arkgate 4.8.23 → 4.8.25

package/templates/agent-skills/ark-order/SKILL.md

@@ -125,7 +125,8 @@ the same files or weaken the gate.
    - Keep Domain-role layers plane-free (`ARKORDER_KERNEL_IN_DOMAIN`).
    - First freeze: `release()`. Later change of a named choice is `proposeRelease` then `apply`
      — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`), not `update` / `patch` / `set`
-     (`ARKORDER_GENERIC_UPDATE`).
+     (`ARKORDER_GENERIC_UPDATE`). Apply the proposal you reviewed against the current Release;
+     a stale one, or one whose blast is not the transition that commits, fails `ARKORDER_STALE_PROPOSAL` — propose again.
    - Name **`xiKeys`** (3–5 slow product decisions). Membership ids and recomputable statuses
      are not keys: derive a status on read or fold it from ingest. A use-case that persists
      those keys is `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
@@ -149,7 +150,8 @@ the same files or weaken the gate.
 - Extra absent and the user wants it: **STOP — do not continue this skill as complete.**
   **`/ark-adopt`** writes advisory `arkOrder`.
 - Skip cluster (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE`
-  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`) after
+  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`
+  / `ARKORDER_XI_TTL` / `ARKORDER_INFORMATION_BUDGET`) after
   the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
 - New plane-root file after the extra is on: **`/ark-place`**.
 - One kernel / bus candidate: **`/ark-runtime`** — do not mix planes.

package/templates/agent-skills/ark-place/SKILL.md

@@ -35,6 +35,12 @@ right house. Skills never enforce — CLI / hooks / CI do.
   adapter or a Domain / auth-tag policy — not another SQLite / JSON-file store
   or admin literal in the page. Soft. Silent when those houses are absent or
   the shortcut is already in the right house. No `/ark-prototype`.
+- When doctor JSON `crossWallDuplication` (status details, `--doctor --all`) lists a
+  family, its `destination` is where the one shared copy goes: the declared shared
+  root, the universe common folder, or the lower layer both sides may import. Write
+  it there and import it from both sides — never a third copy, never a new
+  `allowedCrossSlice` to reach across the wall. `ask-place` means pick a home both
+  sides may import. Advisory. No `/ark-dedupe`.
 - When the matched layer has `layers[].description`, print that caption next to the
   layer name and globs. Omit when absent — do not invent a caption or `/ark-describe`.
 - When the matched layer has `layers[].trustBoundary`, print `trust: <tag>` next
@@ -175,6 +181,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 
 ### Place + ArkRules
+- `arkRules[<Layer>]` may be one path or a list of paths. A child wall may set `childSlices.arkRulesFile` to `arkrules.<Layer>.json`. That file lives at the slice root. Its id in findings is `<childId>#<localId>`. Doctor lists it on `rulesUnderContract.bySlice`. When `ark_place` returns `sliceRules`, those are the ids for this file's slice.
+- A `sliceAliases` entry with `"pinned": true` stays put (a framework route). `reason` is a label only. Do not treat a pinned route as finished while another alias is still an owed move.
 - Choose layer from contract **and** check structure sensors for that layer (private state, factory, thin adapter, writes-via-aggregate).
 - Scaffold to satisfy **[ArkRules]** when present; state which sensors apply.
 - Persistence **writes** (insert/update/delete against a driver) go through a Domain aggregate + persistence adapter. Application/Feature files that import Prisma/pg/Supabase and call `.insert` / `.create` are **[ArkRules]** `writes-via-aggregate`. Do not invent `Externals/` or `admission.ts`.

package/templates/agent-skills/ark-runtime/SKILL.md

@@ -124,7 +124,12 @@ the same files or weaken the gate.
      `appendDecisionTape`. Shadow / compare / replay that snapshot in-memory (not a bus, not
      durable). This is still **[ArkRun]** — do not turn the tape into an ArkOrder skill.
    - In-memory stores lose state on restart — **not** production durability. Note bounded history
-     (`maxHistorySize` 1000) if the hand-rolled version retained everything.
+     (`maxHistorySize` 1000 — history, trace, audit, and the default event buffer) if the
+     hand-rolled version retained everything.
+   - `createStrictArkKernelFromConfig` maps intents by `layers[].intentPrefixes` (canonical
+     layer names get built-in ones); a custom deny-rule layer without prefixes is audited as
+     `layer.observedFlowUnresolvable` (explicit `'hard'` throws `ArkKernelConfigError`). Enforced declarations accept a literal or a same-file
+     `define(..)` creator as the call name.
 6. **Delete the hand-rolled version** once call sites are moved — the point is
    less code, not a second parallel system. Deleting code is a destructive move:
    confirm with the user before removing the old implementation, and never delete

package/templates/arkrules/PersistenceAdapters.json

@@ -4,7 +4,7 @@
   "layer": "PersistenceAdapters",
   "structure": [
     {
-      "id": "thin-adapter",
+      "id": "thin-persistence-adapter",
       "sensor": "thin-adapter",
       "mode": "advisory",
       "description": "Persistence adapters implement ports without domain branching."

package/templates/arkrules/PresentationAdapters.json

@@ -4,7 +4,7 @@
   "layer": "PresentationAdapters",
   "structure": [
     {
-      "id": "thin-adapter",
+      "id": "thin-presentation-adapter",
       "sensor": "thin-adapter",
       "mode": "advisory",
       "description": "Adapters stay thin: map I/O and delegate; avoid domain branching + persistence here."

package/templates/skills/ark-adopt.md

@@ -241,6 +241,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 
 ### Adopt + ArkRules
+- `arkRules[<Layer>]` may be one path or a list. On a child wall, `childSlices.arkRulesFile` (`arkrules.<Layer>.json`) is the slice's own file. Do not put feature rules only in the central file when that filename is set. `"pinned": true` on a slice alias keeps a framework path; `reason` does not pin.
 - After classify: emit or refresh `arkRules` for matched layers (exact names; generic mold for unknowns).
 - Mine rules → inventory + write advisory invariants/structure into `arkrules/<Layer>.json` **in this turn**.
 - Empty `invariants[]` on a populated Domain while `arkRules` is on is residual (`INVARIANT_CATALOG_EMPTY`), not done. Fill 1–2 short phrases. Advisory until a domain structure rule is `enforced`.
@@ -362,7 +363,10 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    import them, and they may import a slice. Doctor lists that shared-root → slice hop even
    when the check stays green, so the wall is direct-only. `sharedImportsSlice: "deny"` closes
    that one hop; it does not finish the wall. Promoting the shared slice to its own
-   layer is still the preferred fix.
+   layer is still the preferred fix. With `"deny-cross-parent"` in a DI app, list the
+   composition root (bootstrap, registrations) in the object form's `stopAt` instead of
+   freezing dozens of `CROSS_PARENT_VIA_SHARED` findings through it; doctor
+   `sharedWalkHubs` names that file.
    `sliceFolders`: a bare name stays an unanchored one-segment match (`features` on
    `src/lib/features/projects/rfi/x.ts` is `features/projects`); a filename is never the
    child segment. A starred prefix (`lib/features/*/*`) is anchored like `sharedRoots`

package/templates/skills/ark-contract.md

@@ -52,6 +52,23 @@ If the host supports **parallel subagents**, fan out read-only scouts; otherwise
 2. Path honest and tightening → execute **`/ark-autopilot`**.
 3. One kernel candidate → **`/ark-runtime`**. One order-plane candidate → **`/ark-order`**.
 
+## Promoting an invariant (advisory → enforced)
+
+Promotion goes through one judge. Run `arkgate-check --promote [<id>] --json` first and read
+each invariant row's `blocker`:
+
+- `no-coverage-evidence` — no test title or declared symbol, partial scan, outside
+  `coverage.coverageRoots`, or no roots declared. Write the evidence or the roots (`/ark-adopt`).
+- `probe-survived` — the committed `.ark/invariant-probe.json` shows, for files unchanged
+  since the run, that the covering tests still pass with the rule broken (`survived`) or never
+  call the symbol (`not-reached`). The fix is a **stronger test**, not more evidence text: add
+  the case the line names, then re-run `arkgate-check --probe-invariants=<id> --write` and
+  commit the file. Never delete or hand-edit the artifact to get past the refusal.
+
+The probe runs the project's own tests in a temporary copy; ask the owner before you run it.
+It is opt-in and not a score: a missing, stale, `killed` or `inconclusive` result changes
+nothing. Only then `--promote <id> --apply`.
+
 ## Completion contract (skill incomplete if missing)
 
 Skill incomplete if missing any field below.

package/templates/skills/ark-coverage.md

@@ -97,11 +97,13 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 4. Editing `arkrules/*` or promoting modes is **`/ark-adopt`**; fixing code under a structure sensor is **`/ark-autopilot`** (judgment, never invent mechanical-safe).
 5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
 5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. `coverage.symbol` means a declaration of that identifier in a non-test file (`symbolEvidenceFile`); imports and test calls do not count. Doctor and `--rules-inventory` print that witness path and the scan discard counts on a green run too. Never report `INVARIANT_UNCOVERED: 0`, a witness path, or a discard line as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. Declaration text is not “the tests pass.” When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run. Adopted + catalogued invariants without `coverage.testGlobs` or `coverage.coverageRoots` fails closed (`INVARIANT_TESTS_PATH_MISSING`) — write the path (`/ark-adopt`). When any invariant is enforced, missing `coverage.coverageRoots` fails closed (`INVARIANT_COVERAGE_ROOTS_MISSING`) — write the runner roots (`/ark-adopt`). `testGlobs` alone is not enough.
+5c. The one exception is owner-invoked: `arkgate-check --probe-invariants` breaks each `coverage.symbol` on purpose in a temporary copy and runs only its covering tests with the project's runner (ask first — it runs their tests). When `.ark/invariant-probe.json` exists, doctor `rulesUnderContract.probe` and `--rules-inventory` `coverageEvidence.probe` show per invariant `killed` / `survived` / `not-reached` / `stale` / `not run`; `INVARIANT_PROBE_SURVIVED` means a fresh row refuses promotion. Report it as **[ArkRules]** "the test names the rule but does not pin it", name the change that went unnoticed, never as a percentage. `killed` is evidence the covering tests catch those three changes — not "the domain is correct."
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 
 
 ### Coverage + ArkRules
 - Fitness report: governed% / gates / baseline = **[Layer]**; `rulesUnderContract` inventoried/under-contract/frozen = **[ArkRules]** (counts, never a score).
+- Invariant probe (when the artifact exists): one row per `survived` / `not-reached` invariant with the line it names and the test to add; `stale` rows mean "re-run `--probe-invariants --write`", never "pinned".
 - Capability gap: “no arkRules map” is optional adoption opportunity, not a failed gate.
 
 ### Coverage + extras

package/templates/skills/ark-explore.md

@@ -58,6 +58,13 @@ one bounded decision needs 2–3 enforceable options.
   including when the run is green. A declaration in a non-test file is not
   “the tests pass” — ArkGate never runs tests. Depth and byte caps stay
   internal; the counts are what you read.
+- When doctor JSON has `orphanModules` with files listed, map them: nothing imports
+  each file and no entry point covers it. Read `certainty` — `maybe-dynamic` and
+  `maybe-unresolved` may still be loaded (open what the evidence names). A
+  `partial` section is never a complete list. `--doctor --all` adds exports
+  nothing imports by name. Map only; deleting is `/ark-fix`, one file at a time.
+  A framework or loader ArkGate does not know goes in `.ark/entry-points.json`
+  with a reason. Never say "dead code". No new skill.
 - A doctor green / Healthy line must name a file, config key, or test.
   Uncited green is a lie — treat it as unfinished. No `/ark-cite`.
 - Distinguish **missing** skills vs **stale** catalog. Installed ≠ stale.

package/templates/skills/ark-fix.md

@@ -25,6 +25,26 @@ Write an **extraction card** (`docs/brownfield-adoption.md` §6) — never mecha
 never silent B apply. **Kill-switch** required. `multiPilotBatchForbidden` — never
 multi-pilot batch. Execute that work on **`/ark-autopilot`**.
 
+## Files nothing imports (one delete at a time)
+
+When `doctor.orphanModules` lists a file with `certainty: no-importer`, nothing
+imports it and no entry point covers it. Delete **one** file through the write
+gate, run `arkgate-check` and status again, then the next. A `maybe-dynamic` or
+`maybe-unresolved` item may still be loaded: open what its evidence names
+first. If a framework or loader uses the file, add a glob with a reason to
+`.ark/entry-points.json` instead — never edit `ark.config.json` for it. No batch
+delete, no codemod.
+
+## Copies across a wall (one move at a time)
+
+When `doctor.crossWallDuplication` (status details, `--doctor --all`) lists a
+family, the wall stopped the import and the code was copied. Move **one** copy to
+the family's `destination` through the write gate (`/ark-place` names it), point
+both sides at it, delete the other copy, run `arkgate-check` and status again,
+then the next family. Never open the wall (`allowedCrossSlice`, a weaker rule) to
+make the copy importable. Copies inside one slice are not listed on purpose. No
+batch, no codemod.
+
 ## Dual engine (mandatory)
 
 | Engine | Role |

package/templates/skills/ark-order.md

@@ -125,7 +125,8 @@ the same files or weaken the gate.
    - Keep Domain-role layers plane-free (`ARKORDER_KERNEL_IN_DOMAIN`).
    - First freeze: `release()`. Later change of a named choice is `proposeRelease` then `apply`
      — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`), not `update` / `patch` / `set`
-     (`ARKORDER_GENERIC_UPDATE`).
+     (`ARKORDER_GENERIC_UPDATE`). Apply the proposal you reviewed against the current Release;
+     a stale one, or one whose blast is not the transition that commits, fails `ARKORDER_STALE_PROPOSAL` — propose again.
    - Name **`xiKeys`** (3–5 slow product decisions). Membership ids and recomputable statuses
      are not keys: derive a status on read or fold it from ingest. A use-case that persists
      those keys is `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
@@ -149,7 +150,8 @@ the same files or weaken the gate.
 - Extra absent and the user wants it: **STOP — do not continue this skill as complete.**
   **`/ark-adopt`** writes advisory `arkOrder`.
 - Skip cluster (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE`
-  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`) after
+  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`
+  / `ARKORDER_XI_TTL` / `ARKORDER_INFORMATION_BUDGET`) after
   the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
 - New plane-root file after the extra is on: **`/ark-place`**.
 - One kernel / bus candidate: **`/ark-runtime`** — do not mix planes.

package/templates/skills/ark-place.md

@@ -35,6 +35,12 @@ right house. Skills never enforce — CLI / hooks / CI do.
   adapter or a Domain / auth-tag policy — not another SQLite / JSON-file store
   or admin literal in the page. Soft. Silent when those houses are absent or
   the shortcut is already in the right house. No `/ark-prototype`.
+- When doctor JSON `crossWallDuplication` (status details, `--doctor --all`) lists a
+  family, its `destination` is where the one shared copy goes: the declared shared
+  root, the universe common folder, or the lower layer both sides may import. Write
+  it there and import it from both sides — never a third copy, never a new
+  `allowedCrossSlice` to reach across the wall. `ask-place` means pick a home both
+  sides may import. Advisory. No `/ark-dedupe`.
 - When the matched layer has `layers[].description`, print that caption next to the
   layer name and globs. Omit when absent — do not invent a caption or `/ark-describe`.
 - When the matched layer has `layers[].trustBoundary`, print `trust: <tag>` next
@@ -175,6 +181,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 
 ### Place + ArkRules
+- `arkRules[<Layer>]` may be one path or a list of paths. A child wall may set `childSlices.arkRulesFile` to `arkrules.<Layer>.json`. That file lives at the slice root. Its id in findings is `<childId>#<localId>`. Doctor lists it on `rulesUnderContract.bySlice`. When `ark_place` returns `sliceRules`, those are the ids for this file's slice.
+- A `sliceAliases` entry with `"pinned": true` stays put (a framework route). `reason` is a label only. Do not treat a pinned route as finished while another alias is still an owed move.
 - Choose layer from contract **and** check structure sensors for that layer (private state, factory, thin adapter, writes-via-aggregate).
 - Scaffold to satisfy **[ArkRules]** when present; state which sensors apply.
 - Persistence **writes** (insert/update/delete against a driver) go through a Domain aggregate + persistence adapter. Application/Feature files that import Prisma/pg/Supabase and call `.insert` / `.create` are **[ArkRules]** `writes-via-aggregate`. Do not invent `Externals/` or `admission.ts`.

package/templates/skills/ark-runtime.md

@@ -124,7 +124,12 @@ the same files or weaken the gate.
      `appendDecisionTape`. Shadow / compare / replay that snapshot in-memory (not a bus, not
      durable). This is still **[ArkRun]** — do not turn the tape into an ArkOrder skill.
    - In-memory stores lose state on restart — **not** production durability. Note bounded history
-     (`maxHistorySize` 1000) if the hand-rolled version retained everything.
+     (`maxHistorySize` 1000 — history, trace, audit, and the default event buffer) if the
+     hand-rolled version retained everything.
+   - `createStrictArkKernelFromConfig` maps intents by `layers[].intentPrefixes` (canonical
+     layer names get built-in ones); a custom deny-rule layer without prefixes is audited as
+     `layer.observedFlowUnresolvable` (explicit `'hard'` throws `ArkKernelConfigError`). Enforced declarations accept a literal or a same-file
+     `define(..)` creator as the call name.
 6. **Delete the hand-rolled version** once call sites are moved — the point is
    less code, not a second parallel system. Deleting code is a destructive move:
    confirm with the user before removing the old implementation, and never delete

package/bin/lib/ark-order-error.mjs

@@ -1,18 +0,0 @@
-/**
- * GENERATED FILE — do not edit by hand.
- *
- * Canonical algorithm: src/domain/arkOrderError.ts
- * Regenerate: node scripts/generate-cli-pure.mjs
- * Drift check: node scripts/generate-cli-pure.mjs --check
- *
- * Pure CLI helper (bin/lib/ark-order-error.mjs). Zero Node I/O.
- */
-
-export class ArkOrderError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = 'ArkOrderError';
-        this.code = code;
-    }
-}

package/bin/lib/ark-order-invariants.mjs

@@ -1,346 +0,0 @@
-/**
- * GENERATED FILE — do not edit by hand.
- *
- * Canonical algorithm: src/domain/arkOrderInvariants.ts
- * Regenerate: node scripts/generate-cli-pure.mjs
- * Drift check: node scripts/generate-cli-pure.mjs --check
- *
- * Pure CLI helper (bin/lib/ark-order-invariants.mjs). Zero Node I/O.
- */
-
-import { ArkOrderError } from './ark-order-error.mjs';
-import { CAPACITY_OPS, DEFAULT_MAX_XI_KEYS } from './ark-order-types.mjs';
-import { deterministicHash, stableSerialize } from './stableHash';
-export { DEFAULT_MAX_XI_KEYS };
-/** D7: consumer still owns handlers — this only names the travel verb. */
-export function ingestTravelAction(residual) {
-    if (residual.kind === 'absorb')
-        return 'send';
-    if (residual.kind === 'escalate_up' && residual.target === 'human')
-        return 'raises';
-    return 'none';
-}
-const FORBIDDEN_PLANE_METHODS = ['update', 'patch', 'set', 'mutate'];
-export function isForbiddenPlaneMethod(name) {
-    return FORBIDDEN_PLANE_METHODS.includes(name);
-}
-function isPrimitive(value) {
-    return (value === null ||
-        typeof value === 'string' ||
-        typeof value === 'number' ||
-        typeof value === 'boolean');
-}
-export function freezeRecord(input, label) {
-    const keys = Object.keys(input);
-    if (keys.length === 0 && label === 'ξ') {
-        throw new ArkOrderError('ARKORDER_EMPTY_XI', 'ξ must name at least one slow mode');
-    }
-    const out = {};
-    for (const key of keys.sort()) {
-        const value = input[key];
-        if (!isPrimitive(value)) {
-            throw new ArkOrderError('ARKORDER_NESTED_XI', `${label} key ${JSON.stringify(key)} is not a slow primitive (nested values are microstate)`);
-        }
-        out[key] = value;
-    }
-    return Object.freeze(out);
-}
-export function assertXiKeyCap(xi, maxXiKeys) {
-    const n = Object.keys(xi).length;
-    if (n === 0) {
-        throw new ArkOrderError('ARKORDER_EMPTY_XI', 'ξ must name at least one slow mode');
-    }
-    if (n > maxXiKeys) {
-        throw new ArkOrderError('ARKORDER_TOO_MANY_PARAMS', `ξ has ${n} keys; maxXiKeys is ${maxXiKeys} (Haken: few slow modes)`);
-    }
-}
-export function assertXiSchema(xi, schema) {
-    if (!schema)
-        return;
-    const properties = schema.properties ?? {};
-    const additional = schema.additionalProperties !== false ? true : false;
-    for (const key of Object.keys(xi)) {
-        const prop = properties[key];
-        if (!prop) {
-            if (!additional) {
-                throw new ArkOrderError('ARKORDER_SCHEMA', `ξ key ${JSON.stringify(key)} is not in xiSchema.properties`);
-            }
-            continue;
-        }
-        if (prop.enum && !prop.enum.some((allowed) => allowed === xi[key])) {
-            throw new ArkOrderError('ARKORDER_SCHEMA', `ξ key ${JSON.stringify(key)} value is not in enum`);
-        }
-        if (prop.type === 'null' && xi[key] !== null) {
-            throw new ArkOrderError('ARKORDER_SCHEMA', `ξ key ${JSON.stringify(key)} must be null`);
-        }
-        if (prop.type && prop.type !== 'null' && typeof xi[key] !== prop.type) {
-            throw new ArkOrderError('ARKORDER_SCHEMA', `ξ key ${JSON.stringify(key)} must be ${prop.type}`);
-        }
-    }
-}
-function catalogDigestFor(xi, catalogDigest) {
-    if (typeof catalogDigest !== 'string')
-        return undefined;
-    if (!Object.prototype.hasOwnProperty.call(xi, 'catalogReleaseId'))
-        return undefined;
-    return catalogDigest;
-}
-export function hashReleasePayload(xi, sigma, catalogDigest) {
-    const digest = catalogDigestFor(xi, catalogDigest);
-    if (digest !== undefined)
-        return deterministicHash(stableSerialize({ xi, sigma, catalogDigest: digest }));
-    return deterministicHash(stableSerialize({ xi, sigma }));
-}
-export function hashXiIdentity(xi, catalogDigest) {
-    const digest = catalogDigestFor(xi, catalogDigest);
-    if (digest !== undefined)
-        return deterministicHash(stableSerialize({ xi, catalogDigest: digest }));
-    return deterministicHash(stableSerialize({ xi }));
-}
-export function hashSigmaIdentity(sigma) {
-    return deterministicHash(stableSerialize({ sigma }));
-}
-export function xiRecordsEqual(left, right) {
-    return stableSerialize(left) === stableSerialize(right);
-}
-/** D1: after the first freeze, a later release() may not change ξ. */
-export function assertUnvalvedRelease(current, nextXi) {
-    if (!current)
-        return;
-    if (xiRecordsEqual(current.xi, nextXi))
-        return;
-    throw new ArkOrderError('ARKORDER_UNVALVED_RELEASE', 'ξ is frozen; change the pattern with proposeRelease then apply(ProposeResult)');
-}
-export function createFrozenRelease(input) {
-    assertXiKeyCap(input.xi, input.maxXiKeys);
-    const xi = freezeRecord(input.xi, 'ξ');
-    assertXiHasNoTtl(xi);
-    assertXiSchema(xi, input.xiSchema);
-    const sigma = freezeRecord(input.sigma ?? {}, 'σ');
-    const release = Object.freeze({
-        version: input.version,
-        hash: hashReleasePayload(xi, sigma, input.catalogDigest),
-        xiHash: hashXiIdentity(xi, input.catalogDigest),
-        sigmaHash: hashSigmaIdentity(sigma),
-        xi,
-        sigma,
-        releasedAt: input.now,
-    });
-    return release;
-}
-/** D2: refresh σ without minting a pattern. xiHash must not change. */
-export function refreshSigmaRecord(input) {
-    const sigma = freezeRecord(input.sigma, 'σ');
-    return Object.freeze({
-        version: input.current.version,
-        hash: hashReleasePayload(input.current.xi, sigma, input.catalogDigest),
-        xiHash: input.current.xiHash,
-        sigmaHash: hashSigmaIdentity(sigma),
-        xi: input.current.xi,
-        sigma,
-        releasedAt: input.now,
-    });
-}
-const XI_TTL_KEY_RE = /^(ttl|freshUntil|fresh_until|maxAge|max_age)$/i;
-export function assertXiHasNoTtl(xi) {
-    for (const key of Object.keys(xi)) {
-        if (XI_TTL_KEY_RE.test(key)) {
-            throw new ArkOrderError('ARKORDER_XI_TTL', `ξ key ${JSON.stringify(key)} is a freshness field; TTL belongs on σ, never on ξ`);
-        }
-    }
-}
-export function assertInformationBudget(projection, budget) {
-    if (!budget || budget.cannotObserve.length === 0)
-        return;
-    const denied = new Set(budget.cannotObserve);
-    for (const kind of projection.allowedKinds) {
-        if (denied.has(kind)) {
-            throw new ArkOrderError('ARKORDER_INFORMATION_BUDGET', `projection allows ${JSON.stringify(kind)}; informationBudget.cannotObserve forbids it`);
-        }
-    }
-}
-export function assertSigmaFresh(input) {
-    if (input.maxAgeMs === undefined)
-        return;
-    const until = input.sigma.freshUntil;
-    if (typeof until === 'number') {
-        if (input.now > until) {
-            throw new ArkOrderError('ARKORDER_STALE_SIGMA', 'σ freshUntil has elapsed; ξ does not TTL');
-        }
-        return;
-    }
-    const origin = typeof input.sigma.releasedAt === 'number' ? input.sigma.releasedAt : input.releasedAt;
-    if (typeof origin === 'number' && input.now - origin > input.maxAgeMs) {
-        throw new ArkOrderError('ARKORDER_STALE_SIGMA', 'σ is older than sigmaMaxAgeMs; ξ does not TTL');
-    }
-}
-export function fieldEventIdentity(event) {
-    return deterministicHash(stableSerialize({ kind: event.kind, payload: event.payload ?? null }));
-}
-function bindResidual(event, xiHash) {
-    return { event, xiHash, eventId: fieldEventIdentity(event) };
-}
-const CAPACITY_OP_SET = new Set(CAPACITY_OPS);
-function isCapacityOp(value) {
-    return typeof value === 'string' && CAPACITY_OP_SET.has(value);
-}
-function numericLeaf(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-}
-function compareCapacity(left, op, right) {
-    if (op === 'lte')
-        return left <= right;
-    if (op === 'lt')
-        return left < right;
-    if (op === 'gte')
-        return left >= right;
-    return left > right;
-}
-function packHasFunction(value) {
-    if (typeof value === 'function')
-        return true;
-    if (value === null || typeof value !== 'object')
-        return false;
-    if (Array.isArray(value))
-        return value.some(packHasFunction);
-    return Object.values(value).some(packHasFunction);
-}
-function evaluateCapacity(event, sigma, pack) {
-    const rows = pack.capacity ?? [];
-    for (const row of rows) {
-        if (packHasFunction(row) || !isCapacityOp(row.op))
-            return 'pack';
-        if (row.kind !== event.kind)
-            continue;
-        const payload = event.payload && typeof event.payload === 'object' && !Array.isArray(event.payload)
-            ? numericLeaf(event.payload[row.payloadKey])
-            : undefined;
-        const limit = numericLeaf(sigma[row.sigmaKey]);
-        if (payload === undefined || limit === undefined)
-            return 'pack';
-        if (!compareCapacity(payload, row.op, limit))
-            return 'capacity';
-    }
-    return 'ok';
-}
-export function classifyIngest(projection, event, packs = [], xiHash = '', sigma = Object.freeze({})) {
-    const kind = event.kind;
-    const bound = bindResidual(event, xiHash);
-    for (const pack of packs) {
-        if (packHasFunction(pack.capacity) || packHasFunction(pack.escalateKinds)) {
-            return {
-                ...bound,
-                kind: 'hold',
-                reasonCode: 'pack',
-                reason: `pack ${pack.id} is not data-only; user predicates are forbidden`,
-            };
-        }
-        if (pack.escalateKinds?.includes(kind)) {
-            const target = pack.escalateTarget ?? 'human';
-            return {
-                ...bound,
-                kind: 'escalate_up',
-                reasonCode: 'pack',
-                reason: `pack ${pack.id} slaves kind ${JSON.stringify(kind)} to a pattern change`,
-                target,
-            };
-        }
-    }
-    if (!projection.allowedKinds.includes(kind)) {
-        return {
-            ...bound,
-            kind: 'escalate_up',
-            reasonCode: 'not-in-pattern',
-            reason: `kind ${JSON.stringify(kind)} is not allowed by h(ξ); field cannot rewrite the pattern`,
-            target: 'human',
-        };
-    }
-    for (const pack of packs) {
-        const cap = evaluateCapacity(event, sigma, pack);
-        if (cap === 'ok')
-            continue;
-        return {
-            ...bound,
-            kind: 'hold',
-            reasonCode: cap,
-            reason: cap === 'capacity'
-                ? `pack ${pack.id} capacity ${JSON.stringify(event.kind)} does not hold`
-                : `pack ${pack.id} capacity is not numeric data`,
-        };
-    }
-    return { ...bound, kind: 'absorb' };
-}
-export function blastRadiusOf(previous, next) {
-    const prev = new Set(previous.allowedKinds);
-    const nxt = new Set(next.allowedKinds);
-    const blast = new Set();
-    for (const kind of prev) {
-        if (!nxt.has(kind))
-            blast.add(kind);
-    }
-    for (const kind of nxt) {
-        if (!prev.has(kind))
-            blast.add(kind);
-    }
-    for (const item of next.invalidated)
-        blast.add(item);
-    return {
-        blastRadius: [...blast].sort(),
-        invalidations: [...next.invalidated].sort(),
-    };
-}
-export function proposePatternChange(input) {
-    const merged = { ...input.current.xi };
-    for (const [key, value] of Object.entries(input.delta)) {
-        if (value === undefined) {
-            delete merged[key];
-            continue;
-        }
-        merged[key] = value;
-    }
-    const candidate = createFrozenRelease({
-        xi: merged,
-        sigma: { ...input.current.sigma },
-        version: input.current.version + 1,
-        now: input.now,
-        maxXiKeys: input.maxXiKeys,
-        xiSchema: input.xiSchema,
-        catalogDigest: input.catalogDigest,
-    });
-    if (candidate.hash === input.current.hash) {
-        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'delta does not change ξ; that is not a pattern change');
-    }
-    const previous = input.projector(input.current, input.current.sigma);
-    const next = input.projector(candidate, candidate.sigma);
-    const { blastRadius, invalidations } = blastRadiusOf(previous, next);
-    if (blastRadius.length === 0) {
-        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'pattern change has empty blast radius; that key is not an order parameter');
-    }
-    return {
-        nextXi: candidate.xi,
-        blastRadius,
-        invalidations,
-    };
-}
-/** D1 valve: freeze ProposeResult.nextXi. Empty blast still fails. */
-export function applyProposedRelease(input) {
-    const candidate = createFrozenRelease({
-        xi: { ...input.proposal.nextXi },
-        sigma: { ...input.current.sigma },
-        version: input.current.version + 1,
-        now: input.now,
-        maxXiKeys: input.maxXiKeys,
-        xiSchema: input.xiSchema,
-        catalogDigest: input.catalogDigest,
-    });
-    if (xiRecordsEqual(candidate.xi, input.current.xi)) {
-        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'delta does not change ξ; that is not a pattern change');
-    }
-    const previous = input.projector(input.current, input.current.sigma);
-    const next = input.projector(candidate, candidate.sigma);
-    const { blastRadius } = blastRadiusOf(previous, next);
-    if (blastRadius.length === 0) {
-        throw new ArkOrderError('ARKORDER_EMPTY_BLAST', 'pattern change has empty blast radius; that key is not an order parameter');
-    }
-    return candidate;
-}