@promptctl/cc-candybar 1.42.1 → 1.43.0

package/src/daemon/socket-ownership.ts

@@ -1,209 +0,0 @@
-import fs from "node:fs";
-import { type DaemonLogger } from "./log";
-import { type LeaseRead } from "./socket-lease";
-
-// ─── Socket ownership self-check ─────────────────────────────────────────────
-//
-// [LAW:single-enforcer] "Serving implies owning the socket path" is a temporal
-// invariant every daemon component assumes and none enforced. The socket-theft
-// storm (brandon-daemon-lifecycle-2b3) proved it false: a daemon whose socket
-// was unlinked + rebound by a reclaimer kept running forever (no idle shutdown,
-// no watchdog in production, RSS backstop only), holding ~400MB each — 28
-// daemons bound in one hour with ZERO voluntary exits. This module is that
-// invariant's single enforcer: a displaced daemon exits within one check
-// interval, making ANY displacement self-healing regardless of which bug caused
-// it.
-//
-// [FRAMING:representation] Ownership of a filesystem entry IS its kernel
-// identity: (st_dev, st_ino). We never unlink + rebind our OWN socket during our
-// lifetime, so that identity is stable for as long as we hold the path. A
-// reclaimer that displaces us unlinks the path and binds a fresh socket → a NEW
-// inode (or, briefly, no file at all). So "the identity now equals the identity
-// I bound" is the exact, load-independent test for continued ownership — unlike
-// a connect probe, which the sibling .1 removed precisely because it lied under
-// load.
-//
-// [FRAMING:representation] The inode alone leaves ONE hole (RESIDUAL 2, the
-// capture race): if a thief completes unlink + rebind inside the sub-millisecond
-// window between our bind() and our 'listening' callback, we stat the path and
-// capture the THIEF's inode as "ours" — so the inode check reads `owned` forever
-// against the wrong identity. We cannot make that captured inode trustworthy (an
-// AF_UNIX listener's fstat reports a different namespace's inode than stat(path),
-// so there is no race-free "the inode I truly bound"). But a real thief, being a
-// daemon, writes its OWN pid into the lease. So ownership requires a SECOND
-// condition: the lease must still name us. A displacer must touch one of the two
-// representations — steal the socket (inode changes) or overwrite the lease (pid
-// changes) — so requiring BOTH drains any orphan within a bounded number of
-// intervals. No live process can share our live pid, so the lease pid alone
-// distinguishes "the lease still names me" (the start-time fingerprint is only
-// needed by the sibling arbitration, which reasons about a possibly-DEAD pid).
-
-// The kernel identity of the bound socket file. (dev, ino) is the unique
-// identity of a filesystem entry; ino alone can be reused across devices.
-export interface SocketIdentity {
-  dev: number;
-  ino: number;
-}
-
-// What re-reading the socket path's identity yielded. Distinguishing
-// present / absent / unreadable keeps the ownership decision a full enumeration
-// over raw inputs (see checkOwnership) rather than collapsing the ambiguous
-// cases early — the same shape as socket-lease.ts's LeaseRead.
-export type IdentityRead =
-  | { kind: "present"; identity: SocketIdentity }
-  | { kind: "absent" }
-  | { kind: "unreadable"; detail: string };
-
-// The self-check outcome. `owned` is the ONLY proof-of-ownership state; every
-// other input maps to `displaced` (fail toward exit).
-export type OwnershipCheck =
-  | { kind: "owned" }
-  | { kind: "displaced"; reason: string };
-
-export const DEFAULT_OWNERSHIP_CHECK_INTERVAL_MS = 5000;
-
-// [LAW:no-silent-failure] The sole effect (statSync) is lifted to a typed
-// boundary read: ENOENT → `absent` (the path was unlinked, not yet rebound),
-// any other error → `unreadable` with the reason inline, never a swallowed
-// default. statSync (not lstatSync) follows a symlink deliberately — it reads
-// the identity of whatever a CLIENT connecting to the path would actually reach,
-// which is exactly what "do I still own what clients hit" asks.
-export function readSocketIdentity(sockPath: string): IdentityRead {
-  try {
-    const st = fs.statSync(sockPath);
-    return { kind: "present", identity: { dev: st.dev, ino: st.ino } };
-  } catch (e) {
-    const code = (e as NodeJS.ErrnoException).code;
-    if (code === "ENOENT") return { kind: "absent" };
-    return { kind: "unreadable", detail: (e as Error).message };
-  }
-}
-
-// [LAW:effects-at-boundaries][LAW:dataflow-not-control-flow] A pure fold:
-// (identity captured at bind, current identity read, my pid, current lease read)
-// → decision. No effects, so every branch is exercised by input enumeration.
-// Ownership is the CONJUNCTION of two conditions; either failing → displaced:
-//   inode:  present + same identity as bound     (we still hold the path we bound)
-//   lease:  owned + pid == mine                  (the lease still names us)
-// Inode failures:  different inode / absent / unreadable → a reclaimer displaced
-//   us (or we cannot prove otherwise). Lease failures: a thief overwrote the
-//   lease with its own pid, or the lease vanished/broke — either way we no
-//   longer hold the authority.
-//
-// [FRAMING:representation] Only "still holding my bound socket AND still named by
-// the lease" proves ownership; anything short is `displaced`. This is the
-// strongest-true theorem for "serving implies owning", checked against BOTH
-// mutable representations a displacer can touch. The failure direction is
-// deliberately safe — a false `displaced` (exit while actually owning) just lets
-// the real owner serve and the next client respawns; a false `owned` is the
-// immortal orphan we are killing. Always err toward exit.
-export function checkOwnership(
-  bound: SocketIdentity,
-  now: IdentityRead,
-  myPid: number,
-  lease: LeaseRead,
-): OwnershipCheck {
-  const inodeFailure = inodeDisplacement(bound, now);
-  if (inodeFailure !== null) {
-    return { kind: "displaced", reason: inodeFailure };
-  }
-  if (lease.kind !== "owned") {
-    return {
-      kind: "displaced",
-      reason: `lease not held (${lease.kind}) — no longer the socket owner`,
-    };
-  }
-  if (lease.pid !== myPid) {
-    return {
-      kind: "displaced",
-      reason: `lease reassigned (names pid=${lease.pid}, we are pid=${myPid}) — a reclaimer overwrote it`,
-    };
-  }
-  return { kind: "owned" };
-}
-
-// Returns the displacement reason if the current path identity no longer matches
-// what we bound, or null if the inode still proves ownership.
-function inodeDisplacement(
-  bound: SocketIdentity,
-  now: IdentityRead,
-): string | null {
-  if (now.kind === "present") {
-    if (now.identity.dev === bound.dev && now.identity.ino === bound.ino) {
-      return null;
-    }
-    return `socket replaced (bound dev=${bound.dev} ino=${bound.ino}, now dev=${now.identity.dev} ino=${now.identity.ino})`;
-  }
-  if (now.kind === "absent") {
-    return "socket path gone (ENOENT) — unlinked by a reclaimer";
-  }
-  return `socket path unreadable (${now.detail}) — cannot prove ownership`;
-}
-
-// [LAW:locality-or-seam] The identity read, the shutdown funnel, and the log
-// sink are injected, not reached for ambiently — so a unit test drives every
-// branch (swap the inode, delete the path) against a fake shutdown with no real
-// daemon, mirroring makeLimits. The real wiring injects
-// `() => readSocketIdentity(sockPath)` and the daemon's single shutdown().
-export interface OwnershipWatchDeps {
-  bound: SocketIdentity;
-  myPid: number;
-  readIdentity: () => IdentityRead;
-  readLease: () => LeaseRead;
-  shutdown: (code: number) => void;
-  log: DaemonLogger;
-  intervalMs?: number;
-}
-
-export interface OwnershipWatchHandle {
-  // Run one check now; funnels through shutdown(0) on the first `displaced`.
-  // Returns the decision so callers/tests can assert without timers.
-  check(): OwnershipCheck;
-  arm(intervalMs?: number): { disarm(): void };
-}
-
-export function makeOwnershipWatch(
-  deps: OwnershipWatchDeps,
-): OwnershipWatchHandle {
-  // [LAW:single-enforcer] Latch like limits' `triggered`: displacement funnels
-  // shutdown exactly once (one log line, one shutdown call), even though
-  // shutdown() is itself idempotent. Serving implies owning through ONE exit.
-  let displaced = false;
-
-  function check(): OwnershipCheck {
-    const decision = checkOwnership(
-      deps.bound,
-      deps.readIdentity(),
-      deps.myPid,
-      deps.readLease(),
-    );
-    if (decision.kind === "displaced" && !displaced) {
-      displaced = true;
-      deps.log(
-        "warn",
-        `ownership self-check: ${decision.reason}; shutting down`,
-      );
-      deps.shutdown(0);
-    }
-    return decision;
-  }
-
-  function arm(
-    intervalMs: number = deps.intervalMs ?? DEFAULT_OWNERSHIP_CHECK_INTERVAL_MS,
-  ): { disarm(): void } {
-    const timer = setInterval(() => {
-      // [LAW:no-ambient-temporal-coupling] Self-disarm once displaced: the watch
-      // has funneled its single shutdown, so stop polling — no zombie statSync
-      // fires during the shutdown window (a hung shutdown reaches its SIGKILL
-      // backstop at 500ms). The timer's whole lifecycle lives here in arm(),
-      // mirroring armBinaryWatch which clears its interval before shutting down.
-      if (check().kind === "displaced") clearInterval(timer);
-    }, intervalMs);
-    // unref so the check never keeps the process alive on its own — it only ever
-    // hastens an exit, never delays one.
-    timer.unref();
-    return { disarm: () => clearInterval(timer) };
-  }
-
-  return { check, arm };
-}

package/src/daemon/stats.ts

@@ -1,235 +0,0 @@
-// [LAW:single-enforcer] One mutator owns runtime counters. Server, caches, and
-// watchers each receive a tiny handle they're allowed to bump, but the
-// canonical object lives here. Stats are read-only after serialization.
-
-import type { LaunchCategory } from "../proc/launch";
-import type { LaunchStatsHandle } from "../proc/stats-handle";
-import { PROTOCOL_VERSION } from "./protocol";
-import { PACKAGE_VERSION } from "../version";
-
-// Rolling window for "last minute" counts. Keep timestamps for each launch in
-// a ring buffer; eviction happens lazily on read.
-//
-// [LAW:dataflow-not-control-flow] The cap is a hard bound on how many
-// launches can be counted in any 60-second window. Bursts above
-// ROLLING_BUFFER_CAP / (ROLLING_WINDOW_MS/1000) launches/sec overwrite
-// timestamps that are still inside the window, causing `lastMinute` to
-// undercount. At 16384 entries / 60s = ~273 sustained launches/sec the
-// undercount only kicks in under pathological load (well past anything kz8
-// is trying to detect). Bump this cap rather than the comment if a future
-// workload ever sustains higher rates.
-const ROLLING_WINDOW_MS = 60_000;
-const ROLLING_BUFFER_CAP = 16384;
-
-// Reservoir-sample histogram (16 entries) per category — sufficient for
-// rough p50/p99 without unbounded memory. Replacement uses a simple
-// counter-mod-N strategy: deterministic and adequate for human-eyeball
-// dashboards (no statistical claim of unbiased sampling).
-const HISTOGRAM_CAP = 16;
-
-export interface StatsSnapshot {
-  pid: number;
-  // [LAW:one-source-of-truth] The daemon's own baked package stamp — set
-  // against `cc-candybar --version` to diagnose client-vs-daemon skew in one
-  // step. The wire contract number is a different fact under its own name.
-  version: string;
-  protocolVersion: number;
-  startedAt: string;
-  uptimeSec: number;
-  rssBytes: number;
-  heapUsedBytes: number;
-  heapTotalBytes: number;
-  externalBytes: number;
-  arrayBuffersBytes: number;
-  requests: {
-    total: number;
-    errored: number;
-    timedOut: number;
-    inFlight: number;
-  };
-  gitCache: {
-    size: number;
-    hits: number;
-    misses: number;
-    invalidations: number;
-    watchers: number;
-  };
-  usageCache: {
-    size: number;
-    hits: number;
-    misses: number;
-    sweeps: number;
-  };
-  renderCache: {
-    size: number;
-  };
-  watchers: {
-    active: number;
-    opened: number;
-    closed: number;
-    evicted: number;
-  };
-  subprocesses: {
-    total: number;
-    inFlight: number;
-    lastMinute: number;
-    byCategory: Record<string, number>;
-    p50DurationMs: Record<string, number>;
-    p99DurationMs: Record<string, number>;
-  };
-  nextRestartReason: string | null;
-}
-
-export class RuntimeStats {
-  readonly startedAt = new Date();
-  requestsTotal = 0;
-  requestsErrored = 0;
-  requestsTimedOut = 0;
-  inFlight = 0;
-
-  watchersOpened = 0;
-  watchersClosed = 0;
-  watchersEvicted = 0;
-
-  // [LAW:dataflow-not-control-flow] Subprocess metering. Every launch carries
-  // its category through one boundary; the per-category state below is a
-  // function of that data, not of which call site fired.
-  subprocessTotal = 0;
-  subprocessInFlight = 0;
-  private readonly subprocessCount = new Map<LaunchCategory, number>();
-  private readonly subprocessHistogram = new Map<LaunchCategory, number[]>();
-  private readonly subprocessHistogramRotator = new Map<
-    LaunchCategory,
-    number
-  >();
-  private readonly rollingTimestamps: number[] = [];
-  private rollingHead = 0;
-
-  // [LAW:one-source-of-truth] The same object that owns the counters also
-  // exposes the metering handle. The launch primitive calls these two
-  // methods; nothing else mutates subprocess state.
-  readonly launchStats: LaunchStatsHandle = {
-    onStart: (category) => {
-      this.subprocessTotal++;
-      this.subprocessInFlight++;
-      this.subprocessCount.set(
-        category,
-        (this.subprocessCount.get(category) ?? 0) + 1,
-      );
-      this.recordRollingNow();
-    },
-    onEnd: (category, durationMs) => {
-      this.subprocessInFlight = Math.max(0, this.subprocessInFlight - 1);
-      this.recordDuration(category, durationMs);
-    },
-  };
-
-  private recordRollingNow(): void {
-    const now = Date.now();
-    if (this.rollingTimestamps.length < ROLLING_BUFFER_CAP) {
-      this.rollingTimestamps.push(now);
-      return;
-    }
-    // Ring buffer once cap hit. The overwritten slot may still be inside the
-    // 60s window — see the cap-rationale comment at ROLLING_BUFFER_CAP.
-    this.rollingTimestamps[this.rollingHead] = now;
-    this.rollingHead = (this.rollingHead + 1) % ROLLING_BUFFER_CAP;
-  }
-
-  private recordDuration(category: LaunchCategory, durationMs: number): void {
-    let hist = this.subprocessHistogram.get(category);
-    if (!hist) {
-      hist = [];
-      this.subprocessHistogram.set(category, hist);
-    }
-    if (hist.length < HISTOGRAM_CAP) {
-      hist.push(durationMs);
-      return;
-    }
-    const idx =
-      (this.subprocessHistogramRotator.get(category) ?? 0) % HISTOGRAM_CAP;
-    hist[idx] = durationMs;
-    this.subprocessHistogramRotator.set(category, idx + 1);
-  }
-
-  private snapshotSubprocesses(): StatsSnapshot["subprocesses"] {
-    const cutoff = Date.now() - ROLLING_WINDOW_MS;
-    let lastMinute = 0;
-    for (const ts of this.rollingTimestamps) {
-      if (ts >= cutoff) lastMinute++;
-    }
-
-    // [LAW:one-source-of-truth] Snapshot includes only categories that have
-    // actually executed — same shape as p50/p99 below. Consumers wanting the
-    // full closed list can read LAUNCH_CATEGORIES (exported from src/proc/launch)
-    // and treat missing keys as zero.
-    const byCategory: Record<string, number> = {};
-    for (const [cat, n] of this.subprocessCount) {
-      if (n > 0) byCategory[cat] = n;
-    }
-
-    const p50: Record<string, number> = {};
-    const p99: Record<string, number> = {};
-    for (const [cat, hist] of this.subprocessHistogram) {
-      if (hist.length === 0) continue;
-      const sorted = [...hist].sort((a, b) => a - b);
-      const p50idx = Math.floor(sorted.length * 0.5);
-      const p99idx = Math.min(
-        sorted.length - 1,
-        Math.floor(sorted.length * 0.99),
-      );
-      const p50val = sorted[p50idx];
-      const p99val = sorted[p99idx];
-      if (p50val !== undefined) p50[cat] = p50val;
-      if (p99val !== undefined) p99[cat] = p99val;
-    }
-
-    return {
-      total: this.subprocessTotal,
-      inFlight: this.subprocessInFlight,
-      lastMinute,
-      byCategory,
-      p50DurationMs: p50,
-      p99DurationMs: p99,
-    };
-  }
-
-  snapshot(extras: {
-    gitCache: StatsSnapshot["gitCache"];
-    usageCache: StatsSnapshot["usageCache"];
-    renderCacheSize: number;
-    watchersActive: number;
-    nextRestartReason?: string | null;
-  }): StatsSnapshot {
-    const mem = process.memoryUsage();
-    return {
-      pid: process.pid,
-      version: PACKAGE_VERSION,
-      protocolVersion: PROTOCOL_VERSION,
-      startedAt: this.startedAt.toISOString(),
-      uptimeSec: Math.floor((Date.now() - this.startedAt.getTime()) / 1000),
-      rssBytes: mem.rss,
-      heapUsedBytes: mem.heapUsed,
-      heapTotalBytes: mem.heapTotal,
-      externalBytes: mem.external,
-      arrayBuffersBytes: mem.arrayBuffers,
-      requests: {
-        total: this.requestsTotal,
-        errored: this.requestsErrored,
-        timedOut: this.requestsTimedOut,
-        inFlight: this.inFlight,
-      },
-      gitCache: extras.gitCache,
-      usageCache: extras.usageCache,
-      renderCache: { size: extras.renderCacheSize },
-      watchers: {
-        active: extras.watchersActive,
-        opened: this.watchersOpened,
-        closed: this.watchersClosed,
-        evicted: this.watchersEvicted,
-      },
-      subprocesses: this.snapshotSubprocesses(),
-      nextRestartReason: extras.nextRestartReason ?? null,
-    };
-  }
-}

package/src/daemon/verbs/config-validators.ts

@@ -1,250 +0,0 @@
-// [LAW:one-source-of-truth] The persistent-config-write instance of the
-// shared keyed-validator registry (validator-registry.ts) — the twin of
-// state-validators.ts for `persist` actions instead of `set` actions.
-// Gates stay derived the same way as session writes: a `persist` action
-// carries its target key and value SOURCE as literal data, so the
-// writable-key gate DERIVES from the action table exactly like
-// deriveActionValidators does for `set`. No baseline keys: every config
-// globals field becomes writable ONLY when a config declares a `persist`
-// action for it — the epic's "zero engine edits to add a menu-able field"
-// goal, realized more strictly here than SessionState's legacy baseline
-// theme/style/toolbar-expanded keys.
-
-import { actionDestinations, type ActionDecl } from "../../config/action";
-import {
-  perConfigDomainsFor,
-  resolveOptionDomain,
-} from "../../config/option-domain";
-import { addableSegmentDomains } from "../../config/edit-chrome";
-import type { DslConfig } from "../../config/dsl-types";
-import { numericGlobalsSeeds } from "../../config/loader/globals";
-import { encodeLayoutOp } from "../../config/layout-ops";
-import {
-  parsePersistTarget,
-  presetRootOpsKey,
-} from "../../config/loader/persist-target";
-import {
-  clampSeed,
-  createValidatorRegistry,
-  mergeContributions,
-  type DerivedValidatorSpec,
-  type KeySpecContribution,
-  type RangeParams,
-  type ValidateResult,
-} from "./validator-registry";
-
-// [LAW:no-silent-fallbacks] No baseline entries: a config globals field is
-// writable ONLY when some `persist` action names it.
-const registry = createValidatorRegistry({}, "config");
-
-export function listConfigKeys(): readonly string[] {
-  return registry.listKeys();
-}
-
-export function validateConfigWrite(
-  key: string,
-  rawValue: string,
-): ValidateResult {
-  return registry.validate(key, rawValue);
-}
-
-export function rangeParamsForConfig(key: string): RangeParams | null {
-  return registry.rangeParamsFor(key);
-}
-
-// [LAW:one-source-of-truth] The ONE place mapping a `persist` ACTION to the
-// validator key SPEC it declares — the mirror of state-validators.ts's
-// actionKeySpecs for `set`. `persist` has no `int` arm: a page cursor is a
-// UI-only paging concept with no meaning as a persisted config default.
-function actionKeySpecs(
-  a: ActionDecl,
-  seeds: ReadonlyMap<string, number>,
-  perConfigDomains: ReadonlyMap<string, readonly string[]>,
-): KeySpecContribution[] {
-  if (!("persist" in a)) return [];
-  if ("to" in a) {
-    return [{ key: a.persist, spec: { kind: "allow-list", allowed: [a.to] } }];
-  }
-  if ("from" in a) {
-    return [
-      {
-        key: a.persist,
-        spec: {
-          kind: "allow-list",
-          allowed: resolveOptionDomain(a.from, perConfigDomains),
-        },
-      },
-    ];
-  }
-  if ("cycle" in a) {
-    return [{ key: a.persist, spec: { kind: "allow-list", allowed: a.cycle } }];
-  }
-  // [LAW:single-enforcer] brandon-layout-edit-2gc.1's structural-edit arms:
-  // the op is fully literal at config-author time (removeSegment's target,
-  // insertSegment's segment/anchor/relation), so — exactly like a literal
-  // `to` — there is exactly ONE legal value this declared action can ever
-  // request: its own encoded op token. Multiple layout actions targeting the
-  // same "presets.<name>.rootOps" key each contribute one allow-list member,
-  // unioned by mergeContributions below, same as multiple `to` actions on
-  // one key already do.
-  if ("removeSegment" in a) {
-    return [
-      {
-        key: a.persist,
-        spec: {
-          kind: "allow-list",
-          allowed: [encodeLayoutOp({ op: "remove", target: a.removeSegment })],
-        },
-      },
-    ];
-  }
-  if ("insertSegment" in a) {
-    return [
-      {
-        key: a.persist,
-        spec: {
-          kind: "allow-list",
-          allowed: [
-            encodeLayoutOp({
-              op: "insert",
-              segment: a.insertSegment,
-              anchor: a.anchor,
-              relation: a.relation,
-            }),
-          ],
-        },
-      },
-    ];
-  }
-  // [LAW:one-source-of-truth] brandon-layout-edit-2gc.3's domain-sourced
-  // sibling: the allow-list is the ENCODED op token for every domain member,
-  // not the raw member — mirroring how a literal `insertSegment` contributes
-  // its own single encoded token above. A click carrying an option this
-  // domain never named — or naming a real segment but the wrong anchor/
-  // relation — cannot decode to a member of this list, so it is rejected the
-  // same loud way an unknown literal op token already is.
-  if ("insertSegmentFrom" in a) {
-    return [
-      {
-        key: a.persist,
-        spec: {
-          kind: "allow-list",
-          allowed: resolveOptionDomain(
-            a.insertSegmentFrom,
-            perConfigDomains,
-          ).map((segment) =>
-            encodeLayoutOp({
-              op: "insert",
-              segment,
-              anchor: a.anchor,
-              relation: a.relation,
-            }),
-          ),
-        },
-      },
-    ];
-  }
-  return [
-    {
-      key: a.persist,
-      spec: {
-        kind: "range",
-        min: a.min,
-        max: a.max,
-        seed: clampSeed(seeds.get(a.persist), a.min, a.max),
-      },
-    },
-  ];
-}
-
-// [LAW:one-source-of-truth] The unset seed for a bounded `persist` key (e.g.
-// a padding stepper) is the value that would render with NO override yet —
-// the merged config's OWN globals field, before this reload's overrides are
-// applied. Mirrors stateKeySeeds' "the bar's current display, not silently
-// min" rule for SessionState steppers.
-function configKeySeeds(config: DslConfig): ReadonlyMap<string, number> {
-  return numericGlobalsSeeds(config.globals);
-}
-
-// [LAW:one-source-of-truth] Every preset a config's action table ALREADY
-// targets via a `presets.<name>.rootOps` key (persist OR reset — the
-// contribution is keyed off intent to use structural editing for that
-// preset, not off "this config has any presets block") stays a
-// registered key EVEN when that preset's CURRENT tree has no
-// addable/removable segment for removeChrome/insertChrome to contribute
-// from. Without this, a preset edited down to zero non-exempt segments
-// (spliceContainer then contributes nothing for it at all) would orphan
-// its OWN reset action: the one affordance meant to undo a fully-emptied
-// preset would throw "unknown config key" at the exact moment it's needed
-// most (brandon-layout-edit-2gc.5 PR review). An EMPTY allow-list
-// registers the key (so `reset-config`'s membership check —
-// src/daemon/verbs/index.ts's resetConfig — passes) without granting any
-// illegitimate WRITE: a real persist write still needs a real
-// removeSegment/insertSegment/insertSegmentFrom action elsewhere;
-// mergeContributions unions an empty array with whatever those contribute.
-//
-// [LAW:no-mode-explosion] Deliberately narrower than "every declared
-// preset" — a config with a `presets` block but ZERO persist/reset actions
-// over it has no structural-editing surface at all, so it registers
-// nothing here, preserving this module's own "zero baseline keys" floor
-// (a globals field, and now a preset's rootOps, is writable only because
-// SOME action names it).
-function presetRootOpsContributions(config: DslConfig): KeySpecContribution[] {
-  const presets = new Set<string>();
-  for (const a of writeDestinations(config)) {
-    const key = "persist" in a ? a.persist : "reset" in a ? a.reset : null;
-    if (key === null) continue;
-    const target = parsePersistTarget(key);
-    if (target?.scope === "preset-root-ops") presets.add(target.preset);
-  }
-  return [...presets].map((name) => ({
-    key: presetRootOpsKey(name),
-    spec: { kind: "allow-list", allowed: [] },
-  }));
-}
-
-function actionContributions(config: DslConfig): KeySpecContribution[] {
-  const seeds = configKeySeeds(config);
-  // [LAW:one-source-of-truth] The "addable segment" domains
-  // (edit-chrome.ts's `addableSegmentDomains`) merge in here alongside
-  // looks/presets — the same per-preset seam `insertSegmentFrom` resolves
-  // through at render (render.ts's registerDslConfig merges the identical
-  // map), so the rendered picker options and the derived click gate can
-  // never diverge over what's addable.
-  const perConfigDomains = new Map([
-    ...perConfigDomainsFor(config),
-    ...addableSegmentDomains(config),
-  ]);
-  return [
-    ...presetRootOpsContributions(config),
-    ...writeDestinations(config).flatMap((a) =>
-      actionKeySpecs(a, seeds, perConfigDomains),
-    ),
-  ];
-}
-
-// [LAW:single-enforcer] Every action as the single-destination declarations it
-// writes through — the SAME explosion state-validators.ts folds over, so a
-// dual-destination action (candybar-settings-ui-aok.3) contributes exactly the
-// `persist` spec its durable half would have contributed alone. One statement
-// of "what are this action's destinations", two derivations reading it.
-function writeDestinations(config: DslConfig): readonly ActionDecl[] {
-  return Object.values(config.actions).flatMap(actionDestinations);
-}
-
-// [LAW:single-enforcer] The SOLE install-site derivation: a config's
-// persistent-config-writable-key surface is the merge of every `persist`
-// ACTION it declares, through the SAME coherence pass deriveActionValidators
-// uses for `set`.
-export function deriveConfigActionValidators(
-  config: DslConfig,
-): readonly KeySpecContribution[] {
-  return mergeContributions(actionContributions(config), "config");
-}
-
-export function registerConfigValidator(
-  key: string,
-  spec: DerivedValidatorSpec,
-): () => void {
-  return registry.register(key, spec);
-}