doxum 0.1.29 → 0.1.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doxum",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "private": false,
   "license": "MIT",
   "description": "Doxum is a typed runtime for complex mutable documents.",
@@ -82,7 +82,8 @@
     "build": "tsdown --config tsdown.config.ts && node scripts/check-build-exports.mjs && pnpm run check:declaration-portability",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run --config vitest.config.ts",
-    "check": "pnpm run format:check && pnpm run lint && pnpm run typecheck && pnpm run check:public-types && pnpm run test && pnpm run check:projection-surface && pnpm run check:runtime-imports",
+    "check": "pnpm run format:check && pnpm run lint && pnpm run typecheck && pnpm run check:public-types && pnpm run test && pnpm run check:runtime-skill && pnpm run check:projection-surface && pnpm run check:runtime-imports",
+    "check:runtime-skill": "node scripts/check-runtime-skill.mjs",
     "check:projection-surface": "node scripts/check-projection-surface.mjs",
     "check:runtime-imports": "node scripts/check-runtime-imports.mjs",
     "check:public-types": "tsc -p tsconfig.public-api.json --noEmit",

package/skills/doxum-runtime/SKILL.md

@@ -1,88 +1,70 @@
 ---
 name: doxum-runtime
-description: 'Use Doxum core, advanced projections, React, and local-sync for schemas, document state, ChangeSets, history, projections, subscriptions, persistence, and adapters.'
+description: Use Doxum public APIs to design, implement, and review schemas, document mutations, projections, React bindings, local sync, and advanced processors without reading implementation source. Read maintainer invariants only when changing Doxum itself.
 ---
 
 # Doxum Runtime
 
-Read the [English guide](references/guide.en.md) or [中文指南](references/guide.zh-CN.md).
-For examples read [patterns](references/patterns.en.md) or [中文模式](references/patterns.zh-CN.md).
-For exact public call shapes, exported package surface, callback contexts, result
-types, and supported errors, read the [API reference](references/api.en.md) or
-[中文 API 参考](references/api.zh-CN.md) instead of implementation source.
-For any projection design or implementation, especially custom processors or
-cross-collection dependencies, read the [projection reference](references/projections.en.md)
-or [中文 Projection 参考](references/projections.zh-CN.md).
-Before runtime changes read [invariants](references/invariants.en.md) or
-[中文不变量](references/invariants.zh-CN.md).
-
-- Root object defines schema identity; Infer describes readonly data with shared immutable payloads.
-- createDocument owns canonical state. update, apply and replace share one session.
-- Draft and trusted internal readWith scopes are borrowed for synchronous callbacks;
-  their proxies must not escape. Public values should use snapshot when they need to
-  outlive the callback.
-- Atomic fields are deeply readonly during access and replaced whole.
-- Maps use get/has/ids/put/remove/replace; table/list/tree use overloaded replace
-  for member and whole-container replacement. Use replace(parent, key, value) for
-  object or variant members whose Draft type contains collection tools.
-- Ordered table/list Drafts use move(key | readonly key[], anchor?) for relative
-  movement and reorder(keys) for an exact full-membership permutation.
-- Trees may be empty. `tree(field(...))` requires every existing node to own `value`;
-  use `tree(optional(field(...)))` only when node payload absence is part of the model.
-  `optional(tree(...))` controls whole-tree presence independently.
-- Tree projection paths reuse ordinary source protocols: `tree.rootId` is scalar,
-  `tree.nodes` is keyed, and `tree.nodes.item(id)` is a single-node value.
-- Expected business failure throws TransactionRejected. Other exceptions roll back
-  and rethrow unchanged. Callback returns carry business values and notices.
-- Commits contain final reversible ChangeSets. History and impact share those facts.
-- ChangeSets group member transitions by container, with explicit added/removed/updated
-  kinds, optional before/after order in the same group, and a separate root reset.
-  Standalone order records and duplicate groups are invalid. Grouping preserves field-level impact.
-- Paths belong in subscription, impact and collection source callbacks.
-- `Schema` / `ObjectSchema` are portable schema handles. Export inferred schemas
-  directly; application code should not need `ReturnType<typeof object>` or internal
-  node types to make declarations portable.
-- Projection definitions are lazy; one ProjectionRuntime owns all materialized
-  producers, outputs, scheduling and source attachments for that Runtime.
-  `KeyedProjection<K,V>` is the single public keyed projection handle. Collection
-  `observe`, `derive.keyed`, `incremental.collection`, group collection leaves and
-  `CollectionInput<K,V>` all use that same keyed capability.
-  Use named-object `derive` for pure aggregate values. The `derive.keyed` family owns
-  keyed derivation: ordinary `derive.keyed` preserves driver membership/order;
-  `keys`/`values`/`entries` expose standard ordered read shapes; `get` is the precise
-  scalar keyed lookup; `subset`/`filter`/`compact` own membership-changing derivation;
-  `groupBy` is the generic reverse-index primitive and `singleton` is optional-scalar
-  to 0/1 keyed composition.
-  Per-entry equality suppresses unchanged generated values. Its dependency form uses a named object: plain Projection members
-  invalidate the driver key set, while `{ source, key }` / `{ source, keys }` members let the Runtime own
-  singular/plural per-output-key source bindings and reverse lookup. Selectors receive
-  `(entry, key)` or `(entry, key, dependencies)`. The producer graph remains explicit and static;
-  processors never perform imperative Runtime reads to discover dependencies.
-  Use `runtime.items(keyedProjection)` / `scope.items(...)` for Runtime-owned ordered
-  membership plus stable per-membership item Readables; do not rebuild that cache in adapters.
-  `input.collection` edits have a strong exception boundary: callback or per-entry
-  equality failure leaves both the published value and the next draft unchanged.
-  A `ProjectionScope` only adds lifecycle ownership through `scope.own(...)`; create
-  definitions with the root declaration APIs, then own a projection or static output tree
-  before that definition is first materialized as a root.
-  Use advanced `incremental` only for retained state or cross-key coordination that
-  cannot be expressed by the `derive.keyed` family. `incremental.keyed` owns independent
-  per-driver-key retained state while preserving driver membership/order and reuses the
-  same dynamic keyed dependency routing. `collectionChange.keys` is the
-  transport-level iterable for incremental added/updated/removed keys; callers handle
-  reset and order semantics themselves. React selector tracking remains a consumer
-  concern through `ProjectionProvider` and `useProjection(projection, selector)`.
-- Advanced incremental definitions always declare `process`; `state()` is present only
-  when retained state is actually needed. `incremental.group` declares its static
-  output tree through the synchronous `output` callback. `define.value` and
-  `define.collection` are callback methods, not separate imports; every returned leaf
-  is a `Projection<T>` or `KeyedProjection<K,V>` from the same producer.
-- Observer errors leave commits accepted. Do not retry as if they rolled back.
-- Core stays framework-neutral; adapters consume standard `Readable`,
-  document `select`, and projection readables without internal target/address protocols.
-- Local sync owns browser persistence/leadership. Network conflict policy and
-  collaborative undo belong at a separate boundary.
-
-Update examples and tests when behavior changes. Never add compatibility APIs,
-a second path grammar, a parallel join/dependency protocol, or another writable
-derived cache.
+Use this skill as the public contract for Doxum. When Doxum is a dependency, work from the public API and these references. Do not inspect `core/src`, `react/src`, tests, source maps, or built JavaScript to discover how application code should use Doxum. If a public behavior is missing here while working in the Doxum repository, treat that as a skill documentation defect and update the skill together with the API change.
+
+Answer and write examples in the user's language. The canonical references are intentionally single-source so API semantics cannot drift between translations.
+
+## Ownership spine
+
+Choose the owner before choosing an API:
+
+- **Canonical application data** belongs to one `DocumentRuntime` created by `createDocument`.
+- **Pure derived data** belongs to lazy `Projection` definitions and one materializing `ProjectionRuntime`.
+- **Runtime-local UI/application state** belongs to `input` or `input.collection`, not to the canonical document unless it must participate in document history, persistence, replay, or impact.
+- **Framework state** stays behind adapters. React consumes `Readable`, document selectors, projections, and projection inputs.
+- **Browser durability/leadership** belongs to `doxum/local-sync`; network collaboration and distributed conflict policy are separate boundaries.
+- **Retained incremental state** belongs to `doxum/advanced` only when ordinary `derive` / `derive.keyed` cannot express the work clearly.
+
+## Reference routing
+
+Read the smallest complete reference for the task before implementing it.
+
+| Task                                                                                                                           | Read                                               |
+| ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- |
+| Exact imports, signatures, callback fields, result types, errors, and all public exports                                       | [Public API](references/public-api.md)             |
+| Schema modeling, validators, Draft operations, reads, snapshots, commits, history, apply, impact, trees                        | [Document runtime](references/document-runtime.md) |
+| `observe`, `derive`, the `derive.keyed` family, dynamic keyed dependencies, Runtime/scope/items, batching, advanced processors | [Projections](references/projections.md)           |
+| React, external sources, `Readable`, and local-sync lifecycle                                                                  | [Integrations](references/integrations.md)         |
+| End-to-end usage patterns that can be adapted directly                                                                         | [Recipes](references/recipes.md)                   |
+| Editing or reviewing Doxum internals, ownership boundaries, scheduler/mutation architecture, release-facing invariants         | [Maintainer invariants](references/invariants.md)  |
+
+For application work, do not read the maintainer reference unless the task is actually changing Doxum itself.
+
+## Default API decisions
+
+Follow these choices unless the requirement says otherwise:
+
+1. Model stable document structure with `object`, `variant`, `map`, `table`, `list`, and `tree`; use `field` for atomic payloads that are replaced as a whole.
+2. Mutate canonical state only through `document.update`, `document.apply`, `document.replace`, or history operations. Draft/read proxies are synchronous borrowed views and must not escape their callback.
+3. Use `read` for one synchronous document read and `select` for a document `Readable` with dynamic dependency tracking.
+4. Use `observe` to bring a document/readable/external source into the projection graph.
+5. Use named-object `derive` for pure aggregate values.
+6. Use `derive.keyed` when one keyed source owns output membership/order. Prefer its built-in `keys`, `values`, `entries`, `get`, `subset`, `filter`, `compact`, `groupBy`, and `singleton` primitives over hand-written incremental collection patches.
+7. Express per-output-key joins through `{ source, key }` or `{ source, keys }` dependencies. Let the Runtime own binding and reverse invalidation; do not maintain an application `Map` just to route dependency changes.
+8. Use `runtime.items(keyedProjection)` or `scope.items(...)` for stable per-membership item `Readable`s.
+9. Use `incremental.keyed` for independent retained state per driver key. Use `incremental.collection` or `incremental.group` only when direct incremental output patching or shared retained state is required.
+10. Use `ProjectionScope` only for lifecycle ownership. Define projections normally, then `scope.own(...)` before that definition is first materialized as a root.
+
+## Failure and lifecycle rules
+
+- Doxum callbacks are synchronous unless the public API explicitly returns a Promise.
+- `TransactionRejected` expresses expected application rejection; ordinary thrown exceptions roll back and rethrow unchanged.
+- A committed document write remains committed even if projection or listener notification later fails; observer errors are reported on the result or through projection error handling.
+- `CollectionChange` is an advanced processor transport contract. Reset, membership transitions, value updates, and order are distinct facts.
+- `input.collection` has a strong exception boundary: callback or equality failure installs no partial next state.
+- Dispose the owning `ProjectionRuntime`, `ProjectionScope`, and `LocalSync` with the application/service lifecycle that created them.
+
+## Completion contract
+
+Before finishing Doxum application work, verify that:
+
+- every import comes from `doxum`, `doxum/advanced`, `doxum/react`, or `doxum/local-sync`;
+- no application behavior depends on an internal path, private brand, generated chunk, or source implementation detail;
+- canonical, projection, input, adapter, and persistence responsibilities have one owner each;
+- advanced APIs are used only for requirements that the ordinary public projection family cannot express;
+- examples follow the documented public failure and lifecycle semantics.

package/skills/doxum-runtime/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: 'Doxum Runtime'
-  short_description: 'Build and review Doxum core, projections, React, and local-sync.'
-  default_prompt: 'Use $doxum-runtime to implement this Doxum feature while preserving its runtime invariants.'
+  short_description: 'Use Doxum public APIs without reading implementation source.'
+  default_prompt: 'Use $doxum-runtime to implement this with the documented public Doxum APIs and lifecycle semantics.'

package/skills/doxum-runtime/references/document-runtime.md

@@ -0,0 +1,370 @@
+# Doxum Document Runtime
+
+Use this reference for schema design, canonical document mutation, reads, subscriptions, history, replay, impact, validation, and tree behavior. Exact signatures and exported types are in [Public API](public-api.md).
+
+## Mental model
+
+A Doxum document has one canonical owner: `DocumentRuntime`. The schema defines structure and identity; the runtime owns canonical data, revision, mutation, ChangeSets, history, and commit publication.
+
+Use these representation choices consistently:
+
+| Requirement                                             | Model                         |
+| ------------------------------------------------------- | ----------------------------- |
+| Fixed named structure                                   | `object({...})`               |
+| Tagged union of object branches                         | `variant(tag, variants)`      |
+| Arbitrary payload replaced as one value                 | `field<T>()`                  |
+| Dynamic keyed values without explicit order             | `map(valueSchema)`            |
+| Ordered keyed object/variant entities                   | `table(entitySchema)`         |
+| Ordered atomic items with stable identity from the item | `list(field<T>(), { keyOf })` |
+| Parent/child topology                                   | `tree(field<T>())`            |
+| Optional member                                         | `optional(schema)`            |
+
+Do not model dynamic keys as undeclared object properties. Object/variant input is closed to declared own members; dynamic domains belong in maps or fields.
+
+## Atomic payloads and structure
+
+`field<T>` is atomic. If `T` is an object, array, `Map`, `Set`, or `Date`, Doxum still treats the whole payload as one value. Access is deeply readonly through `ReadonlyValue<T>` and mutation replaces the payload whole.
+
+Use structure when Doxum must understand and address nested edits. For example:
+
+```ts
+const point = object({
+  x: field<number>(),
+  y: field<number>(),
+});
+
+const stroke = field<readonly { x: number; y: number }[]>();
+```
+
+`point.x` can change independently and participates in path impact. `stroke` changes as one atomic payload.
+
+Published atomic payload references are shared across snapshots, commits, and history. Treat them as immutable through every alias. Doxum does not deep-freeze application payloads and does not clone them merely to defend against mutation.
+
+## Schema handles and inferred types
+
+Use `Schema<T>` / `ObjectSchema<T>` as the portable schema boundary and `Infer<typeof schema>` for the canonical value type.
+
+```ts
+const task = object({
+  title: field<string>(),
+  done: field<boolean>(),
+});
+
+const model = object({
+  tasks: map(task),
+});
+
+type DocumentValue = Infer<typeof model>;
+```
+
+Export inferred schema constants directly. Do not expose internal node types or wrap public schemas in `ReturnType<typeof object>` to make declarations portable.
+
+## Optionality
+
+Optionality is structural presence, not an ordinary value convention.
+
+```ts
+const model = object({
+  nickname: optional(field<string>()),
+  settings: optional(map(field<string>())),
+});
+```
+
+Absent and present-with-`undefined` are distinct where the schema permits an atomic `undefined` payload. Use the schema's optional shape rather than inventing sentinel members.
+
+Tree optionality has two separate meanings:
+
+- `tree(optional(field<T>()))`: each existing node may omit `value`.
+- `optional(tree(field<T>()))`: the whole tree member may be absent.
+
+## Validators and parse
+
+Validators are synchronous and pure. A function validator may be a predicate or assertion:
+
+```ts
+const taskId = (value: unknown): value is TaskId =>
+  typeof value === 'string' && value.startsWith('task:');
+```
+
+Returning `true` or `undefined` means success; returning `false` rejects. An assertion may throw. Standard Schema v1 validators are also accepted, but successful validation must return the same input by identity. Doxum does not accept validator transforms.
+
+Transform external values before they enter Doxum. Use `parse(schema, unknownValue)` to validate unknown input and build schema-owned structure while sharing readonly atomic payloads.
+
+Map/table key validators define the public key type and apply at parse/mutation boundaries:
+
+```ts
+const model = object({
+  tasks: map(task, { key: taskId }),
+});
+```
+
+Branded key types then flow through collection methods, typed paths, impact, and keyed projections.
+
+## Creating the canonical runtime
+
+```ts
+const document = createDocument({
+  schema: model,
+  initial,
+  history: { capacity: 100 },
+});
+```
+
+`createDocument` is the only canonical state owner. Do not mirror canonical document state in a second writable store and synchronize both manually.
+
+`document.readonly()` returns a read/subscription-only alias bound to the same runtime identity.
+
+## Update lifecycle
+
+```ts
+const result = document.update(draft => {
+  const task = draft.tasks.get(taskId);
+  if (!task) throw new TransactionRejected({ code: 'missing-task', message: 'Task missing' });
+  task.done = true;
+  return taskId;
+});
+```
+
+A transaction is synchronous and atomic:
+
+- reads inside the callback see preceding writes in the same transaction;
+- all accepted writes publish together as one commit;
+- an ordinary thrown value rolls back all work and is rethrown unchanged;
+- `TransactionRejected` rolls back and returns `status: 'rejected'` with application diagnostics;
+- returning `false`, `undefined`, or any other ordinary value is just a callback result, not a rejection signal;
+- a net-zero transaction returns `status: 'unchanged'` and publishes no commit.
+
+The callback may not return a Promise.
+
+### Source and history options
+
+`update` accepts `{ source?: 'local' | 'system', history?: boolean }`.
+
+- `local` is the default application-authored commit source.
+- `system` is for application/system work that is still local canonical mutation.
+- `history: false` prevents the commit from entering local undo history.
+
+## Borrowed Draft/Read lifetime
+
+Draft/read access objects are synchronous borrowed capabilities. Do not retain any Draft/Read object, collection accessor, or method past its callback.
+
+Wrong:
+
+```ts
+let tasks;
+document.update(draft => {
+  tasks = draft.tasks;
+});
+tasks.put('later', value);
+```
+
+Use a durable value or a fresh callback instead. When a read must outlive the callback, use `snapshot`:
+
+```ts
+const tasks = read(document, state => snapshot(state.tasks));
+```
+
+`snapshot` copies schema structure and shares atomic payload references under the readonly ownership contract.
+
+## Collection mutation rules
+
+### Map
+
+A map is unordered dynamic membership.
+
+```ts
+draft.tasks.put(id, value); // upsert
+draft.tasks.remove(id); // missing is a no-op
+draft.tasks.replace(nextRecord);
+```
+
+### Table
+
+A table is ordered membership plus object/variant entities.
+
+```ts
+draft.rows.create(id, value, { at: 'start' });
+draft.rows.create([{ id, value }, ...], { after: existingId });
+draft.rows.remove(idOrIds);
+draft.rows.move(idOrIds, { before: anchorId });
+draft.rows.reorder(exactCurrentMembership);
+draft.rows.replace(id, value);
+draft.rows.replace({ ids, byId });
+```
+
+`replace(id,value)` preserves that member's order position. `reorder` requires an exact permutation of current membership.
+
+### List
+
+A list stores atomic items and derives stable identity from `keyOf`.
+
+```ts
+draft.rows.insert(value, { after: id });
+draft.rows.remove(id);
+draft.rows.move(idOrIds, { at: 'end' });
+draft.rows.reorder(exactIds);
+draft.rows.replace(id, replacementWithSameKey);
+draft.rows.replace(nextArray);
+```
+
+Member replacement must retain the addressed stable key.
+
+### Move semantics
+
+For table/list `move(selection, anchor?)`, Doxum first removes the selection, preserves the selected members' current relative order, then resolves the anchor against the remaining sequence. Omitting the anchor means end.
+
+### Tree
+
+Trees are empty or one connected single-root tree. Nodes have reciprocal parent/children topology and no cycles.
+
+```ts
+draft.outline.insert(id, value, { parentId, index });
+draft.outline.move(id, { parentId, index });
+draft.outline.remove(id);
+draft.outline.replace(id, newPayload);
+draft.outline.replace(wholeTree);
+```
+
+`index` is the final child position after removal from the old location. A tree member replacement must satisfy full topology invariants at the boundary.
+
+Do not edit `rootId`, `parentId`, `children`, or `nodes` as raw records through application code; use tree operations.
+
+## Replacing complex object/variant members
+
+Draft object/variant members that contain collection nodes expose collection capabilities rather than plain assignable data. To replace one such member from a plain `Infer` value, use top-level `replace`:
+
+```ts
+document.update(draft => {
+  replace(draft.settings, 'rows', {
+    ids: ['a'],
+    byId: { a: { title: 'A' } },
+  });
+});
+```
+
+A collection's own `replace(next)` remains the normal whole-collection replacement when the collection itself is the mutation target.
+
+## Reading canonical state
+
+Use `document.snapshot()` for a durable whole-document value.
+
+Use `read` for one synchronous selector read:
+
+```ts
+const done = read(document, state => state.tasks.get(taskId)?.done);
+```
+
+Use `select` for a revisioned `Readable`:
+
+```ts
+const selected = select(document, state => state.tasks.get(taskId)?.done);
+const stop = selected.subscribe(() => render(selected.current()));
+```
+
+`select` tracks actual reads, including branching, and rebinds dependencies when the selector's read set changes. Equality defaults to `Object.is`; supply custom equality only for the projected result, not to redefine document semantics.
+
+## Typed paths and subscriptions
+
+Path callbacks describe schema locations without reading current data:
+
+```ts
+const stop = document.subscribe(
+  path => path.tasks.item(taskId).done,
+  commit => handle(commit)
+);
+```
+
+You can subscribe to one path or a non-empty array of paths. Paths compile when the subscription/impact query is registered. They remain meaningful even when an optional/member path is currently absent.
+
+Tree paths expose:
+
+```ts
+path.outline.rootId;
+path.outline.nodes;
+path.outline.nodes.item(nodeId);
+```
+
+## Commits and observer errors
+
+An accepted commit contains:
+
+- monotonic local `revision`;
+- `source` (`local`, `system`, `history`, `remote`);
+- exact normalized reversible `changes`;
+- exact `impact` queries.
+
+Commit listeners and projection processing occur after canonical acceptance. Their failures do not turn an accepted mutation into a rejected one. `TransactionResult` / `OperationResult` report post-commit observer failures in `observerErrors`.
+
+## ChangeSet semantics
+
+A member group owns one container address:
+
+```ts
+{
+  kind: 'members',
+  at: ['tasks', taskId],
+  members: [
+    { key: 'title', kind: 'updated', before: 'A', after: 'B' },
+    { key: 'done', kind: 'updated', before: false, after: true },
+  ],
+}
+```
+
+An ordered container may include `order: { before, after }` in the same group. Order-only groups have an empty `members` array. There is no standalone order change kind.
+
+Tree changes use one tree-container address plus changed node transitions and before/after root id. Whole-document reset is explicit.
+
+ChangeSets are final net changes, not an operation log. Multiple writes that cancel out do not publish a change.
+
+## Applying external ChangeSets
+
+```ts
+const result = document.apply(changes, {
+  expectedRevision: document.revision(),
+  source: 'remote',
+});
+```
+
+`expectedRevision` is mandatory. External `before` data is transport input, not authority: Doxum checks local baseline/state and records actual local before values for reversible local history.
+
+A remote commit invalidates local history. Treat local revision as a local concurrency baseline, not as a globally distributed clock.
+
+## History
+
+```ts
+const group = document.history.group();
+try {
+  document.update(...);
+  document.update(...);
+  group.end();
+} catch (error) {
+  group.cancel();
+  throw error;
+}
+```
+
+`undo()` / `redo()` travel complete ChangeSets atomically. `group().end()` groups completed history entries; `cancel()` restores the group's start through history travel.
+
+A local whole-document replace is reversible. Remote commits clear/invalidate local history because the old local history baseline no longer describes the canonical branch.
+
+## Impact
+
+Use commit impact instead of manually parsing ChangeSets for ordinary subscription/application invalidation questions:
+
+```ts
+if (commit.impact.affects(path => path.tasks.item(id).done)) { ... }
+
+const impact = commit.impact.collection(path => path.tasks);
+if (impact.kind === 'incremental') {
+  impact.added;
+  impact.removed;
+  impact.updated;
+  impact.orderChanged;
+}
+```
+
+Use raw `ChangeSet` only when the exact reversible transport is itself the requirement.
+
+## Disposal
+
+`document.dispose()` ends the runtime. Later access throws `DocumentDisposedError`. Own the document runtime at the application/service boundary that owns its canonical state.