aontu 0.52.1 → 0.54.0

package/src/val/MapVal.ts

@@ -16,6 +16,7 @@ import { unite } from '../unify'
 
 import {
   propagateMarks,
+  canonRiders,
   walk,
   explainOpen,
   ec,
@@ -27,12 +28,15 @@ import { makeNilErr, AontuError } from '../err'
 import {
   top
 } from './top'
+import { pendingMarkWrapper } from './RefVal'
 
 
 import { ConjunctVal } from './ConjunctVal'
 import { NilVal } from './NilVal'
 import { BagVal } from './BagVal'
+import { repathInstance, spreadId } from './Val'
 import { cmpCodePoint } from '../keyorder'
+import { markSpread } from '../provenance'
 
 
 // Structural snapshots of ref spreads (see MapVal.unify), keyed by the
@@ -60,10 +64,21 @@ function snapshotRefSpread(cj: any, ctx: AontuContext): Val | undefined {
   const sk = spreadSnapKey(cj)
   let snap: Val | undefined = snapmap.get(sk)
   if (undefined === snap) {
-    let tgt: Val | undefined = cj.find(ctx)
+    // snap mode: the pending-mark-wrapper defer in find must not
+    // apply here — the snapshot WANTS the pre-resolution structure.
+    let tgt: Val | undefined = cj.find(ctx, true)
     // A ref to a type() resolves to its inner template — snapshot that,
     // so a type-wrapped ref behaves like a plain-map ref spread.
     if (tgt && (tgt as any).isTypeFunc) tgt = (tgt as any).peg?.[0]
+    // A pending type()/hide() CALL is not yet a value to snapshot
+    // (ADR-005, the same rule find's non-snap path defers on): cached
+    // here it resolves at every destination and STAMPS marks the
+    // clearing walk ran too early to clear -- a mutual recursive
+    // schema's members vanished from generation this way. No cache;
+    // retry once the wrapper has resolved at its own field.
+    if (tgt && pendingMarkWrapper(tgt)) {
+      return undefined
+    }
     // Only snapshot a found, path-dependent target. If the target is not
     // present yet (it may be introduced by a later conjunct/merge), do
     // NOT cache — retry on the next fixpoint pass.
@@ -104,7 +119,12 @@ class MapVal extends BagVal {
 
     if (spread) {
       if ('&' === spread.o) {
-        // TODO: handle existing spread!
+        // Multiple same-level spreads arrive as an array and conjoin;
+        // an unequal spread arriving from ANOTHER statement meets this
+        // one in unify's spread combination below — sound since the
+        // combined template became stateless (pure ExpectVal, BUGS.md
+        // §6-§7): each child meets the combined constraint
+        // independently and children never meet each other's data.
         this.spread.cj =
           Array.isArray(spread.v) ?
             1 < spread.v.length ?
@@ -120,7 +140,34 @@ class MapVal extends BagVal {
 
   // NOTE: order of keys is not preserved!
   // not possible in any case - consider {a,b} unify {b,a}
+  // ALIAS DECLARATIONS MUST SIT AT THE DOCUMENT ROOT. Stated on the
+  // VALUE rather than at the parse, because the parse cannot see it: an
+  // INCLUDED file's declarations are at the root of their own text, and
+  // only once the loaded map is placed does it become apparent that
+  // root is not the document's. `%name` is spelled as a reference from
+  // the document root, so an included file's own `%b` would otherwise
+  // reach the INCLUDER's `%b` -- cross-file capture, the hazard the
+  // sigil exists to prevent, one level up.
+  //
+  // P1 is single-file by construction; carrying a name ACROSS files is
+  // what `export` and the destructure are for (P2, not built), and this
+  // refusal is what keeps the two from being confused meanwhile. Pathed
+  // at the DECLARATION, which is what is wrong, not at the map.
+  aliasDeclarationsAreRooted(ctx: AontuContext): Val | undefined {
+    if (0 === this.aliasKeys.length || 0 === this.path.length) {
+      return undefined
+    }
+    const nv: any = new NilVal({ why: 'alias_not_toplevel' }, ctx)
+    nv.site = this.site
+    nv.path = [...this.path, this.aliasKeys[0]]
+    return nv
+  }
+
   unify(peer: Val, ctx: AontuContext): Val {
+    const arooted = this.aliasDeclarationsAreRooted(ctx)
+    if (undefined !== arooted) {
+      return arooted
+    }
     // console.log('MAPVAL-UNIFY', this.id, this.canon, peer.id, peer.canon)
 
     const TOP = top()
@@ -146,9 +193,18 @@ class MapVal extends BagVal {
 
     out.closed = this.closed
     out.optionalKeys = [...this.optionalKeys]
+    out.aliasKeys = [...this.aliasKeys]
     out.spread.cj = this.spread.cj
     out.site = this.site
 
+    // A rel() peer DRIVES whichever side the fold hands it on: the
+    // relation constraint rewrites this container leaf by leaf
+    // (RELATIONS.0.md §3.2), exactly as a sizing residual takes the
+    // driver's seat above.
+    if (true === (peer as any)?.isRel) {
+      return peer.unify(this, te ? ctx.clone({ explain: ec(te, 'REL') }) : ctx)
+    }
+
     if (peer instanceof MapVal) {
       if (!this.closed && peer.closed) {
         out = peer.unify(this, te ? ctx.clone({ explain: ec(te, 'PMC') }) : ctx) as MapVal
@@ -184,6 +240,13 @@ class MapVal extends BagVal {
         // combined here). unite resolves key()/path() at each destination via
         // spreadClone below, so nested + sibling key() cases stay correct
         // (test/spec/spread-nested-key, spread-key-all).
+        //
+        // The combined template must stay STATELESS: this meet wraps a
+        // key present in only one side as an ExpectVal, the combined
+        // map is shared across destinations when path-independent
+        // (spreadClone tier 1), and a stateful expect accumulated the
+        // first sibling's data and met it into the next (BUGS.md
+        // §6-§7). ExpectVal.unify is pure for exactly this reason.
         out.spread.cj = null == out.spread.cj ? peer.spread.cj : (
           null == peer.spread.cj ? out.spread.cj :
             out.spread.cj.canon === peer.spread.cj.canon ? out.spread.cj :
@@ -243,31 +306,46 @@ class MapVal extends BagVal {
         // No `undefined !== child` here: propagateMarks above already
         // dereferenced it, so a missing child would have thrown there.
         if (!spread_cj.isTop
-          && (child as any)._spr === (spread_cj as any).id) {
+          && (child as any)._spr === spreadId(spread_cj)) {
           oval = child.done ? child :
             unite(te ? keyctx.clone({ explain: ec(te, 'KEY:' + key) }) : keyctx,
               child, TOP, 'map-own')
-          ; (oval as any)._spr = (spread_cj as any).id
+          ; (oval as any)._spr = spreadId(spread_cj)
         }
         else {
           const key_spread_cj = spread_cj.spreadClone(keyctx)
 
+          // The one place a spread is APPLIED, so the one place that
+          // knows a contribution came from a template rather than
+          // from the key itself (G7 phase 3). Only when someone is
+          // recording: the walk is O(template) per key per pass.
+          if (undefined !== keyctx.prov) {
+            markSpread(key_spread_cj)
+          }
+
           // child is non-nullish: propagateMarks above dereferences it.
           oval =
             child.isNil ? child :
                 key_spread_cj.isNil ? key_spread_cj :
-                  key_spread_cj.isTop && child.done ? child :
+                  // The no-op meet is SKIPPED on the normal path (it is the
+                  // identity) but TAKEN while recording: a value written once
+                  // and never met is still a contribution the author wants
+                  // pointed at, and the Go port's unite sees that meet (G7
+                  // phase 4). Instrumented runs pay knowingly.
+                  key_spread_cj.isTop && child.done && undefined === keyctx.prov
+                    ? child :
                     child.isTop && key_spread_cj.done ? key_spread_cj :
                       unite(te ? keyctx.clone({ explain: ec(te, 'KEY:' + key) }) : keyctx,
                         child, key_spread_cj, 'map-own')
 
           if (!spread_cj.isTop && !oval.isNil) {
-            ; (oval as any)._spr = (spread_cj as any).id
+            ; (oval as any)._spr = spreadId(spread_cj)
           }
         }
 
         out.peg[key] = oval
 
+
         done = (done && DONE === oval.dc)
       }
 
@@ -291,12 +369,31 @@ class MapVal extends BagVal {
             out.optionalKeys.push(peerkey)
           }
 
+          // ... and so is an alias declaration, for the same reason:
+          // two statements for one map are one map, and a name declared
+          // in either is declared in the result.
+          if (upeer.aliasKeys.includes(peerkey) && !out.aliasKeys.includes(peerkey)) {
+            out.aliasKeys.push(peerkey)
+          }
+
           let child = out.peg[peerkey]
 
           const peerctx = ctx.descend(peerkey)
 
           let oval = out.peg[peerkey] =
-            undefined === child ? this.handleExpectedVal(peerkey, peerchild, this, ctx) :
+            // A peer-only key is CARRIED, not met — except on an
+            // instrumented run, where the identity meet is taken so
+            // the recorder sees where the value came from. The Go port
+            // unites a genable peer-only child with TOP unconditionally
+            // (go/mapval.go), and the difference was invisible until
+            // G4's identity merge brought a peer whose children the
+            // recorder counts as WRITTEN: `why $.b.k` on two positions
+            // of one entity named the site in Go and answered "nothing
+            // met here" in TypeScript.
+            undefined === child
+              ? (undefined !== peerctx.prov && peerchild.isGenable
+                ? unite(peerctx, peerchild, TOP, 'map-peer-only')
+                : this.handleExpectedVal(peerkey, peerchild, this, ctx)) :
               child.isTop && peerchild.done ? peerchild :
                 child.isNil ? child :
                   peerchild.isNil ? peerchild :
@@ -307,15 +404,27 @@ class MapVal extends BagVal {
             // Same apply-once discipline as the own-key loop: once the
             // constraint is merged into the value (marked with the
             // constraint's id), later passes only self-unify.
-            if ((oval as any)._spr !== (spread_cj as any).id) {
+            if ((oval as any)._spr !== spreadId(spread_cj)) {
               let key_spread_cj = spread_cj.spreadClone(peerctx)
 
+              // A SPREAD IS A SPREAD FROM EITHER SIDE. The own-key loop
+              // above marks its template so `why` can say the
+              // contribution came from `&:` rather than from the key;
+              // this arm did not, so the SAME document reported the
+              // role or dropped it depending on whether the template
+              // and the keys were written in one statement or two --
+              // `services: &: {..}` plus `services: {web:{}}` took the
+              // peer path and lost `(spread)` (use-cases/BUGS.md §55).
+              if (undefined !== peerctx.prov) {
+                markSpread(key_spread_cj)
+              }
+
               oval = out.peg[peerkey] =
                 unite(te ? peerctx.clone({ explain: ec(te, 'PSP:' + peerkey) }) : peerctx,
                   oval, key_spread_cj, 'map-peer-spread')
 
               if (!spread_cj.isTop && !oval.isNil) {
-                ; (oval as any)._spr = (spread_cj as any).id
+                ; (oval as any)._spr = spreadId(spread_cj)
               }
             }
           }
@@ -325,6 +434,12 @@ class MapVal extends BagVal {
           done = (done && DONE === oval.dc)
         }
       }
+      else if (true === (peer as any).isContainerKind) {
+        // The container KIND delegates to its own arm, exactly as a
+        // scalar delegates to a ScalarKindVal peer: the kind knows to
+        // admit this map, and this map knows nothing about kinds.
+        out = peer.unify(this, ctx) as any
+      }
       else if (!peer.isTop) {
         out = makeNilErr(ctx, 'map', this, peer)
       }
@@ -382,7 +497,11 @@ class MapVal extends BagVal {
     }
 
     if (!allScalarKind) {
-      return this.clone(ctx)
+      // A full instance (`dup`, ADR-005), paths normalised to the
+      // destination: see Val.spreadClone and repathInstance.
+      const out = this.clone(ctx, { dup: true })
+      repathInstance(out, out.path)
+      return out
     }
 
     let out = (super.clone(ctx) as MapVal)
@@ -399,6 +518,7 @@ class MapVal extends BagVal {
 
     out.closed = this.closed
     out.optionalKeys = [...this.optionalKeys]
+    out.aliasKeys = [...this.aliasKeys]
 
     return out
   }
@@ -414,16 +534,22 @@ class MapVal extends BagVal {
           // (entry[1] as Val).clone(ctx, spec?.mark ? { mark: spec.mark } : {}) :
           (entry[1] as Val).clone(ctx, {
             mark: spec?.mark ?? {},
-            path: [...out.path, entry[0]]
+            path: [...out.path, entry[0]],
+            // The instantiation flag descends (ADR-005): a template's
+            // children are part of the instance.
+            dup: spec?.dup,
           }) :
           entry[1]
     }
     if (this.spread.cj) {
-      out.spread.cj = this.spread.cj.clone(ctx, spec?.mark ? { mark: spec.mark } : {})
+      out.spread.cj = this.spread.cj.clone(ctx,
+        spec?.mark || spec?.dup ?
+          { mark: spec?.mark, dup: spec?.dup } : {})
     }
 
     out.closed = this.closed
     out.optionalKeys = [...this.optionalKeys]
+    out.aliasKeys = [...this.aliasKeys]
 
     // out.from = this.from
 
@@ -437,7 +563,14 @@ class MapVal extends BagVal {
     // independent of insertion/unification order and matches the Go
     // port. A bare .sort() is UTF-16 code-unit order, which puts an
     // astral key ahead of everything in U+E000-U+FFFF -- see cmpCodePoint.
-    let keys = Object.keys(this.peg).sort(cmpCodePoint)
+    // An alias declaration is not part of the document, so canon does
+    // not render it: a document with aliases and the document with
+    // every alias written out longhand must produce the same text and
+    // therefore the same `aon1-` hash. That is the sharpest statement
+    // of what an alias IS -- a name for a value, and nothing more.
+    let keys = Object.keys(this.peg)
+      .filter(k => !this.aliasKeys.includes(k))
+      .sort(cmpCodePoint)
     return '' +
       // this.errcanon() +
       // (this.mark.type ? '<type>' : '') +
@@ -450,7 +583,13 @@ class MapVal extends BagVal {
           JSON.stringify(k) +
           (this.optionalKeys.includes(k) ? '?' : '') +
           ':' +
-          (this.peg[k]?.canon ?? this.peg[k])
+          // canonRiders, not .canon: a deprecated field renders
+          // back as its `deprecate(x, m)` call, reparseably (G3). The
+          // guard is the isVal FLAG, never the canon getter: computing
+          // canon in the guard and again in the render doubles the
+          // recursion per level, which is 2^depth on a nested document.
+          (true === this.peg[k]?.isVal
+            ? canonRiders(this.peg[k]) : this.peg[k])
         ])
         .join(',') +
       '}' // + '<' + (this.mark.hide ? 'H' : '') + '>'

package/src/val/MatchFuncVal.ts

@@ -0,0 +1,176 @@
+/* Copyright (c) 2025 Richard Rodger, MIT License */
+
+// GENERATION: `match(v, p1, r1, p2, r2, …, d?)` (G8 phase 2,
+// docs/capability-review/g8-generation.md). A BOUNDED conditional:
+// alternating pattern/result arguments and an optional trailing
+// default. The first pattern IN ARGUMENT ORDER that `v` unifies with
+// SELECTS its result, and the result is the answer.
+//
+// The design said the answer was `v & p & r` -- the scrutinee narrowed
+// by the arm rather than replaced by it. That cannot be what a match
+// is for: it makes every arm whose result is not already a `v` a
+// contradiction, and the design's own example
+// (`match($.tier, small, {cpu:1}, …)`, a string scrutinee and map
+// results) cannot be evaluated at all under it. A match MAPS a value
+// to another value; a document that wants the scrutinee kept can say
+// so, because the scrutinee is a value it can name.
+//
+//   size: match($.tier, small, {cpu:1}, large, {cpu:8}, {cpu:2})
+//
+// WHAT KEEPS IT FROM BECOMING A CONDITIONAL LANGUAGE. The scrutinee is
+// matched by UNIFIABILITY only: no boolean guards, no comparisons
+// beyond what the constraint atoms already are, no fallthrough (first
+// match wins, in a spec-pinned order), and no way to write a pattern
+// that is not an ordinary Aontu value. The whole form is total.
+//
+// NO MATCH AND NO DEFAULT IS AN ERROR, not an empty answer, and the
+// report names the patterns that were tried -- the admissible-
+// alternatives shape (G2's error contract). A default is how a
+// document says it meant to allow the rest.
+//
+// A RESULT IS NOT EVALUATED UNTIL IT IS SELECTED. Only the scrutinee
+// and the patterns are driven; an unselected result never runs, so a
+// broken arm nobody takes is not an error the document has to carry
+// (which multi-error collection, G2 phase 6, would otherwise report).
+
+import type {
+  Val,
+  ValSpec,
+} from '../type'
+
+import {
+  AontuContext,
+} from '../ctx'
+
+import { makeNilErr } from '../err'
+import { top } from './top'
+import { prefInnerPeg } from './PrefVal'
+import { FuncBaseVal, trialUnify } from './FuncBaseVal'
+
+
+// THE DEFAULTED-SCRUTINEE RULE (ADR-004, use-cases/BUGS.md §5). The
+// generation-effective view of a settled scrutinee: a preference — or
+// a disjunction carrying one — means "this value unless something
+// overrides it", and by resolve time the model has SETTLED (staging
+// rule), so nothing will. The value generation is about to emit is
+// therefore the value the patterns must be tested against. Testing
+// against the still-open preference instead let a pattern SELECT an
+// arm by overriding the default: `side_effect:*readonly|write|
+// destructive` beside `match(.side_effect, destructive, true, false)`
+// answered `true` while generating "readonly" next to it — a derived
+// value contradicting the very value it derives from, exit 0.
+// A pref-free scrutinee (open disjunction included) is untouched:
+// matching by unifiability is its documented meaning.
+// Exported for the multi-pref unit test (ADR-002, the subsumeNode
+// precedent): rankPrefs leaves a settled disjunct at most one pref, so
+// the min-rank scan below cannot be reached through a document.
+export function effectiveScrutinee(v: Val): Val {
+  let out: any = v
+  if (true === out?.isDisjunct && Array.isArray(out.peg)) {
+    const prefs = out.peg.filter((m: any) => true === m?.isPref)
+    if (0 === prefs.length) {
+      return v
+    }
+    // Generation picks the LOWEST rank (effectiveDefault in
+    // subsume.ts; `a:**1|*2` generates 2). rankPrefs leaves at most
+    // one pref standing in a settled disjunct, so the scan is
+    // defensive.
+    out = prefs.reduce((a: any, b: any) => b.rank < a.rank ? b : a)
+  }
+  return prefInnerPeg(out)
+}
+
+
+class MatchFuncVal extends FuncBaseVal {
+  isMatchFunc = true
+
+  // THE STAGING RULE (G8 phase 0). A scrutinee that is still being
+  // narrowed can match an EARLIER pattern than the one it will end up
+  // matching, and the arm a match takes is not a thing to guess at.
+  staged = true
+
+  constructor(
+    spec: ValSpec,
+    ctx?: AontuContext
+  ) {
+    super(spec, ctx)
+  }
+
+
+  funcname() {
+    return 'match'
+  }
+
+
+  prepare(_ctx: AontuContext, _args: Val[]) {
+    return null
+  }
+
+
+  // The scrutinee is argument 0 and the patterns are the odd
+  // arguments; the results are the even ones after 0, and the last
+  // argument is a DEFAULT when the count is even. Written once, read
+  // by both the driver below and resolve.
+  hasDefault() {
+    return 0 === this.peg.length % 2
+  }
+
+
+  unify(peer: Val, ctx: AontuContext): Val {
+    // The scrutinee and the PATTERNS are driven; the results are not
+    // (see the header). driveStagedArgs takes a prefix, so the odd
+    // positions are driven one at a time.
+    let ready = this.driveStagedArgs(ctx, 1)
+    const last = this.peg.length - (this.hasDefault() ? 1 : 0)
+    for (let i = 1; i < last; i += 2) {
+      const arg: Val = this.peg[i]
+      if (!arg.done) {
+        this.peg[i] = arg.unify(top(), ctx)
+      }
+      ready = ready && true === this.peg[i].done
+    }
+
+    if (!ready || !ctx.settle) {
+      return this.residuate(peer, ctx)
+    }
+
+    return super.unify(peer, ctx)
+  }
+
+
+  resolve(ctx: AontuContext, args: Val[]) {
+    const scrutinee: Val = effectiveScrutinee(args[0])
+    const dflt: Val | undefined = this.hasDefault() ?
+      args[args.length - 1] : undefined
+    const last = args.length - (undefined === dflt ? 0 : 1)
+
+    const tried: string[] = []
+
+    for (let i = 1; i < last; i += 2) {
+      const pattern: Val = args[i]
+      tried.push(pattern.canon)
+
+      // The trial is against CLONES: `unite` refines a bag in place
+      // against a TOP peer, and a pattern that failed must be
+      // untouched for the next document that reads its canon.
+      if (undefined !== trialUnify(ctx, scrutinee.clone(ctx), pattern.clone(ctx))) {
+        return args[i + 1].clone(ctx)
+      }
+    }
+
+    if (undefined !== dflt) {
+      return dflt.clone(ctx)
+    }
+
+    return makeNilErr(ctx, 'match_none', this, undefined, 'resolve', {
+      value: scrutinee.canon,
+      tried: tried.join(' '),
+    })
+  }
+
+} /* node:coverage ignore next 5 */
+
+
+export {
+  MatchFuncVal,
+}

package/src/val/MoveFuncVal.ts

@@ -12,7 +12,6 @@ import {
 
 import { makeNilErr } from '../err'
 
-import { NilVal } from '../val/NilVal'
 
 import {
   walk
@@ -21,7 +20,6 @@ import {
 
 
 import { FuncBaseVal } from './FuncBaseVal'
-import { CopyFuncVal } from './CopyFuncVal'
 import { PrefFuncVal } from './PrefFuncVal'
 
 

package/src/val/NilVal.ts

@@ -79,6 +79,31 @@ class NilVal extends Val {
       }
     }
 
+    // THE PATH IS WHERE THE MEET IS, NOT WHERE THE OPERAND WAS WRITTEN
+    // (use-cases/BUGS.md §41). The operand path above decides the SITE
+    // correctly and the path only by accident: a value that arrives by
+    // REFERENCE is re-pathed to the referring field, and its children
+    // are re-pathed to that same field rather than rebased under it, so
+    // every conflict inside `q: $.M` reported `$.q` — the enclosing
+    // record, not the key to edit, and the SAME path for every one of
+    // its fields. The context has descended to the child by the time
+    // the meet fails, and Go reads the path off the tree position for
+    // exactly this reason.
+    //
+    // Only EXTENDS, never redirects: the context path is taken when the
+    // operand's path is a PREFIX of it, so a nil minted away from the
+    // descent (a func resolving an argument, a generator's own probe,
+    // an anchored `--at` run whose operand is already correctly placed)
+    // keeps the path its operand carries. Taking the context path
+    // unconditionally was tried and reverted -- it moved the closed-key,
+    // spread-template and every `--at` finding to the driving location,
+    // which is not where those belong.
+    if (null != ctx?.path && null != nil.path &&
+      nil.path.length < ctx.path.length &&
+      nil.path.every((p, i) => p === ctx.path[i])) {
+      nil.path = [...ctx.path]
+    }
+
     if (ctx) {
       ctx.adderr(nil)
     }

package/src/val/OpBaseVal.ts

@@ -31,6 +31,7 @@ import {
 
 import { ConjunctVal } from './ConjunctVal'
 import { FeatureVal } from './FeatureVal'
+import { hasPlace, fillPlace } from './PlaceVal'
 
 
 
@@ -66,6 +67,17 @@ class OpBaseVal extends FeatureVal {
 
 
   unify(peer: Val, ctx: AontuContext): Val {
+
+    // THE PLACEHOLDER (G8 phase 3, see PlaceVal), on the operator side:
+    // `x: {&: {m: _ + 2}}` meeting `1` is `3`. Same rule as
+    // FuncBaseVal's -- the peer fills the hole and the operation is
+    // what answers.
+    if (!peer.isTop && !peer.isNil && this.id !== peer.id && hasPlace(this)) {
+      if (hasPlace(peer)) {
+        return makeNilErr(ctx, 'place_pair', this, peer)
+      }
+      return fillPlace(this, peer, ctx).unify(top(), ctx)
+    }
     const te = ctx.explain && explainOpen(ctx, ctx.explain, 'Op:' + this.opname(), this, peer)
     // Declared without an initial value: every arm below assigns it, and
     // seeding it with `this` made the two arms that stand the op read as
@@ -165,10 +177,17 @@ class OpBaseVal extends FeatureVal {
   }
 
 
-  clone(ctx: AontuContext, _spec?: ValSpec): Val {
+  clone(ctx: AontuContext, spec?: ValSpec): Val {
     let out = (super.clone(ctx, {
       peg: this.peg,
     }) as OpBaseVal)
+    // THE PER-DESTINATION INSTANTIATION RULE (ADR-005): an operation
+    // inside a template clones its operands as instances — the
+    // default clone shares them (see FuncBaseVal.clone). Every
+    // operand is a Val by construction, as in the Go twin's []Val.
+    if (true === spec?.dup) {
+      out.peg = this.peg.map((a: Val) => a.clone(ctx, { dup: true }))
+    }
     return out
   }
 

package/src/val/OpenFuncVal.ts

@@ -14,7 +14,6 @@ import { makeNilErr } from '../err'
 
 
 import { FuncBaseVal } from './FuncBaseVal'
-import { NilVal } from '../val/NilVal'
 import { BagVal } from '../val/BagVal'
 
 
@@ -39,13 +38,16 @@ class OpenFuncVal extends FuncBaseVal {
 
 
   resolve(ctx: AontuContext | undefined, args: Val[]) {
-    const argval: any = args[0]
+    let argval: any = args[0]
 
     if (null == argval) {
       return makeNilErr(ctx, 'no_first_arg', this, undefined, 'close')
     }
 
     if (argval.isMap || argval.isList) {
+      // In place, for the reason CloseFuncVal.resolve gives: the
+      // instantiation rule (ADR-005) makes the argument this call's
+      // own wherever the call is multiplied.
       (argval as BagVal).closed = false
     }