candor-ts 0.8.12 → 0.8.14

package/lsp.mjs

@@ -356,7 +356,7 @@ function runFix(a) {
         lines.push(`or hoist higher (up to ${r.hoistHigher.slice(0, 4).join(", ")}): keeps the frontier pure too, threads through more signatures`);
       }
     } else {
-      lines.push("no clean hoist — introduce a port (inject the effect from an allowed layer), or relax the boundary");
+      lines.push("no clean hoist — add a thin entry point ABOVE the layer and thread the value down (simplest), OR inject it as a function/closure (not a resolvable trait — candor charges the trait's impl back to the caller), OR relax the boundary");
     }
     lines.push(`policy alternative: ${r.policyAlternative}`);
     transient.set(a.uri, [{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.8)",
   "type": "module",
   "dependencies": {

package/query-core.mjs

@@ -540,14 +540,21 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
   // higher hoist options: allowed-layer transitive callers of the minimal frontier that also route the
   // effect — hoisting higher keeps the frontier pure too, at the cost of threading through more signatures
   // (FIX-SPEC: the trade-off, disclosed not hidden).
+  // The SANDWICHED-layer check (/code-review): a hoist is CLEAN only if no forbidden fn sits ABOVE the
+  // frontier. If a denied fn calls into a hoist target, hoisting the effect there leaves that caller
+  // violating. Detected in the same climb that gathers `hoistHigher` (the allowed ancestors).
   const hoistHigher = new Set();
+  let sandwiched = false;
   const hseen = new Set(hoistTo);
   const hq = [...hoistTo];
   while (hq.length) {
     const cur = hq.shift();
     for (const caller of rev.get(cur) ?? []) {
       const ce = byName.get(caller);
-      if (ce && (ce.inferred ?? []).includes(eff) && deniedLayer(caller, eff, policyParsed, scopeMatches) === null && !hseen.has(caller)) {
+      if (!ce || !(ce.inferred ?? []).includes(eff)) continue;
+      if (deniedLayer(caller, eff, policyParsed, scopeMatches) !== null) {
+        sandwiched = true;
+      } else if (!hseen.has(caller)) {
         hseen.add(caller);
         hoistHigher.add(caller);
         hq.push(caller);
@@ -556,7 +563,7 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
   }
   return {
     fn: start, effect: eff, layer,
-    cleanHoist: hoistTo.size > 0,
+    cleanHoist: hoistTo.size > 0 && !sandwiched,
     site: [...sites].sort(),
     deniedSpan: [...deniedSpan].sort(),
     hoistTo: [...hoistTo].sort(),