aontu 0.52.0 → 0.53.0

package/src/val/OpBaseVal.ts

@@ -17,7 +17,7 @@ import {
 } from '../err'
 
 import { AontuContext } from '../ctx'
-import { unite } from '../unify'
+import { unite, withDepth } from '../unify'
 
 import {
   explainOpen,
@@ -31,6 +31,7 @@ import {
 
 import { ConjunctVal } from './ConjunctVal'
 import { FeatureVal } from './FeatureVal'
+import { hasPlace, fillPlace } from './PlaceVal'
 
 
 
@@ -66,6 +67,17 @@ class OpBaseVal extends FeatureVal {
 
 
   unify(peer: Val, ctx: AontuContext): Val {
+
+    // THE PLACEHOLDER (G8 phase 3, see PlaceVal), on the operator side:
+    // `x: {&: {m: _ + 2}}` meeting `1` is `3`. Same rule as
+    // FuncBaseVal's -- the peer fills the hole and the operation is
+    // what answers.
+    if (!peer.isTop && !peer.isNil && this.id !== peer.id && hasPlace(this)) {
+      if (hasPlace(peer)) {
+        return makeNilErr(ctx, 'place_pair', this, peer)
+      }
+      return fillPlace(this, peer, ctx).unify(top(), ctx)
+    }
     const te = ctx.explain && explainOpen(ctx, ctx.explain, 'Op:' + this.opname(), this, peer)
     // Declared without an initial value: every arm below assigns it, and
     // seeding it with `this` made the two arms that stand the op read as
@@ -83,7 +95,11 @@ class OpBaseVal extends FeatureVal {
 
     for (let arg of this.peg) {
       if (!arg.done) {
-        arg = arg.unify(top(), ctx, ec(te, 'ARG'))
+        // Charged to the depth budget: this recurses without going
+        // through `unite`, so the counter would otherwise stay flat
+        // while the stack grows (see withDepth in unify.ts).
+        const a = arg
+        arg = withDepth(ctx, a, top(), () => a.unify(top(), ctx, ec(te, 'ARG')))
       }
       pegdone &&= arg.done
       newpeg.push(arg)
@@ -161,10 +177,17 @@ class OpBaseVal extends FeatureVal {
   }
 
 
-  clone(ctx: AontuContext, _spec?: ValSpec): Val {
+  clone(ctx: AontuContext, spec?: ValSpec): Val {
     let out = (super.clone(ctx, {
       peg: this.peg,
     }) as OpBaseVal)
+    // THE PER-DESTINATION INSTANTIATION RULE (ADR-005): an operation
+    // inside a template clones its operands as instances — the
+    // default clone shares them (see FuncBaseVal.clone). Every
+    // operand is a Val by construction, as in the Go twin's []Val.
+    if (true === spec?.dup) {
+      out.peg = this.peg.map((a: Val) => a.clone(ctx, { dup: true }))
+    }
     return out
   }
 

package/src/val/OpenFuncVal.ts

@@ -14,7 +14,6 @@ import { makeNilErr } from '../err'
 
 
 import { FuncBaseVal } from './FuncBaseVal'
-import { NilVal } from '../val/NilVal'
 import { BagVal } from '../val/BagVal'
 
 
@@ -39,13 +38,16 @@ class OpenFuncVal extends FuncBaseVal {
 
 
   resolve(ctx: AontuContext | undefined, args: Val[]) {
-    const argval: any = args[0]
+    let argval: any = args[0]
 
     if (null == argval) {
       return makeNilErr(ctx, 'no_first_arg', this, undefined, 'close')
     }
 
     if (argval.isMap || argval.isList) {
+      // In place, for the reason CloseFuncVal.resolve gives: the
+      // instantiation rule (ADR-005) makes the argument this call's
+      // own wherever the call is multiplied.
       (argval as BagVal).closed = false
     }
 

package/src/val/PackFuncVal.ts

@@ -0,0 +1,175 @@
+/* Copyright (c) 2025 Richard Rodger, MIT License */
+
+// GENERATION: `pack(data, tmpl)` (G8 phase 1,
+// docs/capability-review/g8-generation.md). One child of the result map
+// per child of `data`, each of them `tmpl` cloned at the destination.
+//
+//   names: [web, auth, billing]
+//   deploy: pack($.names, {
+//     image: "acme/" + key() + ":1.4.2"
+//     replicas: *2 | integer
+//   })
+//
+// WHY A FUNCTION AND NOT SYNTAX. A comprehension would need keywords,
+// a scoping rule, and string interpolation for the computed name; the
+// language already has functions, spread templates, and `key()`, and
+// `pack` is those three composed. A call is also DATA -- a named node
+// in the tree -- so a document that generates stays as analysable as
+// one that does not.
+//
+// KEYS ARE DATA, NOT POSITION. For a list, the strings themselves are
+// the keys (a non-string element is refused: `pack_key`); for a map,
+// its keys. Terraform's `count` keyed by index is the counter-example
+// the review names: reordering the data churns every downstream child.
+// Duplicate keys are not an error -- the colliding children unify,
+// exactly as duplicate source keys already merge.
+//
+// TOTALITY. `pack` iterates a finite, settled bag and cannot call
+// itself: the number of children it can produce is fixed by data that
+// already exists. Nothing here can recurse, which is the guarantee the
+// combinators exist to keep.
+
+import type {
+  Val,
+  ValSpec,
+} from '../type'
+
+import {
+  AontuContext,
+} from '../ctx'
+
+import { unite } from '../unify'
+import { makeNilErr } from '../err'
+import { MapVal } from './MapVal'
+import { FuncBaseVal } from './FuncBaseVal'
+import { repathInstance } from './Val'
+import { fillPlace } from './PlaceVal'
+
+
+// The keys a data bag names, in the order the result must carry them,
+// or a code naming what is wrong with it. Shared with `each`, which
+// asks the same question of the same argument and answers it with the
+// values rather than the keys.
+function dataKeys(data: Val | undefined): string[] | string {
+  const d: any = data
+
+  if (true === d?.isMap) {
+    return Object.keys(d.peg)
+  }
+
+  if (true === d?.isList) {
+    const out: string[] = []
+    for (const el of d.peg as Val[]) {
+      const e: any = el
+      // A key is a NAME, and only a string is one. A number would
+      // key by position under another spelling, which is the failure
+      // mode the data-keyed rule exists to refuse.
+      if (true !== e?.isScalar || 'string' !== typeof e.peg) {
+        return 'pack_key'
+      }
+      out.push(e.peg)
+    }
+    return out
+  }
+
+  return 'pack_data'
+}
+
+
+class PackFuncVal extends FuncBaseVal {
+  isPackFunc = true
+
+  // THE STAGING RULE (G8 phase 0, see AontuContext.settle). A
+  // generator's data argument is not settled merely by being `done`
+  // once: a sibling conjunct, an include or a spread can still merge
+  // keys into it, and children generated from the half-merged bag
+  // would be missing. It fires on the settle pass and only then.
+  staged = true
+
+  constructor(
+    spec: ValSpec,
+    ctx?: AontuContext
+  ) {
+    super(spec, ctx)
+  }
+
+
+
+  funcname() {
+    return 'pack'
+  }
+
+
+  // The TEMPLATE IS NOT AN ARGUMENT TO DRIVE. Driving it would resolve
+  // its `key()` at the CALL SITE -- the one position the template is
+  // never used at -- and freeze whatever else in it is path-dependent
+  // there too. The data argument is driven by `unify` below instead,
+  // one argument by hand rather than all of them by the base.
+  prepare(_ctx: AontuContext, _args: Val[]) {
+    return null
+  }
+
+
+  unify(peer: Val, ctx: AontuContext): Val {
+    // ONE argument is driven: the data. The template is not (see
+    // prepare above), and driveStagedArgs answers whether the data has
+    // settled -- the other half of "ready to fire".
+    const ready = this.driveStagedArgs(ctx, 1)
+
+    if (!ready || !ctx.settle) {
+      return this.residuate(peer, ctx)
+    }
+
+    return super.unify(peer, ctx)
+  }
+
+
+  resolve(ctx: AontuContext, args: Val[]) {
+    const keys = dataKeys(args?.[0])
+    if ('string' === typeof keys) {
+      return makeNilErr(ctx, keys, this)
+    }
+
+    // Arity is checked at parse (funcArity), so both arguments are here.
+    const tmpl: Val = args[1]
+    const peg: Record<string, Val> = {}
+
+    const src: any = args[0]
+
+    for (const key of keys) {
+      const keyctx = ctx.descend(key)
+      // THE PLACEHOLDER BINDS THE SOURCE CHILD (G8 phase 3): inside a
+      // generator's template `_` is the datum this child is being made
+      // FROM. For a map that is the child's value; for a list of names
+      // it is the name, which is also the key -- so `_` and `key()`
+      // agree there, and differ the moment the data is a map.
+      const source: Val = true === src?.isMap ? src.peg[key] : src.peg[keys.indexOf(key)]
+      // CLONED, never shared. A spread may share a template that holds
+      // nothing path-dependent (MapVal.spreadClone), because a spread
+      // CONSTRAINS a child that exists; a generator's template IS the
+      // child, and a child is a position. Sharing left every generated
+      // child pointing at the template's own parse-time location, which
+      // is the position the template is never used at -- visible as the
+      // site an error inside a generated child reports.
+      //
+      // A FULL INSTANCE, to the leaves (`dup`, ADR-005): a bare clone
+      // shares the inner structure of any call, preference or
+      // operation in the template, so the first child's resolution of
+      // a shared key()/ref answered for every child (BUGS.md §8, §9).
+      const inst = tmpl.clone(keyctx, { dup: true })
+      repathInstance(inst, inst.path)
+      const child = fillPlace(inst, source, keyctx)
+      peg[key] = undefined === peg[key] ? child :
+        unite(keyctx, peg[key], child, 'pack')
+    }
+
+    return new MapVal({ peg }, ctx)
+  }
+
+} /* node:coverage ignore next 7 */
+
+
+export {
+  dataKeys,
+  PackFuncVal,
+}

package/src/val/PathFuncVal.ts

@@ -12,7 +12,6 @@ import {
 
 import { makeNilErr } from '../err'
 
-import { NilVal } from '../val/NilVal'
 import { RefVal } from '../val/RefVal'
 import { FuncBaseVal } from './FuncBaseVal'
 

package/src/val/PlaceVal.ts

@@ -0,0 +1,193 @@
+/* Copyright (c) 2025 Richard Rodger, MIT License */
+
+// THE PLACEHOLDER `_` (G8 phase 3,
+// docs/capability-review/g8-generation.md): a HOLE in a call, filled
+// by whatever the call is unified with.
+//
+//   x: {&: {m: _ + 2}}   x: a: m: 1     ->  a: m: 3
+//   greeting: upper(_) & hello          ->  "HELLO"
+//
+// WHY A HOLE AND NOT A FUNCTION PARAMETER. Aontu has no user-defined
+// functions and will not get them (G8's Boundary): a function value
+// crossing into the data plane is the step that makes a configuration
+// language a programming language. A hole is not a parameter -- it
+// cannot be named, passed, or partially applied. It says only "the
+// value that arrives here", which is what a template needs to compute
+// from the value it lands on.
+//
+// ALONE, `_` IS TOP WITH A MARK: it admits everything and is filled by
+// its peer, exactly as TOP is dropped by one. What makes it different
+// is that a CALL can see it, and a call that holds one waits for a
+// peer to fill it instead of resolving around it. Unfilled at
+// generation it is an error, as TOP is -- a hole is not a value.
+
+import type {
+  Val,
+  ValSpec,
+} from '../type'
+
+import {
+  AontuContext,
+} from '../ctx'
+
+import { Val as ValBase } from './Val'
+
+
+class PlaceVal extends ValBase {
+  isPlace = true
+
+  constructor(
+    spec: ValSpec,
+    ctx?: AontuContext
+  ) {
+    super(spec, ctx)
+  }
+
+
+  unify(peer: Val, _ctx: AontuContext): Val {
+    // The peer FILLS the hole. Against TOP there is nothing to fill it
+    // with, so it waits -- and waiting is not done, or a call holding
+    // it would resolve around it.
+    if (peer.isTop) {
+      this.notdone()
+      return this
+    }
+
+    return peer
+  }
+
+
+  get canon() {
+    return '_'
+  }
+
+
+  // A hole admits everything, so nothing sits above it -- the same
+  // answer TOP gives, for the same reason.
+  superior(): Val {
+    return this
+  }
+
+
+}
+
+
+// A HOLE BELONGS TO ITS NEAREST ENCLOSING GENERATOR. A `_` inside a
+// generator's template (pack/each, arg 1) or condition (filter, arg 1)
+// is that generator's to bind — "_ is the source child" — so neither
+// the hole test nor the fill walk may cross into those arguments from
+// outside. Before this boundary, `close(pack(d, _ & t))` reported a
+// hole to the OUTER call, so an ordinary overlay statement was
+// absorbed into the template instead of merging with the generated
+// child (use-cases/BUGS.md §10), and an outer pack's fill pass
+// captured a NESTED pack's hole lexically, binding it to the outer
+// source (§34). The data argument (arg 0) is not a binding position,
+// so it stays visible: a hole there is an outer hole as before.
+function boundArgStart(v: any): number {
+  return true === v.isPackFunc || true === v.isEachFunc ||
+    true === v.isFilterFunc ? 1 : Infinity
+}
+
+
+// Does this value CONTAIN a hole? Asked of a call before it resolves:
+// a call holding one must wait for a peer to fill it. Holes inside a
+// generator's own binding arguments are NOT this value's holes — see
+// boundArgStart above.
+function hasPlace(v: Val): boolean {
+  if (true === (v as any).isPlace) {
+    return true
+  }
+
+  const peg: any = (v as any).peg
+  const bound = boundArgStart(v)
+
+  if (Array.isArray(peg)) {
+    for (let cI = 0; cI < peg.length && cI < bound; cI++) {
+      const c = peg[cI]
+      if (true === c?.isVal && hasPlace(c)) {
+        return true
+      }
+    }
+  }
+  else if (true === peg?.isVal) {
+    return hasPlace(peg)
+  }
+  else if (null != peg && 'object' === typeof peg) {
+    for (const k of Object.keys(peg)) {
+      if (true === peg[k]?.isVal && hasPlace(peg[k])) {
+        return true
+      }
+    }
+  }
+
+  return false
+}
+
+
+// The same tree with every hole filled by `fill`. Answers the value
+// UNCHANGED when it holds no hole, so a caller can test identity to
+// know whether anything was filled -- and so a tree with no hole is
+// never needlessly cloned. A nested generator's binding arguments are
+// left untouched (boundArgStart): those holes are the inner
+// generator's to fill with its OWN source children when it fires.
+function fillPlace(v: Val, fill: Val, ctx: AontuContext): Val {
+  if (true === (v as any).isPlace) {
+    return fill
+  }
+
+  const peg: any = (v as any).peg
+  const bound = boundArgStart(v)
+
+  if (Array.isArray(peg)) {
+    let changed = false
+    const out = peg.map((c: any, cI: number) => {
+      if (true !== c?.isVal || bound <= cI) {
+        return c
+      }
+      const f = fillPlace(c, fill, ctx)
+      changed = changed || f !== c
+      return f
+    })
+    return changed ? rebuild(v, out, ctx) : v
+  }
+
+  if (true === peg?.isVal) {
+    const f = fillPlace(peg, fill, ctx)
+    return f === peg ? v : rebuild(v, f, ctx)
+  }
+
+  if (null != peg && 'object' === typeof peg) {
+    let changed = false
+    const out: Record<string, Val> = {}
+    for (const k of Object.keys(peg)) {
+      const c = peg[k]
+      // No isVal guard: a slot holding something that is not a Val
+      // answers itself, because fillPlace's own first tests -- is it a
+      // hole, has it a peg -- are both false for one.
+      const f = fillPlace(c, fill, ctx)
+      changed = changed || f !== c
+      out[k] = f
+    }
+    return changed ? rebuild(v, out, ctx) : v
+  }
+
+  return v
+}
+
+
+// A clone carrying a new peg. `clone` shares the peg by reference (see
+// Val.clone), which is exactly what must NOT happen here: the tree
+// being filled is a template, and the fill is one destination's.
+function rebuild(v: Val, peg: any, ctx: AontuContext): Val {
+  const out: any = v.clone(ctx)
+  out.peg = peg
+  out.dc = 0
+  return out
+} /* node:coverage ignore next 8 */
+
+
+export {
+  hasPlace,
+  fillPlace,
+  PlaceVal,
+}

package/src/val/PlusOpVal.ts

@@ -157,9 +157,18 @@ class PlusOpVal extends OpBaseVal {
     }
 
     // Float with float or integer: unchanged R5 contagion, binary64
-    // addition, float result (`1 + 2.0` is `3.0`).
+    // addition, float result (`1 + 2.0` is `3.0`) -- but a sum that
+    // leaves binary64's finite range is NOT a value. Aontu is a JSON
+    // superset and there is no notation for an infinity, so one here
+    // used to escape as `[aontu/internal]` in TypeScript and as Go's
+    // raw `json: unsupported value: +Inf` with no code at all
+    // (use-cases/BUGS.md 39). The same check governs the arithmetic
+    // family (float_overflow, ts/src/val/arith.ts).
     if ('float' === ak || 'float' === bk) {
-      return new NumberVal({ peg: av.peg + bv.peg })
+      const sum = av.peg + bv.peg
+      return Number.isFinite(sum) ?
+        new NumberVal({ peg: sum }) :
+        makeNilErr(ctx, 'float_overflow', this, undefined, 'add')
     }
 
     // Both operands are on the exact ladder: promote to the widest.

package/src/val/PrefFuncVal.ts

@@ -16,7 +16,6 @@ import {
   walk
 } from '../utility'
 
-import { NilVal } from '../val/NilVal'
 import { PrefVal } from '../val/PrefVal'
 import { FuncBaseVal } from './FuncBaseVal'
 

package/src/val/PrefVal.ts

@@ -23,7 +23,20 @@ import {
 import { top } from './top'
 
 import { FeatureVal } from './FeatureVal'
-import { ScalarKindVal, kindFamily } from './ScalarKindVal'
+
+
+// The innermost preferred value under every pref layer: the value a
+// preference of ANY rank ultimately defends, and the one generation
+// emits for it. Shared by the disjunct admission gate (DisjunctVal),
+// the defaulted-scrutinee rule (MatchFuncVal) and the effective-default
+// walk (subsume.ts) so "the default's value" cannot mean three things.
+function prefInnerPeg(v: Val): Val {
+  let out: any = v
+  while (true === out?.isPref) {
+    out = out.peg
+  }
+  return out
+}
 
 
 class PrefVal extends FeatureVal {
@@ -37,19 +50,28 @@ class PrefVal extends FeatureVal {
   // Both are assigned by resuper(), called from the constructor.
   superpeg!: Val
 
-  // The gate an overriding peer must pass. A preference is a DEFAULT, so
-  // a concrete peer replaces it -- but only within the preferred value's
-  // FAMILY: `*lower(1.1) & a` is a conflict, not an override.
+  // THE GATE AN OVERRIDING PEER MUST PASS IS `superpeg` ITSELF — the
+  // preferred value's own KIND, not its family.
   //
-  // Family and not leaf, because the number tower made `integer` and
-  // `float` disjoint siblings under `number`. Gating on the leaf would
-  // turn `*lower(2.2) & 3` (a float default overridden by an integer)
-  // into an error, which is a tightening no document asked for; gating
-  // on the family keeps it working and makes the mirror case
-  // (`*2 & 3.0`, an error before the tower) work too. For every
-  // non-numeric value the family root IS the leaf, so this is the
-  // preferred value's type as before.
-  familypeg!: Val
+  // A preference is a DEFAULT, so a concrete peer replaces it, but only
+  // where the peer is the same kind of thing: `*lower(1.1) & a` is a
+  // conflict, not an override. The number tower made `integer` and
+  // `float` disjoint siblings under `number`, and this gate used to
+  // widen to that family — so `*2.2 & 3` worked, and so did
+  // `*8080 & 3.5`. Those are ONE rule in two directions; no kind-based
+  // gate can keep the first and refuse the second.
+  //
+  // Refusing both is the choice, because the second is the documented
+  // default idiom: `port: *8080 | integer` accepted 3.5 in both ports,
+  // silently widening every key written that way from integer to
+  // number — the finding §6 of the 2026-08-21 status report calls the
+  // most consequential, precisely because docs/skill/examples.md
+  // teaches the idiom to agents.
+  //
+  // What the tightening costs is named rather than hidden: mixing the
+  // numeric leaves around a preference is now an error instead of a
+  // silent widening. `*1.5 & integer` used to answer `integer` and
+  // DISCARD a default that could never apply; it now says so.
 
   rank: number = 0
 
@@ -74,7 +96,21 @@ class PrefVal extends FeatureVal {
   // Recompute the type yardstick and the override gate from the current
   // peg. Called again whenever the peg resolves (e.g. a ref).
   private resuper() {
-    const peg: any = this.peg
+    // THE RANK-UNIFORM MEET (ADR-004). The yardstick is the INNERMOST
+    // preferred value's kind, whatever the preference's rank: `**1.5`
+    // defends `float` exactly as `*1.5` does. The old rule read the
+    // immediate peg, and a rank>=2 peg is itself a PrefVal whose
+    // superior is top -- so ANY conjunct overrode a ranked default
+    // (`**1.5 & float` dropped the default and died as mapval_no_gen;
+    // `**2|integer` met by a bare `integer` lost the default the
+    // spelling exists to carry -- use-cases/BUGS.md §3), while the
+    // rank-1 spelling of the same document kept it. One rule, every
+    // rank. Pinned by test/spec/pref.tsv (pref-rank2-* rows, and the
+    // flipped pref-nested-concrete-wins).
+    let peg: any = this.peg
+    while (true === peg?.isPref) {
+      peg = peg.peg
+    }
 
     // A preference whose peg is ITSELF a kind (`*integer`) constrains
     // nothing: there is no type-of-a-type in this lattice, so any peer
@@ -83,28 +119,13 @@ class PrefVal extends FeatureVal {
     // now that a leaf kind lifts to `number`, it has to be said.)
     if (true === peg.isScalarKind) {
       this.superpeg = top()
-      this.familypeg = this.superpeg
       return
     }
 
-    const sup: any = peg.superior()
-    this.superpeg = sup
-
     // No optional chain: superior() is contractually non-null (every
     // Val returns one, a NilVal returning itself), so guarding against
     // nullish here would claim a possibility the type does not have.
-    if (true === sup.isScalarKind) {
-      const family = kindFamily(sup.peg)
-      // The gate stands in for the preferred value in any conflict it
-      // reports, so it must carry the same site and path as the type it
-      // widens -- otherwise NilVal.make picks a different primary and
-      // the error moves to the wrong path.
-      this.familypeg = family === sup.peg ?
-        sup : sup.place(new ScalarKindVal({ peg: family, path: sup.path }))
-    }
-    else {
-      this.familypeg = sup
-    }
+    this.superpeg = peg.superior()
   }
 
 
@@ -163,13 +184,21 @@ class PrefVal extends FeatureVal {
       why += 'super-'
 
       out = unite(te ? ctx.clone({ explain: ec(te, 'SUPER') }) : ctx,
-        this.familypeg, peer, 'pref-super/' + this.id)
+        this.superpeg, peer, 'pref-super/' + this.id)
 
       // The peer added nothing beyond a type the preferred value already
       // satisfies (`*1 & integer`, `*1 & number`), so the preference
-      // stands. Anything else is a concrete override and wins.
-      if (out.same(this.superpeg) || out.same(this.familypeg)) {
-        out = this.peg
+      // stands — as ITSELF, rank intact (ADR-004). Returning the peg
+      // here (the old rule) demoted the preference to a concrete value
+      // at rank 0 and to a lower rank above it, which both destroyed
+      // overridability (`*1 & integer` then `2` was a conflict) and
+      // broke the layered-defaults ladder: a team's `**debug|string`
+      // meeting an env's `string` branch produced a rank-0 `*debug`
+      // that then fought the env's own rank-0 `*warn` as an equal.
+      // Anything else is a concrete override and wins (subject to the
+      // disjunct admission gate in DisjunctVal).
+      if (out.same(this.superpeg)) {
+        out = this
         why += 'same'
       }
 
@@ -205,7 +234,20 @@ class PrefVal extends FeatureVal {
 
   clone(ctx: AontuContext, spec?: ValSpec): Val {
     let out = (super.clone(ctx, spec) as PrefVal)
-    // out.pref = this.pref.clone(null, ctx)
+    // THE PER-DESTINATION INSTANTIATION RULE (ADR-005). The default
+    // clone shares the preferred value (`peg: this.peg` in Val.clone)
+    // — a cloned pref spread template resolves its inner value at the
+    // template's own location, pinned behaviour. But a template
+    // INSTANCE must own it: with the peg shared, a rank-2 default
+    // (`**key(1) | string`) in a pack template resolved its one
+    // shared inner key() at the first destination and every child got
+    // the first child's key (use-cases/BUGS.md §9 — rank 1 escaped
+    // only because its unify builds a fresh PrefVal per meet). The
+    // superpeg yardstick from the shared peg still holds: the clone's
+    // innermost value is the same kind.
+    if (true === spec?.dup && true === (this.peg as any)?.isVal) {
+      out.peg = this.peg.clone(ctx, { dup: true })
+    }
     return out
   }
 
@@ -227,9 +269,10 @@ class PrefVal extends FeatureVal {
 
     return val.gen(ctx)
   }
-} /* node:coverage ignore next 6 */
+} /* node:coverage ignore next 7 */
 
 
 export {
   PrefVal,
+  prefInnerPeg,
 }