@voxgig/sdkgen 4.30.0 → 4.30.1

package/project/.sdk/tm/rust/feature/secrets/plugin/host.rs

@@ -1,28 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/host.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/host.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! The host: the lifecycle state machine (§5), extension points (§6), and
-//! resource capture (§8).
-//!
-//! TWO RULES SHAPE EVERY METHOD BELOW.
-//!
-//! Transitions are SEQUENTIAL (§5.2). One at a time, in call order, never
-//! interleaved; a transition triggered from inside a lifecycle callback is
-//! `plugin_reentrant`. A hard rule, because it is the only way the
-//! semantics can be identical in Go, in Rust and in single-threaded
-//! JavaScript.
-//!
-//! Reconciliation is EAGER (§18's portability budget). A transition
-//! settles by running the state machine to a fixed point, not by
-//! suspending on a promise.
-//!
-//! AND ONE RULE IS RUST'S OWN: NEVER HOLD A BORROW ACROSS A CALLBACK. A
-//! definition's `define` calls back into the host - `bind`, `export`,
-//! `acquire`, even `nest` - so every method here reads what it needs out
-//! of a `RefCell`, DROPS the borrow, and only then runs anything a plugin
-//! wrote. A held borrow does not produce a wrong answer, it panics, which
-//! is the one failure mode a conformance suite cannot report as a
-//! divergence.
 
 use std::cell::{Cell, RefCell};
 use std::collections::{BTreeMap, BTreeSet};
@@ -55,11 +33,6 @@ pub struct Entry {
     pub order: Value,
     pub unmet: Vec<String>,
     pub scope: Vec<ScopeFn>,
-    /// §11.4's ALWAYS-RELUCTANT rebinding made concrete: the provider ref
-    /// this instance's activation actually chose, per requirement name.
-    /// Re-ranking on every question silently re-points a live consumer at
-    /// any better newcomer, and then losing the provider it was really
-    /// using does not restart it.
     pub selected: BTreeMap<String, String>,
     pub bindings: Vec<Bound>,
     pub exports: BTreeMap<String, Value>,
@@ -83,11 +56,6 @@ pub struct HostInner {
     seqn: Cell<f64>,
     open: Cell<i64>,
     transition: Cell<bool>,
-    /// WHICH callback is running, not merely that one is. §8.1 puts
-    /// resource capture in `activate` and 8.3 says `release` outside
-    /// `activate` is `plugin_release_scope` - and a bare flag cannot tell
-    /// `activate` from `define`, so it admitted an acquire in `define`
-    /// whose scope `unload` would never unwind.
     phase: RefCell<String>,
     /// Set for the duration of a bulk teardown, so `held` knows this is a
     /// coordinated operation rather than an ad-hoc deactivation.
@@ -158,8 +126,6 @@ impl Host {
 
     // --- observation ------------------------------------------------
 
-    /// Introspection NEVER advances the state (§5.2). A status page must
-    /// not be a way to accidentally import twenty packages.
     pub fn list(&self) -> Value {
         let mut out = Value::map();
         for (eref, entry) in self.0.inst.borrow().iter() {
@@ -269,11 +235,6 @@ impl Host {
 
         match outcome {
             Ok(()) => Ok(()),
-            // §12: `plugin_define_failed` and its three siblings are "a
-            // callback raised; wraps the cause". AN ERROR THAT ALREADY
-            // CARRIES A CODE KEEPS IT - the code is the error's identity,
-            // and a plugin raising `store_unreachable` must not have it
-            // rewritten. Only a code-less error is wrapped.
             Err(e) if !e.code.is_empty() => Err(e),
             Err(e) => fail(
                 &format!("plugin_{}_failed", at),
@@ -373,15 +334,6 @@ impl Host {
         Ok(entry)
     }
 
-    /// §9.1: a host that reserves a name MUST still be able to declare the
-    /// instance it reserved - "The host declares those instances itself,
-    /// after the user merge, and always wins."
-    ///
-    /// THE BOUNDARY IS BY METHOD, NOT BY CALLER, and that is a real limit:
-    /// no language here can tell the embedding host from a plugin holding
-    /// the same host object. What reservation protects is CONFIGURATION -
-    /// documents, overlays, `VOXGIG_PLUGIN_*`, construction options and
-    /// ordinary declare/load/options - and all of that still checks.
     pub fn hostdeclare(
         &self,
         eref: &Value,
@@ -414,11 +366,6 @@ impl Host {
         }
         entry.borrow_mut().status = "loaded".to_string();
 
-        // AT LOAD, and before anything runs: a cycle through
-        // restart-causing requirements does not settle, and the only safe
-        // time to report a non-terminating reconcile is before it starts
-        // (§11.3). `provides` is populated by `define`, which has just
-        // run, so this is the first moment the graph is complete.
         if let Err(e) = checkcycle(&self.graphnodes()) {
             entry.borrow_mut().status = "failed".to_string();
             return Err(e);
@@ -426,7 +373,6 @@ impl Host {
         Ok(entry)
     }
 
-    /// The requirement graph as plain data, for the pure detector.
     fn graphnodes(&self) -> Vec<Node> {
         let mut out = Vec::new();
         for (eref, entry) in self.0.inst.borrow().iter() {
@@ -476,8 +422,6 @@ impl Host {
             self.load(&Value::str(&myref), &Value::map())?;
         }
 
-        // A declared requirement that is not live means `pending`:
-        // activation is a STANDING REQUEST, not a one-shot event.
         let unmet = self.unmetof(&entry);
         if !unmet.is_empty() {
             let mut e = entry.borrow_mut();
@@ -525,12 +469,6 @@ impl Host {
         }
 
         if "pending" == status {
-            // DEACTIVATING A PENDING INSTANCE RUNS NO CALLBACK (§5.2). It
-            // never reached activate, so it holds no scope and no live
-            // bindings; running the definition's deactivate there would be
-            // teardown without matching setup, which plugins are not
-            // written to survive and which could fail an instance that had
-            // done nothing wrong. It cannot fail.
             let mut e = entry.borrow_mut();
             e.status = "loaded".to_string();
             e.unmet = Vec::new();
@@ -605,17 +543,6 @@ impl Host {
         self.activate(&Value::str(&r))
     }
 
-    /// Bindings go live only when activation succeeds (§8.1), so the
-    /// teardown is the exact inverse: reverse order, always. Returns the
-    /// errors the scope raised. §8.3: "A failing release does not stop the
-    /// rest. Every entry runs, in reverse order, whatever any of them
-    /// does; the errors are collected and raised as one
-    /// `plugin_release_failed`."
-    ///
-    /// A selection belongs to ONE activation (§11.4). Leaving `live` by
-    /// any door drops it, so the next activation ranks afresh - keeping it
-    /// would make a consumer prefer a provider it never actually ran
-    /// against.
     fn unwind(&self, entry: &Rc<RefCell<Entry>>) -> Vec<PluginError> {
         // TAKE the scope out under a short borrow: the closures below
         // reach back into this same entry (a foreign release records its
@@ -662,10 +589,6 @@ impl Host {
         )
     }
 
-    /// A REQUIREMENT IS ON A CAPABILITY, not on a ref (§11.1). A bare
-    /// string is shorthand for `{name}`. A ref satisfies too, because a
-    /// host that genuinely needs a specific instance should not have to
-    /// invent a capability for it.
     fn unmetof(&self, entry: &Rc<RefCell<Entry>>) -> Vec<String> {
         let reqs = requirements(&entry.borrow().options);
         reqs.iter()
@@ -675,13 +598,6 @@ impl Host {
             .collect()
     }
 
-    /// §11.4's always-reluctant selection, and the ONE place a provider is
-    /// picked for a live instance. If this instance already selected a
-    /// provider for `req` and that provider is STILL a candidate, it keeps
-    /// it - a better-ranked newcomer does not take it.
-    ///
-    /// `remember` is false for the questions asked ABOUT an instance
-    /// rather than BY it: introspection must not create a binding.
     fn chosen(&self, entry: &Rc<RefCell<Entry>>, req: &Value, remember: bool) -> Option<String> {
         let cands = self.providersof(req);
         if cands.is_empty() {
@@ -736,15 +652,6 @@ impl Host {
             .collect()
     }
 
-    /// §11.3's `hold` asks a DIFFERENT question from the cascade, and
-    /// reading it off `consumersof` answered the cascade's.
-    ///
-    /// The cascade wants the edges that RESTART - mandatory-static and
-    /// optional-static - because a restart is what it performs. `hold`
-    /// says "deactivating a REQUIRED instance is
-    /// `plugin_dependency_held`", and required is cardinality:
-    /// `gatesactivation`, not `restartsonloss`. The two sets differ in
-    /// both directions and each difference was a real bug.
     fn holdersof(&self, eref: &str) -> Vec<String> {
         let all: Vec<(String, Rc<RefCell<Entry>>)> = self
             .0
@@ -812,14 +719,6 @@ impl Host {
         resolve_capability(req, &cands)
     }
 
-    /// CONSUMERS GO DOWN FIRST, NOT AFTERWARDS (§11.3).
-    ///
-    /// The cascade is part of the provider's own deactivation and runs
-    /// BEFORE the provider's `deactivate` callback and scope unwind, so a
-    /// consumer's teardown can still call the thing it depends on -
-    /// flushing a buffer to the store it is about to lose is exactly what
-    /// a `deactivate` callback is for, and a cascade that fired after the
-    /// provider was already gone would make that impossible.
     fn cascade(&self, provider: &str, seen: &mut BTreeSet<String>) {
         if seen.contains(provider) {
             return;
@@ -882,10 +781,6 @@ impl Host {
         )
     }
 
-    /// EAGER reconciliation: run to a fixed point rather than scheduling.
-    ///
-    /// Two directions, and both are the reason `pending` exists.
-    /// Activation is a STANDING REQUEST, not a one-shot event.
     fn reconcile(&self) {
         let mut moved = true;
         let mut rounds = 0;
@@ -916,9 +811,6 @@ impl Host {
                 if lost.is_empty() {
                     continue;
                 }
-                // POLICY IS PER REQUIREMENT, not per instance (§11.3). A
-                // `dynamic` requirement whose provider is gone leaves the
-                // consumer LIVE and notified.
                 if !lost.iter().any(|q| restartsonloss(q)) {
                     continue;
                 }
@@ -969,13 +861,6 @@ impl Host {
     // --- ordering ---------------------------------------------------
 
     pub fn order(&self, point: Option<&str>) -> Result<Vec<String>, PluginError> {
-        // Sorted by declaration SEQUENCE, which is what makes the §7
-        // sort's fall-through deterministic in a language whose maps have
-        // no insertion order. §7 breaks ties by `pos`; two instances CAN
-        // share one - `declare` defaults `pos` to the registry size, so an
-        // unload followed by a fresh declare reuses a surviving
-        // instance's - and past that this was falling through to map
-        // order. `seq` is that order, made explicit.
         let mut live: Vec<Binding> = Vec::new();
         for entry in self.0.inst.borrow().values() {
             let e = entry.borrow();
@@ -1154,15 +1039,6 @@ impl Host {
 
     // --- documents --------------------------------------------------
 
-    /// §9.6: "load what is missing, UNLOAD WHAT IS GONE, patch what
-    /// changed, and move activation state to match", with the stated
-    /// ordering - "deactivations and unloads first (reverse load order),
-    /// then loads, then activations in load order".
-    ///
-    /// FOUR PHASES, NOT ONE INTERLEAVED LOOP. An earlier draft walked the
-    /// document once, which never looked at instances the new document had
-    /// DROPPED - so an integration removed from a config reload stayed live
-    /// with its bindings and resources.
     pub fn apply(&self, doc: &Value, profile: &Value) -> Result<(), PluginError> {
         self.guard()?;
         let profile = if profile.is_null() {
@@ -1251,9 +1127,6 @@ impl Host {
             e.pos = ent.get("pos").as_num().unwrap_or(0.0);
         }
 
-        // --- phase 3: loads, in load order -----------------------------
-        // ONLY THE EAGER, ACTIVE ONES: "a document of twenty lazy
-        // instances is twenty map entries and no executed code" (§9.6).
         for eref in want.iter() {
             if wantlive(eref) {
                 self.load(&Value::str(eref), &Value::map())?;
@@ -1321,9 +1194,6 @@ impl Host {
     }
 
     pub fn close(&self) -> Result<(), PluginError> {
-        // A bulk teardown removing the holders too, so `hold` is suspended
-        // for exactly those holders (§11.3) - while the consumers-first
-        // cascade still runs, which is the half that matters.
         self.0.coordinated.set(true);
         let refs: Vec<String> = self.0.inst.borrow().keys().rev().cloned().collect();
         let mut outcome = Ok(());
@@ -1339,8 +1209,6 @@ impl Host {
         outcome
     }
 
-    /// The same record §6.6 gives a plugin about itself, reachable from
-    /// outside for the corpus.
     pub fn positionof(&self, eref: &str, point: Option<&str>) -> Result<Value, PluginError> {
         let myref = canon(eref);
         let entry = self.0.inst.borrow().get(&myref).cloned();
@@ -1357,8 +1225,6 @@ impl Host {
         let mut out = Value::map();
         out.set("index", Value::Num(index as f64));
         out.set("count", Value::Num(ranked.len() as f64));
-        // §6.2 composes b1(b2(b3(base))) with the FIRST binding OUTERMOST,
-        // so these are not index 0 and index count-1 the other way round.
         out.set("outermost", Value::Bool(0 == index));
         out.set(
             "innermost",
@@ -1368,12 +1234,6 @@ impl Host {
     }
 }
 
-// ---------------------------------------------------------------------
-// Inst - what a definition's callbacks see
-// ---------------------------------------------------------------------
-//
-// Deliberately not the internal record: a plugin that could reach `status`
-// could also write it.
 
 #[derive(Clone)]
 pub struct Inst {
@@ -1416,12 +1276,6 @@ impl Inst {
         self.entry.borrow_mut().state.set(key, value);
     }
 
-    /// Foreign resources the host did not hand out are registered
-    /// explicitly (§8.3); host calls are recorded automatically.
-    ///
-    /// SYMMETRIC WITH `acquire`, and it has to be: `open` counts the
-    /// resources CURRENTLY HELD, so an entry that is registered and then
-    /// unwound must leave the count where it found it.
     pub fn release(
         &self,
         func: Rc<dyn Fn() -> Result<(), PluginError>>,
@@ -1452,12 +1306,6 @@ impl Inst {
         Ok(())
     }
 
-    /// The synthetic counter the driver owns, so "what is open" is data
-    /// rather than an assertion each port words differently.
-    ///
-    /// Returns its own release, so a plugin can hand one back early. The
-    /// scope still holds the entry and unwinding it twice is a no-op -
-    /// releasing early must not make teardown wrong.
     pub fn acquire(&self) -> Result<ScopeFn, PluginError> {
         // §8.1: resources are "acquired during `activate` - the scope's
         // actual job". Same reason as `release` above.
@@ -1483,19 +1331,12 @@ impl Inst {
         Ok(rel)
     }
 
-    /// Bind into a host point. Declared in `define`; the host inserts it
-    /// only after `activate` returns successfully (§8.1), which is why a
-    /// failing activate leaves no live binding behind.
     pub fn bind(
         &self,
         point: &str,
         func: super::point::BindFn,
         band: &Value,
     ) -> Result<(), PluginError> {
-        // §12 has carried `plugin_bind_scope` - "binding declared outside
-        // `define`" - since before anything raised it. §8.1 puts binding
-        // DECLARATION in `define` and INSERTION at a successful activate,
-        // and the guard was the half nobody wrote.
         if "define" != self.host.phase() {
             return fail(
                 "plugin_bind_scope",
@@ -1530,19 +1371,7 @@ impl Inst {
             .insert(key.to_string(), value);
     }
 
-    /// WHICH provider this instance is bound to for `name` (§11.1), as a
-    /// ref, or None when nothing provides it.
-    ///
-    /// The host's own `capability` answers with the live providers
-    /// RANKED, not with the one THIS instance took; §11.4's reluctant
-    /// rebinding makes those differ. A REF, not the instance: every port
-    /// can return a string and a corpus entry can assert on one. The
-    /// selection is REMEMBERED, because this is the instance asking.
     pub fn capability(&self, name: &str) -> Option<String> {
-        // THE BORROW ENDS BEFORE `chosen` DOES. `chosen` remembers the
-        // selection, which takes `borrow_mut` on the same entry -- so
-        // reading the requirements inline held a shared borrow across it
-        // and panicked at the write. Rust is the only port that says so.
         let reqs = requirements(&self.entry.borrow().options);
         for req in reqs {
             if req.get("name").as_str() == Some(name) {

package/project/.sdk/tm/rust/feature/secrets/plugin/mod.rs

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/lib.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/lib.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 pub mod value;
 pub mod types;

package/project/.sdk/tm/rust/feature/secrets/plugin/order.rs

@@ -1,20 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/order.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/order.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Ordering (§7) - one rule, one place.
-//!
-//! sdkgen grew two special cases in `makeOptions` (`test`, then `station`)
-//! and the third was not far off. This sort is the whole replacement, and
-//! the tiers are in this order for a reason:
-//!
-//!   1 constraints   before/after edges, by ref or by name
-//!   2 bands         integer, lower first, default 0
-//!   3 declaration   ties break by `pos`
-//!
-//! CONSTRAINTS BEAT BANDS precisely so the correct tool wins when both are
-//! present. A band expresses a genuine cross-cutting layer; a constraint
-//! expresses a relationship between two specific things; and a band chosen
-//! by trial and error to fix an ordering bug is a bug wearing a number.
 
 use std::collections::BTreeMap;
 
@@ -22,8 +8,6 @@ use super::refs::refname;
 use super::types::{details, fail, stable_sort_by, PluginError};
 use super::value::Value;
 
-/// One thing to place: its ref, its declared position, and its ordering
-/// block as authored.
 #[derive(Clone)]
 pub struct Binding {
     pub eref: String,
@@ -48,7 +32,6 @@ pub fn resolve_order(bindings: &[Binding], pin: &Value) -> Result<Vec<String>, P
 
     for b in bindings.iter() {
         let block = &b.order;
-        // An ABSENT constraint and an EMPTY LIST are both "no constraint".
         if order_declared(&block.get("after")) {
             for t in order_targets(&block.get("after"), bindings) {
                 edges.get_mut(&t).unwrap().push(b.eref.clone());
@@ -110,7 +93,6 @@ pub fn resolve_order(bindings: &[Binding], pin: &Value) -> Result<Vec<String>, P
     applypin(out, &edges, pin)
 }
 
-/// An integer, and only an integer: `true` and `"2"` are not bands.
 pub fn order_band(block: &Value) -> i64 {
     block.get("band").as_int().unwrap_or(0)
 }
@@ -153,17 +135,6 @@ pub fn order_targets(spec: &Value, nodes: &[Binding]) -> Vec<String> {
     hit
 }
 
-/// A PIN IS NOT A CONSTRAINT (§7).
-///
-/// Constraints and bands are negotiable by definition - they are what
-/// plugins and documents say they want, and the sort's job is to satisfy
-/// them all. A pin is the host stating a structural invariant of its own
-/// architecture, which is a different kind of claim and must not lose a
-/// tie to a document.
-///
-/// So a pin PLACES the binding at the named end, and an ordering that
-/// would move it away is `plugin_order_pinned` - rejected, not honoured
-/// into a broken wrap.
 fn applypin(
     order: Vec<String>,
     edges: &BTreeMap<String, Vec<String>>,
@@ -175,11 +146,6 @@ fn applypin(
 
     let mut out = order;
 
-    // SORTED, not insertion order. A pin map is data - it can arrive from
-    // a host's own construction options in any order, and two names pinned
-    // to the same end are order-sensitive (`{b:'first', a:'first'}` and
-    // `{a:'first', b:'first'}` give different results). A BTreeMap is
-    // sorted by construction, which is why `Value::Map` is one.
     for name in pin.keys() {
         let want = pin.get(&name);
         let idx = out.iter().position(|r| refname(r) == name);
@@ -188,10 +154,6 @@ fn applypin(
             None => continue,
         };
 
-        // `first`/`outermost` is index 0; `last`/`innermost` is the end.
-        // §6.2 makes the first chain binding outermost, which is why the
-        // vocabulary is positional and why the two spellings pair this
-        // way.
         let wantfirst = matches!(want.as_str(), Some("first") | Some("outermost"));
         let eref = out.remove(idx);
         if wantfirst {

package/project/.sdk/tm/rust/feature/secrets/plugin/point.rs

@@ -1,15 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/point.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/point.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Extension points (§6). Three kinds, chosen because they are what the
-//! two existing systems actually needed, and no more.
-//!
-//! A PLUGIN NEVER MUTATES THE HOST. That inversion is what makes
-//! deactivation possible: sdkgen's `utility.fetcher = wrapped` is not
-//! undoable, but "this instance holds slot 3 of the request chain" is
-//! undoable in O(1). OSGi named it the whiteboard pattern in 2004, in a
-//! paper called *Listeners Considered Harmful*, and for exactly this
-//! reason.
 
 use std::rc::Rc;
 
@@ -19,11 +10,6 @@ use super::value::Value;
 /// The next link of a chain (§6.2), or the base at the end of it.
 pub type NextFn = Rc<dyn Fn(&[Value]) -> Result<Value, PluginError>>;
 
-/// EVERY binding has one signature, whatever kind of point it is on: a
-/// hook and a provider ignore the `next` they are handed, a chain uses it.
-/// One signature is what lets `bound` return a single list the three
-/// callers share, rather than three parallel registries that can disagree
-/// about which instance holds slot 3.
 pub type BindFn = Rc<dyn Fn(Option<&NextFn>, &[Value]) -> Result<Value, PluginError>>;
 
 #[derive(Clone)]
@@ -34,11 +20,6 @@ pub struct Bound {
     pub band: i64,
 }
 
-/// §6.1: "fan-out" is not one answer but four. In a language with
-/// asynchrony, "call every binding" hides a decision - start them all and
-/// wait, await each in turn, or do not wait - and a design that leaves it
-/// unsaid gets four different answers from four ports, in the concurrency
-/// behaviour of production code no corpus entry happens to cover.
 pub const MODES: [&str; 4] = ["emit", "parallel", "serial", "bail"];
 
 /// Fan-out. Return values are ignored except in `bail`.
@@ -78,13 +59,6 @@ pub fn point_emit(bindings: &[Bound], mode: &str, arg: &Value) -> Result<Value,
     })
 }
 
-/// Composition: b1(b2(b3(base))), FIRST BINDING OUTERMOST (§6.2).
-///
-/// Recomputed by the host whenever the live set changes, and cached
-/// between changes. Plugins receive `next` as an argument; they never see
-/// or store the previous value of anything. A plugin that stashes `next`
-/// and calls it after deactivation is a bug the host cannot prevent, and
-/// this says so rather than pretending otherwise.
 pub fn compose(bindings: &[Bound], base: NextFn) -> NextFn {
     let mut nxt = base;
     for b in bindings.iter().rev() {
@@ -95,9 +69,6 @@ pub fn compose(bindings: &[Bound], base: NextFn) -> NextFn {
     nxt
 }
 
-/// At most one live implementation (§6.3). The winner is the highest band,
-/// ties broken by ref sort, and THE LOSERS ARE VISIBLE rather than
-/// silently ignored.
 pub struct Picked {
     pub winner: Option<Bound>,
     pub shadowed: Vec<String>,

package/project/.sdk/tm/rust/feature/secrets/plugin/refs.rs

@@ -1,17 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/refs.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/refs.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Identity: name+tag, written `name$tag` (§4).
-//!
-//! The four pure functions, and the whole of what `ref` pins. They are the
-//! first thing a new port implements and the first corpus section it
-//! passes.
-//!
-//! NO REGEX ENGINE, because the standard library has none and §16 permits
-//! no crate to supply one. The grammar is a character-class walk instead -
-//! which is also why the `#trailing-newline` entries cannot bite this port
-//! the way they bit ruby, python and perl: there is no `$` here to match
-//! before a newline.
 
 use super::types::{details, fail, PluginError};
 use super::value::Value;
@@ -35,12 +24,6 @@ pub fn check_name(name: &Value) -> bool {
     chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '~' | '_' | '-' | '/'))
 }
 
-/// §4: `^[a-zA-Z0-9.~_-]+$`, max 1024, or empty.
-///
-/// The asymmetry with a name is deliberate: a tag MAY start with a digit
-/// because auto-tagging assigns integer tags (`stripe$1`), and a tag
-/// admits neither `@` nor `/` because a name is a package specifier and a
-/// tag is not.
 pub fn check_tag(tag: &Value) -> bool {
     let text = match tag.as_str() {
         Some(s) => s,
@@ -58,18 +41,12 @@ pub fn check_tag(tag: &Value) -> bool {
         .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '~' | '_' | '-'))
 }
 
-/// `name$tag` -> the pair. Canonicalizing: `stripe$` and `stripe` both
-/// give tag "".
 pub fn parse_ref(value: &Value) -> Result<Value, PluginError> {
     let text = match value.as_str() {
         Some(s) => s,
         None => return fail("plugin_bad_name", "ref must be a string", Value::Null),
     };
 
-    // Split on the FIRST `$`. Nothing in the grammar decides this - `$` is
-    // in neither character class - so the corpus is the arbiter (§4 rule
-    // 5), and it picks the split that blames the part actually at fault:
-    // `a$b$c` is a good name with a bad tag, not the reverse.
     let (name, tag) = match text.find('$') {
         Some(cut) => (&text[..cut], &text[cut + 1..]),
         None => (text, ""),
@@ -98,9 +75,6 @@ pub fn parse_ref(value: &Value) -> Result<Value, PluginError> {
     Ok(out)
 }
 
-/// The pair -> `name$tag`. An empty tag NEVER writes the separator, which
-/// is the half of canonicalization `format_ref` owns: parse tolerates
-/// `stripe$`, format never produces it, so a round trip is idempotent.
 pub fn format_ref(name: &Value, tag: &Value) -> Result<String, PluginError> {
     let tag = if tag.is_null() { Value::str("") } else { tag.clone() };
     if !check_name(name) {

package/project/.sdk/tm/rust/feature/secrets/plugin/resolve.rs

@@ -1,13 +1,6 @@
-// VENDORED: @voxgig/plugin sdk-20260917-1242-0 (rust/src/resolve.rs)
-// Source: https://github.com/voxgig/plugin @ 721de3a1bb5ac879b5c118dd9fc55c474a8730c4  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/plugin sdk-20260925-1316-0 (rust/src/resolve.rs)
+// Source: https://github.com/voxgig/plugin @ 43acbf266b0dbcf52e5ab5463d85c822da9cd234  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-//! Dynamic resolution (§10.2) - name to candidate module ids.
-//!
-//! PURE. It returns the ids a host WOULD try, in order; it does not load
-//! anything. That separation is what lets the corpus pin resolution in
-//! every language including those with no dynamic loading at all, and it
-//! is why §15.4 puts real module loading in per-port integration tests
-//! rather than here.
 
 use super::value::Value;
 
@@ -73,11 +66,6 @@ pub fn resolve_candidates(name: &str, sources: &Value) -> Vec<String> {
     out
 }
 
-/// A MODULE PATH IS NOT A NAME (§10.2). The ref grammar starts a name with
-/// a letter or `@`, so `./local/thing` is not a ref and never reaches
-/// candidate generation - seneca allows a path where a plugin name goes,
-/// and this design deliberately does not, because a ref is an ADDRESS
-/// WITHIN A HOST and a path is a LOCATION ON A DISK.
 pub fn resolve_from(from: &Value) -> Vec<Value> {
     vec![from.clone()]
 }