@telorun/analyzer 0.53.0 → 0.55.0

package/dist/analysis-registry.d.ts

@@ -36,6 +36,18 @@ export declare class AnalysisRegistry {
     /** An alias crossing no import boundary, never gated — `Self`, the `Telo` built-ins. */
     registerUngatedAlias(alias: string, target: string): void;
     resolveKind(kind: string): string | undefined;
+    /** Rewrite `telo://Self/<type>` / `telo://<Alias>/<type>` schema references in
+     *  `manifests` to the canonical id their type registered under, in the scope
+     *  each doc was declared in. Idempotent — an already-canonical ref resolves to
+     *  no module and is left alone.
+     *
+     *  `analyze()` runs this over its own view; a caller holding a separately
+     *  flattened projection (the kernel's build-time validator warm, which must
+     *  resolve a `$ref` contract exactly as the runtime will) needs it applied to
+     *  that projection too. Exposed as a method because the alias tables are this
+     *  registry's, and handing them out would make every consumer's scoping its
+     *  own problem. */
+    resolveSchemaTypeRefs(manifests: ResourceManifest[]): void;
     /**
      * Iterates a resource's reference and scope fields as declared by its definition.
      * Calls onRef for each plain reference field and onScope for each scope field.
@@ -82,6 +94,14 @@ export declare class AnalysisRegistry {
      *  of modules. */
     private scopedDefResolver;
     private capabilitiesForRefs;
+    /** Like {@link capabilityForRef}, but a capability GROUP — an abstract with no
+     *  `capability` of its own that other capability abstracts extend, i.e.
+     *  `Telo.Executable` over Invocable and Runnable — expands to its leaves.
+     *  Classification consumers (the editor's port flavor) match against leaf
+     *  capabilities, so without expansion every `Telo.Executable` slot would fall
+     *  out of both classification sets and silently stop rendering — and so would
+     *  slots constrained to the next abstract-of-abstracts. */
+    private leafCapabilitiesForRef;
     /**
      * Walks a manifest's annotation sites (refs, scopes, schema-from, CEL) via
      * the shared manifest visitor, bound to this registry's definitions and

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAYvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAKhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;;;;uBAUmB;IACnB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1D;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAYvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAU3B;;;;;;+DAM2D;IAC3D,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -5,6 +5,7 @@ import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.
 import { visitManifest as runVisitManifest } from "./manifest-visitor.js";
 import { resolveContract } from "./invocation-contract.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
+import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 /**
  * Accumulates type and alias knowledge for a running kernel or analysis session.
  * Wraps AliasResolver and DefinitionRegistry into a single domain-level interface
@@ -33,6 +34,20 @@ export class AnalysisRegistry {
     resolveKind(kind) {
         return this.aliases.resolveKind(kind);
     }
+    /** Rewrite `telo://Self/<type>` / `telo://<Alias>/<type>` schema references in
+     *  `manifests` to the canonical id their type registered under, in the scope
+     *  each doc was declared in. Idempotent — an already-canonical ref resolves to
+     *  no module and is left alone.
+     *
+     *  `analyze()` runs this over its own view; a caller holding a separately
+     *  flattened projection (the kernel's build-time validator warm, which must
+     *  resolve a `$ref` contract exactly as the runtime will) needs it applied to
+     *  that projection too. Exposed as a method because the alias tables are this
+     *  registry's, and handing them out would make every consumer's scoping its
+     *  own problem. */
+    resolveSchemaTypeRefs(manifests) {
+        resolveSchemaTypeRefsIn(manifests, this.aliases, this.aliasesByModule);
+    }
     /**
      * Iterates a resource's reference and scope fields as declared by its definition.
      * Calls onRef for each plain reference field and onScope for each scope field.
@@ -132,12 +147,30 @@ export class AnalysisRegistry {
     capabilitiesForRefs(refs) {
         const out = [];
         for (const ref of refs) {
-            const cap = this.capabilityForRef(ref);
-            if (cap && !out.includes(cap))
-                out.push(cap);
+            for (const cap of this.leafCapabilitiesForRef(ref)) {
+                if (!out.includes(cap))
+                    out.push(cap);
+            }
         }
         return out;
     }
+    /** Like {@link capabilityForRef}, but a capability GROUP — an abstract with no
+     *  `capability` of its own that other capability abstracts extend, i.e.
+     *  `Telo.Executable` over Invocable and Runnable — expands to its leaves.
+     *  Classification consumers (the editor's port flavor) match against leaf
+     *  capabilities, so without expansion every `Telo.Executable` slot would fall
+     *  out of both classification sets and silently stop rendering — and so would
+     *  slots constrained to the next abstract-of-abstracts. */
+    leafCapabilitiesForRef(xTeloRef) {
+        const cap = this.capabilityForRef(xTeloRef);
+        if (!cap)
+            return [];
+        const leaves = this.defs
+            .getByExtends(cap)
+            .filter((d) => d.kind === "Telo.Abstract" && !d.capability)
+            .map((d) => `${d.metadata.module}.${d.metadata.name}`);
+        return leaves.length > 0 ? leaves : [cap];
+    }
     /**
      * Walks a manifest's annotation sites (refs, scopes, schema-from, CEL) via
      * the shared manifest visitor, bound to this registry's definitions and

package/dist/analyzer.d.ts

@@ -4,6 +4,7 @@ import { AnalysisRegistry } from "./analysis-registry.js";
 import { type CelHandlers } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { type ContractScope } from "./invocation-contract.js";
+import { type ZoneExportCache } from "./resolve-zone-requirements.js";
 import { type AnalysisDiagnostic, type AnalysisOptions } from "./types.js";
 /** The {@link ContractScope} the analyzer resolves invocation contracts in: kinds
  *  resolve in the module that declared the definition they were read off (so an
@@ -60,8 +61,8 @@ export declare class StaticAnalyzer {
      * `analyze()`. A missing position throws a clear error rather than
      * silently producing wrong diagnostics.
      */
-    analyze(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
-    analyzeErrors(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry): AnalysisDiagnostic[];
+    analyze(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry, zoneExportCache?: ZoneExportCache): AnalysisDiagnostic[];
+    analyzeErrors(manifests: ResourceManifest[], options?: AnalysisOptions, registry?: AnalysisRegistry, zoneExportCache?: ZoneExportCache): AnalysisDiagnostic[];
     normalize(manifests: ResourceManifest[], registry: AnalysisRegistry, crossModuleTargets?: ResourceManifest[]): ResourceManifest[];
     prepare(manifests: ResourceManifest[], registry: AnalysisRegistry): {
         diagnostics: AnalysisDiagnostic[];

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AA+BlC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA2jBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAgpCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EACL,aAAa,EAEb,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,0BAA0B,CAAC;AAsBlC,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAiBvF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAqF/F;;;;;uDAKuD;AACvD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAClC,aAAa,GAAG;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAAE,CAO9F;AA6FD;0CAC0C;AAC1C,eAAO,MAAM,eAAe,GAAI,OAAO;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OACT,CAAC;AAErD;8EAC8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAuBD;2DAC2D;AAC3D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CASjC;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAmBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAC3D,IAAI,CAiDN;AA8mBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAywCvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB,EAAE;IAMvB,SAAS,CACP,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,EAI1B,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GACtC,gBAAgB,EAAE;IAyBrB,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -5,6 +5,7 @@ import { buildCelEnvironment, buildImportInputCelEnvironment, buildTypedCelEnvir
 import { DefinitionRegistry } from "./definition-registry.js";
 import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { PERMISSIVE_CONTRACT, resolveContract, } from "./invocation-contract.js";
+import { buildCallGraph } from "./call-graph.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, KERNEL_GLOBAL_NAMES, mergeKernelGlobalsIntoContext, } from "./kernel-globals.js";
 import { buildObservedStateIndex, buildObservedStateResourcesSchema, collectRunReachableNames, observedStateRead, validateObservedStateDeclarations, } from "./validate-observed-state.js";
@@ -15,6 +16,9 @@ import { normalizeInlineResources } from "./normalize-inline-resources.js";
 import { REF_VALIDATION_SKIP_KINDS } from "./system-kinds.js";
 import { resolveRefSentinels } from "./resolve-ref-sentinels.js";
 import { resolveSchemaRefKinds } from "./resolve-schema-ref-kinds.js";
+import { runZoneAnalysis } from "./resolve-zone-requirements.js";
+import { validateZoneSlotDeclarations } from "./validate-zone-slots.js";
+import { validateDynamicSelectors, validateRefSlotDeclarations, } from "./validate-ref-slots.js";
 import { resolveSchemaTypeRefs } from "./resolve-schema-type-refs.js";
 import { validateSchemaTypeRefs } from "./validate-schema-type-refs.js";
 import { rewriteSyntheticOrigins } from "./rewrite-synthetic-origins.js";
@@ -380,23 +384,76 @@ function buildStepContextSchema(manifest, defSchema, allManifests, defs, aliases
     }
     return undefined;
 }
-/**
- * Capabilities whose instances structurally expose no `invoke`/`run` method, so
- * a step `invoke` of one always fails at runtime with ERR_RESOURCE_NOT_INVOKABLE
- * (kernel dispatch checks method presence, not capability — evaluation-context.ts).
- * `Telo.Service` is intentionally absent: some services are invocable (a function
- * handler dispatched directly, e.g. `Lambda.Function`), so it can't be rejected
- * statically without false positives. This is the sound subset of the runtime rule.
- */
 /** The built-in namespace: globally resolvable, crossing no import boundary. */
 const TELO_BUILTIN_MODULE = "Telo";
-const NON_INVOKABLE_CAPABILITIES = new Set([
-    "Telo.Provider",
+/** One mapping from a ref-slot issue to a diagnostic — the shape is identical
+ *  for the schema-level and the manifest-level (dynamic selector) checks. */
+function refSlotIssueDiagnostic(issue) {
+    return {
+        severity: DiagnosticSeverity.Error,
+        code: issue.code,
+        source: SOURCE,
+        message: issue.message,
+        data: {
+            resource: { kind: issue.manifest.kind, name: issue.manifest.metadata?.name },
+            filePath: issue.manifest.metadata?.source,
+            path: issue.path,
+        },
+    };
+}
+/**
+ * Is this kind acceptable in a slot that transfers control?
+ *
+ * The executable side is a POSITIVE test against the `Telo.Executable`
+ * hierarchy: a capability that is, or `extends`, `Telo.Executable` is
+ * executable, so a future executable capability opts in with one `extends:`
+ * edge — no name list here to keep in step. This replaced
+ * `NON_INVOKABLE_CAPABILITIES`, a maintained set of capabilities the analyzer
+ * believed could never be invoked, which was unsound in the direction that
+ * rejects working manifests: it listed `Telo.Provider`, and `Ai.Model` is a
+ * Provider the agent controller invokes directly — the divergence being
+ * structural versus nominal, since the kernel tests method presence at dispatch
+ * while any static test can only read a declared capability.
+ *
+ * Outside the hierarchy nothing is guessed: `Telo.Provider` (entry points by
+ * convention) and `Telo.Service` (some services are invocable) pass, an unknown
+ * capability passes (rejecting it would be the wrong polarity for third-party
+ * extensions), and only the kernel-owned capabilities whose CONTRACT has no
+ * entry point — `Telo.Type`, `Telo.Mount`, `Telo.Template`, `Telo.Sink` (a sink
+ * is written to through a direct contract on the controller instance, never
+ * dispatched) — are rejected. That last set is the capabilities' own
+ * definition, not a belief about controllers.
+ */
+function isExecutableKind(kind, defs, aliases) {
+    const canonical = aliases.resolveKind(kind) ?? kind;
+    const def = defs.resolve(canonical);
+    if (!def)
+        return true;
+    const capability = def.capability;
+    if (!capability)
+        return true;
+    if (capabilityExtendsExecutable(capability, defs))
+        return true;
+    return !NO_ENTRY_POINT_CAPABILITIES.has(capability);
+}
+/** Does this capability name `Telo.Executable` or extend it, transitively?
+ *  Derived from the abstract hierarchy at call time, never from a name list. */
+function capabilityExtendsExecutable(capability, defs) {
+    let current = capability;
+    const seen = new Set();
+    while (current && !seen.has(current)) {
+        if (current === "Telo.Executable")
+            return true;
+        seen.add(current);
+        current = defs.resolve(current)?.extends;
+    }
+    return false;
+}
+/** Kernel-owned capabilities whose contract declares no entry point. */
+const NO_ENTRY_POINT_CAPABILITIES = new Set([
     "Telo.Mount",
     "Telo.Type",
     "Telo.Template",
-    // A sink is written to through a direct contract on the controller instance,
-    // never dispatched — so invoking one is statically wrong.
     "Telo.Sink",
 ]);
 /**
@@ -414,9 +471,10 @@ const NON_INVOKABLE_CAPABILITIES = new Set([
  *     *kind* instead of an exported instance (`!ref Stream.Of`) — is a still-a-
  *     sentinel after Phase 2.5 resolution → `UNRESOLVED_REFERENCE` (runtime
  *     `ERR_RESOURCE_NOT_FOUND`).
- *   - Invokability: a resolved instance whose capability structurally has no
- *     invoke/run method (`NON_INVOKABLE_CAPABILITIES`) → `REFERENCE_KIND_MISMATCH`
- *     (runtime `ERR_RESOURCE_NOT_INVOKABLE`).
+ *   - Invokability: a resolved instance whose kind fails `isExecutableKind` —
+ *     outside the `Telo.Executable` hierarchy AND declaring a capability whose
+ *     contract has no entry point → `REFERENCE_KIND_MISMATCH` (runtime
+ *     `ERR_RESOURCE_NOT_INVOKABLE`).
  *
  * Generic and topology-driven — it walks steps via the same `x-telo-step-context`
  * / `x-telo-topology-role` annotations `buildStepContextSchema` uses (through the
@@ -506,17 +564,15 @@ function validateStepInvokeReferences(allManifests, defs, aliases) {
         // Resolved `{kind, name}` (or an inline `{kind, …}` definition) — the
         // instance exists. Mirror the kernel's ERR_RESOURCE_NOT_INVOKABLE, which
         // fires when the instance has neither an `invoke` nor a `run` method
-        // (evaluation-context.ts). That is a per-instance property, not a pure
-        // capability, so only capabilities that STRUCTURALLY expose no such method
-        // are rejected statically — Service is intentionally excluded, since some
-        // services are invocable (e.g. a function handler dispatched directly).
+        // (evaluation-context.ts). That is a per-instance property, so the static
+        // test only rejects a kind whose declared capability names no entry point.
         if (!value || typeof value !== "object" || Array.isArray(value))
             return;
         const kind = value.kind;
         if (typeof kind !== "string")
             return;
-        const capability = defs.resolve(aliases.resolveKind(kind) ?? kind)?.capability;
-        if (typeof capability === "string" && NON_INVOKABLE_CAPABILITIES.has(capability)) {
+        if (!isExecutableKind(kind, defs, aliases)) {
+            const capability = defs.resolve(aliases.resolveKind(kind) ?? kind)?.capability;
             diagnostics.push({
                 severity: DiagnosticSeverity.Error,
                 code: "REFERENCE_KIND_MISMATCH",
@@ -774,7 +830,7 @@ export class StaticAnalyzer {
      * `analyze()`. A missing position throws a clear error rather than
      * silently producing wrong diagnostics.
      */
-    analyze(manifests, options, registry) {
+    analyze(manifests, options, registry, zoneExportCache) {
         assertManifestPositions(manifests);
         const diagnostics = [];
         // Use pre-seeded registries from the provided AnalysisRegistry, or create fresh ones.
@@ -943,6 +999,8 @@ export class StaticAnalyzer {
         // of alias choices. `capability` covers the legacy implements-this-abstract overload;
         // `extends` is the canonical first-class form.
         const refConstraintIssues = [];
+        const refSlotIssues = [];
+        const zoneSlotIssues = [];
         for (const m of manifests) {
             if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract")
                 continue;
@@ -959,11 +1017,35 @@ export class StaticAnalyzer {
             // still on the deprecated form — or with a constraint that no longer
             // resolves — is not the consumer's to fix, and every import would
             // otherwise flood `telo check` with unactionable noise.
-            if (!ownModule || rootModules.has(ownModule))
+            if (!ownModule || rootModules.has(ownModule)) {
                 refConstraintIssues.push(...issues);
+                refSlotIssues.push(...validateRefSlotDeclarations(m));
+                zoneSlotIssues.push(...validateZoneSlotDeclarations(m));
+            }
             const resolvedCapability = def.capability
                 ? (scopeResolver.resolveKind(def.capability) ?? def.capability)
                 : def.capability;
+            // `Telo.Executable` is a slot constraint — the x-telo-ref parent of
+            // Invocable and Runnable — and names no lifecycle role. The kernel
+            // rejects it at load; without this the analyzer would report "no issues"
+            // on a manifest that cannot boot.
+            if (resolvedCapability === "Telo.Executable" &&
+                (!ownModule || rootModules.has(ownModule))) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "CAPABILITY_NOT_DECLARABLE",
+                    source: SOURCE,
+                    message: `'${def.metadata?.name}' declares capability: Telo.Executable, which is an ` +
+                        `x-telo-ref slot constraint (the parent Telo.Invocable and Telo.Runnable extend), ` +
+                        `not a declarable lifecycle role. Declare 'Telo.Invocable' (invoke) or ` +
+                        `'Telo.Runnable' (run) instead.`,
+                    data: {
+                        resource: { kind: m.kind, name: m.metadata?.name },
+                        filePath: m.metadata?.source,
+                        path: "capability",
+                    },
+                });
+            }
             const resolvedExtends = def.extends
                 ? (scopeResolver.resolveKind(def.extends) ?? def.extends)
                 : def.extends;
@@ -992,6 +1074,23 @@ export class StaticAnalyzer {
                 };
                 const filePath = issue.manifest.metadata?.source;
                 const data = { resource, filePath, path: issue.path };
+                if (issue.annotation === "zone") {
+                    // Mirrors X_TELO_REF_UNRESOLVED: an unresolvable provider kind would
+                    // leave the requirement silently unenforced — no provider ever
+                    // matches a kind that does not exist.
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "ZONE_PROVIDER_UNRESOLVED",
+                        source: SOURCE,
+                        message: `x-telo-requires-zone '${issue.ref}' at '${issue.path}' names no kind. The prefix ` +
+                            `must be an import alias declared in this file's 'imports:' map, 'Self' for a kind ` +
+                            `in this library, or 'Telo' for a built-in. An unresolvable zone would leave the ` +
+                            `requirement silently unenforced. Known aliases: ` +
+                            `${issue.knownAliases?.join(", ") || "(none)"}.`,
+                        data,
+                    });
+                    continue;
+                }
                 if (issue.reason === "legacy") {
                     diagnostics.push({
                         severity: DiagnosticSeverity.Warning,
@@ -1031,6 +1130,31 @@ export class StaticAnalyzer {
                 }
             }
             diagnostics.push(...validateReferenceForms(manifests, defs, aliases, aliasesByModule));
+            // The x-telo-ref annotation's own validity — the strict half of the
+            // accessor split; `readRefSlot` stays lenient so surfaces keep working
+            // mid-migration, and this reports what leniency would silently absorb.
+            for (const issue of refSlotIssues)
+                diagnostics.push(refSlotIssueDiagnostic(issue));
+            // Same split for the two zone annotations. Unreadable ones fail in
+            // OPPOSITE directions — a dropped requirement is silently unenforced, a
+            // dropped provision invents failures — so neither can be left to
+            // leniency.
+            for (const issue of zoneSlotIssues) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: issue.code,
+                    source: SOURCE,
+                    message: issue.message,
+                    data: {
+                        resource: {
+                            kind: issue.manifest.kind,
+                            name: issue.manifest.metadata?.name,
+                        },
+                        filePath: issue.manifest.metadata?.source,
+                        path: issue.path,
+                    },
+                });
+            }
         }
         // Phase 2: extract inline resources from x-telo-ref slots into first-class manifests
         const allManifests = normalizeInlineResources(manifests, defs, aliases, aliasesByModule);
@@ -1039,6 +1163,44 @@ export class StaticAnalyzer {
         // kernel controllers) see a uniform shape. Runs after normalize so both
         // original and inline-extracted manifests have their sentinels resolved.
         resolveRefSentinels(allManifests, aliases, aliasesByModule, [], defs);
+        // ONE typed reference graph per analysis. Both graph consumers in this
+        // pass (the dynamic-selector check and run-reachability) read the same
+        // build — constructing it per consumer is strictly more work than the
+        // walks it replaced, and performance is a core goal. Lazy, so a
+        // skipValidation pass with no observed state builds nothing.
+        let callGraphMemo;
+        const getCallGraph = () => (callGraphMemo ??= buildCallGraph(allManifests, defs, {
+            aliases,
+            aliasesByModule,
+        }));
+        // A `use` case map's selector written in CEL is a hard diagnostic — a call
+        // graph known only at runtime is not statically analyzable, and no fallback
+        // is conservative for every consumer. Scoped to the entry's own modules:
+        // a published dependency's manifest is not the consumer's to fix.
+        if (!options?.skipValidation) {
+            for (const issue of validateDynamicSelectors(allManifests, defs, aliases, aliasesByModule, getCallGraph())) {
+                const ownModule = issue.manifest.metadata?.module;
+                if (ownModule && !rootModules.has(ownModule))
+                    continue;
+                diagnostics.push(refSlotIssueDiagnostic(issue));
+            }
+            // Zone requirements — a projection over the same graph: propagate along
+            // `call` edges, discharge at providing slots under correlation, fire at
+            // terminating edges and boot. Imported libraries' export contracts are
+            // derived over their full documents (options.moduleDocuments — the
+            // flattened view no longer holds their internal dispatch chains), cached
+            // per library in the host-lifetime `zoneExportCache`.
+            diagnostics.push(...runZoneAnalysis({
+                manifests: allManifests,
+                graph: getCallGraph(),
+                defs,
+                aliases,
+                aliasesByModule,
+                rootModules,
+                moduleDocuments: options?.moduleDocuments,
+                cache: zoneExportCache,
+            }));
+        }
         // Phase 2.6: register each named `Telo.Type` resource's schema under its
         // canonical module-scoped id (`telo://<module>/<name>`), validate
         // `telo://Self|Alias/Type` schema refs resolve to one, then rewrite those
@@ -1195,7 +1357,7 @@ export class StaticAnalyzer {
         const observedState = buildObservedStateIndex(allManifests, defs, aliases, moduleScopes);
         const reportsObservedState = [...observedState.values()].some((r) => r.status);
         const runReachable = reportsObservedState
-            ? collectRunReachableNames(allManifests, defs, aliases)
+            ? collectRunReachableNames(getCallGraph())
             : new Set();
         // Build typed kernel globals schema so x-telo-context chain validation
         // recognises variables, secrets, resources, env automatically
@@ -1789,8 +1951,8 @@ export class StaticAnalyzer {
         // the chain root so position-index lookups land on the parent doc.
         return rewriteSyntheticOrigins(diagnostics, allManifests);
     }
-    analyzeErrors(manifests, options, registry) {
-        return this.analyze(manifests, options, registry).filter((d) => d.severity === DiagnosticSeverity.Error);
+    analyzeErrors(manifests, options, registry, zoneExportCache) {
+        return this.analyze(manifests, options, registry, zoneExportCache).filter((d) => d.severity === DiagnosticSeverity.Error);
     }
     normalize(manifests, registry, 
     // Forwarded foreign exports used only as cross-module resolution targets (see

package/dist/builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA2JvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAmsB/C,CAAC"}
+{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../src/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA6JvD,eAAO,MAAM,eAAe,EAAE,kBAAkB,EAqtB/C,CAAC"}

package/dist/builtins.js

@@ -134,7 +134,9 @@ const ROOT_LOGGING_SCHEMA = {
             type: "array",
             items: {
                 type: "object",
-                "x-telo-ref": "Telo.LogSink",
+                // A sink is written to directly by the logging pipeline, never through
+                // `ctx.invoke` — so from the Application's side it is held, not called.
+                "x-telo-ref": { kind: "Telo.LogSink", use: "dependency" },
                 "x-telo-inline": true,
             },
         },
@@ -143,9 +145,22 @@ const ROOT_LOGGING_SCHEMA = {
 };
 export const KERNEL_BUILTINS = [
     { kind: "Telo.Abstract", metadata: { name: "Template", module: "Telo" } },
-    { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" } },
+    // "Control can be transferred to this" — the parent of Invocable and Runnable,
+    // and the only thing a slot that accepts either needs to say. It is a SLOT
+    // CONSTRAINT, never a lifecycle role: `capability: Telo.Executable` is rejected
+    // because it is absent from the kernel's `KNOWN_CAPABILITIES` enum, which is
+    // what keeps "what a resource is" and "what a slot does with it" separate.
+    //
+    // `Telo.Service` is deliberately NOT under it. A Service's `run()` is a
+    // lifecycle start the kernel dispatches differently (no ambient scope, so
+    // inbound work roots its own trace), and admitting it here would make every
+    // step's `invoke:` slot accept a service. Boot-target slots that genuinely take
+    // `Runnable | Service` stay kind lists — the honest shape for a heterogeneous
+    // set.
+    { kind: "Telo.Abstract", metadata: { name: "Executable", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Runnable", module: "Telo" }, extends: "Telo.Executable" },
     { kind: "Telo.Abstract", metadata: { name: "Service", module: "Telo" } },
-    { kind: "Telo.Abstract", metadata: { name: "Invocable", module: "Telo" } },
+    { kind: "Telo.Abstract", metadata: { name: "Invocable", module: "Telo" }, extends: "Telo.Executable" },
     { kind: "Telo.Abstract", metadata: { name: "Mount", module: "Telo" } },
     { kind: "Telo.Abstract", metadata: { name: "Type", module: "Telo" } },
     {
@@ -544,12 +559,16 @@ export const KERNEL_BUILTINS = [
                     "x-telo-step-context": { invoke: "invoke", outputType: "outputType" },
                     type: "array",
                     items: {
+                        // A genuinely heterogeneous set stays a kind list: `Telo.Service` is
+                        // deliberately outside `Telo.Executable`, since a service's `run()`
+                        // is a lifecycle start the kernel dispatches without an ambient
+                        // scope.
+                        "x-telo-ref": { kind: ["Telo.Runnable", "Telo.Service"], use: "call" },
                         anyOf: [
-                            { type: "string", "x-telo-ref": "Telo.Runnable" },
-                            { type: "string", "x-telo-ref": "Telo.Service" },
+                            { type: "string" },
                             // Post-resolution shape that `resolveRefSentinels`
                             // substitutes a `!ref <name>` sentinel into. The
-                            // adjacent `x-telo-ref` constraints govern the kind
+                            // adjacent `x-telo-ref` constraint governs the kind
                             // check; this branch only admits the structural form so
                             // AJV doesn't reject a resolved ref.
                             {
@@ -569,9 +588,9 @@ export const KERNEL_BUILTINS = [
                                 required: ["ref"],
                                 properties: {
                                     ref: {
+                                        "x-telo-ref": { kind: ["Telo.Runnable", "Telo.Service"], use: "call" },
                                         anyOf: [
-                                            { type: "string", "x-telo-ref": "Telo.Runnable" },
-                                            { type: "string", "x-telo-ref": "Telo.Service" },
+                                            { type: "string" },
                                             {
                                                 type: "object",
                                                 required: ["kind", "name"],
@@ -603,6 +622,11 @@ export const KERNEL_BUILTINS = [
                                     name: { type: "string" },
                                     invoke: {
                                         "x-telo-topology-role": "invoke",
+                                        "x-telo-ref": {
+                                            kind: "Telo.Executable",
+                                            use: "call",
+                                            inputs: "/inputs",
+                                        },
                                         type: "object",
                                         required: ["kind", "name"],
                                         properties: {
@@ -610,10 +634,6 @@ export const KERNEL_BUILTINS = [
                                             name: { type: "string" },
                                         },
                                         additionalProperties: true,
-                                        anyOf: [
-                                            { "x-telo-ref": "Telo.Invocable" },
-                                            { "x-telo-ref": "Telo.Runnable" },
-                                        ],
                                     },
                                     inputs: {
                                         // Same annotation Run.Sequence steps carry: it is what makes