@playfast/reform 1.3.0 → 1.4.0

package/src/runtime/mount-scope-hardening.test.ts

@@ -0,0 +1,440 @@
+import { Context, Deferred, Effect, Layer, Option } from 'effect'
+import { expect, it } from '@effect/vitest'
+import * as Composition from '../compose/composition'
+import { provide } from '../compose/provide'
+import { mount } from '../compose/structure'
+import * as Ui from '../compose/ui'
+import { ui } from '../compose/ui'
+import * as Feature from '../feature/feature'
+import { featureModule } from '../feature/feature'
+import { scene } from '../scene/scene'
+import { makeScheduler } from '../internal/scheduler'
+import { flush, until } from '../testkit/flight.testkit'
+import { Engine } from './loop'
+import { makeAppRuntime } from './appRuntime'
+
+/**
+ * Round-4 adversarial audit — the owner-scope / instrumentation / scheduler fix set.
+ *
+ * Only findings that survived an attempt to refute them are filed here. Every
+ * assertion states the behaviour the FIXED code is supposed to have; each test
+ * fails on the current working tree and carries a PASSING control in the same
+ * body that proves the harness works and isolates the defect.
+ *
+ * Targets:
+ *   1 + 2 — `runtime/capturedAppRuntime.ts` / `runtime/featureMount.ts` (owner scopes)
+ *   3     — `internal/scheduler.ts` (`isLive` over a non-Set iterable)
+ */
+
+// `until`'s poll budget. 40 rounds x 10ms is the same budget the round-3 hunt
+// used: far above the microtask cost of a real release, short enough that a
+// failing arm reports quickly.
+const ROUNDS = 40
+
+// ---------------------------------------------------------------------------
+// Shared scene / feature definitions
+// ---------------------------------------------------------------------------
+
+interface LifecycleProbeService {
+  readonly acquired: Array<string>
+  readonly released: Array<string>
+}
+
+const LifecycleProbeBase: Context.TagClass<
+  LifecycleProbe,
+  'audit4.LifecycleProbe',
+  LifecycleProbeService
+> = Context.Tag('audit4.LifecycleProbe')<LifecycleProbe, LifecycleProbeService>()
+class LifecycleProbe extends LifecycleProbeBase {}
+
+const makeProbe = (): LifecycleProbeService => ({ acquired: [], released: [] })
+
+class AuditUi extends ui('audit4.AuditUi')<{ props: {} }>() {}
+class AuditComp extends Composition.make('audit4.AuditComp', {
+  title: 'Audit',
+  ui: AuditUi,
+})<AuditComp>() {}
+const AuditLive = Composition.live(AuditComp, function* () {
+  return mount({ props: {}, slots: {} })
+})
+
+class AuditRootUi extends ui('audit4.AuditRootUi')<{ props: {} }>() {}
+class AuditRootComp extends Composition.make('audit4.AuditRootComp', {
+  title: 'AuditRoot',
+  ui: AuditRootUi,
+})<AuditRootComp>() {}
+const AuditRootLive = Composition.live(AuditRootComp, function* () {
+  return mount({ props: {}, slots: {} })
+})
+
+const auditRootViews = AuditRootLive.pipe(
+  Layer.provideMerge(
+    provide(
+      AuditRootUi,
+      Ui.make(AuditRootUi, () => null),
+    ),
+  ),
+)
+
+const auditScene = (probe: LifecycleProbeService) =>
+  scene(AuditRootComp, {
+    provide: [
+      auditRootViews.pipe(
+        Layer.provideMerge(Layer.succeed(LifecycleProbe, probe)),
+        Layer.provideMerge(Engine),
+      ),
+    ],
+  })
+
+// A scoped marker. `acquired` records that the layer really built; `released`
+// records that its scope really closed.
+const scopedMark = (label: string): Layer.Layer<never, never, LifecycleProbe> =>
+  Layer.scopedDiscard(
+    Effect.gen(function* () {
+      const probe = yield* LifecycleProbe
+      yield* Effect.acquireRelease(
+        Effect.sync(() => probe.acquired.push(label)),
+        () => Effect.sync(() => probe.released.push(label)),
+      )
+    }),
+  )
+
+// Same marker, but its release parks on a latch nobody has opened yet: a flush
+// that has not finished, a socket that has not answered, a queue still draining.
+const parkedMark = (
+  label: string,
+  latch: Deferred.Deferred<void>,
+): Layer.Layer<never, never, LifecycleProbe> =>
+  Layer.scopedDiscard(
+    Effect.gen(function* () {
+      const probe = yield* LifecycleProbe
+      yield* Effect.acquireRelease(
+        Effect.sync(() => probe.acquired.push(label)),
+        () =>
+          Deferred.await(latch).pipe(
+            Effect.zipRight(Effect.sync(() => probe.released.push(label))),
+          ),
+      )
+    }),
+  )
+
+// ---------------------------------------------------------------------------
+// FINDING 1 — runtime/capturedAppRuntime.ts + runtime/featureMount.ts
+//
+// `forkMountScope` is `Scope.fork(owner, sequential)`. Effect's `Scope.fork` on a
+// CLOSED owner does not fail and does not give back a usable scope: it hands back
+// a scope that is *already closed* (`ScopeImpl.fork`: `if (this.state._tag ===
+// "Closed") { newScope.state = this.state; return newScope }`). `addFinalizer` on
+// a closed scope runs the finalizer THERE AND THEN, so `Layer.build` against it
+// SUCCEEDS while releasing every resource at the moment it is acquired.
+//
+// Nothing on the mount paths checks for that. A `RuntimeHandle` handed to a
+// feature's `onLive` mounts into the FEATURE's scope (that is the point of the
+// fix), so a host that still holds the handle after the feature is disposed —
+// proof/drive-style headless hosts, any custom host, and the window React's
+// `CapturedFeatureHost` opens when a child's effect re-runs in the same commit
+// that closed its parent's mount — now gets a mount that reports `onLive`,
+// hands over services whose finalizers have already run, and never calls
+// `onFailed`. The runtime already knows how to refuse a mount it cannot own:
+// `if (status.disposed) { return () => {} }` is the same situation one level down.
+//
+// Before the fix this call produced a working (leaking) mount, so the fix traded
+// a leak for a silent dead mount reported as live.
+// ---------------------------------------------------------------------------
+
+class OwnerFeature extends Feature.make('audit4.owner', {
+  composition: AuditComp,
+  module: featureModule([LifecycleProbe], Layer.merge(AuditLive, scopedMark('owner'))),
+}) {}
+
+// Two identical children: one mounted on a live owner (the control), one on the
+// dead one. Same module shape, same requirements, same mount path.
+class ControlChildFeature extends Feature.make('audit4.controlChild', {
+  composition: AuditComp,
+  module: featureModule([LifecycleProbe], Layer.merge(AuditLive, scopedMark('control-child'))),
+}) {}
+class OrphanChildFeature extends Feature.make('audit4.orphanChild', {
+  composition: AuditComp,
+  module: featureModule([LifecycleProbe], Layer.merge(AuditLive, scopedMark('orphan-child'))),
+}) {}
+
+const OwnerNative = Feature.tree<typeof OwnerFeature>(OwnerFeature.token)
+const ControlChildNative = Feature.tree<typeof ControlChildFeature>(ControlChildFeature.token)
+const OrphanChildNative = Feature.tree<typeof OrphanChildFeature>(OrphanChildFeature.token)
+
+it.scopedLive(
+  'a feature mounted through a handle whose owner scope has closed is not reported live',
+  () =>
+    Effect.gen(function* () {
+      const probe = makeProbe()
+      const app = makeAppRuntime(auditScene(probe))
+      yield* Effect.addFinalizer(() => Effect.sync(() => app.dispose()))
+
+      // Every listener/handler is attached before anything is awaited.
+      const owner = { live: 0, failed: 0 }
+      const control = { live: 0, failed: 0 }
+      const orphan = { live: 0, failed: 0 }
+      // The owner's handle, captured as a closure so its exact `RuntimeHandle<...>`
+      // type is kept without restating it.
+      const mountOrphan = { run: Option.none<() => void>() }
+
+      const disposeOwner = app.mountFeature(OwnerNative.binding, {
+        onLive: (ownerRuntime) => {
+          owner.live += 1
+          mountOrphan.run = Option.some(() => {
+            ownerRuntime.mountFeature(OrphanChildNative.binding, {
+              onLive: () => {
+                orphan.live += 1
+              },
+              onFailed: () => {
+                orphan.failed += 1
+              },
+            })
+          })
+        },
+        onFailed: () => {
+          owner.failed += 1
+        },
+      })
+
+      // CONTROL — the same child module, same mount call, mounted on an owner scope
+      // that is open (the runtime's own root). It goes live and STAYS live: its
+      // resource is acquired and not released.
+      app.mountFeature(ControlChildNative.binding, {
+        onLive: () => {
+          control.live += 1
+        },
+        onFailed: () => {
+          control.failed += 1
+        },
+      })
+
+      yield* until(
+        () => owner.live + control.live + owner.failed + control.failed,
+        (n) => n >= 2,
+        ROUNDS,
+      )
+      expect(owner).toEqual({ live: 1, failed: 0 })
+      expect(control).toEqual({ live: 1, failed: 0 })
+      expect(probe.acquired.slice().sort()).toEqual(['control-child', 'owner'])
+      expect(probe.released).toEqual([])
+
+      // CONTROL — the owner's own disposer closes the owner's scope, and only it.
+      disposeOwner()
+      yield* until(
+        () => probe.released.length,
+        (n) => n >= 1,
+        ROUNDS,
+      )
+      yield* flush()
+      expect(probe.released).toEqual(['owner'])
+
+      // THE DEFECT — the host still holds the owner's handle and mounts through it.
+      // The handle's owner scope is closed, so this mount can own nothing.
+      Option.match(mountOrphan.run, {
+        onNone: () => undefined,
+        onSome: (run) => run(),
+      })
+      yield* until(
+        () => orphan.live + orphan.failed,
+        (n) => n >= 1,
+        ROUNDS,
+      )
+      yield* flush()
+
+      // A mount the runtime cannot own must not acquire resources it will release
+      // in the same breath...
+      expect(probe.acquired).not.toContain('orphan-child')
+      // ...and must not be reported live. `onFailed` (or the same silent no-op the
+      // `status.disposed` guard gives) is the honest answer; `onLive` is not.
+      expect(orphan.live).toBe(0)
+    }),
+)
+
+// ---------------------------------------------------------------------------
+// FINDING 2 — runtime/capturedAppRuntime.ts, `dispose()`
+//
+// Every feature mount is now forked from ONE `rootScope`, and `dispose()` closes
+// it with a single `Effect.runFork(Scope.close(rootScope, ...))`. `rootScope` is
+// `Scope.make()`, i.e. `ExecutionStrategy.sequential`, so its finalizers — one
+// `childScope.close(exit)` per mount — run one after another, each awaiting the
+// previous. Sibling mounts are independent, and a finalizer that has not finished
+// is not a defect: a flush, a socket close, a queue drain all take a turn. One
+// such finalizer now withholds the teardown of every OTHER mount for as long as
+// it runs, and forever if it never completes.
+//
+// The mounts that carry their own disposer (`mountScoped`, through
+// `activationDisposers`) each get their own `Effect.runFork` and are unaffected;
+// features have no disposer of their own on this path, so they are exactly the
+// ones that serialize. `Scope.fork`'s strategy argument governs how a mount's OWN
+// finalizers run (sequential/LIFO is right there); what serializes siblings is
+// the strategy of the scope they are forked FROM.
+// ---------------------------------------------------------------------------
+
+const parkedFeature = (latch: Deferred.Deferred<void>) =>
+  class ParkedFeature extends Feature.make('audit4.parked', {
+    composition: AuditComp,
+    module: featureModule([LifecycleProbe], Layer.merge(AuditLive, parkedMark('parked', latch))),
+  }) {}
+
+class TidyFeature extends Feature.make('audit4.tidy', {
+  composition: AuditComp,
+  module: featureModule([LifecycleProbe], Layer.merge(AuditLive, scopedMark('tidy'))),
+}) {}
+const TidyNative = Feature.tree<typeof TidyFeature>(TidyFeature.token)
+
+it.scopedLive(
+  'dispose(): one mount whose finalizer has not finished does not withhold the others',
+  () =>
+    Effect.gen(function* () {
+      // ---- CONTROL: `tidy` mounted SECOND, so the root closes it FIRST ---------
+      // Same scene, same two features, same `dispose()` — only the order the two
+      // mounts were registered in differs. `tidy` releases promptly, which proves
+      // the harness, the probe and `dispose()`'s reach are all working, and pins the
+      // difference below to teardown order alone.
+      const controlLatch = yield* Deferred.make<void>()
+      const ControlParked = parkedFeature(controlLatch)
+      const ControlParkedNative = Feature.tree<typeof ControlParked>(ControlParked.token)
+      const controlProbe = makeProbe()
+      const controlApp = makeAppRuntime(auditScene(controlProbe))
+      yield* Effect.addFinalizer(() =>
+        Effect.sync(() => controlApp.dispose()).pipe(
+          Effect.zipRight(Effect.asVoid(Deferred.succeed(controlLatch, undefined))),
+        ),
+      )
+      const controlFailures: Array<string> = []
+      controlApp.mountFeature(ControlParkedNative.binding, {
+        onLive: () => undefined,
+        onFailed: () => controlFailures.push('parked'),
+      })
+      controlApp.mountFeature(TidyNative.binding, {
+        onLive: () => undefined,
+        onFailed: () => controlFailures.push('tidy'),
+      })
+      yield* until(
+        () => controlProbe.acquired.length,
+        (n) => n >= 2,
+        ROUNDS,
+      )
+      expect(controlFailures).toEqual([])
+      expect(controlProbe.acquired.slice().sort()).toEqual(['parked', 'tidy'])
+
+      controlApp.dispose()
+      yield* until(
+        () => controlProbe.released.length,
+        (n) => n >= 1,
+        ROUNDS,
+      )
+      yield* flush()
+      expect(controlProbe.released).toEqual(['tidy'])
+
+      // ---- THE DEFECT: `tidy` mounted FIRST, so the root closes it LAST --------
+      const latch = yield* Deferred.make<void>()
+      const Parked = parkedFeature(latch)
+      const ParkedNative = Feature.tree<typeof Parked>(Parked.token)
+      const probe = makeProbe()
+      const app = makeAppRuntime(auditScene(probe))
+      yield* Effect.addFinalizer(() =>
+        Effect.sync(() => app.dispose()).pipe(
+          Effect.zipRight(Effect.asVoid(Deferred.succeed(latch, undefined))),
+        ),
+      )
+      const failures: Array<string> = []
+      app.mountFeature(TidyNative.binding, {
+        onLive: () => undefined,
+        onFailed: () => failures.push('tidy'),
+      })
+      app.mountFeature(ParkedNative.binding, {
+        onLive: () => undefined,
+        onFailed: () => failures.push('parked'),
+      })
+      yield* until(
+        () => probe.acquired.length,
+        (n) => n >= 2,
+        ROUNDS,
+      )
+      expect(failures).toEqual([])
+      expect(probe.acquired.slice().sort()).toEqual(['parked', 'tidy'])
+
+      app.dispose()
+      yield* until(
+        () => probe.released.length,
+        (n) => n >= 1,
+        ROUNDS,
+      )
+      yield* flush()
+      // `tidy`'s finalizer is instant and owes nothing to `parked`. It is withheld
+      // for as long as `parked`'s finalizer runs.
+      expect(probe.released).toContain('tidy')
+
+      // CONTROL — opening the latch settles BOTH, which proves neither finalizer was
+      // broken or skipped: the only thing under test above is when they ran.
+      yield* Deferred.succeed(latch, undefined)
+      yield* until(
+        () => probe.released.length,
+        (n) => n >= 2,
+        ROUNDS,
+      )
+      expect(probe.released.slice().sort()).toEqual(['parked', 'tidy'])
+    }),
+)
+
+// ---------------------------------------------------------------------------
+// FINDING 3 — internal/scheduler.ts
+//
+// `schedule` takes `Iterable<() => void>` and is exported from
+// `@playfast/reform/internal` as part of the "primitive-authoring toolkit … for
+// first-party companion packages that build their own first-class Sources".
+//
+// `schedule` now snapshots with `Array.from(listeners)` AND keeps `listeners`
+// itself to re-read at flush; `isLive` then answers a non-Set source with
+// `Arr.fromIterable(source).includes(listener)`. For any one-shot iterable — the
+// `MapIterator` from `map.values()`, a `SetIterator`, a generator — the snapshot
+// drains the iterator, so the re-read at flush sees an EMPTY sequence and EVERY
+// listener of that write is judged dead and dropped. Not one wake is delivered
+// and nothing reports an error.
+//
+// The previous `[...listeners].forEach(...)` consumed the iterable exactly once,
+// so this is a regression, and it is silent: the type says `Iterable`.
+// ---------------------------------------------------------------------------
+
+const drainMicrotasks = async (turns = 5): Promise<void> => {
+  await Array.from({ length: turns }).reduce<Promise<void>>(
+    (chain) => chain.then(() => new Promise<void>((resolve) => queueMicrotask(resolve))),
+    Promise.resolve(),
+  )
+}
+
+it('scheduler: a write whose source is a one-shot iterable still wakes its listeners', async () => {
+  const woken: Array<string> = []
+  const first = (): void => void woken.push('first')
+  const second = (): void => void woken.push('second')
+
+  // CONTROL — the identical listeners, published through a Set (the hot path a
+  // store uses) and through an array literal (the shape `boundary`/`event` use).
+  // Both are delivered, which proves the scheduler, the drain and this harness.
+  const setScheduler = makeScheduler()
+  const setWoken: Array<string> = []
+  const setFirst = (): void => void setWoken.push('first')
+  setScheduler.schedule(new Set([setFirst]))
+  const arrayScheduler = makeScheduler()
+  const arrayWoken: Array<string> = []
+  const arrayFirst = (): void => void arrayWoken.push('first')
+  arrayScheduler.schedule([arrayFirst])
+
+  // THE DEFECT — the same two listeners handed over as a one-shot iterable. A
+  // registry that keeps its subscribers in a Map and publishes `map.values()` is
+  // the plainest way to write this, and it typechecks.
+  const registry = new Map<string, () => void>([
+    ['first', first],
+    ['second', second],
+  ])
+  const scheduler = makeScheduler()
+  scheduler.schedule(registry.values())
+
+  await drainMicrotasks()
+
+  expect(setWoken).toEqual(['first'])
+  expect(arrayWoken).toEqual(['first'])
+  expect(woken).toEqual(['first', 'second'])
+})

package/src/runtime/runtime.schema-identity.test.ts

@@ -0,0 +1,188 @@
+import { expect, it } from '@effect/vitest'
+import { Effect, Exit, Layer, LogLevel, Logger, Option, Schema as S } from 'effect'
+import { Engine, Event, publish, Reducer, State, StateFamily, StateGroup } from '../index'
+import { makeStore } from '../internal/store'
+import { flush, until } from '../testkit/flight.testkit'
+
+const silent = Logger.withMinimumLogLevel(LogLevel.None)
+
+// ---------------------------------------------------------------------------
+//  — reducer/reducer.ts:160 re-decodes an ALREADY-DECODED fold result.
+//
+// `event.ts:51` documents the exact hazard and dodges it with `validateSync`
+// ("decodeUnknownSync would reject transforming schemas — e.g. a real Option,
+// whose _tag lives on the prototype"). The reducer write path never got the
+// same treatment, so any State whose schema transforms (S.Option, S.Date,
+// S.BigInt, S.Set, …) makes every fold throw a ParseError. `isolateApply`
+// swallows it, so the write is lost and only a log line records it.
+// ---------------------------------------------------------------------------
+it.live('a reducer over an Option-valued State silently drops every write', () => {
+  class Selected extends State.make('identity/selected', S.Option(S.String)) {}
+  class Marker extends State.make('identity/marker', S.Number) {}
+  class Picked extends Event.make('identity/Picked', S.Struct({ id: S.String })) {}
+  class PickReducer extends Reducer.make('identity/PickReducer', {
+    states: [Selected],
+    events: [Picked],
+  }) {}
+  const PickReducerLive = Reducer.live(PickReducer, (_, event) => Option.some(event.id))
+  // A plain-schema witness folding the same event: once it moves, the frame is done.
+  class MarkReducer extends Reducer.make('identity/MarkReducer', {
+    states: [Marker],
+    events: [Picked],
+  }) {}
+  const MarkReducerLive = Reducer.live(MarkReducer, (n) => n + 1)
+
+  const TestLayer = Layer.mergeAll(PickReducerLive, MarkReducerLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(State.live(Selected, Option.none<string>()), State.live(Marker, 0), Engine),
+    ),
+  )
+
+  return Effect.gen(function* () {
+    const selected = yield* Selected.store
+    const marker = yield* Marker.store
+
+    yield* publish('High', Event.construct(Picked, { id: 'a' }))
+    yield* until(
+      () => marker.get(),
+      (n) => n === 1,
+    )
+
+    expect(selected.get()).toStrictEqual(Option.some('a'))
+  }).pipe(Effect.provide(TestLayer), silent)
+})
+
+// ---------------------------------------------------------------------------
+//  — state/stateGroup.ts:116 decodes seeds from the ENCODED side while
+// `GroupSeeds` types them as the DECODED side (`StateValue` = Schema.Type).
+// Handing the group exactly the value its type demands dies the layer.
+// ---------------------------------------------------------------------------
+it.effect('StateGroup.live dies on the very seed value its type demands', () => {
+  class Selected extends State.make('identity/group-selected', S.Option(S.String)) {}
+  class Group extends StateGroup.make(Selected) {}
+
+  return Effect.gen(function* () {
+    const exit = yield* Effect.scoped(
+      Layer.build(StateGroup.live(Group, { 'identity/group-selected': Option.some('a') })),
+    ).pipe(Effect.exit)
+
+    expect(Exit.isSuccess(exit)).toBe(true)
+  }).pipe(silent)
+})
+
+// ---------------------------------------------------------------------------
+//  — state/stateFamily.ts:74. `forget(key)` drops the entry without
+// waking anyone subscribed to it, and `at(key)` then mints a NEW store. Every
+// consumer that read the key through `readTracked` is holding the dead store:
+// it never fires again, and its value diverges from the family's forever.
+// Same shape as #22 — state that outlives the identity it was derived for.
+// ---------------------------------------------------------------------------
+it.live('forgetting a family key orphans every live subscriber of that key', () => {
+  class Items extends StateFamily.make('identity/items', S.String, S.Number) {}
+  class Marker extends State.make('identity/family-marker', S.Number) {}
+  class Bumped extends Event.make('identity/Bumped', S.Struct({ id: S.String })) {}
+  class Removed extends Event.make('identity/Removed', S.Struct({ id: S.String })) {}
+
+  class ItemsReducer extends Reducer.make('identity/ItemsReducer', {
+    family: Items,
+    keyOf: (event) => event.id,
+    events: [Bumped, Removed],
+  }) {}
+  const ItemsLive = Reducer.live(ItemsReducer, (n, event) =>
+    event._tag === Removed.tag ? StateFamily.Tombstone : n + 1,
+  )
+  class MarkReducer extends Reducer.make('identity/FamilyMarkReducer', {
+    states: [Marker],
+    events: [Bumped],
+  }) {}
+  const MarkReducerLive = Reducer.live(MarkReducer, (n) => n + 1)
+
+  const TestLayer = Layer.mergeAll(ItemsLive, MarkReducerLive).pipe(
+    Layer.provideMerge(Layer.mergeAll(StateFamily.live(Items, 0), State.live(Marker, 0), Engine)),
+  )
+
+  return Effect.gen(function* () {
+    const family = yield* Items.store
+    const marker = yield* Marker.store
+
+    // A consumer reads key 'a' once and subscribes to it — exactly what
+    // `StateFamily.read` does for a component through `readTracked`.
+    const tracked = family.at('a')
+    const wakes = { n: 0 }
+    tracked.subscribe(() => {
+      wakes.n += 1
+    })
+
+    yield* publish('High', Event.construct(Bumped, { id: 'a' }))
+    yield* until(
+      () => marker.get(),
+      (n) => n === 1,
+    )
+    yield* publish('High', Event.construct(Bumped, { id: 'a' }))
+    yield* until(
+      () => marker.get(),
+      (n) => n === 2,
+    )
+    yield* until(
+      () => wakes.n,
+      (n) => n >= 2,
+    )
+    expect(tracked.get()).toBe(2)
+    const wakesBefore = wakes.n
+
+    // Remove the key, then re-create it. What key 'a' holds is now 1, not 2.
+    yield* publish('High', Event.construct(Removed, { id: 'a' }))
+    yield* publish('High', Event.construct(Bumped, { id: 'a' }))
+    yield* until(
+      () => marker.get(),
+      (n) => n === 3,
+    )
+    // Notifications ride the same microtask flush as the write that just
+    // landed, so draining turns is exact where a duration would be a guess.
+    yield* flush()
+
+    // Key 'a' now reads 1 where the orphaned consumer still sees 2 …
+    expect(family.at('a').get()).toBe(1)
+    expect(tracked.get()).toBe(2)
+    // … and nothing ever woke that consumer to tell it.
+    expect(wakes.n).toBeGreaterThan(wakesBefore)
+  }).pipe(Effect.provide(TestLayer), silent)
+})
+
+// ---------------------------------------------------------------------------
+//  — internal/scheduler.ts:41 copies live listeners into `pending` at
+// write time, and `store.set` (internal/store.ts:34) schedules them there. An
+// unsubscribe that lands between the write and the microtask flush removes the
+// listener from the store but not from `pending`, so a torn-down subscription
+// still fires. `event.ts:113` hand-guards against exactly this with its own
+// `active` flag; nothing else does.
+// ---------------------------------------------------------------------------
+it.live('a listener unsubscribed after a write still fires on the next flush', () =>
+  Effect.gen(function* () {
+    const store = makeStore(0)
+    const witness = makeStore(0)
+    const wakes = { n: 0 }
+    const witnessWakes = { n: 0 }
+
+    const off = store.subscribe(() => {
+      wakes.n += 1
+    })
+    witness.subscribe(() => {
+      witnessWakes.n += 1
+    })
+
+    store.set(1)
+    // Teardown before the flush: the subscription is gone by the time it runs.
+    off()
+
+    // Both stores share the default scheduler, so the witness flush drains
+    // anything the first write could have queued.
+    witness.set(1)
+    yield* until(
+      () => witnessWakes.n,
+      (n) => n > 0,
+    )
+
+    expect(wakes.n).toBe(0)
+  }),
+)

package/src/state/state.ts

@@ -49,8 +49,12 @@ interface StateStatics<N extends string, A> {
   readonly name: N
   readonly capture: <Result>(visit: StateCapture<Result>) => Result
   readonly store: Context.Tag<StateStore<N, A>, Store<A>>
-  readonly decodeUnknown: (input: unknown) => Effect.Effect<A, ParseResult.ParseError, never>
-  readonly decodeUnknownSync: (input: unknown) => A
+  // Writes and seeds carry already-decoded domain values, so they are checked
+  // against the Type side. `decodeUnknownSync` would reject a transforming schema
+  // (a real Option, whose _tag lives on the prototype). Only `decodeUnknownOption`
+  // decodes — seed overrides arrive encoded, from outside the graph.
+  readonly validate: (input: unknown) => Effect.Effect<A, ParseResult.ParseError, never>
+  readonly validateSync: (input: unknown) => A
   readonly decodeUnknownOption: (input: unknown) => Option.Option<A>
 }
 
@@ -98,8 +102,8 @@ export const make = <const N extends string, StateSchema extends Schema.Schema.A
     manifest,
     name,
     store,
-    decodeUnknown: Schema.decodeUnknown(schema),
-    decodeUnknownSync: Schema.decodeUnknownSync(schema),
+    validate: Schema.validate(schema),
+    validateSync: Schema.validateSync(schema),
     decodeUnknownOption: Schema.decodeUnknownOption(schema),
     capture: <Result>(visit: StateCapture<Result>): Result => visit(state),
   })