MountedFacade<C>
+  readonly settle: Effect.Effect<void, never, never>
+}
+function makeMountedFacade(
+  runtime: RenderRuntime,
+  root: AnyComposition,
+  sink: Sink,
+  dispatched: Set<string>,
+  settleBoundary: SettleBoundary,
+): MountedFacadeHandleErasure
+function makeMountedFacade(
+  runtime: RenderRuntime,
+  root: AnyComposition,
+  sink: Sink,
+  dispatched: Set<string>,
+  settleBoundary: SettleBoundary,
+): MountedFacadeHandleErasure {
+  const bindings = collectRuntimeBindings(root, runtime)
+  const lookup = makeCaptureLookup()
+  const settle = settleBoundary(settleTreeRuntime(runtime, root, bindings, sink, lookup))
+  const rerender = renderTreeRuntime(runtime, root, bindings, sink, lookup)
 
-  const propsFor = (ref: NodeRef): Effect.Effect<unknown, never, CompositionService> =>
-    Effect.map(rerender, () => capturesFor(sink, ref.name)[ref.index]?.props)
+  const triggerOf = (ref: NodeRef, event: string): Effect.Effect<Trigger<unknown>, never, never> =>
+    Option.match(
+      Option.flatMap(nodeCaptureFor(lookup, ref), (capture) =>
+        Option.fromNullable(capture.events[event]),
+      ),
+      {
+        onNone: () =>
+          Effect.dieMessage(
+            new UnknownAction({
+              composition: ref.name,
+              action: event,
+              rendered: lookup.captures.filter((entry) => entry.ref.name === ref.name).length,
+            }).message,
+          ),
+        onSome: Effect.succeed,
+      },
+    )
+
+  const propsFor = (ref: NodeRef): Effect.Effect<unknown, never, never> =>
+    Effect.map(rerender, () =>
+      Option.match(nodeCaptureFor(lookup, ref), {
+        onNone: () => undefined,
+        onSome: (capture) => capture.props,
+      }),
+    )
 
-  const nodeFacade = (ref: NodeRef, comp: CompositionClass<unknown>): AnyFacade => ({
+  const nodeFacade = (ref: NodeRef, comp: AnyComposition): MountedFacadeErasure => ({
     props: propsFor(ref),
-    // Assert the computed props match a typed subset. Reuses the same partial-match
-    // logic as `expect(...).toMatchObject`; dies with `AssertionFailed` on mismatch.
     expectProps: (partial) =>
       propsFor(ref).pipe(
-        Effect.flatMap((props) => {
-          const mismatch = matchProps({ actual: props, expected: partial })
-          return mismatch === undefined
-            ? Effect.void
-            : Effect.dieMessage(new AssertionFailed({ detail: mismatch }).message)
-        }),
+        Effect.flatMap((props) => expectMatchingProps({ actual: props, expected: partial })),
       ),
-    // `keyed` resolves event/slot names at runtime; the string-keyed proxy is the one
-    // reflection boundary — every name it serves is a real contract member, so reading
-    // it as the contract-typed surface is sound. The action resolves to the props this
-    // node computed once the dispatch settled (the typed "result" of the event).
-    // oxlint-disable-next-line reform-rules/no-type-assertion -- reflection boundary: the string-keyed proxy serves only real contract event names
     actions: keyed(
-      (event): Action =>
-        (payload) =>
-          rerender.pipe(
-            Effect.flatMap(() => triggerOf(ref, event)),
-            Effect.flatMap((trigger) =>
-              Effect.sync(() => {
-                dispatched.add(event)
-                trigger(payload)
-              }),
-            ),
-            Effect.flatMap(() => settle),
-            Effect.flatMap(() => propsFor(ref)),
+      (event) => (payload: unknown) =>
+        rerender.pipe(
+          Effect.flatMap(() => triggerOf(ref, event)),
+          Effect.flatMap((trigger) =>
+            Effect.sync(() => {
+              dispatched.add(event)
+              trigger(payload)
+            }),
           ),
-    ) as AnyFacade['actions'],
-    // oxlint-disable-next-line reform-rules/no-type-assertion -- reflection boundary: the string-keyed proxy serves only real contract slot names
-    slots: keyed((slotName) => slotFacade(comp, slotName)) as AnyFacade['slots'],
+          Effect.flatMap(() => settle),
+          Effect.flatMap(() => propsFor(ref)),
+        ),
+    ),
+    slots: keyed((slotName) => slotFacade(ref, comp, slotName)),
     frame: settle,
   })
 
-  const slotFacade = (parent: CompositionClass<unknown>, slotName: string): AnySlotFacade => {
+  const slotFacade = (
+    parentRef: NodeRef,
+    parent: AnyComposition,
+    slotName: string,
+  ): MountedSlotFacadeErasure => {
     const slotClass = slotsOf(parent)[slotName]
     const child = slotClass && bindings.get(slotClass)
     if (child === undefined) {
-      // oxlint-disable-next-line reform-rules/no-throw -- proof navigated to an undeclared slot: programmer error surfaced as a defect during generator-time proxy access
-      throw new UnknownSlot({ parent: uiNameOf(parent), slot: slotName })
+      return Effect.runSync(
+        Effect.dieMessage(new UnknownSlot({ parent: uiNameOf(parent), slot: slotName }).message),
+      )
     }
     const childName = uiNameOf(child)
-    const atIndex = (index: number): Effect.Effect<AnyFacade, never, CompositionService> =>
-      Effect.as(rerender, nodeFacade({ name: childName, index }, child))
-    const first = nodeFacade({ name: childName, index: 0 }, child)
-    // The render index of the child whose structure-fill `key` matches (plan 06).
-    // Keys ride on the capture from `each`'s `key` (or a singleton `one` key), so
-    // selection is by stable identity, not render order — `none` when no fill carries it.
-    const indexOfKey = (key: string): Option.Option<number> =>
-      Arr.findFirstIndex(capturesFor(sink, childName), (capture) => capture.key === key)
+    const childRefAt = (index: number): NodeRef =>
+      slotCapturesFor(lookup, parentRef, slotName)[index]?.ref ?? {
+        name: childName,
+        parent: Option.some(parentRef),
+        slot: Option.some({
+          name: slotName,
+          index,
+          key: Option.none(),
+          keyOccurrence: 0,
+        }),
+      }
+    const atIndex = (index: number): Effect.Effect<MountedFacadeErasure, never, never> =>
+      Effect.as(rerender, nodeFacade(childRefAt(index), child))
+    const first = nodeFacade(childRefAt(0), child)
     return {
       first: atIndex(0),
       at: atIndex,
       all: Effect.map(rerender, () =>
-        capturesFor(sink, childName).map((_capture, index) => nodeFacade({ name: childName, index }, child)),
+        slotCapturesFor(lookup, parentRef, slotName).map((entry) => nodeFacade(entry.ref, child)),
       ),
-      // Select the one child mounted under `key` (the `each` item key). Re-renders
-      // first so the fill keys reflect the latest frame, then resolves its facade;
-      // dies with `UnknownSlot` (key in the slot position) when no fill carries it.
       byKey: (key) =>
         Effect.flatMap(rerender, () =>
-          Option.match(indexOfKey(key), {
-            onNone: () =>
-              Effect.dieMessage(
-                new UnknownSlot({ parent: uiNameOf(parent), slot: `${slotName}[key=${key}]` }).message,
-              ),
-            onSome: (index) => Effect.succeed(nodeFacade({ name: childName, index }, child)),
-          }),
+          Option.match(
+            Arr.findFirst(
+              slotCapturesFor(lookup, parentRef, slotName),
+              (entry) => entry.capture.key === key,
+            ),
+            {
+              onNone: () =>
+                Effect.dieMessage(
+                  new UnknownSlot({
+                    parent: uiNameOf(parent),
+                    slot: `${slotName}[key=${key}]`,
+                  }).message,
+                ),
+              onSome: (entry) => Effect.succeed(nodeFacade(entry.ref, child)),
+            },
+          ),
         ),
-      // Every child whose computed props satisfy `predicate`. Re-renders, then maps
-      // the matching captures back to their facades by render index.
       where: (predicate) =>
         Effect.map(rerender, () =>
-          capturesFor(sink, childName).flatMap((capture, index) =>
-            predicate(capture.props) ? [nodeFacade({ name: childName, index }, child)] : [],
+          slotCapturesFor(lookup, parentRef, slotName).flatMap((entry) =>
+            predicate(entry.capture.props) ? [nodeFacade(entry.ref, child)] : [],
           ),
         ),
-      // How many children this slot mounted this frame — the fill length.
-      count: Effect.map(rerender, () => capturesFor(sink, childName).length),
-      // Used directly, a slot behaves as its first instance.
+      count: Effect.map(rerender, () => slotCapturesFor(lookup, parentRef, slotName).length),
       props: first.props,
       expectProps: first.expectProps,
       actions: first.actions,
@@ -472,104 +779,849 @@ const makeFacadeEffect = Effect.fn('makeFacadeEffect')(function* (
     }
   }
 
-  return { facade: nodeFacade({ name: uiNameOf(root), index: 0 }, root), settle }
-})
+  return {
+    facade: nodeFacade(rootRef(root), root),
+    settle,
+  }
+}
+
+export const makeProofFacade = <
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  runtime: ManagedRuntime.ManagedRuntime<Services | CaptureSink, never>,
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
+  sink: Sink,
+  dispatched: Set<string>,
+): {
+  readonly facade: Facade<C, never>
+  readonly settle: Effect.Effect<void, never, never>
+} => {
+  return makeFacade(runtime, scene, sink, dispatched)
+}
 
-export const makeFacade = (
-  runtime: ManagedRuntime.ManagedRuntime<RuntimeServices, never>,
-  root: CompositionClass<unknown>,
+export const makeRuntimeHandleFacade = <
+  Services,
+  RootIdentifier extends NoInfer<Services>,
+  P,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  N extends string,
+  Identity,
+>(
+  runtime: RuntimeHandle<Services>,
+  root: RuntimeRootComposition<RootIdentifier, P, C, S, N, Identity>,
   sink: Sink,
   dispatched: Set<string>,
-): { readonly facade: AnyFacade; readonly settle: Effect.Effect<void, never, CompositionService> } =>
-  runtime.runSync(makeFacadeEffect(root, sink, dispatched))
+): {
+  readonly facade: MountedFacade<C>
+  readonly settle: Effect.Effect<void, never, never>
+} => makeMountedFacade(runtime, root, sink, dispatched, directSettle)
 
-/** Declared-but-never-dispatched events for a proof's requirement (coverage). */
-const missingCoverage = (proof: Proof, dispatched: Set<string>): ReadonlyArray<string> =>
+type FeatureMountState =
+  | { readonly _tag: 'Loading' }
+  | { readonly _tag: 'Live'; readonly runtime: HostRuntime }
+  | { readonly _tag: 'Failed'; readonly error: FeatureLoadFailed }
+
+interface TreeFeatureMount {
+  readonly id: string
+  readonly binding: AnyFeatureBinding
+  readonly parent: HostRuntime
+  readonly depth: number
+  readonly props: unknown
+  attempt: number
+  state: FeatureMountState
+  dispose: () => void
+}
+
+interface TreeNode {
+  readonly path: string
+  readonly depth: number
+  readonly key: Option.Option<string>
+  readonly comp: AnyComposition
+  readonly props: unknown
+  readonly events: Record<string, Trigger<unknown>>
+  readonly slots: Readonly<Record<string, ReadonlyArray<TreeNode>>>
+}
+
+interface TreeRenderState {
+  readonly root: TreeNode
+  readonly fingerprint: string
+}
+
+export interface RuntimeTreeFacade<C extends UiContract> {
+  readonly facade: MountedFacade<C>
+  readonly settle: Effect.Effect<void, never, never>
+  dispose(): void
+}
+
+interface RuntimeTreeFacadeErasure extends MountedFacadeHandleErasure {
+  dispose(): void
+}
+
+interface TreeDriver {
+  readonly render: () => TreeRenderState
+  readonly settle: Effect.Effect<void, never, never>
+  readonly dispose: () => void
+}
+
+interface MountIdentityInput {
+  readonly parent: HostRuntime
+  readonly parentPath: string
+  readonly slotName: string
+  readonly key: string
+  readonly binding: AnyFeatureBinding
+}
+
+interface FeatureRecordInput {
+  readonly id: string
+  readonly parent: HostRuntime
+  readonly binding: AnyFeatureBinding
+  readonly depth: number
+  readonly props: unknown
+}
+
+interface RenderCompositionInput {
+  readonly runtime: HostRuntime
+  readonly comp: AnyComposition
+  readonly props: unknown
+  readonly key: Option.Option<string>
+  readonly path: string
+  readonly depth: number
+  readonly seen: Set<string>
+  readonly mountMissing: boolean
+}
+
+const encodeIdentityPart = (part: string): string => `${part.length}:${part}`
+
+const fillEntries = (
+  slotName: string,
+  fill: SlotFill<unknown>,
+): ReadonlyArray<{ readonly key: string; readonly props: unknown }> =>
+  Match.value(fill).pipe(
+    Match.when({ _tag: 'Each' }, (each) => each.items),
+    Match.when({ _tag: 'One' }, (oneFill) => [{ key: `${slotName}.0`, props: oneFill.props }]),
+    Match.when({ _tag: 'Absent' }, () => []),
+    Match.exhaustive,
+  )
+
+const treeFingerprint = (node: TreeNode): unknown => [
+  uiNameOf(node.comp),
+  node.key,
+  node.props,
+  Rec.map(node.slots, (children) => children.map(treeFingerprint)),
+]
+
+const makeTreeDriver = (
+  runtime: HostRuntime,
+  root: AnyComposition,
+  rootProps: unknown,
+  sink: Sink,
+): TreeDriver => {
+  const mounts = new Map<string, TreeFeatureMount>()
+  const runtimeIds = new WeakMap<HostRuntime, number>()
+  const bindingIds = new WeakMap<object, number>()
+  const sequence = { runtime: 0, binding: 0 }
+  const status = { disposed: false }
+
+  const identity = <Subject extends object>(
+    identities: WeakMap<Subject, number>,
+    subject: Subject,
+    next: () => number,
+  ): number => {
+    const current = identities.get(subject)
+    if (current !== undefined) {
+      return current
+    }
+    const created = next()
+    identities.set(subject, created)
+    return created
+  }
+
+  const mountId = ({ parent, parentPath, slotName, key, binding }: MountIdentityInput): string => {
+    const runtimeId = identity(runtimeIds, parent, () => ++sequence.runtime)
+    const bindingId = identity(bindingIds, binding, () => ++sequence.binding)
+    return [String(runtimeId), parentPath, slotName, String(bindingId), key]
+      .map(encodeIdentityPart)
+      .join('')
+  }
+
+  const startMount = (record: TreeFeatureMount): void => {
+    record.attempt += 1
+    const attempt = record.attempt
+    record.binding.capture<void>((binding) => {
+      if (binding.strategy === 'default') {
+        record.state = { _tag: 'Live', runtime: record.parent }
+        binding.boot.forEach((event) => record.parent.dispatch('High', event))
+        record.dispose = () => {}
+        return
+      }
+      record.state = { _tag: 'Loading' }
+      record.dispose = record.parent.mountAnyFeature(binding, {
+        props: record.props,
+        onLive: (childRuntime) => {
+          if (status.disposed || record.attempt !== attempt || mounts.get(record.id) !== record) {
+            return
+          }
+          record.state = { _tag: 'Live', runtime: childRuntime }
+        },
+        onFailed: (error) => {
+          if (status.disposed || record.attempt !== attempt || mounts.get(record.id) !== record) {
+            return
+          }
+          record.state = { _tag: 'Failed', error }
+        },
+      })
+    })
+  }
+
+  const retryMount = (record: TreeFeatureMount): void => {
+    if (status.disposed || mounts.get(record.id) !== record || record.state._tag !== 'Failed') {
+      return
+    }
+    record.dispose()
+    startMount(record)
+  }
+
+  const featureRecord = ({
+    id,
+    parent,
+    binding,
+    depth,
+    props,
+  }: FeatureRecordInput): TreeFeatureMount => {
+    const current = mounts.get(id)
+    if (current !== undefined && current.binding === binding && current.parent === parent) {
+      return current
+    }
+    if (current !== undefined) {
+      current.attempt += 1
+      current.dispose()
+    }
+    const created: TreeFeatureMount = {
+      id,
+      binding,
+      parent,
+      depth,
+      props,
+      attempt: 0,
+      state: { _tag: 'Loading' },
+      dispose: () => {},
+    }
+    mounts.set(id, created)
+    startMount(created)
+    return created
+  }
+  const featureRecordForRender = (
+    input: FeatureRecordInput,
+    mountMissing: boolean,
+  ): TreeFeatureMount | undefined => {
+    const current = mounts.get(input.id)
+    if (current !== undefined || !mountMissing) {
+      return current
+    }
+    return featureRecord(input)
+  }
+
+  const renderComposition = ({
+    runtime: currentRuntime,
+    comp,
+    props,
+    key,
+    path,
+    depth,
+    seen,
+    mountMissing,
+  }: RenderCompositionInput): TreeNode => {
+    const endRenderSpan = sink.instrumentation.uiRendered(uiNameOf(comp))
+    const frame = renderCompositionRuntime(currentRuntime, comp, props)
+    endRenderSpan()
+    sink.api.record({
+      name: uiNameOf(comp),
+      props: frame.props,
+      events: eventsOf(frame),
+      ...(Option.isSome(key) ? { key: key.value } : {}),
+    })
+
+    const fills = structureFills(frame)
+    const renderedSlots = Rec.map(slotsOf(comp), (slotClass, slotName) => {
+      const fill = fills[slotName]
+      if (fill === undefined) {
+        return []
+      }
+      const child = readRuntimeSlotChild({
+        runtime: currentRuntime,
+        slotDefinition: slotClass,
+        parent: comp,
+      })
+      return fillEntries(slotName, fill).flatMap((entry) => {
+        const childPath = `${path}${encodeIdentityPart(slotName)}${encodeIdentityPart(entry.key)}`
+        if (!isFeatureBinding(child)) {
+          return [
+            renderComposition({
+              runtime: currentRuntime,
+              comp: child,
+              props: entry.props,
+              key: Option.some(entry.key),
+              path: childPath,
+              depth: depth + 1,
+              seen,
+              mountMissing,
+            }),
+          ]
+        }
+        const id = mountId({
+          parent: currentRuntime,
+          parentPath: path,
+          slotName,
+          key: entry.key,
+          binding: child,
+        })
+        seen.add(id)
+        const record = featureRecordForRender(
+          {
+            id,
+            parent: currentRuntime,
+            binding: child,
+            depth: depth + 1,
+            props: entry.props,
+          },
+          mountMissing,
+        )
+        if (record === undefined) {
+          return []
+        }
+        return child.capture<ReadonlyArray<TreeNode>>((binding) =>
+          Match.value(record.state).pipe(
+            Match.when({ _tag: 'Live' }, (live) => [
+              renderComposition({
+                runtime: live.runtime,
+                comp: binding.composition,
+                props: entry.props,
+                key: Option.some(entry.key),
+                path: childPath,
+                depth: depth + 1,
+                seen,
+                mountMissing,
+              }),
+            ]),
+            Match.when({ _tag: 'Failed' }, (failed) =>
+              Option.match(binding.placeholder, {
+                onNone: () => [],
+                onSome: (placeholder) => [
+                  renderComposition({
+                    runtime: currentRuntime,
+                    comp: placeholder.failed,
+                    props: {
+                      error: failed.error,
+                      retry: () => retryMount(record),
+                    },
+                    key: Option.some(entry.key),
+                    path: `${childPath}/failed`,
+                    depth: depth + 1,
+                    seen,
+                    mountMissing,
+                  }),
+                ],
+              }),
+            ),
+            Match.when({ _tag: 'Loading' }, () =>
+              Option.match(binding.placeholder, {
+                onNone: () => [],
+                onSome: (placeholder) => [
+                  renderComposition({
+                    runtime: currentRuntime,
+                    comp: placeholder.loading,
+                    props: entry.props,
+                    key: Option.some(entry.key),
+                    path: `${childPath}/loading`,
+                    depth: depth + 1,
+                    seen,
+                    mountMissing,
+                  }),
+                ],
+              }),
+            ),
+            Match.exhaustive,
+          ),
+        )
+      })
+    })
+
+    return {
+      path,
+      depth,
+      key,
+      comp,
+      props: frame.props,
+      events: eventsOf(frame),
+      slots: renderedSlots,
+    }
+  }
+
+  const disposeStale = (seen: ReadonlySet<string>): void => {
+    Arr.sortWith(
+      Array.from(mounts.values()).filter((record) => !seen.has(record.id)),
+      (record) => -record.depth,
+      Order.number,
+    ).forEach((record) => {
+      mounts.delete(record.id)
+      record.attempt += 1
+      record.dispose()
+    })
+  }
+
+  const render = (): TreeRenderState => {
+    // Discover the desired graph without acquiring missing Features, then release
+    // removed scopes deepest-first before the live pass mounts replacements.
+    sink.reset()
+    const retained = new Set<string>()
+    renderComposition({
+      runtime,
+      comp: root,
+      props: rootProps,
+      key: Option.none(),
+      path: 'root',
+      depth: 0,
+      seen: retained,
+      mountMissing: false,
+    })
+    disposeStale(retained)
+    sink.reset()
+    const seen = new Set<string>()
+    const rootNode = renderComposition({
+      runtime,
+      comp: root,
+      props: rootProps,
+      key: Option.none(),
+      path: 'root',
+      depth: 0,
+      seen,
+      mountMissing: true,
+    })
+    return {
+      root: rootNode,
+      fingerprint: formatFingerprint(treeFingerprint(rootNode)),
+    }
+  }
+
+  const settle = Effect.gen(function* () {
+    yield* settleDrain
+    const first = render()
+    const progress = yield* Effect.iterate(
+      {
+        previous: first.fingerprint,
+        remaining: SETTLE_MAX_RENDERS,
+        stable: false,
+      },
+      {
+        while: (progress: SettleProgress) => !progress.stable && progress.remaining > 0,
+        body: (progress) =>
+          Effect.gen(function* () {
+            yield* settleDrain
+            yield* Effect.sleep(SETTLE_STEP)
+            const current = render()
+            return {
+              previous: current.fingerprint,
+              remaining: progress.remaining - 1,
+              stable: current.fingerprint === progress.previous,
+            }
+          }),
+      },
+    )
+    yield* ensureSettled(progress)
+  })
+
+  const dispose = (): void => {
+    if (status.disposed) {
+      return
+    }
+    status.disposed = true
+    Arr.sortWith(Array.from(mounts.values()), (record) => -record.depth, Order.number).forEach(
+      (record) => {
+        record.attempt += 1
+        record.dispose()
+      },
+    )
+    mounts.clear()
+  }
+
+  return { render, settle, dispose }
+}
+
+export function makeRuntimeTreeFacade<
+  Services,
+  RootIdentifier extends NoInfer<Services>,
+  P,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  N extends string,
+  Identity,
+>(
+  runtime: RuntimeHandle<Services>,
+  root: RuntimeRootComposition<RootIdentifier, P, C, S, N, Identity>,
+  rootProps: P,
+  sink: Sink,
+  dispatched: Set<string>,
+): RuntimeTreeFacade<C>
+export function makeRuntimeTreeFacade(
+  runtime: HostRuntime,
+  root: AnyComposition,
+  rootProps: unknown,
+  sink: Sink,
+  dispatched: Set<string>,
+): RuntimeTreeFacadeErasure {
+  const driver = makeTreeDriver(runtime, root, rootProps, sink)
+  const currentRoot = (): TreeNode => driver.render().root
+
+  // `peek` is the non-dying half of `resolve`: None once the node has left the
+  // tree, so an action that removed its own node can still report a result.
+  const nodeFacade = (
+    resolve: () => TreeNode,
+    peek: () => Option.Option<TreeNode>,
+  ): MountedFacadeErasure => ({
+    props: Effect.sync(() => resolve().props),
+    expectProps: (partial) =>
+      Effect.sync(() => {
+        const mismatch = matchProps({
+          actual: resolve().props,
+          expected: partial,
+        })
+        if (mismatch !== undefined) {
+          return Effect.runSync(
+            Effect.dieMessage(new AssertionFailed({ detail: mismatch }).message),
+          )
+        }
+      }),
+    actions: keyed(
+      (event) => (payload: unknown) =>
+        Effect.gen(function* () {
+          const node = resolve()
+          const trigger = node.events[event]
+          if (trigger === undefined) {
+            return yield* Effect.dieMessage(
+              new UnknownAction({
+                composition: uiNameOf(node.comp),
+                action: event,
+                rendered: 1,
+              }).message,
+            )
+          }
+          dispatched.add(event)
+          trigger(payload)
+          yield* driver.settle
+          // A self-removing action leaves nothing to re-read; report what the
+          // node last rendered instead of dying on the vanished child.
+          return Option.match(peek(), {
+            onNone: () => node.props,
+            onSome: (settled) => settled.props,
+          })
+        }),
+    ),
+    slots: keyed((slotName) => slotFacade(resolve, slotName)),
+    frame: driver.settle,
+  })
+
+  const slotFacade = (
+    resolveParent: () => TreeNode,
+    slotName: string,
+  ): MountedSlotFacadeErasure => {
+    const children = (): ReadonlyArray<TreeNode> => {
+      const parent = resolveParent()
+      const resolved = parent.slots[slotName]
+      if (resolved === undefined) {
+        return Effect.runSync(
+          Effect.dieMessage(
+            new UnknownSlot({ parent: uiNameOf(parent.comp), slot: slotName }).message,
+          ),
+        )
+      }
+      return resolved
+    }
+    const peekAt = (index: number): Option.Option<TreeNode> =>
+      Option.fromNullable(children()[index])
+    const peekByKey = (key: string): Option.Option<TreeNode> =>
+      Arr.findFirst(children(), (candidate) => Option.contains(candidate.key, key))
+    const childAt = (index: number): MountedFacadeErasure =>
+      nodeFacade(
+        () => children()[index] ?? missingChild(index),
+        () => peekAt(index),
+      )
+    const childByKey = (key: string): MountedFacadeErasure =>
+      nodeFacade(
+        () => Option.getOrElse(peekByKey(key), () => missingKey(key)),
+        () => peekByKey(key),
+      )
+    const missingChild = (index: number): never => {
+      const parent = resolveParent()
+      return Effect.runSync(
+        Effect.dieMessage(
+          new UnknownSlot({
+            parent: uiNameOf(parent.comp),
+            slot: `${slotName}[${index}]`,
+          }).message,
+        ),
+      )
+    }
+    const missingKey = (key: string): never => {
+      const parent = resolveParent()
+      return Effect.runSync(
+        Effect.dieMessage(
+          new UnknownSlot({
+            parent: uiNameOf(parent.comp),
+            slot: `${slotName}[key=${key}]`,
+          }).message,
+        ),
+      )
+    }
+    const first = childAt(0)
+    return {
+      first: Effect.sync(() => childAt(0)),
+      at: (index) => Effect.sync(() => childAt(index)),
+      all: Effect.sync(() => children().map((_child, index) => childAt(index))),
+      byKey: (key) =>
+        Effect.sync(() => {
+          const child = Arr.findFirst(children(), (candidate) =>
+            Option.contains(candidate.key, key),
+          )
+          return Option.isNone(child) ? missingKey(key) : childByKey(key)
+        }),
+      where: (predicate) =>
+        Effect.sync(() =>
+          children().flatMap((child, index) => (predicate(child.props) ? [childAt(index)] : [])),
+        ),
+      count: Effect.sync(() => children().length),
+      props: first.props,
+      expectProps: first.expectProps,
+      actions: first.actions,
+      slots: first.slots,
+      frame: driver.settle,
+    }
+  }
+
+  return {
+    facade: nodeFacade(currentRoot, () => Option.some(currentRoot())),
+    settle: driver.settle,
+    dispose: driver.dispose,
+  }
+}
+
+const proofRootProps = <
+  P,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  N extends string,
+  Identity,
+>(
+  composition: CompositionClass<P, C, S, N, Identity>,
+): Effect.Effect<P, never, never> =>
+  Option.match(composition.parseProps({}), {
+    onNone: () => Effect.dieMessage(invalidCompositionProps(composition)),
+    onSome: Effect.succeed,
+  })
+
+const withProofRuntimeTree = <
+  A,
+  E,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
+  sink: Sink,
+  dispatched: Set<string>,
+  use: (runtime: HostRuntime, tree: RuntimeTreeFacade<C>) => Effect.Effect<A, E, never>,
+): Effect.Effect<A, E, never> =>
+  Effect.acquireUseRelease(
+    Effect.sync(() => makeAppRuntime(scene)),
+    (runtime) =>
+      Effect.acquireUseRelease(
+        Effect.gen(function* () {
+          const rootProps = yield* proofRootProps(scene.composition)
+          yield* Effect.sync(() => runtime.boot())
+          return makeRuntimeTreeFacade(runtime, scene.composition, rootProps, sink, dispatched)
+        }),
+        (tree) => use(runtime, tree),
+        (tree) => Effect.sync(tree.dispose),
+      ),
+    (runtime) => Effect.sync(runtime.dispose),
+  )
+
+const missingCoverage = (
+  proof: Pick<Proof, 'requirement'>,
+  dispatched: Set<string>,
+): ReadonlyArray<string> =>
   Option.match(proof.requirement.manifest.events, {
     onNone: () => [],
     onSome: (declared) => declared.map(String).filter((event) => !dispatched.has(event)),
   })
 
-const bootScene = (scene: Scene): Effect.Effect<void, never, Bus> =>
-  Effect.forEach(
-    Option.getOrElse(Option.fromNullable(scene.boot), () => []),
-    (event) => publish('High', event),
-  ).pipe(Effect.asVoid)
+interface ProofPlacement {
+  readonly requirement: Proof['requirement']
+  readonly placement: 'Root' | 'Slot'
+}
+
+const compositionIdentity = (composition: AnyComposition): symbol =>
+  composition.capture<symbol>((exact) => exact.identity)
+
+const verifyProofPlacement = (
+  proof: ProofPlacement,
+  scene: AnyScene,
+  runtime: RenderRuntime,
+): Effect.Effect<void, never, never> => {
+  const expected = proof.requirement.manifest.composition
+  if (
+    proof.placement === 'Root' &&
+    Object.is(compositionIdentity(scene.composition), compositionIdentity(expected))
+  ) {
+    return Effect.void
+  }
+  if (proof.placement === 'Slot') {
+    const matches = Rec.values(slotsOf(scene.composition)).some((slotClass) => {
+      const child = childComposition(
+        readRuntimeSlotChild({
+          runtime,
+          slotDefinition: slotClass,
+          parent: scene.composition,
+        }),
+      )
+      return Object.is(compositionIdentity(child), compositionIdentity(expected))
+    })
+    if (matches) {
+      return Effect.void
+    }
+  }
+  const location = proof.placement === 'Root' ? 'scene root' : 'direct scene slot'
+  return Effect.dieMessage(
+    `reform-proof: requirement composition ${expected.manifest.name} is not the ${location} by definition identity`,
+  )
+}
 
-const executeProofEffect = Effect.fn('executeProofEffect')(function* (
-  proof: Proof,
+const executeProofWithSink = Effect.fn('executeProofWithSink')(function* <
+  Comp extends ProductComposition,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  proof: ProofCase<Comp, C, S, Services, P, N, Identity>,
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
   sink: Sink,
-): Effect.fn.Return<ProofResult, never, RuntimeServices> {
+): Effect.fn.Return<ProofResult, never, never> {
   const dispatched = new Set<string>()
   const statement = proof.requirement.manifest.statement
-  return yield* Effect.gen(function* () {
-    const { facade, settle } = yield* makeFacadeEffect(proof.scene.composition, sink, dispatched)
-    yield* bootScene(proof.scene)
-    yield* settle
-    yield* Effect.gen(() => proof.body(facade))
-    const missing = missingCoverage(proof, dispatched)
-    const coverageError = `requirement declares events never dispatched: ${missing.join(', ')}`
-    return missing.length > 0
-      ? { requirement: statement, ok: false, error: coverageError }
-      : { requirement: statement, ok: true }
-  }).pipe(
+  const runGenerator = Effect.fn('runProofGenerator')(function* (
+    generator: ReturnType<typeof proof.body>,
+    input: unknown,
+    settleEffect: Effect.Effect<void, never, never>,
+  ): Effect.fn.Return<void, unknown, never> {
+    const next = generator.next(input)
+    if (next.done === true) {
+      return
+    }
+    const output = yield* yieldWrapGet(next.value)
+    yield* settleEffect
+    yield* runGenerator(generator, output, settleEffect)
+  })
+  return yield* withProofRuntimeTree(scene, sink, dispatched, (runtime, tree) =>
+    Effect.gen(function* () {
+      yield* verifyProofPlacement(proof, scene, runtime)
+      yield* tree.settle
+      yield* runGenerator(proof.body(tree.facade), undefined, tree.settle)
+      const missing = missingCoverage(proof, dispatched)
+      const coverageError = `requirement declares events never dispatched: ${missing.join(', ')}`
+      return missing.length > 0
+        ? { requirement: statement, ok: false, error: coverageError }
+        : { requirement: statement, ok: true, error: undefined }
+    }),
+  ).pipe(
     Effect.catchAllCause((cause) =>
-      Effect.succeed({ requirement: statement, ok: false, error: messageOf(Cause.squash(cause)) }),
+      Effect.succeed({
+        requirement: statement,
+        ok: false,
+        error: messageOf(Cause.squash(cause)),
+      }),
     ),
   )
 })
 
-/**
- * Run one proof against a fresh runtime, returning its pass/fail result. Each
- * proof gets its own isolated environment, so nothing leaks between proofs. Boots
- * the scene as the host would, settles, then runs the proof body to completion.
- */
-export const executeProof = async (proof: Proof): Promise<ProofResult> => {
-  const sink = makeSink(sceneInstrumentation(proof.scene))
-  return Effect.runPromise(executeProofEffect(proof, sink).pipe(Effect.provide(proofLayer(proof.scene, sink))))
-}
-
-/**
- * Drive one proof a step at a time, recording a `StepFrame` after each yielded
- * effect settles. Reuses the same facade/settle engine as `executeProof`, but
- * instead of handing the body to `Effect.gen` (which runs it to completion), it
- * pumps the generator by hand — `gen.next(value)` yields the next effect, the
- * active proof layer runs it, then the driver snapshots the sink and feeds the
- * result back. So the editor gets the per-step timeline with no change to the
- * proof authoring API.
- */
-const driveProofEffect = Effect.fn('driveProofEffect')(function* (
-  proof: Proof,
+export const executeProofEffect = (proof: Proof): Effect.Effect<ProofResult, never, never> =>
+  proof.capture(
+    <
+      Comp extends ProductComposition,
+      C extends UiContract,
+      S extends ReadonlyArray<unknown>,
+      Services,
+      P,
+      N extends string,
+      Identity,
+    >(
+      exact: ProofCase<Comp, C, S, Services, P, N, Identity>,
+    ): Effect.Effect<ProofResult, never, never> => {
+      const sink = makeSink(sceneInstrumentation(exact.scene))
+      return executeProofWithSink<Comp, C, S, Services, P, N, Identity>(exact, exact.scene, sink)
+    },
+  )
+
+export const executeProof = (proof: Proof): Promise<ProofResult> =>
+  Effect.runPromise(executeProofEffect(proof))
+
+const driveProofWithSink = Effect.fn('driveProofWithSink')(function* <
+  Comp extends ProductComposition,
+  C extends UiContract,
+  S extends ReadonlyArray<unknown>,
+  Services,
+  P,
+  N extends string,
+  Identity,
+>(
+  proof: ProofCase<Comp, C, S, Services, P, N, Identity>,
+  scene: CapturedScene<C, S, Services, P, N, Identity>,
   sink: Sink,
-): Effect.fn.Return<DriveResult, never, RuntimeServices> {
+): Effect.fn.Return<DriveResult, never, never> {
   const frames = yield* Ref.make<ReadonlyArray<StepFrame>>([])
   const statement = proof.requirement.manifest.statement
-  // The driver's per-frame timeline does not enforce coverage; collect into a
-  // throwaway set so `makeFacadeEffect`'s contract is satisfied.
+  // Driving tracks dispatches for the facade without enforcing coverage.
   const dispatched = new Set<string>()
   const record = (index: number): Effect.Effect<void> =>
     Ref.update(frames, (current) => [...current, { index, captures: [...sink.captures] }])
-  // Pump the generator: run each yielded effect on the runtime, snapshot, recur.
   const pump = Effect.fn('pump')(function* (
-    generator: ReturnType<Proof['body']>,
+    generator: ReturnType<typeof proof.body>,
     step: PumpStep,
-  ): Effect.fn.Return<void, unknown, CompositionService> {
+    settleEffect: Effect.Effect<void, never, never>,
+  ): Effect.fn.Return<void, unknown, never> {
     const next = generator.next(step.input)
     if (next.done === true) {
       return
     }
     const output = yield* yieldWrapGet(next.value)
+    yield* settleEffect
     yield* record(step.index)
-    yield* pump(generator, { input: output, index: step.index + 1 })
+    yield* pump(generator, { input: output, index: step.index + 1 }, settleEffect)
   })
-  return yield* Effect.gen(function* () {
-    const { facade, settle } = yield* makeFacadeEffect(proof.scene.composition, sink, dispatched)
-    yield* bootScene(proof.scene)
-    yield* settle
-    yield* record(0)
-    yield* pump(proof.body(facade), { input: undefined, index: 1 })
-    return { requirement: statement, frames: yield* Ref.get(frames), ok: true }
-  }).pipe(
+  return yield* withProofRuntimeTree(scene, sink, dispatched, (runtime, tree) =>
+    Effect.gen(function* () {
+      yield* verifyProofPlacement(proof, scene, runtime)
+      yield* tree.settle
+      yield* record(0)
+      yield* pump(proof.body(tree.facade), { input: undefined, index: 1 }, tree.settle)
+      return {
+        requirement: statement,
+        frames: yield* Ref.get(frames),
+        ok: true,
+        error: undefined,
+      }
+    }),
+  ).pipe(
     Effect.catchAllCause((cause) =>
       Ref.get(frames).pipe(
         Effect.map((collected) => ({
@@ -583,7 +1635,23 @@ const driveProofEffect = Effect.fn('driveProofEffect')(function* (
   )
 })
 
-export const driveProof = async (proof: Proof): Promise<DriveResult> => {
-  const sink = makeSink(sceneInstrumentation(proof.scene))
-  return Effect.runPromise(driveProofEffect(proof, sink).pipe(Effect.provide(proofLayer(proof.scene, sink))))
-}
+export const driveProofEffect = (proof: Proof): Effect.Effect<DriveResult, never, never> =>
+  proof.capture(
+    <
+      Comp extends ProductComposition,
+      C extends UiContract,
+      S extends ReadonlyArray<unknown>,
+      Services,
+      P,
+      N extends string,
+      Identity,
+    >(
+      exact: ProofCase<Comp, C, S, Services, P, N, Identity>,
+    ): Effect.Effect<DriveResult, never, never> => {
+      const sink = makeSink(sceneInstrumentation(exact.scene))
+      return driveProofWithSink<Comp, C, S, Services, P, N, Identity>(exact, exact.scene, sink)
+    },
+  )
+
+export const driveProof = (proof: Proof): Promise<DriveResult> =>
+  Effect.runPromise(driveProofEffect(proof))