@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/mode-policy.d.ts

@@ -20,7 +20,6 @@ import { type ToolRoster } from "./tool-roster.js";
 import { type PermissionMode } from "./ask-origin.js";
 import type { RuntimeCaps } from "./runtime-caps.js";
 import type { RunnerDeps } from "./runner-deps.js";
-import { recordedModeSeed } from "./checkpoint-store.js";
 import type { TaskSpec } from "./task-spec.js";
 /** WHY an effective mode is not the requested one: the deployment's deny bit (`RuntimeCaps.bypassPermissions` /
  *  `RuntimeCaps.autoMode`), a requested `auto` with no classifier face wired, or a child's declaration folded under
@@ -162,25 +161,11 @@ export declare function modeRequestAfterResume(seat: PermissionMode | undefined,
  * (the re-supplied config, before the claim) — a resume prepare would refuse is refused before it consumes the row.
  */
 export declare function refusePermissionModeDoors(spec: Pick<TaskSpec, "permissionMode" | "shellGate">): PermissionMode | undefined;
-/**
- * The doors a RESUMED leg's prepare refuses at, read as one screen for the resume ladder to run BEFORE the claim: the mode
- * doors on the re-supplied config ({@link refusePermissionModeDoors}), its output-style seat (`resolveOutputStyleFrame`), its
- * approval-reach declaration (`screenApprovalReach`), the skills it invokes by name (`screenUserInvokedSkills` — the part no
- * roster changes; a name the leg's roster reads as nothing is prepare's), its attachments (`screenUserAttachments` — a resume
- * sends no new human message, so any entry is refused) and the mode words the checkpoint row recorded (`recordedModeSeed`) — prepare's own functions, so the refusal carries the very
- * sentence and code prepare would throw. It leaves by the resume's ONE refusal channel, `CheckpointError`
- * `checkpoint.config_refused` (`message` = prepare's sentence, `detail.code` = prepare's code, `detail.field` = the input that
- * carries it: `"taskConfig"` or `"inheritedGate"`), where prepare itself would end the run `failed` after the claim — a
- * refusal there consumes the row and reopens it as a system retry that replays the recorded decision, which a CONFIG
- * correction cannot reach. Before the claim the row stays `pending` and byte-identical, and the same token is redeemable by a
- * corrected resume. A throw that is not one of prepare's five codes (a caller's accessor failing) is not a refusal and leaves
- * as it was thrown.
- */
-export declare function refuseResumeDoors(config: Pick<TaskSpec, "permissionMode" | "shellGate" | "outputStyle" | "approvalReach" | "skills" | "userInvokedSkills" | "userAttachments">, recordedGate: Parameters<typeof recordedModeSeed>[0]): void;
 /** The resume's ONE refusal channel for a door prepare would refuse at: runs `screen` (prepare's own function, which throws prepare's sentence and code) and
  *  leaves a refusal of one of {@link CHECKPOINT_CONFIG_REFUSAL_CODES} as `checkpoint.config_refused` — the sentence, prepare's code as `detail.code`, the input
- *  that carries it as `detail.field`, and prepare's own arm as `detail.reason` when its error names one. Anything else leaves as it was thrown. */
-export declare function asResumeConfigRefusal(field: "taskConfig" | "inheritedGate", screen: () => void): void;
+ *  that carries it as `detail.field`, and prepare's own arm as `detail.reason` when its error names one. Anything else leaves as it was thrown. What the
+ *  door returns is returned (a {@link ConfigDoorEntry}: the resume's way of entering a door the config-door phase lists). */
+export declare function asResumeConfigRefusal<T>(field: "taskConfig" | "deps" | "inheritedGate", screen: () => T): T;
 /** The three-member answer every mode question gets — the manifest member, the steer verb's return value and the
  *  fold notice's detail share it. `requested` is absent when the caller declared nothing (a root inherits `default`,
  *  a child inherits its parent). */

package/dist/core/mode-policy.js

@@ -7,11 +7,7 @@ import { argvOf, lexShellText } from "../shell/lex.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { createSafeNotifier } from "./safe-notify.js";
 import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "./retired-keys.js";
-import { resolveOutputStyleFrame } from "./output-style.js";
-import { screenUserAttachments } from "./user-attachment.js";
-import { CheckpointError, isCheckpointConfigRefusalCode, recordedModeSeed } from "./checkpoint-store.js";
-import { screenApprovalReach } from "./wiring-manifest.js";
-import { screenUserInvokedSkills } from "./skill-grant.js";
+import { CheckpointError, isCheckpointConfigRefusalCode } from "./checkpoint-store.js";
 export const PERMISSION_MODE_FOLD_REASONS = Object.freeze(["operator_deny", "face_absent", "inherited_ceiling"]);
 export const ACCEPT_EDITS_FILE_COMMANDS = Object.freeze(["mkdir", "touch", "rm", "rmdir", "mv", "cp", "sed"]);
 const MODE_POLICY_TABLE = {
@@ -111,19 +107,9 @@ export function refusePermissionModeDoors(spec) {
     }
     return mode;
 }
-export function refuseResumeDoors(config, recordedGate) {
-    asResumeConfigRefusal("taskConfig", () => {
-        refusePermissionModeDoors(config);
-        resolveOutputStyleFrame(config.outputStyle);
-        screenApprovalReach(config.approvalReach);
-        screenUserInvokedSkills(config);
-        screenUserAttachments(config.userAttachments, { resumeLeg: true });
-    });
-    asResumeConfigRefusal("inheritedGate", () => void recordedModeSeed(recordedGate));
-}
 export function asResumeConfigRefusal(field, screen) {
     try {
-        screen();
+        return screen();
     }
     catch (e) {
         if (e instanceof Error && "code" in e && isCheckpointConfigRefusalCode(e.code)) {

package/dist/core/mods/kernel/dispatch.js

@@ -1,7 +1,7 @@
 import { CATCH_BUDGET_MS, createSelfBudget, POST_ABORT_GRACE_MS, RUNAWAY_AFTER_MS, unrefTimer, watchRunaway } from "./budget.js";
 import { expandModPattern, isModEventName, MOD_SEATS, nextToRefusal, stationOn } from "./events.js";
 import { ENGINE_ORIGIN, modsInvalid, screenModSeats, } from "./registration.js";
-import { answerUpward, answerViolation, detachedCopy, matcherMatches, matcherViolation, methodAnswerViolation, NEXT_IN_FLIGHT, pinnedKeyChanged, receiveAnswer, receivePayload, } from "./site-rules.js";
+import { answerUpward, answerViolation, detachedCopy, engineObjectsOnce, handedOn, matcherMatches, matcherViolation, methodAnswerViolation, NEXT_IN_FLIGHT, receiveAnswer, receiveEvent, receivePayload, } from "./site-rules.js";
 const TIER_RANK = { prepend: 0, user: 1, append: 2, builtin: 3, core: 4 };
 const bypassed = (floors, tier) => floors.some((f) => TIER_RANK[f.from] < TIER_RANK[tier] && TIER_RANK[tier] < TIER_RANK[f.to]);
 export async function admitMods(input) {
@@ -202,7 +202,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
         hasHandlers: (event, participant) => mounted.some((h) => h.events.has(event) && admits(participant, h)),
         dispatch: (event, e, options) => {
             const st = stationOn(event, side);
-            const received = st === undefined ? { refusal: `${event} is not raised on the ${side} bus` } : receivePayload(e);
+            const received = st === undefined ? { refusal: `${event} is not raised on the ${side} bus` } : receiveEvent(e);
             if (st === undefined || "refusal" in received) {
                 const reason = `${event}: ${"refusal" in received ? received.refusal : "not raised"}`;
                 report(new Error(`engine: ${reason} — the dispatch was not run`));
@@ -237,7 +237,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
             throw new Error(`${caller.origin.plugin}: $.${event}: not raised on the ${side} bus`);
         let e0 = args;
         if (seat.enter !== undefined) {
-            const shaped = receivePayload(seat.enter(args), undefined, isProxy);
+            const shaped = receivePayload(seat.enter(args), isProxy, engineObjectsOnce(args)());
             if ("refusal" in shaped)
                 throw new TypeError(`${caller.origin.plugin}: $.${event}: ${shaped.refusal}`);
             e0 = shaped.payload;
@@ -263,7 +263,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
             throw new Error(`${caller.origin.plugin}: $.${event}: ${deny}`);
         return typeof answer === "object" && answer !== null ? Reflect.get(answer, "value") : undefined;
     }
-    function dollarFor(reg, frames, budget, signal) {
+    function dollarFor(reg, frames, budget, signal, engines) {
         const origin = Object.freeze({ plugin: reg.name, tier: reg.tier });
         const callerFrames = Object.freeze([...frames, Object.freeze({ kind: "dollar", plugin: reg.name })]);
         const namespaces = new Map();
@@ -273,7 +273,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
             ns[m.method] = async (args) => {
                 if (!reg.callsBound.has(m.event))
                     throw new Error(`${reg.name}: $.${m.event}: not declared in uses.calls`);
-                const received = receivePayload(args === undefined ? {} : args, undefined, isProxy);
+                const received = receivePayload(args === undefined ? {} : args, isProxy, engines());
                 if ("refusal" in received)
                     throw new TypeError(`${reg.name}: $.${m.event}: takes one object — ${received.refusal}`);
                 if (m.pauses)
@@ -347,19 +347,17 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
             const drop = () => void pendingRuns.delete(run);
             run.then(drop, drop);
         };
+        const engines = engineObjectsOnce(e0);
         const handOn = (passed) => {
             if (passed === e0)
                 return { snap: e0 };
-            const received = receivePayload(passed, e0, isProxy);
-            if ("refusal" in received)
-                return { violation: `next() takes the event object: ${received.refusal}` };
-            const k = pinnedKeyChanged(st.pinned, e0, received.payload);
-            return k === undefined ? { snap: received.payload } : { violation: `next() changed the pinned key "${k}"` };
+            const handed = handedOn(st.pinned, e0, passed, engines(), isProxy);
+            return "violation" in handed ? handed : { snap: handed.payload };
         };
         const takeAnswer = (answer, s, e, h) => {
             let taken = answer;
             if (!s.answers.some((a) => Object.is(a, answer))) {
-                const received = receiveAnswer(answer, isProxy);
+                const received = receiveAnswer(answer, engines(), isProxy);
                 if ("refusal" in received)
                     return { violation: received.refusal };
                 taken = received.answer;
@@ -472,7 +470,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
             }
             else {
                 const next = makeNext({ budget, signal: ac.signal, trace: () => Object.freeze([...state.below]) }, (x) => descend(x, floors), to);
-                const $ = dollarFor(h.reg, myFrames, budget, ac.signal);
+                const $ = dollarFor(h.reg, myFrames, budget, ac.signal, engines);
                 handlerP = invokeNow(() => h.fn($, e, next));
                 try {
                     const raced = await Promise.race([handlerP, budget.expired]);
@@ -578,7 +576,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
                 return why !== undefined ? Promise.reject(new Error(`${h.reg.name}: ${why}`)) : replay(x, [...floors, { from: h.reg.tier, to: tier }]);
             }, { error, called: state.called });
             try {
-                const raced = await Promise.race([invokeNow(() => onCatch(dollarFor(h.reg, myFrames, budget, ac.signal), e, next)), budget.expired]);
+                const raced = await Promise.race([invokeNow(() => onCatch(dollarFor(h.reg, myFrames, budget, ac.signal, engines), e, next)), budget.expired]);
                 if (raced === "expired" && budget.isExpired())
                     return { problem: `its .catch ran past its ${CATCH_BUDGET_MS}ms budget` };
                 if (violated !== undefined)
@@ -610,7 +608,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
                 report(new Error(`${name}: ${event}: an observe handler returned a verdict — not adopted; an observe handler answers undefined`), "observational-hook-verdict-ignored");
             };
             try {
-                const raced = await Promise.race([invokeNow(() => h.fn(dollarFor(h.reg, myFrames, budget, ac.signal), detachedCopy(e0), next)), budget.expired]);
+                const raced = await Promise.race([invokeNow(() => h.fn(dollarFor(h.reg, myFrames, budget, ac.signal, engines), detachedCopy(e0), next)), budget.expired]);
                 if (raced === "expired" && budget.isExpired())
                     throw new Error(`ran past its ${h.reg.budgetMs}ms budget`);
                 verdict(raced);
@@ -631,7 +629,7 @@ function createBus(side, mounted, bottoms, report, records, describe, isProxy) {
                         called: false,
                     });
                     try {
-                        const caught = await Promise.race([invokeNow(() => onCatch(dollarFor(h.reg, myFrames, catchBudget, cac.signal), detachedCopy(e0), cnext)), catchBudget.expired]);
+                        const caught = await Promise.race([invokeNow(() => onCatch(dollarFor(h.reg, myFrames, catchBudget, cac.signal, engines), detachedCopy(e0), cnext)), catchBudget.expired]);
                         if (!(caught === "expired" && catchBudget.isExpired()))
                             verdict(caught);
                     }

package/dist/core/mods/kernel/events.d.ts

@@ -8,12 +8,14 @@
  */
 /**
  * The kernel CONTRACT number — a monotonic integer, independent of the package version (the package is
- * cut with core every release; this number is not). Every party that loads a kernel copy compares it for
- * EQUALITY. It is raised when, and only when, one of four things changes: the chain semantics (`next`,
- * `next.to`, origin, trace, re-entry frames), the registration form (`ModRegistration`, `on`, `uses`),
- * the event closed set (names and their `side`), or the failure columns (failure, abort, pinned keys).
+ * cut with core every release; this number is not). It is exported for a host that loads a kernel copy
+ * beside another one to compare for EQUALITY; nothing in this folder or in the engine reads it, so two
+ * copies that differ are not detected here. It is raised when, and only when, one of four things changes:
+ * the chain semantics (`next`, `next.to`, origin, trace, re-entry frames), the registration form (`ModRegistration`, `on`, `uses`),
+ * the event closed set (names and their `side`), or the failure columns (failure, abort, pinned keys — which keys,
+ * and how a pinned key is judged: by value since 2).
  */
-export declare const KERNEL_CONTRACT_VERSION = 1;
+export declare const KERNEL_CONTRACT_VERSION = 2;
 /** The five tiers in run order (CC names). `builtin` and `core` are the engine's own. */
 export declare const MOD_TIERS: readonly ["prepend", "user", "append", "builtin", "core"];
 export type ModTier = (typeof MOD_TIERS)[number];
@@ -58,7 +60,8 @@ export declare const SEAT_TIER_TABLE: Readonly<{
 export interface ModStation {
     readonly failure: ModFailureAnswer;
     readonly abort: ModAbortPosture;
-    /** Keys a handler may not change when it passes `e` on through `next`. */
+    /** Keys a handler may not change when it passes `e` on through `next` — compared by value: the engine's fact handed on,
+     *  or a copy of it (a spread, a structured clone, a JSON round trip), is not a change; a different value is. */
     readonly pinned: readonly string[];
     readonly method?: {
         readonly pausesCallerBudget: boolean;

package/dist/core/mods/kernel/events.js

@@ -1,4 +1,4 @@
-export const KERNEL_CONTRACT_VERSION = 1;
+export const KERNEL_CONTRACT_VERSION = 2;
 export const MOD_TIERS = Object.freeze(["prepend", "user", "append", "builtin", "core"]);
 export const MOD_SEATS = Object.freeze(["deployment", "task"]);
 export const MOD_EVENT_SIDES = Object.freeze(["engine", "surface", "both"]);
@@ -87,7 +87,7 @@ export const MOD_EVENT_TABLE = Object.freeze({
     "prompt.context": engine(),
     "prompt.attachment": engine(),
     "prompt.mention": surface,
-    "prompt.compose": engine(station("skip", "grace", ["model"])),
+    "prompt.compose": engine(station("skip", "grace", ["model", "catalog", "selectors"])),
     "tool.describe": engine(),
     "command.run": surface,
     "command.describe": surface,

package/dist/core/mods/kernel/receive.d.ts

@@ -8,8 +8,11 @@
  * ordinary array — within `depth` levels is copied member by member off its own property descriptors, captured in
  * one call before any of the caller's code can run; each member lands as an enumerable data property of the copy (a
  * defined property, never an assignment, so an own `__proto__` key stays a plain key). Anything else — a function, an
- * object of another prototype, a container past `depth` — is handed as it is or refused, by `others`, which also
- * says whether cycles and shared references keep their shape or are refused / walked again.
+ * object of another prototype, a container past `depth` — is handed as it is, refused, or (an object of another
+ * prototype under `copy`) copied off its own members like a record, by `others`, which also says whether cycles and
+ * shared references keep their shape or are refused / walked again. A refusal refuses the whole receipt, or — under
+ * `contain` — only the member it was met in. The walk keeps its own stack (one frame per container being copied), so
+ * neither how deep a value nests nor how deep its caller already stands decides a verdict: only `depth` does.
  *
  * Zero-dependency on purpose (this folder compiles on its own): a Proxy cannot be recognised from here, so the
  * host passes its probe (`isProxy`); with a probe, a Proxy is refused before anything is asked of it.
@@ -18,7 +21,8 @@
 export interface ReceiptMode {
     /**
      * `call-once`: every own string-keyed member is read — a data property's value, or an accessor's getter called exactly
-     * once on the object (a getter that throws refuses the receipt; one that moves the object's prototype refuses it).
+     * once on the object (a getter that throws refuses the receipt; one that moves the object's prototype refuses it, but
+     * under `others: "copy"`).
      * `refuse`: only own enumerable string-keyed DATA properties are members; an accessor, a non-enumerable property or
      * a symbol-keyed one refuses the receipt (no getter ever runs).
      */
@@ -28,14 +32,34 @@ export interface ReceiptMode {
     /** What a value that is not copied is (a function, another prototype, a container past `depth`, a symbol or a
      *  bigint): handed as it is, or a refusal of the receipt. Shared references keep their shape in the copy (one copy
      *  each); under `as-is` a cycle does too, under `refuse` a cycle is refused and a shared reference must fit `depth`
-     *  where it sits each time it is met. */
-    readonly others: "as-is" | "refuse";
+     *  where it sits each time it is met. `copy` is `refuse`, except that an object of another prototype within `depth`
+     *  — a class instance, another realm's object or array, an array of a subclass — is copied as an ordinary record (an
+     *  array as an ordinary array) off its OWN members: its prototype is not kept and no code of the prototype runs, so a
+     *  prototype's getters and a built-in's internal state (a `Date`'s time, a `Map`'s entries) are not members and are
+     *  not copied, while every own data member is (and an own accessor is read as `accessors` says; one that moves the
+     *  object's prototype changes nothing the copy holds). A Proxy and a cycle are still refused. */
+    readonly others: "as-is" | "refuse" | "copy";
+    /** `refuse`: a container (an ordinary record or array) past `depth` refuses the receipt (`too-deep`) even where
+     *  `others` hands other values as they are — a value of another kind there is still what `others` says — and a shared
+     *  reference must fit `depth` where it sits each time it is met, by the height its first walk found (a walk that ran
+     *  into a container still being walked — a cycle — counts that container as one level, and so does an object the
+     *  reader holds, met directly or in what holds it): `depth` is a bound, never a copy depth. Absent ⇒ a container past
+     *  `depth` is what `others` says. */
+    readonly past?: "refuse";
+    /** A fault met in a member — its getter threw, it is a value the receipt refuses, it holds a cycle, it runs too deep,
+     *  or it could not be copied at all (`uncopyable`) — leaves THAT member out of its container's copy and is reported in the
+     *  receipt's `faults` (where it was met); the walk goes on with the next member. A container refused where it was met
+     *  is refused again wherever else it is met (never read twice). Only a fault of the received value itself refuses the
+     *  receipt. Absent ⇒ the first fault refuses the receipt. */
+    readonly contain?: true;
     /** Every container the copy makes is frozen (a received value cannot be changed after it was received). */
     readonly freeze?: boolean;
     /** The host's Proxy probe. */
     readonly isProxy?: (value: object) => boolean;
 }
-/** Why a receipt was refused. */
+/** Why a receipt was refused. `uncopyable` has two causes, and depth is neither (the walk keeps its own stack): reading
+ *  the value threw where none of its getters runs — a Proxy's trap, on a receipt given no Proxy probe; what it threw is
+ *  never read — or the value holds more objects than one receipt can index. */
 export declare const RECEIPT_FAULTS: readonly ["proxy", "accessor", "hidden", "getter-threw", "prototype-moved", "not-data", "cycle", "too-deep", "uncopyable"];
 export type ReceiptFaultKind = (typeof RECEIPT_FAULTS)[number];
 /** A refusal and where in the value it was met (member names from the top). */
@@ -43,9 +67,11 @@ export interface ReceiptFault {
     readonly kind: ReceiptFaultKind;
     readonly path: readonly string[];
 }
+/** A receipt: the copy (with, under `contain`, every fault a member was left out for), or the refusal. */
 export type Receipt = {
     readonly ok: true;
     readonly value: unknown;
+    readonly faults?: readonly ReceiptFault[];
 } | {
     readonly ok: false;
     readonly fault: ReceiptFault;
@@ -53,13 +79,16 @@ export type Receipt = {
 /** Whether `v` is an ordinary record: an object whose prototype is `Object.prototype` or none (an array is not one). */
 export declare function isPlainRecord(v: unknown): v is Record<string, unknown>;
 /**
- * Receive `value` by `mode`. `held` names objects the reader already owns: met in the walk, each is kept as itself
- * (not received again) — so a member handed back unchanged keeps its identity.
+ * Receive `value` by `mode`. `held` names objects the reader already owns: met in the walk, each is kept as itself — not
+ * received again, never walked — so a member handed back unchanged keeps its identity. The set is consulted as it is,
+ * never copied, so one set serves every receipt of the same owner.
  */
-export declare function receive(value: unknown, mode: ReceiptMode, held?: Iterable<unknown>): Receipt;
+export declare function receive(value: unknown, mode: ReceiptMode, held?: ReadonlySet<object>): Receipt;
 /** The mods bus's mode: a payload and an answer received whole — no accessor runs, no depth limit, cycles and shared
  *  references kept, a function or a class instance handed as it is, every copied container frozen (so a member the
- *  bus holds cannot be changed under it by a handler that holds it too). */
+ *  bus holds cannot be changed under it by a handler that holds it too). The engine's own event is received in it as it
+ *  is; what a handler gives the bus — a payload, an answer, a `$` call's arguments — in it held to the bus's one depth
+ *  (the site rules set `depth` and `past: "refuse"`). */
 export declare const MODS_PAYLOAD_MODE: ReceiptMode;
 /** One clause naming a fault for a sentence ("an accessor at input.deep.x"). */
 export declare function describeFault(fault: ReceiptFault): string;

package/dist/core/mods/kernel/receive.js

@@ -10,91 +10,156 @@ function isOrdinaryArray(v) {
 }
 export function receive(value, mode, held) {
     const seen = new Map();
-    if (held !== undefined)
-        for (const h of held)
-            if (typeof h === "object" && h !== null)
-                seen.set(h, h);
     const path = [];
     const open = new Set();
     const heights = new Map();
+    const faults = [];
+    const refusedAt = new Map();
+    const stack = [];
+    const refusals = new Set();
     const refuse = (kind) => {
-        throw { refused: Object.freeze({ kind, path: Object.freeze([...path]) }) };
+        const fault = Object.freeze({ kind, path: Object.freeze([...path]) });
+        refusals.add(fault);
+        throw fault;
     };
+    const faultOf = (err) => typeof err === "object" && err !== null && refusals.has(err) ? err : Object.freeze({ kind: "uncopyable", path: Object.freeze([...path]) });
     const other = (v, kind) => (mode.others === "as-is" ? v : refuse(kind));
-    const walk = (v, level) => {
+    const refuseContainer = (v, kind) => {
+        if (mode.contain === true) {
+            refusedAt.set(v, kind);
+            open.delete(v);
+        }
+        return refuse(kind);
+    };
+    const memberOf = (v, d) => {
+        if (Object.hasOwn(d, "value")) {
+            if (mode.accessors === "refuse" && d.enumerable !== true)
+                refuse("hidden");
+            return d.value;
+        }
+        if (mode.accessors === "refuse")
+            refuse("accessor");
+        const get = Object.hasOwn(d, "get") ? d.get : undefined;
+        try {
+            return get === undefined ? undefined : Reflect.apply(get, v, []);
+        }
+        catch {
+            return refuse("getter-threw");
+        }
+    };
+    const measured = mode.past === "refuse" || mode.others !== "as-is";
+    const heightOf = (v) => heights.get(v) ?? (open.has(v) || (held?.has(v) === true && mode.isProxy?.(v) !== true && (isOrdinaryArray(v) || isPlainRecord(v))) ? 1 : 0);
+    const pastDepth = (v, level) => measured && level + heightOf(v) > mode.depth;
+    const meet = (v, level) => {
         if (v === null || v === undefined || typeof v === "string" || typeof v === "number" || typeof v === "boolean")
             return v;
         if (typeof v !== "object")
             return other(v, "not-data");
+        if (held?.has(v) === true)
+            return pastDepth(v, level) ? refuse("too-deep") : v;
         if (seen.has(v)) {
-            if (open.has(v))
-                return mode.others === "refuse" ? refuse("cycle") : seen.get(v);
-            if (mode.others === "refuse" && level + (heights.get(v) ?? 1) > mode.depth)
+            if (refusedAt.has(v))
+                return refuse(refusedAt.get(v));
+            if (open.has(v) && mode.others !== "as-is")
+                return refuse("cycle");
+            return pastDepth(v, level) ? refuse("too-deep") : seen.get(v);
+        }
+        if (level >= mode.depth && mode.past === "refuse") {
+            if (mode.isProxy?.(v) === true)
+                return refuse("proxy");
+            if (isOrdinaryArray(v) || isPlainRecord(v))
                 return refuse("too-deep");
-            return seen.get(v);
         }
         if (level >= mode.depth)
             return other(v, "too-deep");
         if (mode.isProxy?.(v) === true)
             return refuse("proxy");
-        const list = isOrdinaryArray(v);
-        if (!list && !isPlainRecord(v))
+        const list = isOrdinaryArray(v) || (mode.others === "copy" && Array.isArray(v));
+        if (!list && !isPlainRecord(v) && mode.others !== "copy")
             return other(v, "not-data");
         const proto = Object.getPrototypeOf(v);
         const captured = Object.getOwnPropertyDescriptors(v);
         const out = list ? [] : {};
         seen.set(v, out);
         open.add(v);
-        let height = 1;
         if (mode.accessors === "refuse" && Object.getOwnPropertySymbols(captured).length > 0)
-            refuse("hidden");
-        for (const key of Object.getOwnPropertyNames(captured)) {
-            if (list && key === "length")
-                continue;
-            const d = captured[key];
-            path.push(key);
-            let member;
-            if (Object.hasOwn(d, "value")) {
-                if (mode.accessors === "refuse" && d.enumerable !== true)
-                    refuse("hidden");
-                member = d.value;
-            }
-            else {
-                if (mode.accessors === "refuse")
-                    refuse("accessor");
-                const get = Object.hasOwn(d, "get") ? d.get : undefined;
-                try {
-                    member = get === undefined ? undefined : get.call(v);
-                }
-                catch {
-                    return refuse("getter-threw");
-                }
-            }
-            Object.defineProperty(out, key, { value: walk(member, level + 1), enumerable: true, writable: true, configurable: true });
-            if (typeof member === "object" && member !== null)
-                height = Math.max(height, (heights.get(member) ?? 0) + 1);
-            path.pop();
-        }
-        heights.set(v, height);
-        if (mode.accessors === "call-once" && Object.getPrototypeOf(v) !== proto)
-            refuse("prototype-moved");
-        if (Array.isArray(out)) {
-            const length = captured["length"]?.value;
+            refuseContainer(v, "hidden");
+        stack.push({ v, out, list, proto, captured, keys: Object.getOwnPropertyNames(captured), level, next: 0, height: 1, key: "", member: undefined });
+        return out;
+    };
+    const land = (f, key, copy, member) => {
+        if (measured && typeof member === "object" && member !== null)
+            f.height = Math.max(f.height, heightOf(member) + 1);
+        Object.defineProperty(f.out, key, { value: copy, enumerable: true, writable: true, configurable: true });
+        path.length = f.level;
+    };
+    const finish = (f) => {
+        heights.set(f.v, f.height);
+        if (mode.accessors === "call-once" && mode.others !== "copy" && Object.getPrototypeOf(f.v) !== f.proto)
+            refuseContainer(f.v, "prototype-moved");
+        if (Array.isArray(f.out)) {
+            const length = f.captured["length"]?.value;
             if (typeof length === "number")
-                out.length = length;
+                f.out.length = length;
         }
         if (mode.freeze === true)
-            Object.freeze(out);
-        open.delete(v);
-        return out;
+            Object.freeze(f.out);
+        open.delete(f.v);
+        return f.out;
     };
+    const received = (copy) => (mode.contain === true ? { ok: true, value: copy, faults: Object.freeze(faults) } : { ok: true, value: copy });
     try {
-        return { ok: true, value: walk(value, 0) };
+        const copy = meet(value, 0);
+        if (stack.length === 0)
+            return received(copy);
     }
     catch (err) {
-        if (typeof err === "object" && err !== null && "refused" in err)
-            return { ok: false, fault: err.refused };
-        return { ok: false, fault: Object.freeze({ kind: "uncopyable", path: Object.freeze([...path]) }) };
+        return { ok: false, fault: faultOf(err) };
+    }
+    for (;;) {
+        const f = stack[stack.length - 1];
+        if (f.next < f.keys.length) {
+            const key = f.keys[f.next++];
+            if (f.list && key === "length")
+                continue;
+            path.push(key);
+            try {
+                const member = memberOf(f.v, f.captured[key]);
+                const frames = stack.length;
+                const copy = meet(member, f.level + 1);
+                if (stack.length > frames) {
+                    f.key = key;
+                    f.member = member;
+                }
+                else
+                    land(f, key, copy, member);
+            }
+            catch (err) {
+                if (mode.contain !== true)
+                    return { ok: false, fault: faultOf(err) };
+                faults.push(faultOf(err));
+                path.length = f.level;
+            }
+            continue;
+        }
+        let copy;
+        try {
+            copy = finish(f);
+        }
+        catch (err) {
+            stack.pop();
+            const holder = stack[stack.length - 1];
+            if (mode.contain !== true || holder === undefined)
+                return { ok: false, fault: faultOf(err) };
+            faults.push(faultOf(err));
+            path.length = holder.level;
+            continue;
+        }
+        stack.pop();
+        const holder = stack[stack.length - 1];
+        if (holder === undefined)
+            return received(copy);
+        land(holder, holder.key, copy, holder.member);
     }
 }
 export const MODS_PAYLOAD_MODE = Object.freeze({ accessors: "refuse", depth: Infinity, others: "as-is", freeze: true });