@songsid/agend 2.2.0-beta.9 → 2.3.0-beta.1

package/dist/ui/shared/effect-poster-reader.js

@@ -0,0 +1,98 @@
+/** #1629: closed static-poster reads only. No epoch, library/runtime route, code, or response-derived URL. */
+const pools = new WeakMap(), ID = /^[0-9a-f]{32}$/;
+const plain = x => !!x && (Object.getPrototypeOf(x) === Object.prototype || Object.getPrototypeOf(x) === null);
+const exact = (x, keys) => plain(x) && Reflect.ownKeys(x).length === keys.length && keys.every(k => Object.hasOwn(x, k) && Object.hasOwn(Object.getOwnPropertyDescriptor(x, k), "value"));
+const instanceOK = x => typeof x === "string" && x.length >= 1 && x.length <= 128;
+export function checkEffectPosters(value) {
+  if (!exact(value, ["rev", "posters"]) || !Number.isSafeInteger(value.rev) || value.rev < 0 || !Array.isArray(value.posters) || value.posters.length > 2) return null;
+  const out = [], ids = new Set(), descriptors = Object.getOwnPropertyDescriptors(value.posters);
+  if (Reflect.ownKeys(descriptors).length !== value.posters.length + 1) return null;
+  for (let n = 0; n < value.posters.length; n++) {
+    const descriptor = descriptors[n]; if (!descriptor || !Object.hasOwn(descriptor, "value")) return null;
+    const p = descriptor.value;
+    // Titles are display-only, never selectors/URLs/CSS. The server's normalized UTF-16 input bound is 400.
+    if (!exact(p, ["id", "title"]) || typeof p.id !== "string" || !ID.test(p.id) || ids.has(p.id) || typeof p.title !== "string" || p.title.length < 1 || p.title.length > 400) return null;
+    ids.add(p.id); out.push(Object.freeze({ id: p.id, title: p.title }));
+  }
+  return Object.freeze({ rev: value.rev, posters: Object.freeze(out) });
+}
+/** Refuse animation/non-PNG/oversized images before DOM decode. This is not a CRC or compressed-data decoder. */
+export function checkStaticEffectPoster(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length < 45 || bytes.length > 1048576 || [137, 80, 78, 71, 13, 10, 26, 10].some((b, n) => bytes[n] !== b)) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength), width = view.getUint32(16), height = view.getUint32(20);
+  if (!width || !height || width > 4096 || height > 4096 || width * height > 8388608) return null;
+  let offset = 8, count = 0, data = false;
+  while (offset + 12 <= bytes.length && ++count <= 4096) {
+    const length = view.getUint32(offset), type = String.fromCharCode(...bytes.subarray(offset + 4, offset + 8));
+    if (offset + length + 12 > bytes.length || ["acTL", "fcTL", "fdAT"].includes(type) || (count === 1 ? type !== "IHDR" || length !== 13 : type === "IHDR")) return null;
+    if (type === "IDAT" && length) data = true;
+    offset += length + 12;
+    if (type === "IEND") return !length && data && offset === bytes.length ? new Uint8Array(bytes) : null;
+  }
+  return null;
+}
+/** Two physical requests per Window, across canceled/replaced readers; cancellation does not release early. */
+export function createEffectPosterReader({ window: host, current } = {}) {
+  const unavailable = { ok: false, dispose() {} };
+  if (!host || typeof current !== "function" || ![host.fetch, host.AbortController, host.setTimeout, host.clearTimeout, host.performance?.now].every(x => typeof x === "function")) return unavailable;
+  if (!pools.has(host)) pools.set(host, new Set());
+  const all = pools.get(host), own = new Set(); let dead = false, revoked = false, previous = null;
+  const alive = () => !dead && !revoked && current() === true;
+  function stop() { if (dead) return; dead = true; for (const op of own) op.abort(); }
+  function now() {
+    let n; try { n = host.performance.now(); } catch { stop(); return null; }
+    if (!Number.isFinite(n) || n < 0 || previous !== null && n < previous) { stop(); return null; }
+    previous = n; return n;
+  }
+  function read(path, mime, limit, project, signal) {
+    if (!alive() || signal?.aborted || all.size >= 2) return Promise.resolve(null);
+    const began = now(); if (began === null) return Promise.resolve(null);
+    const controller = new host.AbortController(), op = {}; all.add(op); own.add(op);
+    let reader = null, body = null, cancellation = null, timer, release;
+    const cancelled = new Promise(resolve => { release = resolve; });
+    const cancelBody = () => {
+      if (cancellation) return cancellation;
+      try { cancellation = Promise.resolve(reader ? reader.cancel() : body?.cancel?.()).catch(() => {}); }
+      catch { cancellation = Promise.resolve(); }
+      return cancellation;
+    };
+    op.abort = () => { controller.abort(); if (body) void cancelBody(); release(null); };
+    const valid = () => {
+      const t = now();
+      if (!alive() || controller.signal.aborted || t === null || t < began || t - began >= 10000) { op.abort(); return false; }
+      return true;
+    };
+    const work = Promise.resolve().then(async () => {
+      if (!valid()) return null;
+      const response = await host.fetch(path, { credentials: "same-origin", cache: "no-store", redirect: "error", signal: controller.signal }); body = response.body;
+      if (!valid()) return null;
+      if ([401, 403, 409].includes(response.status)) { revoked = true; for (const pending of own) pending.abort(); return null; }
+      if (!response.ok || response.redirected || (response.headers.get("content-type") || "").split(";")[0].trim().toLowerCase() !== mime) return null;
+      const length = response.headers.get("content-length");
+      if (length !== null && (!/^(0|[1-9][0-9]*)$/.test(length) || !Number.isSafeInteger(Number(length)) || Number(length) > limit) || typeof body?.getReader !== "function") return null;
+      reader = body.getReader(); const chunks = []; let size = 0;
+      for (;;) {
+        const part = await reader.read(); if (!valid()) return null;
+        if (part.done) break;
+        if (!(part.value instanceof Uint8Array) || (size += part.value.length) > limit) return null;
+        chunks.push(new Uint8Array(part.value));
+      }
+      const bytes = new Uint8Array(size); let offset = 0; for (const part of chunks) { bytes.set(part, offset); offset += part.length; }
+      if (!valid()) return null; const answer = project(bytes); return valid() ? answer : null;
+    }).catch(() => null).finally(async () => {
+      controller.abort(); await cancelBody(); all.delete(op); own.delete(op); host.clearTimeout(timer); signal?.removeEventListener("abort", op.abort);
+    });
+    timer = host.setTimeout(op.abort, 10000); signal?.addEventListener("abort", op.abort, { once: true });
+    return Promise.race([work, cancelled]);
+  }
+  return { ok: true,
+    summary(instance, signal) {
+      return instanceOK(instance) ? read(`/ui/effect-posters?instance=${encodeURIComponent(instance)}`, "application/json", 8192, bytes => {
+        try { return checkEffectPosters(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes))); } catch { return null; }
+      }, signal) : Promise.resolve(null);
+    },
+    image(instance, id, signal) {
+      return instanceOK(instance) && typeof id === "string" && ID.test(id) ? read(`/ui/effect-posters/${id}.png?instance=${encodeURIComponent(instance)}`, "image/png", 1048576, checkStaticEffectPoster, signal) : Promise.resolve(null);
+    }, dispose: stop,
+  };
+}

package/dist/ui/shared/effect-posters.js

@@ -0,0 +1,117 @@
+/** #1629: static current-chat posters. No Worker, preview frame, events, profile write or personal-slot authority. */
+import { createEffectPosterReader, checkEffectPosters } from "./effect-poster-reader.js";
+import { createEffectGeometry, hostEffectRect } from "./effect-geometry.js";
+import { stockEffectTrust } from "./effect-stock-trust.js";
+import { effectStockSnapshot } from "./effect-stock-snapshot.js";
+const decoding = new WeakMap();
+export function createChatPosters({ window: host, name, element, current, observe, factories = {} } = {}) {
+  let dead = false, failed = false, generation = 0, allowed = false, metadata = null, request = null, queued = false, raf = null;
+  let root = null, geometry = null, reader = null, mutation = null, resize = null, offAuth = null;
+  const rows = new Map(), offs = [];
+  const alive = () => !dead && current() === true && element?.isConnected === true && element.ownerDocument === host.document && host.document.body.dataset.mode === "full" && !host.AgendAuth.sessionEnded();
+  const make = (key, fallback) => factories[key] ?? fallback;
+  const gate = () => {
+    try {
+      const x = observe();
+      if (!alive() || x.shown !== true || x.fallback !== true || host.document.visibilityState !== "visible") return null;
+      const rect = hostEffectRect(element), proof = effectStockSnapshot(make("stock", stockEffectTrust)(host, { frameRoot: root, ownerCss: x.ownerCss }));
+      if (!rect || !proof || rect.x + rect.width <= 0 || rect.y + rect.height <= 0 || rect.x >= host.innerWidth || rect.y >= host.innerHeight) return null;
+      return { rect, proof };
+    } catch { return null; }
+  };
+  function clear() {
+    for (const row of rows.values()) {
+      row.controller.abort(); row.binding?.remove?.(); row.image.remove();
+      if (row.url) host.URL.revokeObjectURL(row.url);
+    }
+    rows.clear(); geometry?.hide?.();
+  }
+  function cancel() { generation++; request?.controller.abort(); clear(); metadata = null; }
+  function fail() { if (dead) return; failed = true; cancel(); }
+  function dispose() {
+    if (dead) return; dead = true; cancel(); reader?.dispose?.();
+    if (raf !== null) host.cancelAnimationFrame(raf); raf = null;
+    for (const off of offs) { try { off(); } catch { /* release all */ } }
+    offAuth?.(); mutation?.disconnect(); resize?.disconnect(); geometry?.dispose?.(); root?.remove();
+  }
+  const unavailable = () => ({ ok: false, dispose });
+  try {
+    if (!host?.document || typeof current !== "function" || typeof observe !== "function" || typeof name !== "string" || !name.length || name.length > 128 || host.document.body.dataset.mode !== "full" ||
+      ![host.MutationObserver, host.ResizeObserver, host.requestAnimationFrame, host.cancelAnimationFrame, host.URL?.createObjectURL, host.URL?.revokeObjectURL, host.Blob, host.AbortController, host.setTimeout, host.clearTimeout, host.performance?.now, host.AgendAuth?.onSessionEnd, host.AgendAuth?.sessionEnded].every(x => typeof x === "function")) return unavailable();
+    offAuth = host.AgendAuth.onSessionEnd(dispose);
+    if (!alive()) { dispose(); return unavailable(); }
+    root = host.document.createElement("div"); root.className = "agend-effect-layer"; host.document.body.append(root);
+    geometry = make("geometry", createEffectGeometry)({ window: host }); if (!geometry.ok) throw Error("geometry unavailable");
+    reader = make("reader", createEffectPosterReader)({ window: host, current: alive }); if (!reader.ok) throw Error("reader unavailable");
+    if (!decoding.has(host)) decoding.set(host, new Set());
+    mutation = new host.MutationObserver(invalidate); mutation.observe(host.document.documentElement, { subtree: true, childList: true, attributes: true, characterData: true });
+    resize = new host.ResizeObserver(invalidate); resize.observe(host.document.documentElement); resize.observe(element);
+    for (const type of ["scroll", "resize", "orientationchange"]) { host.addEventListener(type, invalidate, true); offs.push(() => host.removeEventListener(type, invalidate, true)); }
+    const visibility = () => { if (host.document.visibilityState !== "visible") { cancel(); allowed = false; } invalidate(); };
+    host.document.addEventListener("visibilitychange", visibility); offs.push(() => host.document.removeEventListener("visibilitychange", visibility));
+    host.addEventListener("pagehide", dispose); offs.push(() => host.removeEventListener("pagehide", dispose));
+  } catch { dispose(); return unavailable(); }
+  function schedule() { if (alive() && raf === null) raf = host.requestAnimationFrame(() => { raf = null; sync(); }); }
+  function invalidate() { if (dead) return; geometry.hide(); schedule(); }
+  function valid(mine) { return alive() && generation === mine && !failed && !!gate(); }
+  async function loadImage(row, mine) {
+    try {
+      const bytes = await reader.image(name, row.id, row.controller.signal);
+      if (!valid(mine) || rows.get(row.id) !== row) return;
+      if (!bytes) { fail(); return; }
+      const pending = decoding.get(host); if (pending.size >= 2) { fail(); return; }
+      const token = {}; pending.add(token);
+      let timer = null, aborted = false;
+      const abort = () => { aborted = true; row.controller.abort(); if (rows.get(row.id) === row) fail(); };
+      try {
+        const began = host.performance.now();
+        if (!Number.isFinite(began) || began < 0) { fail(); return; }
+        timer = host.setTimeout(abort, 10000);
+        row.url = host.URL.createObjectURL(new host.Blob([bytes], { type: "image/png" }));
+        row.image.src = row.url;
+        await row.image.decode();
+        if (aborted || !valid(mine) || rows.get(row.id) !== row) return;
+        const ended = host.performance.now();
+        if (!Number.isFinite(ended) || ended < began || ended - began >= 10000) { fail(); return; }
+        const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+        if (row.image.naturalWidth !== view.getUint32(16) || row.image.naturalHeight !== view.getUint32(20)) { fail(); return; }
+        row.ready = true; sync();
+      } finally { host.clearTimeout(timer); pending.delete(token); }
+    } catch { if (alive() && generation === mine) fail(); }
+  }
+  async function read() {
+    const op = { controller: new host.AbortController(), generation }; request = op;
+    try {
+      const result = await reader.summary(name, op.controller.signal);
+      if (!valid(op.generation) || request !== op) return;
+      const checked = checkEffectPosters(result);
+      if (!checked) { fail(); return; }
+      metadata = checked;
+      for (const p of checked.posters) {
+        const image = host.document.createElement("img"); image.className = "agend-effect-poster"; image.setAttribute("alt", ""); image.setAttribute("aria-hidden", "true"); image.decoding = "async";
+        root.append(image);
+        const binding = geometry.bind(image, { layer: "behind", by: "agent" });
+        if (!binding.ok || typeof image.decode !== "function") { binding.remove?.(); image.remove(); fail(); return; }
+        const row = { id: p.id, image, binding, controller: new host.AbortController(), url: null, ready: false }; rows.set(p.id, row);
+        // The IMG is proved hidden synchronously before any source is assigned or control yields.
+        void loadImage(row, op.generation);
+      }
+    } catch { if (alive() && generation === op.generation) fail(); }
+    finally { if (request === op) request = null; if (queued && alive()) { queued = false; sync(); } }
+  }
+  function sync() {
+    if (!alive()) { dispose(); return; }
+    geometry.hide();
+    const evidence = gate();
+    if (!evidence) { if (allowed) cancel(); allowed = false; return; }
+    allowed = true;
+    if (failed) return;
+    for (const row of rows.values()) if (row.ready && !row.binding.sync(evidence.rect, evidence.proof)) { fail(); return; }
+    if (!metadata && !request) void read();
+    if (rows.size) schedule();
+  }
+  return { ok: true, sync,
+    changed() { if (!alive()) return; cancel(); failed = false; if (request) queued = true; else sync(); },
+    dispose, snapshot: () => ({ failed, count: rows.size, ready: [...rows.values()].filter(r => r.ready).length }),
+  };
+}

package/dist/ui/shared/effect-profiler.js

@@ -0,0 +1,162 @@
+/** #1629: host observations only. This pure module mounts nothing and accepts no frame/Worker messages. */
+const finite = v => typeof v === "number" && Number.isFinite(v);
+const plain = v => !!v && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
+const DAY = 86400000;
+export const EFFECT_BUDGETS = Object.freeze({
+  standard: Object.freeze({ fps: 55, longTaskMsPerSecond: 50 }),
+  constrained: Object.freeze({ fps: 50, longTaskMsPerSecond: 25 }),
+});
+const deviceClass = v => v === "standard" || v === "constrained";
+const id = v => typeof v === "string" && /^[0-9a-f]{32}$/.test(v);
+
+/** One host-owned mount. The registry must remove the frame when remove is true, never merely hide it. */
+export class EffectBudget {
+  constructor({ device, baselineFps, clock = () => performance.now(), longTasksSupported = false } = {}) {
+    if (!deviceClass(device) || !finite(baselineFps) || baselineFps <= 0 || baselineFps > 1000 || typeof clock !== "function" || typeof longTasksSupported !== "boolean") throw new TypeError("effect budget options");
+    this.device = device;
+    // Measured by the host while NO effects are mounted; never author-supplied or learned from a running effect.
+    this.fpsFloor = Math.min(EFFECT_BUDGETS[device].fps, baselineFps * 0.9);
+    this.clock = clock;
+    this.longTasksSupported = longTasksSupported;
+    this.last = null;
+    this.epoch = this.time();
+    this.lastWindow = null;
+    this.frames = [];
+    this.tasks = [];
+    this.overflow = false;
+    this.hiddenAt = null;
+    this.verdict = "ok";
+    this.reason = null;
+    this.badWindows = 0;
+    this.metrics = null;
+    this.loadMs = null;
+    if (this.epoch === null) this.stop("clock_unavailable");
+  }
+  time() {
+    let now;
+    try { now = this.clock(); } catch { return null; }
+    if (!finite(now) || now < 0 || this.last !== null && now < this.last) return null;
+    this.last = now;
+    return now;
+  }
+  stop(reason = "stopped") {
+    if (this.verdict === "paused") return this.snapshot();
+    this.verdict = "paused";
+    this.reason = reason;
+    this.frames = [];
+    this.tasks = [];
+    return this.snapshot();
+  }
+  /** Invoke on host-observed load, not on child-provided timing. First load only. */
+  loaded() {
+    const now = this.time();
+    if (now === null) return this.stop("clock_unavailable");
+    if (this.verdict !== "paused" && this.loadMs === null) this.loadMs = now - this.epoch;
+    return this.snapshot();
+  }
+  /** Invoke from the host's rAF callback; elapsed time always comes from the host clock. */
+  frame() {
+    const now = this.time();
+    if (now === null) return this.stop("clock_unavailable");
+    if (this.verdict === "paused" || this.hiddenAt !== null || now < this.epoch + 1000) return this.snapshot();
+    this.trim(now);
+    if (this.frames.at(-1) !== now) {
+      if (this.frames.length >= 2048) this.overflow = true;
+      else this.frames.push(now);
+    }
+    return this.snapshot();
+  }
+  /** Only the host observer calls this. `attributed` means it matched THIS host-owned container. */
+  longTask(start, duration, attributed = false) {
+    const now = this.time();
+    if (now === null) return this.stop("clock_unavailable");
+    if (this.verdict === "paused" || this.hiddenAt !== null || !this.longTasksSupported) return false;
+    if (!finite(start) || start < 0 || !finite(duration) || duration < 50 || duration > 60000 || start + duration > now || typeof attributed !== "boolean") return false;
+    const from = Math.max(start, this.epoch + 1000, now - 2000), to = start + duration;
+    if (from >= to) return false;
+    this.trim(now);
+    if (this.tasks.length >= 256) { this.overflow = true; return false; }
+    this.tasks.push({ from, to, attributed });
+    return true;
+  }
+  trim(now) {
+    this.frames = this.frames.filter(t => t > now - 2000);
+    this.tasks = this.tasks.filter(t => t.to > now - 2000);
+  }
+  /** Strict booleans: unknown page gates fail closed. No setting can revive a paused mount. */
+  gates(raw = {}) {
+    const now = this.time();
+    if (now === null) return this.stop("clock_unavailable");
+    if (!plain(raw)) return this.stop("gates_unknown");
+    const { hidden, reducedMotion, saveData, show } = raw;
+    if ([hidden, reducedMotion, saveData, show].some(v => typeof v !== "boolean")) return this.stop("gates_unknown");
+    if (this.verdict === "paused") return this.snapshot();
+    if (reducedMotion || saveData || !show) return this.stop(reducedMotion ? "reduced_motion" : saveData ? "save_data" : "viewer_off");
+    if (hidden && this.hiddenAt === null) this.hiddenAt = now;
+    if (hidden && now - this.hiddenAt >= 10000) return this.stop("hidden");
+    if (!hidden && this.hiddenAt !== null) {
+      // A delayed visibility callback must not revive a frame whose removal deadline already passed.
+      if (now - this.hiddenAt >= 10000) return this.stop("hidden");
+      this.hiddenAt = null;
+      this.epoch = now;
+      this.lastWindow = null;
+      this.frames = [];
+      this.tasks = [];
+      this.overflow = false;
+      this.badWindows = 0;
+      this.metrics = null;
+    }
+    return this.snapshot();
+  }
+  /** Poll no faster than once per second; a delayed callback never fabricates missed windows. */
+  poll() {
+    const now = this.time();
+    if (now === null) return this.stop("clock_unavailable");
+    if (this.verdict === "paused") return this.snapshot();
+    if (this.hiddenAt !== null) return now - this.hiddenAt >= 10000 ? this.stop("hidden") : this.snapshot();
+    if (now < this.epoch + 3000 || this.lastWindow !== null && now - this.lastWindow < 1000) return this.snapshot();
+    this.lastWindow = now;
+    this.trim(now);
+    const sum = attributed => this.tasks.filter(t => attributed === null || t.attributed === attributed)
+      .reduce((n, t) => n + Math.max(0, t.to - Math.max(t.from, now - 2000)), 0) / 2;
+    const fps = this.frames.length / 2;
+    const hostMs = this.longTasksSupported ? sum(null) : null;
+    const ownMs = this.longTasksSupported && this.tasks.some(t => t.attributed) ? sum(true) : null;
+    const limits = EFFECT_BUDGETS[this.device];
+    const bad = this.overflow || fps < this.fpsFloor || hostMs !== null && hostMs > limits.longTaskMsPerSecond;
+    this.metrics = { at: now, hostFps: fps, hostLongTaskMsPerSecond: hostMs, attributedLongTaskMsPerSecond: ownMs,
+      attribution: ownMs === null ? "unknown" : "observed", fpsFloor: this.fpsFloor, windowMs: 2000 };
+    this.overflow = false;
+    if (bad) {
+      this.badWindows++;
+      this.verdict = "degraded";
+      this.reason = "host_budget";
+      if (this.badWindows >= 3) return this.stop("host_budget");
+    } else this.badWindows = 0;
+    return this.snapshot();
+  }
+  snapshot() {
+    const remove = this.verdict === "paused";
+    return { verdict: this.verdict, reason: this.reason, remove, forward: !remove && this.hiddenAt === null,
+      quality: this.verdict === "ok" ? "normal" : "low", pointerHz: this.verdict === "ok" ? 60 : 30,
+      badWindows: this.badWindows, loadMs: this.loadMs, metrics: this.metrics ? { ...this.metrics } : null };
+  }
+}
+
+/** Persisted calendar policy is separate from monotonic measurement. No storage is opened by this module. */
+export function newEffectPauseHistory(effectId, device, wall) {
+  if (!id(effectId) || !deviceClass(device) || !finite(wall) || wall < 0) return null;
+  return { v: 1, id: effectId, device, pauses: [], off: false, lastWall: wall };
+}
+export function recordEffectPause(history, wall) {
+  if (!plain(history) || Object.keys(history).sort().join(",") !== "device,id,lastWall,off,pauses,v" || history.v !== 1 || !id(history.id) || !deviceClass(history.device) || typeof history.off !== "boolean" || !finite(history.lastWall) || history.lastWall < 0 || !finite(wall) || wall < 0 || !Array.isArray(history.pauses) || history.pauses.length > 3) return { ok: false, error: "pause_history_unknown" };
+  let previous = -1;
+  for (const at of history.pauses) {
+    if (!finite(at) || at < 0 || at < previous || at > history.lastWall) return { ok: false, error: "pause_history_unknown" };
+    previous = at;
+  }
+  // A wall-clock rollback cannot age out pauses. A forward jump can; off remains sticky for this content id.
+  const now = Math.max(wall, history.lastWall);
+  const pauses = [...history.pauses.filter(t => t > now - DAY), now].slice(-3);
+  return { ok: true, history: { ...history, pauses, lastWall: now, off: history.off || pauses.length >= 3 } };
+}

package/dist/ui/shared/effect-profiles.js

@@ -0,0 +1,65 @@
+/** #1629: bounded host-window quantiles; not a frame message handler or admission verdict. */
+const plain = o => !!o && (Object.getPrototypeOf(o) === Object.prototype || Object.getPrototypeOf(o) === null);
+const finite = x => typeof x === "number" && Number.isFinite(x);
+const bounded = (x, max) => finite(x) && x >= 0 && x <= max;
+const reasons = [null, "host_budget", "clock_unavailable", "gates_unknown", "hidden", "reduced_motion", "save_data", "viewer_off"];
+const keys = ["key", "id", "device", "verdict", "reason", "remove", "forward", "quality", "pointerHz", "badWindows", "loadMs", "metrics"];
+const metricKeys = ["at", "hostFps", "hostLongTaskMsPerSecond", "attributedLongTaskMsPerSecond", "attribution", "fpsFloor", "windowMs"];
+const exact = (o, allowed) => plain(o) && Object.keys(o).sort().join(",") === [...allowed].sort().join(",");
+const quantile = (values, q) => { if (!values.length) return null; const a = [...values].sort((x, y) => x - y); return a[Math.max(0, Math.ceil(q * a.length) - 1)]; };
+
+/** A new collector belongs to one exact registry key/id/class mount. It never reads message content or child data. */
+export function createEffectProfileCollector(options = {}) {
+  let key, id, device, clock;
+  try { if (!exact(options, ["key", "id", "device", "clock"])) return { ok: false }; ({ key, id, device, clock } = options); } catch { return { ok: false }; }
+  if (typeof key !== "string" || key.length < 1 || key.length > 256 || typeof id !== "string" || !/^[a-f0-9]{32}$/.test(id) || !["standard", "constrained"].includes(device) || typeof clock !== "function") return { ok: false };
+  let dead = false, previous = null, lastSample = null, floor = null, last = null;
+  const samples = [];
+  const time = () => {
+    let n; try { n = clock(); } catch { dead = true; return null; }
+    if (!finite(n) || n < 0 || previous !== null && n < previous) { dead = true; return null; }
+    previous = n; return n;
+  };
+  if (time() === null) return { ok: false };
+  return { ok: true,
+    add(raw) {
+      if (dead) return false;
+      try {
+        // Reject unknown keys without reading their values or accessors.
+        if (!exact(raw, keys) || raw.key !== key || raw.id !== id || raw.device !== device || !["ok", "degraded", "paused"].includes(raw.verdict) || !reasons.includes(raw.reason)
+          || typeof raw.remove !== "boolean" || typeof raw.forward !== "boolean" || raw.remove !== (raw.verdict === "paused") || raw.remove && raw.forward
+          || raw.quality !== (raw.verdict === "ok" ? "normal" : "low") || raw.pointerHz !== (raw.verdict === "ok" ? 60 : 30)
+          || !Number.isInteger(raw.badWindows) || raw.badWindows < 0 || raw.badWindows > 3 || raw.loadMs !== null && !bounded(raw.loadMs, 600000)) { dead = true; return false; }
+        const n = time(); if (n === null) return false;
+        // Warmup is not an observed window and never turns missing measurements into zero cost.
+        if (raw.metrics === null) return false;
+        const m = raw.metrics;
+        if (!exact(m, metricKeys) || !finite(m.at) || m.at < 0 || m.at > n || !bounded(m.hostFps, 1000) || !finite(m.fpsFloor) || m.fpsFloor <= 0 || m.fpsFloor > 1000 || m.windowMs !== 2000
+          || m.hostLongTaskMsPerSecond !== null && !bounded(m.hostLongTaskMsPerSecond, 256000)
+          || m.attributedLongTaskMsPerSecond !== null && (!bounded(m.attributedLongTaskMsPerSecond, 256000) || m.hostLongTaskMsPerSecond === null || m.attributedLongTaskMsPerSecond > m.hostLongTaskMsPerSecond)
+          || m.attribution !== (m.attributedLongTaskMsPerSecond === null ? "unknown" : "observed") || floor !== null && m.fpsFloor !== floor) { dead = true; return false; }
+        // Only poll() creates a window. rAF/gates/load/stop snapshots retain its immutable host timestamp.
+        // A paused duplicate may describe the last verdict, but cannot renew the observation or add a sample.
+        if (lastSample !== null && m.at === lastSample && last) last = { verdict: raw.verdict, reason: raw.reason, loadMs: raw.loadMs };
+        if (n - m.at > 5000 || lastSample !== null && m.at - lastSample < 1000) return false;
+        floor = m.fpsFloor; lastSample = m.at;
+        samples.push({ fps: m.hostFps, task: m.hostLongTaskMsPerSecond, own: m.attributedLongTaskMsPerSecond });
+        if (samples.length > 120) samples.shift();
+        last = { verdict: raw.verdict, reason: raw.reason, loadMs: raw.loadMs };
+        return true;
+      } catch { dead = true; return false; }
+    },
+    report(options = {}) {
+      let off;
+      try { if (!plain(options) || Object.keys(options).some(k => k !== "off")) return null; off = options.off ?? false; } catch { dead = true; return null; }
+      if (dead || typeof off !== "boolean" || lastSample === null || !last) return null;
+      const n = time(); if (n === null || n - lastSample > 5000) return null;
+      const host = samples.filter(s => s.task !== null).map(s => s.task), own = samples.filter(s => s.own !== null).map(s => s.own), fps = samples.map(s => s.fps);
+      return { id, profile: { v: 1, device, verdict: off ? "off" : last.verdict, reason: last.reason, samples: samples.length,
+        fps_p50: quantile(fps, 0.5), fps_p10: quantile(fps, 0.1), fps_floor: floor,
+        long_task_p95: quantile(host, 0.95), long_task_samples: host.length,
+        attributed_long_task_p95: quantile(own, 0.95), attributed_samples: own.length, attribution: own.length ? "observed" : "unknown", load_ms: last.loadMs } };
+    },
+    dispose() { dead = true; samples.length = 0; last = null; },
+  };
+}