@prestack/thread 0.0.3 → 0.1.0

package/dist/integrity/constraint.ts

@@ -1,14 +1,28 @@
 import type { Threaded } from '../core/thread.ts'
 import { named } from '../core/scope.ts'
 
+export interface Sourced {
+  readonly at: string
+  readonly source: string
+}
+
+export type Proof = string | { readonly files: readonly Sourced[]; readonly at: string }
+
+export function shown(proof: Proof): string {
+  if (typeof proof === 'string') return proof
+  const target = proof.files.find((one) => one.at === proof.at) ?? proof.files[0]
+  const beside = proof.files.filter((one) => one.at !== proof.at).map((one) => one.at)
+  return `${target?.source ?? ''}${beside.length > 0 ? ` (in a tree holding ${beside.join(', ')})` : ''}`
+}
+
 export interface Constraint extends Threaded {
   readonly version: number
   readonly where: { readonly paths: readonly string[]; readonly except?: readonly string[] }
   readonly bans: string
   readonly because: string
   readonly instead: string
-  readonly wrong: string
-  readonly right: string
+  readonly wrong: Proof
+  readonly right: Proof
   readonly governs?: string
   readonly severity?: 'forbidden' | 'warning'
 }
@@ -214,7 +228,14 @@ export const CONSTRAINTS: readonly Constraint[] = [
       '`declares` is exactly one parent ever, and with two the child\'s owner, its shape and its origin each have two answers while the tree gives none. Measured 2026-08-14: the two rows may sit in different files, so no slopnator that sees one file can find this — check-threads found it only by comparing parents across the whole descent, which is why it was a check rather than a rule. Measured 2026-08-15: this rule read `threads/` and nothing else, so a file outside the tree that declared a child the tree already declares was invisible to it — and a file outside the tree may name children, which is the whole premise `broken-lineage` rests on. It now counts parents from every file the tree reaches, not from one directory',
     instead:
       'keep the row that owns it and delete the other. If both are true, one of them is a `derives` or a `seeds`, which may have many parents because neither of them owns the child',
-    wrong: "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/one.ts',\n    },\n  ],\n}",
+    wrong: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_parented_row.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_parented_row.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/one.ts',\n    },\n  ],\n}\n" },
+      ],
+      at: 'threads/_probe_parented_row.ts',
+    },
     right: "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/two.ts',\n    },\n  ],\n}",
     cites: [{ on: '2026-08-14', said: 'Cause we need unthreaded, redthread, broken lineage, and the request/produce errors....' }],
     seeds: [
@@ -275,13 +296,19 @@ export const CONSTRAINTS: readonly Constraint[] = [
     at: './constraint.ts',
     describes: 'The refusal of a written address that is not on disk — a file moves and every sentence naming it becomes a confident lie that still reads as correct, and counting those without judging them is worse than never scanning, because the number reads as a result.',
     version: 1,
-    where: { paths: ['.'], except: ['slopnators/', '_generated/', 'thread/integrity/sealed.ts'] },
+    where: { paths: ['.'], except: ['slopnators/', '_generated/'] },
     bans: 'a string naming a path in this repository that is not on disk',
     because:
       'measured 2026-08-10: 91 distinct paths across 240 mentions named files that had moved under `packages/core/`, and every one of them read as correct. Measured 2026-08-14: paths:check scanned 505 files, found 59 more and judged none of them, printing "no findings" while holding the count — a class counted and unjudged is worse than one never scanned, because the number reads as a result',
     instead:
       'fix the path, or delete the sentence naming it. A path that carries a `{variable}` states the directory it writes into, and that directory must exist',
-    wrong: "const at = 'threads/nope.ts'",
+    wrong: {
+      files: [
+        { at: 'threads/_probe_there.ts', source: 'export const THERE = 1\n' },
+        { at: 'probe.tsx', source: "const at = 'threads/nope.ts'\n" },
+      ],
+      at: 'probe.tsx',
+    },
     right: "const at = 'packages/core/integrity/src/constraint.ts'",
     cites: [{ on: '2026-08-14', said: 'I want you to transform every single thing that currently is a check into a law, so we can retire checks and we can have SSOT for laws, and slopnators only for execution.' }],
     seeds: [
@@ -347,7 +374,13 @@ export const CONSTRAINTS: readonly Constraint[] = [
     because:
       'the gate is the commands these name, so one that package.json lacks fails as `Command "nope:check" not found` at the moment it is reached — after every step before it has already run, and only when somebody runs the gate. Measured 2026-08-14: sixteen rows name sixteen commands and nothing has ever compared them against package.json; they are correct today by nobody having mistyped one',
     instead: 'add the script to package.json, or fix the name. A row naming a command is a promise that the command exists',
-    wrong: "const M = {\n  runs: 'pnpm nope:check',\n}",
+    wrong: {
+      files: [
+        { at: 'package.json', source: '{\n  "scripts": {\n    "typecheck": "tsc"\n  }\n}\n' },
+        { at: 'threads/_probe_command.ts', source: "const M = {\n  runs: 'pnpm nope:check',\n}\n" },
+      ],
+      at: 'threads/_probe_command.ts',
+    },
     right: "const M = {\n  runs: 'pnpm typecheck',\n}",
     cites: [{ on: '2026-08-14', said: 'I think you need to study how a file gets parented and make proper error handling for everything. No at is just one.' }],
     seeds: [
@@ -379,7 +412,13 @@ export const CONSTRAINTS: readonly Constraint[] = [
       'a rule is a row and a slopnator is a function, and nothing but their names holds the two together — so either half can go missing and the other reads as working. A rule whose slopnator is absent registers, loads, reports nothing, and is indistinguishable from a rule being obeyed. A slopnator no rule names is code that runs in no gate and governs nothing, while looking like enforcement to anybody reading the directory. Measured 2026-08-15: this rule was real and enforced, but it lived as a gate step in ci.ts rather than as a rule — one more place where a guarantee could be turned off by editing a list, which is the thing the rules exist to stop. Moving it here deletes the step rather than adding a check',
     instead: 'write the rule that needs the slopnator, or delete the slopnator. `pnpm slopnator:seed` writes the scaffold for a rule that has none, and a rename is a `git mv` rather than a second file',
     wrong: "const CONSTRAINTS = [\n  {\n    id: 'nothing-names-this-slopnator',\n  },\n]",
-    right: "const CONSTRAINTS = [\n  {\n    id: 'no-comment',\n  },\n]",
+    right: {
+      files: [
+        { at: 'threads/_probe_paired.ts', source: "const CONSTRAINTS = [\n  {\n    id: 'no-comment',\n  },\n]\n" },
+        { at: 'threads/slopnators/sl_no_comment.ts', source: 'export const slopnator = { on: [], holds: () => false }\n' },
+      ],
+      at: 'threads/_probe_paired.ts',
+    },
     cites: [
       { on: '2026-08-14', said: 'A law is written, names a slopnator. Slopnator is seeded magically. Someone write the function. An enforcer picks it up and it just works.' },
       { on: '2026-08-15', said: 'Does a slopnator without a law or a law without a slopnator exist? This should be an error....' },
@@ -413,7 +452,14 @@ export const CONSTRAINTS: readonly Constraint[] = [
       'the glossary is derived: a word\'s meaning is the `describes` on the row that coins it, so a word coined twice with two descriptions has two meanings and the file can hold one. Repetition is not the defect — measured 2026-08-15, the tree coins `slopnator` on twelve rows and `trial` on twelve, deliberately, because the founder asked for the category in the glossary rather than each instance under its own name. Disagreement is the defect: those same twelve rows each stated a different sentence, so the tree asserted twelve meanings for one word and nothing looked. Five words were split this way — `slopnator`, `trial`, `ci`, `build` and `glossary` — and three of them were the same sentence written twice, which is the SSOT failure wearing a second coat',
     instead:
       'state the category meaning on every row that coins the word, because the word is what the row names. Where two rows describe the same file from different heights, the row that declares it wins and the node repeats it. Where a row needs to say something only true of its own instance, it needs its own id — and if you do not want that word in the glossary, the sentence does not belong on the row',
-    wrong: "const M: Threaded = {\n  declares: [\n    {\n      id: 'one',\n      describes: 'The first thing.',\n    },\n    {\n      id: 'one',\n      describes: 'A different thing entirely.',\n    },\n  ],\n}",
+    wrong: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_meant_row.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_meant_row.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  declares: [\n    {\n      id: 'one',\n      describes: 'The first thing.',\n    },\n    {\n      id: 'one',\n      describes: 'A different thing entirely.',\n    },\n  ],\n}\n" },
+      ],
+      at: 'threads/_probe_meant_row.ts',
+    },
     right: "const M: Threaded = {\n  declares: [\n    {\n      id: 'one',\n      describes: 'The first thing.',\n    },\n    {\n      id: 'one',\n      describes: 'The first thing.',\n    },\n  ],\n}",
     cites: [
       { on: '2026-08-15', said: 'the ids thing. We can\'t have that, the id\'s being the same.' },
@@ -592,8 +638,24 @@ export const CONSTRAINTS: readonly Constraint[] = [
       'measured 2026-08-25: nothing anywhere holds a dispatched name against a declaration. `packages/ui/src/bindings.tsx` exposes `run(workflow: string, input?)`, and that workflow is a bare string passed to a context the UI package never sees — so a name that matches no operation reaches the browser and fails at whatever the host does with an unknown id. The second half is measured from the other side: `dispatch` in packages/core/operations/src/dispatch.ts takes an Operation object rather than a name, so no shipped call site names an operation as a string at all, and the only place a name was written down was that `run`. Measured again the same day, after `packages/ui/src/bindings.tsx` was deleted: `dispatch` is now a seam on the UI config, named once, handed a name — so from here on a dispatched name is always written where it can be read, and this rule is what holds it to a declaration. A name assembled at runtime is the same hole with a lid on it — it reads from every check exactly like a name that was checked and found',
     instead:
       'write the name where it can be read, and declare the operation it names — `dispatch(\'wf_send_invoice\')` against a row whose `at` is `operations/wf_send_invoice.ts`. Where the name genuinely varies, the choosing belongs in the declaration, not in a template string',
-    wrong: "dispatch('wf_not_declared')",
-    right: "dispatch('wf_send_invoice')",
+    wrong: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_operations.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_operations.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  declares: [\n    {\n      id: 'wf_send_invoice',\n      at: 'operations/wf_send_invoice.ts',\n    },\n  ],\n}\n" },
+        { at: 'app/_probe_wrong.tsx', source: "dispatch('wf_not_declared')" },
+      ],
+      at: 'app/_probe_wrong.tsx',
+    },
+    right: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_operations.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_operations.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  declares: [\n    {\n      id: 'wf_send_invoice',\n      at: 'operations/wf_send_invoice.ts',\n    },\n  ],\n}\n" },
+        { at: 'app/_probe_right.tsx', source: "dispatch('wf_send_invoice')" },
+      ],
+      at: 'app/_probe_right.tsx',
+    },
     cites: [
       { on: '2026-08-25', said: 'And make sure the composition can only dispatch existing operations.' },
       { on: '2026-08-25', said: 'Yes — reading a view is dispatching too' },
@@ -629,8 +691,24 @@ export const CONSTRAINTS: readonly Constraint[] = [
       'measured 2026-08-25: the founder wrote `<Button.primary text="translation.key" />` as the shape a composition takes, and the fourteen variants in packages/ui/src/variants.ts hold no row `primary` — the one that fits is `button-primary`. `element()` in packages/ui/src/wrappers.tsx resolves any member through a proxy, so that call renders a button carrying the class `thread-primary`, which the stylesheet generator never writes because no variant of that name exists to write it from. It renders, it is unstyled, and nothing in the repository says a word. The pairing half is the same hole from the other side: `card` declares fifteen elements that wear it and `Button` is not among them, and nothing stops `<Button.card />` either. Both are the silent-pass shape — a check reporting success because it measured nothing',
     instead:
       'declare the variant, and name the element in that row\'s `wears` — the row is what makes the pairing legal, which is why `<Button.buttonPrimary />` holds and `<Button.primary />` does not',
-    wrong: '<Button.primary />',
-    right: '<Button.buttonPrimary />',
+    wrong: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_worn.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_worn.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const ELEMENTS: Threaded = {\n  id: 'element',\n  declares: [\n    {\n      id: 'button',\n      at: 'app/_probe_button.tsx',\n    },\n  ],\n}\n\nexport const VARIANTS: Threaded = {\n  id: 'variant',\n  declares: [\n    {\n      id: 'button-primary',\n      at: 'app/_probe_variant.ts',\n      wears: ['Button'],\n    },\n  ],\n}\n" },
+        { at: 'app/_probe_wrong.tsx', source: '<Button.primary />' },
+      ],
+      at: 'app/_probe_wrong.tsx',
+    },
+    right: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_worn.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_worn.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const ELEMENTS: Threaded = {\n  id: 'element',\n  declares: [\n    {\n      id: 'button',\n      at: 'app/_probe_button.tsx',\n    },\n  ],\n}\n\nexport const VARIANTS: Threaded = {\n  id: 'variant',\n  declares: [\n    {\n      id: 'button-primary',\n      at: 'app/_probe_variant.ts',\n      wears: ['Button'],\n    },\n  ],\n}\n" },
+        { at: 'app/_probe_right.tsx', source: '<Button.buttonPrimary />' },
+      ],
+      at: 'app/_probe_right.tsx',
+    },
     cites: [
       { on: '2026-08-25', said: 'Variants themselves declare what elements they relate to, in their declarations. Then the composition says button.primary and if that matches the combination of variant and element it\'s acceptable.' },
       { on: '2026-08-25', said: 'If there\'s no primary variant.....that\' an error moron. Didn\'t I said that it can\'t name a variant that doesn\'t exist?' },
@@ -702,8 +780,22 @@ export const CONSTRAINTS: readonly Constraint[] = [
       'a member is added by declaring it and then written, never the other way round — the same order a rule follows to its slopnator, and for the same reason: the row is what everything downstream reads, so a file that arrived without one is a thing the runtime, the API, the agent tools and the trials have all never heard of, while it sits there able to act. The two halves are held together by nothing but a name, so either can go missing and the other reads as working. Absence is the finding in both directions because there is no third place to look: the rows are what exists, the folder is what was written, and any gap between them is one somebody has to close on purpose. The rule reaches by shape and not by name — it reads every island that seeds its members from the tree, so an island added tomorrow is governed without editing this row',
     instead:
       'add the row to the island\'s tree file first and run `pnpm member:seed`, which writes the file that row brings into existence — then write the member into the template it left',
-    wrong: "export const OPERATIONS: readonly Member[] = [\n  {\n    id: 'wf_nothing_seeded_this',\n  },\n]",
-    right: "export const OPERATIONS: readonly Member[] = []",
+    wrong: {
+      files: [
+        { at: 'threads/thread.ts', source: "export const THREAD: Threaded = {\n  declares: [\n    { id: 'operations', at: 'src/islands/operations.ts', governs: ['operations/'] },\n    { id: 'operation', at: 'threads/operations.ts' },\n  ],\n}\n" },
+        { at: 'src/islands/operations.ts', source: 'export const OperationsIslandSchema = {}\n' },
+        { at: 'threads/operations.ts', source: "export const OPERATIONS: readonly Threaded[] = [\n  {\n    id: 'wf_nothing_seeded_this',\n  },\n]\n" },
+      ],
+      at: 'threads/operations.ts',
+    },
+    right: {
+      files: [
+        { at: 'threads/thread.ts', source: "export const THREAD: Threaded = {\n  declares: [\n    { id: 'operations', at: 'src/islands/operations.ts', governs: ['operations/'] },\n    { id: 'operation', at: 'threads/operations.ts' },\n  ],\n}\n" },
+        { at: 'src/islands/operations.ts', source: 'export const OperationsIslandSchema = {}\n' },
+        { at: 'threads/operations.ts', source: 'export const OPERATIONS: readonly Threaded[] = []\n' },
+      ],
+      at: 'threads/operations.ts',
+    },
     cites: [
       { on: '2026-08-17', said: 'FIRST we add the new row in workflows.ts, which seeds a new wf_{id} file in a workflows folder.' },
       { on: '2026-08-17', said: 'The file is not authored but seeded. We can write the operation after, but it must have a template with instructions maybe of how to build. Like slopnators.' },
@@ -771,7 +863,14 @@ export const CONSTRAINTS: readonly Constraint[] = [
     because:
       'the loader opens the paths an island governs and nothing else, so a declaration written beside the code that needs it is not a smaller declaration — it is no declaration, and every surface downstream reports success over it: it typechecks, the editor completes it, and the generator emits nothing. This is one rule rather than one per island because the rule never differed — measured 2026-08-17: the same sentence was written eleven times, and the island-to-path fact it depends on appeared 130 times across 56 authored files, so eleven copies of a rule drifted against a fact stated everywhere. Here the island states what it governs once, and the slopnator reads it. The call it looks for is read out of the island itself rather than derived from its name, because no convention survives contact with the real set: `sql` exposes `defineSqlFunctions` and `navigation` exposes `defineMap`. An island that governs only folders is one whose kind is derived and authored nowhere, so the call is refused everywhere — which is what `AUTHORED_MAP` did for the map at build.ts:150, now stated on the island instead of in the CLI',
     instead: 'declare it in the file the island governs, and import it where it is needed',
-    wrong: "export default definePermissions({ specVersion: 1, entities: [{ entity: 'ent_order' }] })",
+    wrong: {
+      files: [
+        { at: 'threads/thread.ts', source: "export const THREAD: Threaded = {\n  declares: [\n    { id: 'permissions', at: 'threads/_island_permissions.ts', governs: ['app/_declare/permissions.ts'] },\n  ],\n}\n" },
+        { at: 'threads/_island_permissions.ts', source: 'export const PermissionsIslandSchema = {}\nexport function definePermissions() {}\n' },
+        { at: 'probe.tsx', source: "export default definePermissions({ specVersion: 1, entities: [{ entity: 'ent_order' }] })\n" },
+      ],
+      at: 'probe.tsx',
+    },
     right: "import permissions from 'app/_declare/permissions'",
     cites: [
       { on: '2026-08-17', said: 'If there\'s something that is govern by an island but it\'s propelry done through island, error.' },
@@ -805,8 +904,20 @@ export const CONSTRAINTS: readonly Constraint[] = [
     because:
       'what an island governs is the one fact about it that nothing else can supply. It is not derivable from the island\'s name — measured 2026-08-17: `navigation` governs `app/screens/` and its schema lives in `map.ts`, and `sql` exposes `defineSqlFunctions`, so two of thirteen break any convention a generator could apply. Stated as nothing, the rule that refuses a declaration elsewhere has no elsewhere to refuse: no file is the place its kind belongs, which makes every file the place. The island still parses, still typechecks, still appears in the tree, and governs nobody — inert rather than absent, which is the harder kind to notice',
     instead: 'state what the island governs — a file where its kind is declared, or a folder whose implementation it governs',
-    wrong: "const M: Islanding = { declares: [{ id: 'events', at: 'packages/core/spec/src/islands/events.ts' }] }",
-    right: "const M: Islanding = { declares: [{ id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['app/_declare/events.ts'] }] }",
+    wrong: {
+      files: [
+        { at: 'threads/_inert_probe.ts', source: "export const M: Threaded = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts' },\n  ],\n}\n" },
+        { at: 'packages/core/spec/src/islands/events.ts', source: 'export const EventsIslandSchema = {}\n' },
+      ],
+      at: 'threads/_inert_probe.ts',
+    },
+    right: {
+      files: [
+        { at: 'threads/_inert_probe.ts', source: "export const M: Threaded = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['app/_declare/events.ts'] },\n  ],\n}\n" },
+        { at: 'packages/core/spec/src/islands/events.ts', source: 'export const EventsIslandSchema = {}\n' },
+      ],
+      at: 'threads/_inert_probe.ts',
+    },
     cites: [
       { on: '2026-08-17', said: 'An island extends threader. It declares what it governs.' },
       { on: '2026-08-17', said: 'If there\'s an island that doesn\'t state what it governs, error.' },
@@ -875,7 +986,14 @@ export const CONSTRAINTS: readonly Constraint[] = [
     instead:
       'name an island the tree declares, or drop the `governs` — a rule about a kind nobody can declare is a rule about nothing',
     wrong: "export const L: Constraint = {\n  id: 'a-rule',\n  governs: 'no-island-by-this-name',\n}",
-    right: "export const L: Constraint = {\n  id: 'a-rule',\n  governs: 'entities',\n}",
+    right: {
+      files: [
+        { at: 'threads/thread.ts', source: "export const THREAD: Threaded = {\n  declares: [\n    { id: 'entities', at: 'threads/_island_entities.ts', governs: ['app/_declare/entities.ts'] },\n  ],\n}\n" },
+        { at: 'threads/_island_entities.ts', source: 'export const EntitiesIslandSchema = {}\nexport function defineEntities() {}\n' },
+        { at: 'threads/_probe_governed.ts', source: "export const L: Constraint = {\n  id: 'a-rule',\n  governs: 'entities',\n}\n" },
+      ],
+      at: 'threads/_probe_governed.ts',
+    },
     cites: [
       { on: '2026-08-16', said: 'Here\'s a new law I need you to add: No island without law.' },
       { on: '2026-08-16', said: 'So also we need a "law doesn\'t match island" if this is to be done entirely by hand so we catch drifts.' },
@@ -1045,8 +1163,24 @@ export const CONSTRAINTS: readonly Constraint[] = [
     because:
       'measured 2026-08-22: `OperationNode` stated `node` as a bare string, so a body naming `nd_teleport` compiled, loaded and dispatched, and nothing anywhere compared that name against a declared node. The first reading of this rule matched that string. Measured again 2026-08-26, after a node began building its own span: an operation writes no such string any more — it imports a node and calls it — so the reading matched nothing on any real file, and its own proofs were written in the same retired shape, so it passed its trial while measuring nothing. Both halves drifted together, which is the only way a rule goes quiet without anybody noticing. Proved by planting a node body no row declares and running a real app: it ran, answered `ok`, and the sweep named the file for being unthreaded and said nothing about the operation built from it. What an operation says today is the import it reaches its node through, so that is what is read — resolved to a path and checked against the descent, which also catches an import that resolves to nothing at all, where the only other answer was a module-not-found at run time. Measured a third time the same day, an hour after that reading shipped: it matched `import … from` and nothing else, so `await import(...)`, `require(...)` and `export … from` each walked through it, each tried against a real tree and each unremarked. Twice now this rule has enumerated a form instead of stating its rule, which is how a refusal ends up being a list of whatever somebody happened to try. The rule is about the PATH: a string that resolves under `nodes/` names a node, and a node the descent never reaches is a step nobody agreed to — whether it arrives by import, by require, by re-export, or sitting in a const waiting to be used',
     instead: 'declare the node in the tree and then build from it. What an app can be asked to do grows by declaring a node, never by importing a file nothing brought into existence',
-    wrong: "import { node as ghost } from '../nodes/nd_ghost.ts'",
-    right: "import { node as read } from '../nodes/nd_read.ts'",
+    wrong: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_nodes.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_nodes.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const NODES: Threaded = {\n  id: 'nodes',\n  declares: [\n    {\n      id: 'read',\n      at: 'nodes/nd_read.ts',\n    },\n  ],\n}\n" },
+        { at: 'operations/_probe_wrong.ts', source: "import { node as ghost } from '../nodes/nd_ghost.ts'" },
+      ],
+      at: 'operations/_probe_wrong.ts',
+    },
+    right: {
+      files: [
+        { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+        { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_nodes.ts',\n    },\n  ],\n}\n" },
+        { at: 'threads/_probe_nodes.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const NODES: Threaded = {\n  id: 'nodes',\n  declares: [\n    {\n      id: 'read',\n      at: 'nodes/nd_read.ts',\n    },\n  ],\n}\n" },
+        { at: 'operations/_probe_right.ts', source: "import { node as read } from '../nodes/nd_read.ts'" },
+      ],
+      at: 'operations/_probe_right.ts',
+    },
     cites: [
       { on: '2026-08-22', said: 'Operations are bilt of nodes, only nodes that are declared.' },
       { on: '2026-08-22', said: 'That\'s why it grows. We declare, operations can do more.' },
@@ -1080,8 +1214,26 @@ export const CONSTRAINTS: readonly Constraint[] = [
     because:
       'measured 2026-08-24: a prefix is not bound to a file. Both tree files export a list called `MEMBERS`, both are arrays of rows carrying a string id, and nothing in TypeScript or in any check separated them — a node id placed in the operations list typechecked, attached, seeded a body and read as agreed, and an operation id placed in the nodes list did the same. The prefix is the only thing that says which of the two a row is, and it was decoration. Measured again 2026-08-25, after the first reading of this was deleted for a different reason: the same gap was still open, and the founder named it as one of five mismatches against their stated requirements. Depth is what the reading turns on — a member row states its own id, and the `seeds` and `derives` rows beneath it state theirs, which are bodies rather than operations or nodes, so `wf_send_invoice_body` carries no prefix and must not be refused for it. Only rows sitting directly in the list are read',
     instead: 'name the row for what it is. An operation is `wf_`, `vw_` or `agt_` and belongs in the operations tree; a node is `nd_` and belongs in the nodes tree. A row in the wrong list is not a naming slip, it is a declaration of the wrong thing',
-    wrong: "export const MEMBERS: readonly Member[] = [\n  {\n    id: 'nd_teleport',\n    at: '_threads/operations.ts',\n    describes: 'a node wearing an operation list',\n    version: 1,\n  },\n]",
-    right: "export const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_send_invoice',\n    at: '_threads/operations.ts',\n    describes: 'sends an invoice',\n    version: 1,\n  },\n]",
+    wrong: {
+      files: [
+        {
+          at: 'threads/operations.ts',
+          source:
+            "export const MEMBERS: readonly Member[] = [\n  {\n    id: 'nd_teleport',\n    at: '_threads/operations.ts',\n    describes: 'a node wearing an operation list',\n    version: 1,\n  },\n]\n",
+        },
+      ],
+      at: 'threads/operations.ts',
+    },
+    right: {
+      files: [
+        {
+          at: 'threads/operations.ts',
+          source:
+            "export const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_send_invoice',\n    at: '_threads/operations.ts',\n    describes: 'sends an invoice',\n    version: 1,\n  },\n]\n",
+        },
+      ],
+      at: 'threads/operations.ts',
+    },
     cites: [
       { on: '2026-08-24', said: 'operations.ts, where it declares nodes.ts and dispatch.ts, and member rows in operations are wf_,vw_ and agt_ files.' },
       { on: '2026-08-25', said: '3 fix it please.' },

package/dist/integrity/generators/compiler.js

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { readdirSync, readFileSync, writeFileSync } from "../../core/files.js";
 import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
 import { argv, execPath, stderr, stdout } from 'node:process';

package/dist/integrity/generators/compiler.ts

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process'
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { readdirSync, readFileSync, writeFileSync } from '../../core/files.ts'
 import { createRequire } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
 import { argv, execPath, stderr, stdout } from 'node:process'

package/dist/integrity/generators/gate.js

@@ -1,26 +1,19 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { readFileSync as bytesAt } from 'node:fs';
+import { join } from 'node:path';
 import { argv, execPath, stderr, stdout } from 'node:process';
-import { pathToFileURL } from 'node:url';
 import { descend } from "../../core/descend.js";
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "../../core/files.js";
 import { LOADER, exit } from "../../core/invoked.js";
+import { valuesIn } from "../../core/rows.js";
 import { ORGANISATION, ours } from "../../core/scope.js";
 import { findTree, inTree } from "../../core/tree.js";
 const TREE = findTree();
 const ROOT = TREE.at;
 const STEP_TIMEOUT = 600_000;
-const { GATE } = (await import(__rewriteRelativeImportExtension(pathToFileURL(inTree(TREE, 'gate.ts')).href)));
-const { GENERATORS } = (await import(__rewriteRelativeImportExtension(pathToFileURL(inTree(TREE, 'derivation.ts')).href)));
+const { GATE } = valuesIn(readFileSync(inTree(TREE, 'gate.ts')));
+const { GENERATORS } = valuesIn(readFileSync(inTree(TREE, 'derivation.ts')));
 function refuse(why) {
     stderr.write(`gate: ${why}\n`);
     exit(1);
@@ -51,7 +44,7 @@ function steps() {
 const writers = [
     ...rowsOf(GATE.declares),
     ...rowsOf(GENERATORS),
-    ...[...walked.threaded.values()].flat().filter((one) => one.list === 'declares').map((one) => one.row),
+    ...[...walked.threaded.values()].flat().filter((one) => one.list === 'declares' && one.row.by === undefined).map((one) => one.row),
     ...[...walked.stated.values()].map((one) => one),
 ];
 const written = new Map();
@@ -127,7 +120,7 @@ function fingerprint() {
     const hash = (at) => {
         if (!existsSync(join(ROOT, at)))
             return;
-        of[at] = createHash('sha256').update(readFileSync(join(ROOT, at))).digest('hex').slice(0, 16);
+        of[at] = createHash('sha256').update(bytesAt(join(ROOT, at))).digest('hex').slice(0, 16);
     };
     const sheets = join(ROOT, '_threads');
     if (existsSync(sheets)) {
@@ -155,7 +148,6 @@ function fingerprint() {
 const RECEIPT_AT = join('.thread', 'gate.json');
 const RECEIPT = join(ROOT, RECEIPT_AT);
 if (failed.length === 0 && dropped.length === 0) {
-    mkdirSync(dirname(RECEIPT), { recursive: true });
     writeFileSync(RECEIPT, `${JSON.stringify({ passed: chosen.length, ...fingerprint() }, null, 2)}\n`, 'utf8');
     stdout.write(`gate: wrote ${RECEIPT_AT} — what compiles is checked against this, so a tree that skipped the gate does not build.\n`);
 }

package/dist/integrity/generators/gate.ts

@@ -1,11 +1,13 @@
 import { spawnSync } from 'node:child_process'
 import { createHash } from 'node:crypto'
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { readFileSync as bytesAt } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { argv, execPath, stderr, stdout } from 'node:process'
-import { fileURLToPath, pathToFileURL } from 'node:url'
+import { fileURLToPath } from 'node:url'
 import { descend } from '../../core/descend.ts'
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from '../../core/files.ts'
 import { LOADER, exit } from '../../core/invoked.ts'
+import { valuesIn } from '../../core/rows.ts'
 import { ORGANISATION, ours } from '../../core/scope.ts'
 import { findTree, inTree } from '../../core/tree.ts'
 
@@ -14,8 +16,8 @@ const ROOT = TREE.at
 
 const STEP_TIMEOUT = 600_000
 
-const { GATE } = (await import(pathToFileURL(inTree(TREE, 'gate.ts')).href)) as { GATE: { derives?: unknown; declares?: unknown } }
-const { GENERATORS } = (await import(pathToFileURL(inTree(TREE, 'derivation.ts')).href)) as { GENERATORS: readonly Record<string, unknown>[] }
+const { GATE } = valuesIn(readFileSync(inTree(TREE, 'gate.ts'))) as { GATE: { derives?: unknown; declares?: unknown } }
+const { GENERATORS } = valuesIn(readFileSync(inTree(TREE, 'derivation.ts'))) as { GENERATORS: readonly Record<string, unknown>[] }
 
 function refuse(why: string): never {
   stderr.write(`gate: ${why}\n`)
@@ -66,7 +68,7 @@ function steps(): readonly Step[] {
 const writers: readonly Row[] = [
   ...rowsOf(GATE.declares),
   ...rowsOf(GENERATORS),
-  ...[...walked.threaded.values()].flat().filter((one) => one.list === 'declares').map((one) => one.row as Row),
+  ...[...walked.threaded.values()].flat().filter((one) => one.list === 'declares' && (one.row as Row).by === undefined).map((one) => one.row as Row),
   ...[...walked.stated.values()].map((one) => one as Row),
 ]
 
@@ -156,7 +158,7 @@ function fingerprint(): { readonly of: Record<string, string>; readonly versions
   const of: Record<string, string> = {}
   const hash = (at: string): void => {
     if (!existsSync(join(ROOT, at))) return
-    of[at] = createHash('sha256').update(readFileSync(join(ROOT, at))).digest('hex').slice(0, 16)
+    of[at] = createHash('sha256').update(bytesAt(join(ROOT, at))).digest('hex').slice(0, 16)
   }
   const sheets = join(ROOT, '_threads')
   if (existsSync(sheets)) {
@@ -182,7 +184,6 @@ const RECEIPT_AT = join('.thread', 'gate.json')
 const RECEIPT = join(ROOT, RECEIPT_AT)
 
 if (failed.length === 0 && dropped.length === 0) {
-  mkdirSync(dirname(RECEIPT), { recursive: true })
   writeFileSync(RECEIPT, `${JSON.stringify({ passed: chosen.length, ...fingerprint() }, null, 2)}\n`, 'utf8')
   stdout.write(`gate: wrote ${RECEIPT_AT} — what compiles is checked against this, so a tree that skipped the gate does not build.\n`)
 } else if (existsSync(RECEIPT)) {

package/dist/integrity/generators/publish.js

@@ -1,16 +1,9 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from "../../core/files.js";
+import { valuesIn } from "../../core/rows.js";
 import { join } from 'node:path';
 import { argv, env, execPath, stderr, stdout } from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { TYPED } from "../../core/answers.js";
 import { CLI, exit } from "../../core/invoked.js";
 import { named } from "../../core/scope.js";
 import { findTree, inTree } from "../../core/tree.js";
@@ -31,11 +24,6 @@ const CHECKS = [
         runs: 'pnpm exec eslint .',
         because: 'the rules that live on the lint surface, which is the only one carrying a fixer the sweep can report but not repair',
     },
-    {
-        id: 'seal',
-        runs: 'pnpm seal:check',
-        because: 'the package must be the bytes it says it is. CHECKED and never regenerated, because a release that rewrites its own seal can never fail it',
-    },
 ];
 const MINE = /^(?:npx |pnpm )?thread /;
 function run(what, extra) {
@@ -79,7 +67,7 @@ const TOKEN = 'sec_registry_token';
 const PRODUCTION = 'production';
 const secrets = inTree(TREE, 'secrets.ts');
 const declared = existsSync(secrets)
-    ? ((await import(__rewriteRelativeImportExtension(pathToFileURL(secrets).href))).SECRETS ?? [])
+    ? (valuesIn(readFileSync(secrets)).SECRETS ?? [])
     : [];
 const vaulted = declared.some((one) => one.id === TOKEN);
 if (vaulted && !sealedIn(ROOT, PRODUCTION).includes(TOKEN)) {
@@ -108,10 +96,10 @@ stdout.write(vaulted
     ? `publish: ${TOKEN} is declared and sealed for ${PRODUCTION}. It is opened only after every check passes, and handed to pnpm as its auth setting for ${registry}.\n`
     : `publish: no row declares ${TOKEN}, so this publish uses ${signedAs}. Declare it with \`thread create secret\` to publish with a token sealed in this repository instead.\n`);
 stdout.write('publish: deriving and building what the packaging rows state first, so every check below reads the files this release ships rather than the source they were written from.\n');
-const made = run('npx thread packaged --build');
+const made = run(`${TYPED} packaged --build`);
 stdout.write(`publish: packaged exited ${String(made)}\n`);
 if (made !== 0) {
-    refuse('packaged', made, 'a package whose manifest and release note are not what its rows state would go out describing itself as something nobody declared, and one that did not compile would go out promising files it does not have', 'npx thread packaged --build');
+    refuse('packaged', made, 'a package whose manifest and release note are not what its rows state would go out describing itself as something nobody declared, and one that did not compile would go out promising files it does not have', `${TYPED} packaged --build`);
 }
 stdout.write(`\npublish: ${String(CHECKS.length)} check(s) stand between this tree and ${registry}. Any one of them stops it.\n`);
 for (const check of CHECKS)
@@ -124,32 +112,32 @@ for (const [index, check] of CHECKS.entries()) {
     if (code !== 0)
         refuse(check.id, code, check.because, check.runs);
 }
-const numbered = run('npx thread packaged --release');
+const numbered = run(`${TYPED} packaged --release`);
 stdout.write(`publish: packaged --release exited ${String(numbered)}\n`);
 if (numbered !== 0) {
-    refuse('packaged', numbered, 'the next release number is written onto the manifests only once every check has passed, and writing it refused, so nothing here carries a number to go out under', 'npx thread packaged --release');
+    refuse('packaged', numbered, 'the next release number is written onto the manifests only once every check has passed, and writing it refused, so nothing here carries a number to go out under', `${TYPED} packaged --release`);
 }
 const handed = vaulted ? { [setting()]: await tokened() } : undefined;
 stdout.write(`\npublish: every check passed. Publishing to ${registry} with ${vaulted ? `${TOKEN} from this repository's vault` : signedAs}.\n`);
 const sent = run(`pnpm -r publish --registry ${registry} --no-git-checks --access public`, handed);
 if (sent !== 0) {
     stderr.write(`\npublish: the checks passed and the publish itself exited ${String(sent)}.\n`);
-    const back = run('npx thread packaged');
+    const back = run(`${TYPED} packaged`);
     stderr.write(back === 0
         ? 'publish: the manifests carry the last recorded release again and no note was written, so the next `thread publish` numbers this release once more.\n'
-        : 'publish: the manifests still carry the number that did not go out. Run `npx thread packaged` to put the last recorded release back.\n');
+        : `publish: the manifests still carry the number that did not go out. Run \`${TYPED} packaged\` to put the last recorded release back.\n`);
     exit(1);
 }
-const recorded = run('npx thread packaged --record');
+const recorded = run(`${TYPED} packaged --record`);
 stdout.write(`publish: packaged --record exited ${String(recorded)}\n`);
 if (recorded !== 0) {
-    stderr.write('\npublish: the packages went out and the note recording them refused to be written, so the next publish would number this release again. Run `npx thread packaged --record` and read what it says.\n');
+    stderr.write(`\npublish: the packages went out and the note recording them refused to be written, so the next publish would number this release again. Run \`${TYPED} packaged --record\` and read what it says.\n`);
     exit(1);
 }
 const SHEET = 'packaging.ts';
 const sheet = inTree(TREE, SHEET);
 const stated = existsSync(sheet)
-    ? (await import(__rewriteRelativeImportExtension(pathToFileURL(sheet).href)))
+    ? valuesIn(readFileSync(sheet))
     : {};
 const shipped = stated.PACKAGES ?? [];
 function versionAt(folder) {
@@ -191,5 +179,5 @@ else {
         stdout.write(`publish: committed the derived artifacts to ${branch} — ${going}.\n`);
     }
 }
-stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate, the lint and the seal, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`);
+stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate and the lint, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`);
 exit(0);