aontu 0.53.0 → 0.55.0

package/dist/lang.js

@@ -10,12 +10,30 @@ exports.Site = exports.Lang = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const jsonic_1 = require("@tabnas/jsonic");
+// THE CONFIG-FORMAT READERS (ADR-012). Each is a jsonic plugin for one
+// format, so an included `.toml` or `.yaml` is parsed by a real parser
+// for that format rather than guessed at by this one. `@tabnas/json` is
+// the strict RFC 8259 reader, used for `.json` and `.jsonld`.
+const sig_1 = require("./sig");
+const json_1 = require("@tabnas/json");
+const toml_1 = require("@tabnas/toml");
+const jsonc_1 = require("@tabnas/jsonc");
+const json5_1 = require("@tabnas/json5");
+const yaml_1 = require("@tabnas/yaml");
+const ini_1 = require("@tabnas/ini");
 const debug_1 = require("@tabnas/debug");
 const multisource_1 = require("@tabnas/multisource");
 // TODO: @tabnas/multisource should support virtual fs
 const file_1 = require("@tabnas/multisource/resolver/file");
 const pkg_1 = require("@tabnas/multisource/resolver/pkg");
 const mem_1 = require("@tabnas/multisource/resolver/mem");
+// The Aontu-source processor, TAKEN RATHER THAN ALIASED. The obvious
+// spelling is the alias `aon: 'jsonic'`, which multisource resolves
+// through its own processor map -- but `jsonic` is a FORMAT NAME in
+// the include table now, so that alias resolved to the plain-jsonic
+// DATA reader and every `.aon` include was suddenly parsed without the
+// language in it. Naming the function leaves nothing to collide with.
+const jsonic_2 = require("@tabnas/multisource/processor/jsonic");
 const std_1 = require("./std");
 const mod_1 = require("./mod");
 const expr_1 = require("@tabnas/expr");
@@ -50,8 +68,8 @@ const KeyFuncVal_1 = require("./val/KeyFuncVal");
 const TypeFuncVal_1 = require("./val/TypeFuncVal");
 const HideFuncVal_1 = require("./val/HideFuncVal");
 const DeprecateFuncVal_1 = require("./val/DeprecateFuncVal");
-const IdFuncVal_1 = require("./val/IdFuncVal");
 const ReferFuncVal_1 = require("./val/ReferFuncVal");
+const GraphAtomVal_1 = require("./val/GraphAtomVal");
 const PackFuncVal_1 = require("./val/PackFuncVal");
 const EachFuncVal_1 = require("./val/EachFuncVal");
 const FilterFuncVal_1 = require("./val/FilterFuncVal");
@@ -61,6 +79,7 @@ const AggFuncVal_1 = require("./val/AggFuncVal");
 const PlaceVal_1 = require("./val/PlaceVal");
 const MoveFuncVal_1 = require("./val/MoveFuncVal");
 const PathFuncVal_1 = require("./val/PathFuncVal");
+const ContainerKindVal_1 = require("./val/ContainerKindVal");
 const PrefFuncVal_1 = require("./val/PrefFuncVal");
 const CloseFuncVal_1 = require("./val/CloseFuncVal");
 const OpenFuncVal_1 = require("./val/OpenFuncVal");
@@ -102,6 +121,12 @@ function bigVal(res) {
 const CC_0 = 48;
 const CC_d = 100;
 const CC_D = 68;
+// THE ALIAS SIGIL. `%` is part of an alias's name, so the name is one
+// lexeme wherever it appears and its meaning is decided by position:
+// a BINDING in key position (`%uint8: …` declares), a USE in value
+// position (`listen: %uint8` refers). docs/design/ALIASES.0.md §4.
+const CC_PCT = 37;
+const ALIAS_RE = /^%[A-Za-z_][A-Za-z0-9_]*/;
 let AontuJsonic = function AontuLang(jsonic) {
     jsonic.use(asPlugin(path_1.Path));
     // Only # line comments are valid Aontu syntax (see
@@ -112,6 +137,35 @@ let AontuJsonic = function AontuLang(jsonic) {
         terms = dropUnfilled(terms);
         if (0 === terms.length)
             return incompleteNil(r, ctx);
+        // AN ALIAS IS NOT A PATH SEGMENT. `$.%foo` is refused: the alias
+        // namespace and the path namespace are disjoint, and an alias is
+        // reached by writing `%foo` and only that.
+        //
+        // The engine spells an alias reference AS a root reference to the
+        // declaration -- which is what gives it order independence and a
+        // cycle check shared with paths -- but that is an implementation of
+        // the name, not a second way to write it. Left writable, the two
+        // spellings would drift apart the moment aliases stop being
+        // file-shaped, and `$.%b` inside an included file would reach the
+        // INCLUDER's `%b` rather than its own, which is exactly the
+        // cross-file capture the sigil exists to prevent.
+        // `%foo` lexes to the reference itself, so in `$.%foo` it arrives
+        // as a TERM rather than as a string segment -- both shapes are
+        // checked, since a quoted `$."%foo"` would arrive as the string.
+        // Terms here are always Vals -- dropUnfilled has removed the
+        // nulls, and the dot rules never hand over a raw string -- so the
+        // shapes are exactly three: a RefVal (peg is the segment array), a
+        // StringVal (peg is the segment), and anything else (a numeric or
+        // exact segment, which cannot be an alias name).
+        for (const t of terms) {
+            const segs = Array.isArray(t.peg) ? t.peg :
+                ('string' === typeof t.peg ? [t.peg] : []);
+            for (const seg of segs) {
+                if ('string' === typeof seg && ALIAS_RE.test(seg)) {
+                    return addsite(new NilVal_1.NilVal({ why: 'alias_in_path' }), r, ctx);
+                }
+            }
+        }
         return addsite(new RefVal_1.RefVal({ peg: terms, prefix }), r, ctx);
     };
     jsonic.options({ comment: { def: null } });
@@ -183,9 +237,41 @@ let AontuJsonic = function AontuLang(jsonic) {
             check: (lex) => {
                 // Guard first, on char codes: this hook runs at every text
                 // position, and the common case (any run that cannot be a `0d`
-                // literal) must cost two char reads and no allocation.
+                // literal or an alias) must cost two char reads and no
+                // allocation.
                 const pnt = lex.pnt;
                 const src = lex.src;
+                // AN ALIAS NAME IS CLAIMED WHOLE, for the same reason the `0d`
+                // run below is: the text matcher's ender regexp would otherwise
+                // carve `%uint8` at the `%` and emit the sigil as its own token,
+                // leaving a bare `uint8` behind -- which is exactly the capture
+                // the sigil exists to prevent. Claiming it here, before that
+                // ender runs, keeps the name one lexeme.
+                //
+                // The token's SOURCE is the whole `%name`, which is what makes
+                // the same lexeme work in both positions: jsonic keys a pair by
+                // the token's source text (`0d1: 5` yields the key `0d1`), so a
+                // declaration reads as the key `%uint8`, while a value position
+                // calls the function below and gets the reference.
+                if (CC_PCT === src.charCodeAt(pnt.sI)) {
+                    const ares = ALIAS_RE.exec(lex.refwd());
+                    if (null == ares) {
+                        return undefined;
+                    }
+                    const asrc = ares[0];
+                    const atkn = lex.token('#VL', 
+                    // AN ALIAS REFERENCE IS A PATH REFERENCE. `%uint8` is
+                    // `$.%uint8`: root-absolute, one segment, spelled with the
+                    // sigil the declaration is spelled with. Everything the
+                    // design asks of it -- order independence, alias-of-alias,
+                    // redeclaration unifying, cycle refusal spanning both
+                    // namespaces -- is then the reference machinery already in
+                    // the language, not a second resolver beside it.
+                    (r, ctx) => addsite(new RefVal_1.RefVal({ peg: [asrc], absolute: true }), r, ctx), asrc, pnt);
+                    pnt.sI += asrc.length;
+                    pnt.cI += asrc.length;
+                    return { done: true, token: atkn };
+                }
                 if (CC_0 !== src.charCodeAt(pnt.sI)) {
                     return undefined;
                 }
@@ -338,6 +424,13 @@ help isolate the syntax error.`,
         move: MoveFuncVal_1.MoveFuncVal,
         path: PathFuncVal_1.PathFuncVal,
         pref: PrefFuncVal_1.PrefFuncVal,
+        // First-class paths and the container kinds
+        // (docs/design/PATHS.0.md). `path(p)` CAPTURES a path as a value;
+        // `path()`, `map()` and `list()` are kinds -- the vacuous
+        // constructor call admits its values and defaults to nothing,
+        // where the container LITERALS `{}`/`[]` default to empty.
+        map: ContainerKindVal_1.MapFuncVal,
+        list: ContainerKindVal_1.ListFuncVal,
         close: CloseFuncVal_1.CloseFuncVal,
         open: OpenFuncVal_1.OpenFuncVal,
         super: SuperFuncVal_1.SuperFuncVal,
@@ -368,16 +461,17 @@ help isolate the syntax error.`,
         // record rides the result (Val.deprecation) and canon renders the
         // call back (canonRiders).
         deprecate: DeprecateFuncVal_1.DeprecateFuncVal,
-        // G4 phase 1: the identity mark. Written as a conjunct
-        // (`id(svc/auth) & {…}`), it resolves to the unit carrying the
-        // name, and every node in one evaluation with that name is
-        // unified with every other.
-        id: IdFuncVal_1.IdFuncVal,
         // G4 phase 2: the checked, typed, LINK-shaped reference. A
-        // constraint on a string field: the string must be an entity
-        // address, the address must resolve, and the optional argument
-        // flows INTO the target. The field keeps the string.
+        // constraint on a string field: the string must be a TREE ADDRESS
+        // (`$.a.b` or `.b`), the address must resolve, and the optional
+        // argument flows INTO the target. The field keeps the string.
         refer: ReferFuncVal_1.ReferFuncVal,
+        rel: ReferFuncVal_1.RelFuncVal,
+        // RELATIONS P2 (docs/design/RELATIONS.0.md §3.3): the graph
+        // atoms, conjoined at the field whose key is the predicate they
+        // govern. Lattice-inert; the verdict lands at generation.
+        acyclic: GraphAtomVal_1.AcyclicFuncVal,
+        inverse: GraphAtomVal_1.InverseFuncVal,
         // G8 phase 1: the generation combinators. `pack` makes one keyed
         // child per child of its data, `each` one list element; both clone
         // their template per destination exactly as a spread does, and both
@@ -415,6 +509,11 @@ help isolate the syntax error.`,
         // RECORDS: `sum(pick($.lines, amountCents))`. Not a clever `each`
         // template -- `each` MEETS each child, and a meet cannot select.
         pick: AggFuncVal_1.PickFuncVal,
+        // G9 phase 2: the fold to a STRING. `sum` folds with `add`; this
+        // folds with `+`, so it inherits the one number-to-text rule and
+        // the language does not grow a second. It is the primitive that
+        // turns a bag of computed lines into a file.
+        join: AggFuncVal_1.JoinFuncVal,
     };
     // A dangling operator (`a:1|`, `a:$`, `a:*` at end of input) leaves
     // null/undefined unfilled terms. Junction ops drop them (so `a:1&`
@@ -424,10 +523,8 @@ help isolate the syntax error.`,
     const dropUnfilled = (terms) => terms.filter((t) => null != t);
     const incompleteNil = (r, ctx) => addsite(new NilVal_1.NilVal({ why: 'incomplete_expression' }), r, ctx);
     // Build a call from a NAME and the argument terms as the author
-    // wrote them. Shared by the `func(...)` handler and by the pipe,
-    // which is the same call with one more argument on the front — so
-    // the arity check, the comma-group rule and the raw-value conversion
-    // are stated once and both spellings get all three.
+    // wrote them: the arity check, the comma-group rule and the
+    // raw-value conversion, stated once.
     const buildCall = (r, ctx, fname, argterms) => {
         const funcval = funcMap[fname];
         // Arity is known for every built-in, so a surplus or missing
@@ -457,12 +554,6 @@ help isolate the syntax error.`,
                     want: arityText(arity[0], arity[1]),
                     got: '' + got,
                 };
-                // The CALL AS WRITTEN rides the refusal (G8 phase 4): a pipe
-                // rebuilds `x |> upper()` as `upper(x)`, and the arity it fails
-                // on here is the arity of a call one argument short of the one
-                // the author actually wrote.
-                nil._callname = fname;
-                nil._callterms = argterms;
                 return addsite(nil, r, ctx);
             }
         }
@@ -491,38 +582,8 @@ help isolate the syntax error.`,
         const val = null == funcval ?
             new NilVal_1.NilVal({ why: 'unknown_function' }) :
             new funcval({ peg: args });
-        // The call as written, for the pipe to rebuild from. Parse-time
-        // only: nothing downstream reads it, and a clone does not carry it.
-        //
-        // NOT on a constraint atom that BUILT: an atom with its argument
-        // list complete is a residual, not a call waiting for a subject,
-        // and `1 |> neq(2,3)` is asking for `1 & neq(2,3)` -- which is
-        // what `&` is for. (An atom the arity check REFUSED still carries
-        // it, on the nil above: `1 |> min()` is `min(1)`, and that is a
-        // call waiting for a subject.) The Go port cannot rebuild a built
-        // atom at all -- its residual keeps no atom name -- so this is
-        // also what keeps the two ports answering the same thing.
-        if (true !== val.isConstraint) {
-            val._callname = fname;
-            val._callterms = argterms;
-        }
         return val;
     };
-    // The argument terms `f(...)` would have been written with, had the
-    // piped value been written into it. A comma group is one raw-array
-    // term: for a POSITIONAL function the group is separate arguments,
-    // so the piped value joins them; for a constraint atom the group IS
-    // the argument list, so the piped value joins the list instead.
-    const pipeTerms = (call, val) => {
-        const written = call._callterms;
-        const group = 1 === written.length && Array.isArray(written[0]) ?
-            written[0] : written;
-        if (0 === group.length) {
-            return [val];
-        }
-        return true === POSITIONAL_ARG_FUNCS[call._callname] ?
-            [val, ...group] : [[val, ...group]];
-    };
     let opmap = {
         'conjunct-infix': (r, ctx, _op, terms) => addsite(new ConjunctVal_1.ConjunctVal({ peg: dropUnfilled(terms) }), r, ctx),
         'disjunct-infix': (r, ctx, _op, terms) => addsite(new DisjunctVal_1.DisjunctVal({ peg: dropUnfilled(terms) }), r, ctx),
@@ -534,11 +595,47 @@ help isolate the syntax error.`,
         'star-prefix': (r, ctx, _op, terms) => {
             if (null == terms[0])
                 return incompleteNil(r, ctx);
+            // A PREFERENCE MARKS A VALUE, AND A BARE KEY IS NOT ONE.
+            // `*a: 1` has no braces, so the prefix took the whole IMPLICIT
+            // map as its operand and the document silently became
+            // `*{"a":1}` -- `*a: 1, b: 2` became a one-element LIST, losing
+            // `b` outright. Neither is anything the author wrote.
+            //
+            // The accident is confined to the first position of the implicit
+            // top-level map, which is the only place no brace has yet
+            // committed the rule to a map: `{*a: 1}` and `a: 1, *b: 2` are
+            // ALREADY parse errors. This makes the third spelling agree with
+            // them rather than inventing a meaning for it.
+            //
+            // A BRACED operand is untouched, and that is the whole of the
+            // distinction: `*{x:1}` and `*[1]` are the real spelling, they
+            // are what `*{x:1} | *{y:2}` needs, and the shared spec pins them
+            // (11 rows). The open token's own source text is what separates
+            // the two -- `{` or `[` for a braced bag, the first key or
+            // element for an implicit one.
+            const bag = terms[0];
+            if ((bag.isMap && '{' !== bag.site.src) ||
+                (bag.isList && '[' !== bag.site.src)) {
+                return addsite(new NilVal_1.NilVal({ why: 'pref_implicit_bag' }), r, ctx);
+            }
             return addsite(new PrefVal_1.PrefVal({ peg: terms[0] }), r, ctx);
         },
         'dollar-prefix': (r, ctx, _op, terms) => {
             if (null == terms[0])
                 return incompleteNil(r, ctx);
+            // A refusal from the dot rule below (an alias used as a path
+            // segment) rides straight through: wrapping it in a VarVal would
+            // replace `alias_in_path` with a var whose peg is a nil.
+            if (terms[0]?.isNil) {
+                return terms[0];
+            }
+            // `$%foo` -- the sigil directly after the root -- reaches here
+            // as the alias reference rather than through the dot rule, and
+            // is refused for the same reason.
+            if (terms[0] instanceof RefVal_1.RefVal &&
+                terms[0].peg.some((seg) => 'string' === typeof seg && ALIAS_RE.test(seg))) {
+                return addsite(new NilVal_1.NilVal({ why: 'alias_in_path' }), r, ctx);
+            }
             // $.a.b absolute path
             if (terms[0] instanceof RefVal_1.RefVal) {
                 terms[0].absolute = true;
@@ -593,37 +690,6 @@ help isolate the syntax error.`,
                 return incompleteNil(r, ctx);
             return addsite(val, r, ctx);
         },
-        // THE PIPE `|>` (G8 phase 4): parse-time sugar and nothing else.
-        // `x |> f(a)` IS `f(x, a)` -- the piped value goes in as the FIRST
-        // argument, Elixir-style, because every Aontu call is data-first
-        // already (`close(x)`, `pack(data, tmpl)`) and a pipe must read the
-        // way the calls it replaces read. It never reaches a Val: by the
-        // time the tree exists the call is an ordinary call, which is why
-        // canon can never emit the token and the two ports' canon stay
-        // byte-identical without either knowing about it.
-        'pipe-infix': (r, ctx, _op, terms) => {
-            const val = terms[0];
-            const call = terms[1];
-            if (null == val || null == call)
-                return incompleteNil(r, ctx);
-            // The right-hand side is a CALL: either one the func handler
-            // already built, or one it refused for an arity the pipe is about
-            // to satisfy. Both carry what they were written as.
-            if (null != call._callname) {
-                return buildCall(r, ctx, call._callname, pipeTerms(call, val));
-            }
-            // ... or a bare NAME, which is the whole point of the short
-            // spelling: `x |> upper` is `upper(x)`. A bare word has already
-            // become a string VALUE by the time an infix operator sees it, so
-            // this is where a string becomes a call.
-            if (true === call?.isScalar && 'string' === typeof call.peg &&
-                null != funcMap[call.peg]) {
-                return buildCall(r, ctx, call.peg, [val]);
-            }
-            // Anything else is not a call, and a pipe into a non-call is a
-            // mistake in the source rather than a value.
-            return addsite(new NilVal_1.NilVal({ why: 'pipe_target' }), r, ctx);
-        },
         'func-paren': (r, ctx, _op, terms) => {
             let val = terms[1];
             const fname = terms[0];
@@ -651,13 +717,6 @@ help isolate the syntax error.`,
             'disjunct': {
                 infix: true, src: '|', left: 14_000_000, right: 15_000_000
             },
-            // G8 phase 4: the pipe. LOOSEST of all the infix operators, so
-            // `a & b |> f` pipes the whole meet and not just `b` -- a pipe
-            // reads as "and then", which is a statement about everything to
-            // its left. Kept in lock-step with the op table in go/lang.go.
-            'pipe-infix': {
-                infix: true, src: '|>', left: 12_000_000, right: 13_000_000
-            },
             'plus-infix': {
                 src: '+',
                 infix: true,
@@ -740,6 +799,7 @@ help isolate the syntax error.`,
     const TX = jsonic.token.TX;
     const NR = jsonic.token.NR;
     const QM = jsonic.token.QM;
+    const VL = jsonic.token.VL;
     const OPTKEY = [TX, ST, NR];
     jsonic.rule('expr', (rs) => {
         rs.close([
@@ -861,6 +921,7 @@ help isolate the syntax error.`,
         ])
             .bc((r, ctx) => {
             const optionalKeys = r.u.aontu_optional_keys ?? [];
+            const aliasKeys = r.u.aontu_alias_keys ?? [];
             let mo = r.node;
             // An elided value (`a:`) leaves a raw null/undefined that never
             // passed through the val rule. It is REFUSED rather than made a
@@ -920,12 +981,14 @@ help isolate the syntax error.`,
                 // TODO: needs addpath?
                 let mopv = new MapVal_1.MapVal({ peg: mop });
                 mopv.optionalKeys = optionalKeys;
+                mopv.aliasKeys = aliasKeys;
                 r.node =
                     addsite(new ConjunctVal_1.ConjunctVal({ peg: [mopv, ...mo.___merge] }), r, ctx);
             }
             else {
                 r.node = addsite(new MapVal_1.MapVal({ peg: mo }), r, ctx);
                 r.node.optionalKeys = optionalKeys;
+                r.node.aliasKeys = aliasKeys;
             }
             return undefined;
         })
@@ -1047,6 +1110,31 @@ help isolate the syntax error.`,
         })
             .bc((rule) => {
             // TRAVERSE PARENTS TO GET PATH
+            // A DECLARATION IS A PAIR WHOSE KEY IS AN ALIAS NAME. The lexer
+            // claims `%name` whole and hands it over as a #VL token whose
+            // SOURCE is the name, so the key TEXT alone cannot be the test:
+            // a quoted `"%a": 1` is an ordinary key that merely starts with
+            // the sigil, and erasing that would be wrong. The token is what
+            // separates them.
+            //
+            // Recorded on the enclosing map, never on the value, and that is
+            // the point: a reference COPIES the value it resolves to, so a
+            // mark riding the value would erase the referring field too.
+            // Being a property of the map is also what carries it through a
+            // meet, the way optional keys are carried.
+            const ktkn = rule.o0;
+            if (null != ktkn && VL === ktkn.tin && ALIAS_RE.test('' + ktkn.src)) {
+                const holder = rule.parent;
+                const aname = '' + ktkn.src;
+                // Always recorded here; whether the map is ALLOWED to carry
+                // declarations is decided on the VALUE (MapVal.unify), not at
+                // the parse. The parse cannot see it: an INCLUDED file's
+                // declarations are at the root of their own text, and only
+                // once the loaded map is placed does it become apparent that
+                // root is not the document's.
+                holder.u.aontu_alias_keys = (holder.u.aontu_alias_keys || []);
+                holder.u.aontu_alias_keys.push(aname);
+            }
             if (rule.u.spread) {
                 rule.node[type_1.SPREAD] =
                     (rule.node[type_1.SPREAD] || { o: rule.o0.src, v: [] });
@@ -1083,7 +1171,10 @@ help isolate the syntax error.`,
                 s: [QM, CL],
                 c: (r) => r.prev.u.aontu_optional,
                 p: 'val',
-                u: { spread: true, done: true, list: true, pair: true },
+                u: {
+                    spread: true, done: true, list: true, pair: true,
+                    aontu_optional_elem: true,
+                },
                 a: (r) => {
                     pairkey(r.prev);
                     r.u.key = r.prev.u.key;
@@ -1091,18 +1182,17 @@ help isolate the syntax error.`,
                 },
                 g: 'aontu-optional-elem'
             },
-            // A PLAIN pair in list position, `[k:v]`. It contributes no
-            // element either -- a key:value pair is simply not a list element,
-            // which is the rule the optional form above already followed, and
-            // the two spellings must not disagree (issue #40).
-            //
-            // It needed an alt of its own because only a NON-NUMERIC key was
-            // already inert: jsonic writes the pair at `node[key]`, and the
-            // node is an array, so `[x:1]` set a property that never showed up
-            // (`length` stays 0) while `[0:1]` set an INDEX and became an
-            // element -- `[1:2]` even filling the gap with a null. That is the
-            // shape of a JavaScript array, not a decision about the language,
-            // and it made the two ports disagree on generate as well as canon.
+            // A PLAIN pair in list position IS A SINGLE-KEY MAP ELEMENT:
+            // `[a:1, b:2]` is `[{a:1}, {b:2}]` (the rule @tabnas/jsonic
+            // spells as `list.pair`). This REVERSES issue #40's "a pair is
+            // not an element": that rule was chosen because jsonic wrote
+            // the pair at `node[key]` -- an array PROPERTY that never
+            // showed up for a text key and an INDEX for a numeric one --
+            // and inert beat that incoherence. But inert was itself a
+            // silent drop: `x: [a:1, b:2]` evaluated to `x: []`, the
+            // author's data gone at exit 0. The element is built in the
+            // bc below, where the value is already a Val; the snapshot
+            // still neutralises jsonic's raw slot write first.
             {
                 s: [OPTKEY, CL], p: 'val',
                 u: { spread: true, done: true, list: true, pair: true },
@@ -1113,26 +1203,291 @@ help isolate the syntax error.`,
                 g: 'aontu-plain-pair-elem'
             }
         ])
-            .bc((rule) => {
+            // NOTE: manually adjust path - the twin of the `pair` rule's hook
+            // above, and for the same reason, one layer down.
+            //
+            // Every alt above contributes NO element: a `&:` spread is a
+            // constraint on the elements, and a `k:v` pair in list position is
+            // simply not one (the `aontu-plain-pair-elem` note above). The array
+            // slot they briefly occupy is already given back by
+            // restorePairSlot. The PATH index was not: @tabnas/path's
+            // `@elem-ao` increments `r.k.index` for every elem rule it sees, so
+            // each of these stole an index and every later element's path was
+            // one too high — `[&: integer, 10, 20, "bad"]` reported the bad
+            // value at `$.l.3` while `aontu get $.l.2` returned it, and on a
+            // one-element list the path pointed off the end. Generation was
+            // never wrong, which is why nothing caught it: the array is right
+            // and only the labels on it were shifted (BUGS.md 44).
+            //
+            // Rewinding here rather than in the plugin keeps the plugin's rule
+            // ("in an array, the path property is the element index") true —
+            // these alts are the aontu-specific exceptions to what counts as an
+            // element, so the correction belongs with the grammar that
+            // introduces them. The child is re-pathed because the plugin has
+            // already stamped it with the index being given back: a spread
+            // takes the `'&'` segment its map twin takes, and a pair takes its
+            // key, as a map entry would.
+            .ao((r) => {
+            // A pair IS an element now, so it keeps the index @tabnas/path
+            // gave it, and its VALUE is pathed through both the index and
+            // the key (`[a: $.nope]` fails at $.l.0.a). Only the `&:`
+            // spread still contributes no element and gives its index back
+            // (BUGS.md 44).
+            if (0 < r.d && r.u.spread && !r.u.pair) {
+                r.k.index = r.k.index - 1;
+                const seg = '&';
+                r.child.k.path = [...r.k.path, seg];
+                r.child.k.key = seg;
+            }
+            else if (0 < r.d && r.u.pair) {
+                // The element's index is the array length: everything before
+                // it is already pushed, and the pair's own map is pushed at
+                // close. `r.k.index` is not usable here -- the path plugin
+                // counts only the elements it pushes itself, and this one is
+                // aontu's.
+                const seg = '' + r.u.key;
+                r.child.k.path =
+                    [...r.k.path, '' + (r.node?.length ?? 0), seg];
+                r.child.k.key = seg;
+            }
+        })
+            .bc((rule, ctx) => {
             // TRAVERSE PARENTS TO GET PATH
-            if (rule.u.spread) {
+            // Only the `&:` alternative is a SPREAD. All four alts above set
+            // `spread: true` -- it is what marks them as contributing no
+            // element -- so this guard needs the narrower test, and `pair`
+            // is what distinguishes a `k:v` in list position from a spread.
+            //
+            // Without it a pair BUILT the spread record, with `o` taken from
+            // its own key rather than '&': `[x:1, &:integer, "bad"]` left
+            // `{o:'x', v:[1, integer]}`, and ListVal's `'&' === spread.o`
+            // then discarded the real constraint -- so the element spread
+            // was silently dropped and the bad value generated (BUGS.md 46).
+            // A pair alone did it too: `[x:1, 10]` produced a spread record
+            // out of nothing.
+            if (rule.u.spread && !rule.u.pair) {
                 rule.node[type_1.SPREAD] =
                     (rule.node[type_1.SPREAD] || { o: rule.o0.src, v: [] });
                 rule.node[type_1.SPREAD].v.push(rule.child.node);
             }
+            // The slot is given back BEFORE the element is added: the
+            // restore undoes jsonic's raw write (a property for a text
+            // key, an INDEX for a numeric one -- restoring length is what
+            // keeps `[1:2]` from padding with a null), and the push then
+            // appends cleanly after it.
             restorePairSlot(rule);
+            // THE SINGLE-KEY MAP ELEMENT, for both pair spellings. The
+            // value is a Val already (`p: 'val'`), so the map is built
+            // exactly as the map rule builds one -- and an elided value
+            // (`[a:]`) is refused exactly as the map rule refuses one
+            // (issue #48): a key with nothing after the colon is a
+            // mistake, not an empty value.
+            if (true === rule.u.pair) {
+                const key = '' + rule.u.key;
+                let v = rule.child.node;
+                if (null == v) {
+                    v = addsite(new NilVal_1.NilVal({ why: 'elided_value' }), rule, ctx);
+                    v.path = [...(rule.k?.path ?? []),
+                        '' + rule.node.length, key];
+                }
+                const mv = addsite(new MapVal_1.MapVal({ peg: { [key]: v } }), rule, ctx);
+                // `[a?: 1]` is `[{a?: 1}]`: the key is optional IN the
+                // element, so the two spellings stay one rule apart rather
+                // than two behaviours apart.
+                if (true === rule.u.aontu_optional_elem) {
+                    mv.optionalKeys = [key];
+                }
+                rule.node.push(mv);
+            }
             return undefined;
         })
             .close([{ s: [CJ, CL], r: 'elem', b: 2, g: 'spread,json,more' }]);
         return rs;
     });
 };
+// INCLUDE_KINDS IS THE RULE FOR WHAT AN INCLUDE MEANS (ADR-012,
+// use-cases/BUGS.md §49). An extension is on this list or it is not
+// read at all, and its entry says WHICH OF TWO THINGS the file is.
+//
+// `source` — Aontu, with everything the language has: types, defaults,
+// references, constraints, its own includes. Two extensions, and they
+// are the ones this project owns.
+//
+// A FORMAT NAME — configuration DATA, parsed by that format's own
+// parser into the JSON value it denotes, which then becomes Aontu
+// values like any other data. Every one of these formats maps onto
+// JSON, which is why one word covers them: a `.toml` file is a map of
+// scalars, lists and maps, and so is the `.aon` file that unifies with
+// it. What the format does NOT get is the language — a `&` in a YAML
+// file is a YAML anchor, not a spread key, because the YAML parser
+// reads it, not this one.
+//
+// The parsers are @tabnas's, one per format, and the Go port uses the
+// same ones (ADR-001): the two implementations agree because they are
+// running the same grammar, not because two hand-written readers were
+// kept in step.
+//
+// This table and go/source.go's includeKinds are the same table.
+const INCLUDE_KINDS = {
+    aon: 'source',
+    aontu: 'source',
+    json: 'json',
+    // JSON-LD is JSON: a `@context` is a key like any other here, and
+    // what it MEANS is the vocabulary's business, not the reader's.
+    jsonld: 'json',
+    jsonc: 'jsonc',
+    json5: 'json5',
+    jsonic: 'jsonic',
+    jsc: 'jsonic',
+    toml: 'toml',
+    yaml: 'yaml',
+    yml: 'yaml',
+    ini: 'ini',
+};
+// `.csv` IS DELIBERATELY ABSENT, and the reason is ADR-001 rather than
+// taste. The two ports' CSV parsers disagree about what a CSV file IS:
+// one answers header-keyed records with string fields, the other raw
+// rows including the header, with numbers parsed. Admitting it would
+// admit a divergence into the one thing this project refuses to have
+// one in. Recorded in ADR-012 and pinned by file.tsv's load-ext-csv.
+// The multisource kind of a path: the LAST segment's extension, without
+// its dot, lowercased -- `''` for a name that has none. The rule is
+// @tabnas/multisource's own extKind (and Go's filepath.Ext), copied
+// rather than imported because it decides what a source IS: a dot in a
+// parent folder (`/my.app/conf`) must not read as an extension.
+function extKindOf(full) {
+    const seg = full.match(/[^\\/]*$/)[0];
+    return (seg.match(/\.([^.]*)$/) || ['', ''])[1].toLowerCase();
+}
+// The refusal message, naming the extension -- because the extension is
+// the whole reason, and a reader told only "not readable" has to guess
+// which part of the path the engine objected to. Byte-identical to Go's
+// extensionMsg.
+function extensionMsg(path, ext) {
+    const which = '' === ext ? 'no extension' : 'extension: .' + ext;
+    return 'include not readable: ' + path + ' (' + which + ')';
+}
+// THE RULE ALSO HOLDS FOR A RESOLVER THIS ENGINE DID NOT WRITE.
+// gateExtension refuses an unlisted extension inside makeModelResolver,
+// which is the default; a HOST may supply its own through
+// `AontuOptions.resolver`, and that one has never heard of
+// INCLUDE_KINDS. Without this the host's resolution would fall to
+// multisource's own default for an unnamed kind, which hands the file
+// back as TEXT — or, for `.js`, EXECUTES it. So the two roads end in
+// one place: whatever chose the source, an extension off the list is
+// refused with the same code and the same message.
+const refuseProcessor = (res) => {
+    // `full` is the one part a host resolution may leave out -- it is the
+    // path the resolver CHOSE, and a resolver that answers from something
+    // other than a filesystem need not have one. The written path always
+    // reaches here, so it is the fallback.
+    const err = new Error(extensionMsg(res.path, extKindOf(res.full ?? res.path)));
+    err.code = 'include_extension';
+    throw err;
+};
+// ONE READER PER FORMAT, BUILT ONCE. These are stateless parsers and
+// building a jsonic instance is not free, so they are made at module
+// load rather than per include. The file name is passed through so a
+// syntax error inside an included `.toml` names the `.toml`.
+const DATA_READERS = (() => {
+    const viaPlugin = (plugin) => {
+        const jsonic = jsonic_1.Jsonic.make().use(plugin);
+        return (src, fileName) => jsonic(src, { fileName });
+    };
+    const toml = viaPlugin(toml_1.Toml);
+    // The strict RFC 8259 reader is its own parser rather than a
+    // plugin, and it is `make().parse` rather than the module's bare
+    // `parse`: only the instance carries the meta bag, and without it
+    // a syntax error in an included `.json` says `<no-file>`.
+    const json = (0, json_1.make)();
+    return {
+        json: (src, fileName) => json.parse(src, { fileName }),
+        jsonc: viaPlugin(jsonc_1.Jsonc),
+        json5: viaPlugin(json5_1.Json5),
+        // Plain jsonic needs no plugin: it IS the base parser.
+        jsonic: (src, fileName) => (0, jsonic_1.Jsonic)(src, { fileName }),
+        toml: (src, fileName) => tomlDates(toml(src, fileName)),
+        yaml: viaPlugin(yaml_1.Yaml),
+        ini: viaPlugin(ini_1.Ini),
+    };
+})();
+/**
+ * A TOML document with its dates as the TEXT they were written as.
+ *
+ * TOML HAS DATES AND JSON DOES NOT, so the reader cannot hand one over
+ * as itself: it answers with a marker object carrying the kind and the
+ * source text. The value that reaches a document is that TEXT, which is
+ * what a JSON document carries for a date anyway — and it is what the
+ * Go port produces too, from a `*TomlTime` holding those same two
+ * fields (`dataToValDepth`, go/source.go). Without this the same file
+ * is a nested map in one port and a string in the other, which is the
+ * class of divergence ADR-012 exists to stop.
+ *
+ * The guard is exact — one key, `__toml__`, holding a `kind` and a
+ * `src` string — so a document whose own data happens to use the name
+ * passes through untouched.
+ */
+function tomlDates(node) {
+    if (Array.isArray(node)) {
+        return node.map(tomlDates);
+    }
+    if (null === node || 'object' !== typeof node) {
+        return node;
+    }
+    const keys = Object.keys(node);
+    const mark = node.__toml__;
+    if (1 === keys.length && '__toml__' === keys[0] && null != mark &&
+        'string' === typeof mark.kind && 'string' === typeof mark.src) {
+        return mark.src;
+    }
+    const out = {};
+    for (const k of keys) {
+        out[k] = tomlDates(node[k]);
+    }
+    return out;
+}
+/**
+ * Read one included file as DATA in the named format.
+ *
+ * The parser hands back the JSON value the file denotes — plain maps,
+ * lists and scalars — and rawToVal turns that into Vals. THE
+ * CONVERSION HAPPENS HERE, not at the top level, because an include is
+ * usually not at the top level: `a: @"conf.toml"` puts the value under
+ * a key, where a raw JavaScript object is something the tree cannot
+ * unify with (the crash that was BUGS §49b).
+ */
+const dataProcessor = (format) => (res) => {
+    res.val = rawToVal(DATA_READERS[format](res.src, res.path));
+};
+/**
+ * The multisource processor map, built FROM the include table so the
+ * two cannot drift: every extension the table names gets the reader
+ * the table names for it, and the two kinds that are not in the table
+ * refuse.
+ */
+function includeProcessors() {
+    const map = {
+        // multisource's fallback for an extension no entry names, so it is
+        // the one that catches whatever the resolver's gate did not.
+        '': refuseProcessor,
+        // ... and the one upstream default that would EXECUTE the file.
+        js: refuseProcessor,
+    };
+    const source = (0, jsonic_2.makeJsonicProcessor)();
+    for (const kind of Object.keys(INCLUDE_KINDS)) {
+        const format = INCLUDE_KINDS[kind];
+        map[kind] = 'source' === format ? source : dataProcessor(format);
+    }
+    return map;
+}
 // SECURITY: under the DEFAULT ('system') include capability this
-// resolver reads any file/package the process can reach — @"path"
-// follows relative paths (`@"../../etc/passwd"`) and symlinks, and
-// @"pkg" can require() arbitrary installed modules — so treat opening
-// an untrusted source as running it. The trust profile (G5,
-// docs/trust.md) is the confinement surface: `trust.include` of
+// resolver reads any file the process can reach — @"path" follows
+// relative paths (`@"../../etc/passwd.aon"`) and symlinks — so treat
+// opening an untrusted source as reading your disk. It no longer RUNS
+// one: @"pkg" could require() an arbitrary installed module until
+// ADR-012, which refuses a `.js` entry point by the same rule that
+// refuses `.txt`. The trust profile (G5, docs/trust.md) is the
+// confinement surface: `trust.include` of
 // 'none', `{ mem }` or `{ root }` restricts what `@"..."` may resolve,
 // and a denied resolution is a deterministic parse-stage
 // `include_denied` error.
@@ -1214,6 +1569,25 @@ function makeModelResolver(options) {
         err.code = 'include_denied';
         throw err;
     };
+    // AN UNREADABLE EXTENSION THROWS, exactly as a denial does, and for
+    // the same reason: a bare-member include (`@"notes.txt"` at the top
+    // of a file) MERGES into the enclosing map, and a nil contributes no
+    // keys, so an injected refusal would vanish and leave a plausible,
+    // silently-partial document. Lang.parse turns the throw into the
+    // parse-stage `include_extension` nil.
+    const refuseExtension = (path, full) => {
+        const err = new Error(extensionMsg(path, extKindOf(full)));
+        err.code = 'include_extension';
+        throw err;
+    };
+    // The gate every leg that RESOLVES A NAME passes through. The std and
+    // module legs do not: both state `kind: 'aon'` because what they
+    // serve is Aontu source by construction, not by its spelling.
+    const gateExtension = (path, full) => {
+        if (undefined === INCLUDE_KINDS[extKindOf(full)]) {
+            refuseExtension(path, full);
+        }
+    };
     // The user cache: whatever the host named, else the platform rule
     // (`modCacheDir`, ts/src/mod.ts) the tooling writes by.
     const modCache = (opts) => {
@@ -1280,6 +1654,11 @@ function makeModelResolver(options) {
         let res = memResolver(path, popts, rule, ctx, jsonic);
         res.path = path;
         if (res.found) {
+            // THE EXTENSION DECIDES HERE TOO. A virtual file set is still a
+            // file set: its keys carry extensions, and the same rule has to
+            // read them, or the mem capability becomes a way to include what
+            // the filesystem would refuse.
+            gateExtension(path, res.full ?? path);
             record(ctx, res.full ?? path, 'mem');
             return res;
         }
@@ -1328,6 +1707,10 @@ function makeModelResolver(options) {
             if (null != rootDir && outsideRoot(rootDir, full)) {
                 deny(path);
             }
+            // After the trust check, not before: a file outside the
+            // confinement root is denied whatever it is called, and answering
+            // "extension" there would say the file exists.
+            gateExtension(path, full);
             // The warning window for the staged default flip (G5 phase 6):
             // under 'system', the CLI supplies trustWarn and the entry root,
             // and every resolution escaping that root names the flag a future
@@ -1350,6 +1733,7 @@ function makeModelResolver(options) {
         res = pkgResolver(path, popts, rule, ctx, jsonic);
         res.path = path;
         if (res.found) {
+            gateExtension(path, res.full);
             if (null != options.trustWarn) {
                 options.trustWarn('pkg', res.full);
             }
@@ -1360,62 +1744,60 @@ function makeModelResolver(options) {
         return res;
     };
 }
-// funcArity is the permitted WRITTEN argument count of each built-in, as
+// THE SIGNATURE REGISTRY (docs/design/SIGNATURES.0.md). The call
+// surface is DECLARED in test/spec/signature.tsv and parsed by the
+// signature grammar (ts/src/sig.ts) from the build-time-inlined copy;
+// the arity table and the positional set below are DERIVED from the
+// parsed registry (funcSig, ts/src/sig.ts), so the declaration is the
+// one source. go/func.go derives the same two tables from the same
+// text.
 // The functions whose comma-separated arguments are distinct POSITIONS
 // rather than one argument list. See the func-paren handler above: this
 // is the set whose comma group is expanded back into separate `peg`
-// entries.
-const POSITIONAL_ARG_FUNCS = {
-    deprecate: true, pack: true, each: true, filter: true, match: true,
-    // Arithmetic takes two OPERANDS, and an operand is a position: `sub`
-    // is not commutative, so `sub(a, b)` reaching the engine as one
-    // two-element list would lose which is which.
-    add: true, sub: true, mul: true, div: true, mod: true, rem: true,
-    // The bag and the key are distinct positions.
-    pick: true,
-};
+// entries. Derived: two or more declared argument slots, excluding the
+// residual producers (`constraint` results) -- the constraint atoms
+// make the same expansion in their own constructor (`atomArgs`,
+// ConstraintVal.ts, deliberately before the settled check), which is
+// why they are not in this set; `must` is the load-bearing example.
+// Arithmetic is here because `sub` is not commutative: `sub(a, b)`
+// reaching the engine as one two-element list would lose which is
+// which.
+const POSITIONAL_ARG_FUNCS = {};
+for (const name in sig_1.funcSig) {
+    if (2 <= sig_1.funcSig[name].args.length && 'constraint' !== sig_1.funcSig[name].out) {
+        POSITIONAL_ARG_FUNCS[name] = true;
+    }
+}
 // [min, max]; a max of -1 is unbounded. Every name in funcMap has an
 // entry, and the arity is a property of the language rather than of
-// either port -- go/func.go carries the same table.
-//
-// Nearly everything takes exactly one. The exceptions earn their place:
-// key() names how many levels UP the path to read, defaulting to the
-// parent when omitted, neq takes a whole set of exclusions, unique()
-// takes none (a property of the container) or a PROJECTOR key, must()
-// takes a check AND the author's message for when it fails, and the
-// arithmetic family takes two operands.
-const funcArity = {
-    upper: [1, 1], lower: [1, 1], copy: [1, 1], pref: [1, 1],
-    super: [1, 1], type: [1, 1], hide: [1, 1], close: [1, 1],
-    open: [1, 1], move: [1, 1], path: [1, 1],
-    min: [1, 1], max: [1, 1], above: [1, 1], below: [1, 1], re: [1, 1],
-    length: [1, 1],
-    key: [0, 1],
-    // THE ONE ARGUMENT IS A PROJECTOR: `unique(port)` says no two
-    // members share a `port`. The arity was reserved for it (finding I).
-    unique: [0, 1],
-    neq: [1, -1],
-    must: [2, 2],
-    deprecate: [1, 2],
-    id: [1, 1],
-    refer: [0, 1],
-    pack: [2, 2],
-    each: [1, 2],
-    filter: [2, 2],
-    // The scrutinee, then pattern/result pairs, then an optional
-    // default: three arguments at least, and any number above that.
-    match: [3, -1],
-    // Two operands, always. Arithmetic has no variadic reading that is
-    // not a fold, and a fold is the recursion this language refuses.
-    add: [2, 2], sub: [2, 2], mul: [2, 2],
-    div: [2, 2], mod: [2, 2], rem: [2, 2],
-    // One bag. The operation is fixed, so there is nothing else to pass:
-    // a fold's second argument is a FUNCTION, and this language has none
-    // to give it.
-    sum: [1, 1], least: [1, 1], greatest: [1, 1],
-    // The bag, and the key to take from each of its children.
-    pick: [2, 2],
-};
+// either port -- go/func.go derives the same table. A required slot
+// counts toward the minimum; a rest slot makes the maximum unbounded
+// and counts its group size (one, for a plain rest type) toward the
+// minimum, which is what gives `match` its floor of three and `neq`
+// its floor of one.
+function sigArity(sig) {
+    let min = 0;
+    let max = 0;
+    for (const a of sig.args) {
+        if (true === a.rest) {
+            min += undefined === a.group ? 1 : a.group.length;
+            max = -1;
+        }
+        else {
+            if (true !== a.opt) {
+                min++;
+            }
+            if (-1 !== max) {
+                max++;
+            }
+        }
+    }
+    return [min, max];
+}
+const funcArity = {};
+for (const name in sig_1.funcSig) {
+    funcArity[name] = sigArity(sig_1.funcSig[name]);
+}
 // writtenArgCount counts the arguments as the AUTHOR wrote them.
 //
 // It cannot simply be terms.length: a comma group reaches the func-paren
@@ -1447,11 +1829,11 @@ function arityText(lo, hi) {
     if (lo !== hi) {
         return 0 === lo ? 'no arguments or one' : 'one argument or two';
     }
-    // NO {0,0} ARM. `unique` was the only built-in taking none, and its
-    // one argument is now the projector the arity was reserved for
-    // (finding I), so a phrasing for a count no entry carries would be
-    // untested prose pretending to be tested -- the rule this function's
-    // header states. The arm returns with the table, if one ever does.
+    // The {0,0} arm returned with the container kinds and acyclic()
+    // (ADR-015): `map(1)` must not claim map takes exactly one.
+    if (0 === hi) {
+        return 'no arguments';
+    }
     if (2 === hi) {
         return 'exactly two arguments';
     }
@@ -1489,15 +1871,21 @@ function opCharHint(src) {
     return '';
 }
 function rawToVal(n) {
-    if (null == n) {
-        return new NullVal_1.NullVal({ peg: null });
-    }
-    if (true === n.isVal) {
+    if (true === n?.isVal) {
         return n;
     }
     if (Array.isArray(n)) {
         return new ListVal_1.ListVal({ peg: n.map(rawToVal) });
     }
+    // THE SCALAR ARMS ARE WHERE A CONFIG FILE BECOMES VALUES. Every
+    // format on the include table is read by its own parser into plain
+    // JavaScript -- a string, a number, a map -- and this is the walk
+    // that turns that into Vals (dataProcessor, ADR-012). The two arms
+    // above are the other caller: a raw expression TERM, which the
+    // expression grammar hands over already built.
+    if (null == n) {
+        return new NullVal_1.NullVal({ peg: null });
+    }
     const t = typeof n;
     if ('string' === t) {
         return new StringVal_1.StringVal({ peg: n });
@@ -1512,14 +1900,20 @@ function rawToVal(n) {
     if ('boolean' === t) {
         return new BooleanVal_1.BooleanVal({ peg: n });
     }
-    if ('object' === t) {
-        const peg = {};
-        for (const k in n) {
-            peg[k] = rawToVal(n[k]);
-        }
-        return new MapVal_1.MapVal({ peg });
+    // AND EVERYTHING ELSE IS A MAP, with no arm after it because there is
+    // nothing after it. Every reader on the include table answers with
+    // the JSON kinds and no others -- probed, including the two that
+    // could plausibly escape them: a big integer comes back a `number`,
+    // and a TOML date is normalised to its text before it gets here. The
+    // one include that could hand over a function was `.js`, which
+    // ADR-012 refuses. `parse_unknown` lived here for that case and has
+    // no producer left in this port; the Go twin keeps its own, where the
+    // type switch really can be handed something unaccounted for.
+    const peg = {};
+    for (const k in n) {
+        peg[k] = rawToVal(n[k]);
     }
-    return new NilVal_1.NilVal({ why: 'parse_unknown' });
+    return new MapVal_1.MapVal({ peg });
 }
 class Lang {
     constructor(options) {
@@ -1539,11 +1933,22 @@ class Lang {
             // works. `.jsonic` is retired (no longer auto-resolved); the
             // default `['jsonic','jsc','json','js']` is overridden here.
             // (Upstream option name is the misspelled `implictExt`.)
+            //
+            // Only these two are SEARCHED for a bare `@"name"`; `.json` and
+            // `.jsonld` are read when NAMED, which is how a vendored
+            // vocabulary is always written.
             implictExt: ['aon', 'aontu'],
-            processor: {
-                aontu: 'jsonic',
-                aon: 'jsonic',
-            }
+            // ONE ENTRY PER EXTENSION THE TABLE NAMES, built from it (see
+            // includeProcessors) so the rule and its wiring cannot drift.
+            //
+            // The upstream defaults are REPLACED, not extended. Its `json`
+            // entry is what made that extension the one that crashed: it
+            // hands back a raw JS object where the aontu grammar produces
+            // Vals, and the tree then met a value it could not convert
+            // (BUGS §49b). Its `js` entry EXECUTES the file, which is not
+            // something an extension should be able to ask for. And its
+            // fallback hands any other file back as TEXT.
+            processor: includeProcessors()
         })
             .use(AontuJsonic);
     }
@@ -1584,18 +1989,15 @@ class Lang {
             }
         }
         catch (e) {
-            if ('include_denied' === e?.code ||
-                'module_missing' === e?.code || 'module_integrity' === e?.code ||
-                'module_depth' === e?.code) {
-                // A denied include (trust profile, G5): the resolver throws so
-                // a bare-member include cannot vanish in the merge, and the
-                // code survives here as the parse-stage nil the registry
-                // pins (errcodes.tsv: include_denied, class parse).
-                // A denied include (G5) and a module that is missing or fails
-                // its pin (G6 phase 2) are refused the same way, for the same
-                // reason: the resolver THROWS so a bare-member include cannot
-                // vanish in the merge, and the code survives here as the
-                // parse-stage nil the registry pins (errcodes.tsv).
+            if ('include_denied' === e?.code || 'include_extension' === e?.code ||
+                mod_1.MODULE_REFUSAL_CODES.has(e?.code)) {
+                // A denied include (G5), an include whose extension is not read
+                // as Aontu source (ADR-012, INCLUDE_KINDS), and a module that is
+                // missing, fails its pin, or names a path that escapes its store
+                // (G6 phase 2) are refused the same way, for the same reason: the
+                // resolver THROWS so a bare-member include cannot vanish in the
+                // merge, and the code survives here as the parse-stage nil the
+                // registry pins (errcodes.tsv).
                 val = new NilVal_1.NilVal({
                     why: 'parse',
                     err: new NilVal_1.NilVal({