@telorun/kernel 0.80.0 → 0.82.0

package/src/evaluation-context.ts

@@ -29,8 +29,10 @@ import {
 } from "@telorun/sdk";
 import { RuntimeError } from "@telorun/sdk";
 import { evalPathCovers } from "@telorun/analyzer";
+import { effectOwnerOf, executeReturnedChain } from "./effect-scope.js";
 import {
   classifyInitFailures,
+  isDeferral,
   renderInitFailureText,
   summarizeInitFailures,
   type FailedResource,
@@ -491,12 +493,28 @@ export class EvaluationContext implements IEvaluationContext {
     { resource: ResourceManifest; instance: ResourceInstance }
   >();
 
-  /** Resources that have been created but not yet initialized (between phases). */
+  /** Resources that have been created but not yet initialized (between phases).
+   *  `source` is the manifest as REGISTERED, kept so a discarded instance is
+   *  rebuilt from what the author wrote rather than from the create-time
+   *  expansion of it. */
   protected readonly createdInstances = new Map<
     string,
-    { resource: ResourceManifest; instance: ResourceInstance; ctx: any }
+    { resource: ResourceManifest; instance: ResourceInstance; ctx: any; source: ResourceManifest }
   >();
 
+  /**
+   * Resources whose failed `init()` could not be rolled back.
+   *
+   * Withheld rather than retried: re-running `init()` from a state an inverse
+   * refused to restore is worse than not retrying, so the loop skips them and
+   * they are reported with both the init error and the refusing inverse.
+   */
+  private readonly withheldResources = new Set<string>();
+
+  /** Resources discarded after a failed `init()` and re-queued for creation.
+   *  Their re-creation is not progress — see the create sub-phase. */
+  private readonly recreatedResources = new Set<string>();
+
   /** Resources queued for initialization on this context node. */
   private pendingResources: ResourceManifest[] = [];
 
@@ -746,6 +764,20 @@ export class EvaluationContext implements IEvaluationContext {
    * Attach a child context to this node. The child's parent is set to this
    * context and the child is registered under the given name.
    */
+  /**
+   * Detach a child from this node — the inverse of {@link spawnChild}.
+   *
+   * A child is normally torn down in place, so this exists for the one case
+   * that discards it instead: an import whose instance is dropped and rebuilt
+   * must not leave its child in `children`, or this context's teardown cascades
+   * into a context whose replacement is already live. Here rather than in the
+   * controller, because how children are tracked is this class's own fact.
+   */
+  detachChild(child: IEvaluationContext): void {
+    const index = this.children.indexOf(child);
+    if (index >= 0) this.children.splice(index, 1);
+  }
+
   spawnChild<T extends IEvaluationContext>(child: T): T {
     child.parent = this;
     this.children.push(child);
@@ -843,11 +875,18 @@ export class EvaluationContext implements IEvaluationContext {
               resource: created.resource,
               instance: created.instance,
               ctx: created.ctx,
+              source: resource,
             });
             const idx = this.pendingResources.findIndex((m) => m.metadata.name === name);
             if (idx >= 0) this.pendingResources.splice(idx, 1);
             errors.delete(name);
-            progress = true;
+            // A FIRST creation is progress; RE-creating a resource whose init
+            // failed is not. Counting it would keep the loop alive on a
+            // permanently failing resource for every remaining pass, re-running
+            // `create()` each time — ten module loads for a broken import, ten
+            // pools for an unreachable database. Its retry still happens; what
+            // it no longer does is claim the environment moved.
+            if (!this.recreatedResources.has(name)) progress = true;
             const createdRes = created.resource;
             const refs = collectResourceRefs(createdRes);
             this.resourceDependencies.set(name, localDependencyNames(refs));
@@ -881,8 +920,8 @@ export class EvaluationContext implements IEvaluationContext {
       }
 
       // Init sub-phase
-      for (const [name, { resource, instance, ctx }] of [...this.createdInstances]) {
-        if (this.resourceInstances.has(name)) continue;
+      for (const [name, { resource, instance, ctx, source }] of [...this.createdInstances]) {
+        if (this.resourceInstances.has(name) || this.withheldResources.has(name)) continue;
         try {
           if (this.preInitHook) {
             this.preInitHook(
@@ -895,7 +934,68 @@ export class EvaluationContext implements IEvaluationContext {
               this,
             );
           }
-          if (instance.init) await instance.init(ctx);
+          const scope = effectOwnerOf(instance)?.effects;
+          scope?.openFrame("init");
+          try {
+            // What `init()` RETURNS is what undoes it. A controller that
+            // allocates nothing returns nothing; there is no `teardown()`, so an
+            // allocation outside the chain is one nothing will reclaim.
+            if (instance.init) await executeReturnedChain(await instance.init(ctx), scope);
+          } catch (error) {
+            // Recover before the next pass: the loop retries a failed init, and
+            // an init that registered a listener before it failed to connect
+            // would otherwise register that listener again on every pass.
+            //
+            // HOW MUCH unwinds depends on whether the instance survives. A
+            // deferral keeps it, so only the init frame goes — unwinding the
+            // create frame there would destroy what construction built (a
+            // connection's pool) and then re-init the same instance against it.
+            // A real failure discards the instance, so everything `create()`
+            // allocated on its behalf goes with it or nothing reclaims it.
+            const deferred = isDeferral(error);
+            const refused = (await (deferred ? scope?.unwindFrame() : scope?.unwindAll())) ?? [];
+            if (refused.length > 0) {
+              // Retrying from a state that could not be rolled back is worse
+              // than not retrying, so the resource is withheld with a cause
+              // naming both the init error and the inverse that refused. The
+              // entry stays in `createdInstances` so it is still reported as a
+              // failure; the loop skips it from here on.
+              this.withheldResources.add(name);
+              throw new RuntimeError(
+                "ERR_EFFECT_RECOVERY_FAILED",
+                `${resource.kind} '${name}' failed to initialize and could not be rolled back: ` +
+                  `${refused.map((f) => `'${f.reason}' (${errorText(f.error)})`).join(", ")}`,
+                [
+                  { severity: "error", message: errorText(error), resource: name },
+                  ...refused.map((f) => ({
+                    severity: "error" as const,
+                    message: `inverse '${f.reason}' refused: ${errorText(f.error)}`,
+                    resource: name,
+                  })),
+                ],
+              );
+            }
+            // A DEFERRAL is not a failure: it is the loop's own "your turn has
+            // not come" signal, raised when a ref names a resource that has not
+            // initialized yet. The instance stays — re-creating it would re-run
+            // `create()`, which for an import re-registers its alias and reloads
+            // its module, and for a template re-registers its children. Its init
+            // frame alone was unwound above, so the next pass re-inits a
+            // constructed resource rather than a dismantled one.
+            if (deferred) throw error;
+            // The inverses restored what init() touched OUTSIDE the instance;
+            // the instance's own half-built fields are beyond their reach, so
+            // the object goes too and the next pass builds a fresh one. That is
+            // what makes "retry from a clean state" literal rather than a
+            // convention each controller has to honour.
+            this.createdInstances.delete(name);
+            this.recreatedResources.add(name);
+            // Re-queued as REGISTERED, not as created: the create-time manifest
+            // has already been through compile-field expansion, and expanding
+            // it a second time would evaluate an author's expression twice.
+            this.pendingResources.push(source);
+            throw error;
+          }
           // Publish BEFORE registering: publication can fail (a kind returning
           // the reserved `status` key without declaring it, a report that does
           // not match `status:`), and a resource that failed must not be left
@@ -1133,8 +1233,29 @@ export class EvaluationContext implements IEvaluationContext {
       reportedStatus.delete(instance);
       startedInstances.delete(instance);
       completedInstances.delete(instance);
+      // Tearing a resource down IS unwinding its effects — every frame, newest
+      // first, LIFO within each. There is no `teardown()` to call: what undoes a
+      // resource is what its `init()` and `run()` returned.
+      const owner = effectOwnerOf(instance);
+      const refused = (await owner?.effects.unwindAll()) ?? [];
+      if (refused.length > 0) {
+        // Aggregate and continue: one refusing inverse must not strand the log
+        // sinks pinned last to outlive everything that might log on the way
+        // down.
+        failures.push({
+          resource: label,
+          error: new RuntimeError(
+            "ERR_EFFECT_RECOVERY_FAILED",
+            `${refused.length} inverse(s) refused: ` +
+              refused.map((f) => `'${f.reason}' (${errorText(f.error)})`).join(", "),
+          ),
+        });
+      }
+      // A drain waits for in-flight background work under a bound and then
+      // abandons it — not an inverse, so it is not on a frame; it runs here,
+      // once the resource's own effects are undone.
       try {
-        if (instance.teardown) await instance.teardown();
+        await owner?.drainDetached();
       } catch (err) {
         // Aggregate rather than abort. A single throwing resource used to
         // abandon every resource after it in the cascade — including the log
@@ -1681,12 +1802,27 @@ export class EvaluationContext implements IEvaluationContext {
     // as started, so this has to happen first.
     await this.markStarted(name, instance);
 
+    // A frame of its own: what `run()` allocates (a listening socket, a kernel
+    // hold) is undone when the run's frame unwinds, without disturbing what
+    // `init()` built underneath it.
+    const effects = effectOwnerOf(instance)?.effects;
+    effects?.openFrame("run");
+
     try {
       // Runnable: run inside the ALS scope so nested invokes inherit the token and
       // trace id (skip the redundant `run` when the token is already ambient).
       // Service: call directly with the explicit context and NO ambient scope, so
       // its long-lived async work does not capture this scope.
-      const call = () => (instance.run as (c?: InvokeContext) => Promise<void>)(invokeCtx);
+      // What `run()` returns is what undoes it — the socket it opened, the hold
+      // it took. The chain executes INSIDE the same ambient scope as the call
+      // that produced it: its bodies are the work `run()` would otherwise have
+      // done inline, so running them outside would silently strip the
+      // cancellation token and trace parent from exactly the code that moved
+      // into a chain.
+      const call = async () => {
+        const returned = await (instance.run as (c?: InvokeContext) => Promise<unknown>)(invokeCtx);
+        await executeReturnedChain(returned, effects);
+      };
       await (isService || invokeCtx === ambient ? call() : cancellationStore.run(invokeCtx, call));
       // A one-shot Runnable that discovered something during run() publishes it
       // without an explicit call; a Service never reaches this until teardown.
@@ -1694,16 +1830,30 @@ export class EvaluationContext implements IEvaluationContext {
       await this.publishSnapshot(name);
       await this.emit(`${name}.Run`, span("end", "ok", {}));
     } catch (err) {
+      // A run that did not complete leaves nothing of its own behind: its frame
+      // unwinds here, so a `listen()` that threw releases the hold it took a
+      // line earlier instead of holding the process open for a server that
+      // never came up.
+      const refused = (await effects?.unwindFrame()) ?? [];
+      const recovery =
+        refused.length > 0
+          ? {
+              recoveryFailures: refused.map((f) => ({
+                reason: f.reason,
+                message: errorText(f.error),
+              })),
+            }
+          : {};
       if (isCancellationError(err)) {
         const reason = err instanceof Error ? err.message : String(err);
-        await this.emit(`${name}.RunCancelled`, span("end", "cancelled", { reason }));
+        await this.emit(`${name}.RunCancelled`, span("end", "cancelled", { reason, ...recovery }));
         throw err;
       }
       const detail =
         err instanceof Error
           ? { name: err.name, message: err.message }
           : { name: "UnknownError", message: String(err) };
-      await this.emit(`${name}.RunFailed`, span("end", "failed", detail));
+      await this.emit(`${name}.RunFailed`, span("end", "failed", { ...detail, ...recovery }));
       throw err;
     }
   }
@@ -2053,6 +2203,11 @@ function locateFailedAccess(
   return null;
 }
 
+/** One line for an inverse's refusal, quoted into a recovery aggregate. */
+function errorText(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
+
 function describeMissingAccess(value: unknown, key: string): string {
   if (value === null) return `cannot read '${key}' — value is null`;
   if (value === undefined) return `cannot read '${key}' — value is undefined`;

package/src/init-failure-diagnostics.ts

@@ -6,11 +6,18 @@ import type { RuntimeDiagnostic } from "@telorun/sdk";
  * failure of its own. This is the ONLY signal that an entry may be collapsed —
  * see {@link classifyInitFailures}.
  */
-const DEPENDENCY_PENDING_CODES = new Set([
+export const DEPENDENCY_PENDING_CODES = new Set([
   "ERR_LOCAL_REF_PENDING",
   "ERR_CROSS_MODULE_REF_PENDING",
 ]);
 
+/** Whether a thrown error is the loop's own "not your turn yet" signal rather
+ *  than a failure of the resource. */
+export function isDeferral(err: unknown): boolean {
+  const code = (err as { code?: string } | undefined)?.code;
+  return code !== undefined && DEPENDENCY_PENDING_CODES.has(code);
+}
+
 /** One resource that did not reach the `Initialized` state, with the outbound
  *  edges (names of resources in the SAME context) captured for it. */
 export interface FailedResource {

package/src/kernel.ts

@@ -51,6 +51,7 @@ import { ambientInvokeContext } from "./evaluation-context.js";
 import { ModuleContext } from "./module-context.js";
 import { ResourceContextImpl } from "./resource-context.js";
 import { mintResourceHandle } from "./resource-handle.js";
+import { bindEffectOwner } from "./effect-scope.js";
 import { declarationOfInstance, recordInstanceDeclaration } from "./instance-declaration.js";
 import { nodeHostVersions } from "./host-versions.js";
 import { nodeCelHandlers } from "./cel-handlers.js";
@@ -1017,8 +1018,12 @@ export class Kernel implements IKernel {
     return this._entryUrl;
   }
 
-  /** The npm install root for this load (`<cache-root>/npm`), threaded to the
-   *  controller loader so it doesn't re-derive it from the entry URL. */
+  /** The npm install BASE for this load (`<cache-root>/npm`), threaded to the
+   *  controller loader so it doesn't re-derive it from the entry URL. The base
+   *  holds one root per (entry path, host platform); the loader picks which one
+   *  this runner uses, so two runners over one workspace — a host and a
+   *  bind-mounting container — never share a tree whose `package.json` can only
+   *  be true for one of them. */
   getInstallRoot(): string | undefined {
     return this._cacheRoot ? `${this._cacheRoot}/npm` : undefined;
   }
@@ -1385,7 +1390,17 @@ export class Kernel implements IKernel {
     try {
       this.sharedSchemaValidator
         .compile(configSchema)
-        .validate(stripCompiledValues(resource, configSchema));
+        .validate(
+          stripCompiledValues(resource, configSchema, undefined, (ref) =>
+            // A kind may describe a slot with a shape declared elsewhere. The
+            // strip walk has to see THROUGH that reference or the value under it
+            // reads as undescribed, and every CEL leaf beneath it collapses to
+            // `""` — which the shape then rejects, reporting a violation of a
+            // value the author never wrote. AJV resolves it either way; this is
+            // what lets the placeholder walk agree with it.
+            this.sharedSchemaValidator.getSchema(ref) as Record<string, any> | undefined,
+          ),
+        );
     } catch (error) {
       throw new RuntimeError(
         "ERR_RESOURCE_SCHEMA_VALIDATION_FAILED",
@@ -1453,16 +1468,14 @@ export class Kernel implements IKernel {
     // parent inputs → controller → parent result → mapping → child result.
     this.bindInvocationContract(instance, processedResource, resolvedKind, ctx);
 
-    // Fold the resource's fire-and-forget drain into its own teardown: tearing
-    // the resource down drains the background tasks it spawned (the kernel just
-    // calls teardown() — it tracks no tasks itself). A drain with no pending
-    // tasks is a no-op, so this is safe for every resource.
-    const ownerCtx = ctx as ResourceContextImpl;
-    const originalTeardown = instance.teardown?.bind(instance);
-    instance.teardown = async () => {
-      await ownerCtx.drainDetached();
-      if (originalTeardown) await originalTeardown();
-    };
+    // Record the instance's inverse accumulator here, at the single
+    // instance-production site, for the same reason the handle is minted here:
+    // the teardown cascade holds an instance and nothing else, so this is the
+    // one point where the instance and its context are both in hand. The
+    // detached drain is NOT folded into teardown any more — it waits for
+    // in-flight work rather than undoing anything, so the teardown cascade
+    // calls it directly (see `EvaluationContext.teardownResources`).
+    bindEffectOwner(instance, ctx as ResourceContextImpl);
 
     if (!runtime.length) return { instance, ctx, resource: processedResource };
 

package/src/manifest-schemas.ts

@@ -214,12 +214,7 @@ function lazyValidator(schema: object): LazyValidator {
 export const validateResourceDefinition = lazyValidator(ResourceDefinitionSchema);
 export const validateResourceAbstract = lazyValidator(ResourceAbstractSchema);
 
-export function formatAjvErrors(errors: any[] | null | undefined): string {
-  if (!errors || errors.length === 0) return "Unknown schema error";
-  return errors
-    .map((err) => {
-      const p = err.instancePath || "/";
-      return `${p} ${err.message ?? "is invalid"}`;
-    })
-    .join("; ");
-}
+/** Re-exported from the analyzer so a schema failure is phrased identically
+ *  under `telo check` and at runtime — the kernel's own copy rendered the same
+ *  failure as a raw `instancePath + message` join and handled no union. */
+export { formatAjvErrors } from "@telorun/analyzer";

package/src/module-context.ts

@@ -277,6 +277,22 @@ export class ModuleContext extends EvaluationContext implements IModuleContext {
     }
   }
 
+  /**
+   * Undo every registration an alias made — the kind gate, the exported-instance
+   * scope and the exported-kind resolver — as ONE operation, because they are
+   * one act: an import controller registers all four in `create()` and an alias
+   * left half-registered would resolve kinds through a module whose instances
+   * are gone. This is the inverse of the create-frame effect that registers
+   * them, so an import whose instance is discarded does not leave its alias
+   * behind for the retry to collide with.
+   */
+  unregisterImport(alias: string): void {
+    this.importAliases.delete(alias);
+    this.importedKinds.delete(alias);
+    this.importedScopes.delete(alias);
+    this.importedKindResolvers.delete(alias);
+  }
+
   /**
    * Register an alias that crosses no import boundary and is therefore never gated:
    * `Self` (a library resolving its own kinds — `exports.kinds` gates importers, not

package/src/observed-state.ts

@@ -1,4 +1,4 @@
-import { registerTeloKeywords } from "@telorun/analyzer";
+import { formatAjvErrors, registerTeloKeywords } from "@telorun/analyzer";
 import AjvModule from "ajv";
 import { detachSnapshotValue, OBSERVED_STATE_KEY, RuntimeError } from "@telorun/sdk";
 
@@ -96,9 +96,7 @@ export function acceptReportedStatus(
   }
   const validate = validatorFor(opts.statusSchema);
   if (!validate(status)) {
-    const detail = (validate.errors ?? [])
-      .map((e) => `${e.instancePath || "/"} ${e.message ?? "is invalid"}`)
-      .join("; ");
+    const detail = formatAjvErrors(validate.errors);
     throw new RuntimeError(
       "ERR_OBSERVED_STATE_INVALID",
       `${opts.kind} '${opts.name}' reported observed state that does not match its declared 'status:': ${detail}`,

package/src/resource-context.ts

@@ -28,7 +28,10 @@ import {
   type TypeRule,
   type OpenZoneAttributes,
   type ZoneEntry,
+  type EffectBody,
+  type EffectChain,
 } from "@telorun/sdk";
+import { EffectScope } from "./effect-scope.js";
 import { registerTeloKeywords } from "@telorun/analyzer";
 import { isRefSentinel } from "@telorun/templating";
 import { ZoneContext } from "./zone-context.js";
@@ -829,6 +832,35 @@ export class ResourceContextImpl implements ResourceContext {
     await this.kernel.emitRuntimeEvent(`${this.metadata.name}.${event}`, payload);
   }
 
+  /**
+   * This resource's inverse accumulator. Opened with the context — `create()`
+   * is where template controllers and imports allocate, so an effect performed
+   * there is on the chain alongside `init()` and `run()`.
+   */
+  #effects: EffectScope | undefined;
+
+  get effects(): EffectScope {
+    return (this.#effects ??= new EffectScope(String(this.metadata?.name ?? "<unnamed>")));
+  }
+
+  effect<T>(reason: string, body: EffectBody<void, T>): EffectChain<T> {
+    return this.effects.chain(reason, body);
+  }
+
+  /**
+   * Hold the kernel open; the returned closure releases it.
+   *
+   * Deliberately NOT registered as an effect here. A hold IS an effect — it is
+   * an action with an inverse — but which FRAME owns it is a fact only the
+   * caller has: `run()`'s hold belongs to the run frame, a hold taken per
+   * durable run inside `invoke()` belongs to that operation and is disposed when
+   * the run settles. Registering here would put every hold on whichever frame
+   * happened to be open, and the four call sites that already wrap it in an
+   * effect would register the same release twice.
+   *
+   * So this returns the raw inverse, and a caller places it:
+   * `ctx.effect("kernel hold", async () => ({ result: undefined, inverse: ctx.acquireHold() }))`.
+   */
   acquireHold(reason?: string): () => void {
     return this.kernel.acquireHold(reason);
   }

package/src/schema-compiled-values.ts

@@ -1,5 +1,5 @@
 import { isCompiledValue } from "@telorun/sdk";
-import { selectUnionBranch } from "@telorun/analyzer";
+import { type ExternalSchemaResolver, resolveRefIn, selectUnionBranch } from "@telorun/analyzer";
 
 /** Returns a schema-appropriate placeholder value for a CompiledValue field. */
 function placeholderForSchema(schema: Record<string, unknown>): unknown {
@@ -38,22 +38,25 @@ function placeholderForSchema(schema: Record<string, unknown>): unknown {
   }
 }
 
-/** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
+/**
+ * Resolve a `$ref` — document-local against `root`, everything else through the
+ * schema store when the caller supplies one.
+ *
+ * Without the store a named shape (`telo:<module>/<Type>`) stops the walk: the
+ * node reads as undescribed, so every CEL leaf beneath it collapses to `""` and
+ * is then rejected by the very schema that describes it. A kind referencing a
+ * shape declared elsewhere is exactly the case, and the failure surfaces as a
+ * violation of a value the author never wrote.
+ */
 function resolveSchemaRef(
   schema: Record<string, unknown>,
   root: Record<string, unknown>,
-): Record<string, unknown> {
-  if (
-    schema.$ref &&
-    typeof schema.$ref === "string" &&
-    (schema.$ref as string).startsWith("#/$defs/")
-  ) {
-    const defName = (schema.$ref as string).slice("#/$defs/".length);
-    const defs = root.$defs as Record<string, Record<string, unknown>> | undefined;
-    const resolved = defs?.[defName];
-    if (resolved) return resolved;
-  }
-  return schema;
+  external?: ExternalSchemaResolver,
+): { schema: Record<string, unknown>; root: Record<string, unknown> } {
+  return resolveRefIn(schema as Record<string, any>, root as Record<string, any>, external) as {
+    schema: Record<string, unknown>;
+    root: Record<string, unknown>;
+  };
 }
 
 /** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
@@ -121,13 +124,18 @@ export function stripCompiledValues(
   v: unknown,
   schema: Record<string, unknown> = {},
   rootSchema?: Record<string, unknown>,
+  external?: ExternalSchemaResolver,
 ): unknown {
   const root = rootSchema ?? schema;
   // Ancestors on the current path, so a genuine cycle stops while a sub-object
   // that merely appears twice is still stripped both times.
   const ancestors = new Set<object>();
 
-  const walk = (value: unknown, rawNodeSchema: Record<string, unknown>): unknown => {
+  const walk = (
+    value: unknown,
+    rawNodeSchema: Record<string, unknown>,
+    base: Record<string, unknown> = root,
+  ): unknown => {
     // A UNION carries no `type` / `items` / `properties` of its own, so descending
     // through one hands every CEL leaf underneath the schema-unaware `""`
     // placeholder — which the branches then reject, reporting violations against
@@ -136,12 +144,16 @@ export function stripCompiledValues(
     // placed. Shared with the analyzer rather than reimplemented: the static and
     // dispatch halves must choose the same branch, or one reports what the other
     // accepts.
+    const entered = resolveSchemaRef(rawNodeSchema, base, external);
     const nodeSchema = selectUnionBranch(
-      resolveSchemaRef(rawNodeSchema, root),
+      entered.schema,
       value,
-      root as Record<string, any>,
+      entered.root as Record<string, any>,
+      external,
     ) as Record<string, unknown>;
-    const resolved = resolveSchemaRef(nodeSchema, root);
+    const here = resolveSchemaRef(nodeSchema, entered.root, external);
+    const resolved = here.schema;
+    const nodeRoot = here.root;
 
     if (isCompiledValue(value)) return placeholderForSchema(resolved);
     // A slot the schema declares as a reference is never config when it HOLDS a
@@ -153,8 +165,10 @@ export function stripCompiledValues(
     if (resolved["x-telo-ref"] !== undefined && !isConfigAtRefSlot(value)) return value;
 
     if (Array.isArray(value)) {
-      const itemSchema = resolveSchemaRef((resolved.items ?? {}) as Record<string, unknown>, root);
-      return walkGuarded(value, () => value.map((item) => walk(item, itemSchema)));
+      const item = resolveSchemaRef((resolved.items ?? {}) as Record<string, unknown>, nodeRoot, external);
+      return walkGuarded(value, () =>
+        value.map((element) => walk(element, item.schema, item.root)),
+      );
     }
     if (value !== null && typeof value === "object") {
       // A class instance (a client, a pool, a stream) carries no CompiledValues
@@ -166,7 +180,7 @@ export function stripCompiledValues(
       return walkGuarded(value, () => {
         const out: Record<string, unknown> = {};
         for (const [k, val] of Object.entries(value as Record<string, unknown>)) {
-          out[k] = walk(val, props[k] ?? {});
+          out[k] = walk(val, props[k] ?? {}, nodeRoot);
         }
         return out;
       });