footprintjs 9.44.3 → 9.46.0

package/CLAUDE.md

@@ -9,7 +9,7 @@ Entry points: `footprintjs` (public API) · `/recorders` (factories) · `/trace`
 | src/lib/ | one job |
 |---|---|
 | capture/ | retention policies + bounded payload summarization (leaf; shared by tracking dials AND deferred-observer capture) + `valueKinds` (the ONE classifier of value kinds: `deepEqual`'s arms and what freezing seals, 9.44.2) + the shared leaves `invokeHook` (the one recorder-hook invoker both delivery tiers use), `circular` (dev-mode cycle probe), `summarizeValue` (the narrative one-liner); `lib/devMode.ts` — the dev-mode flag — is its sibling leaf (all four moved out of scope/ and recorder/ in F0: they closed the one memory ⇄ scope ⇄ recorder module cycle) |
-| memory/ | transactional state: SharedMemory heap, StageContext frames, TransactionBuffer staging (+ admission.ts, the admitted record's check; deltaEncoding.ts, the delta encoder's helpers), EventLog commit log — PLUS the ONE verb law (`verbs.ts`, L1: `applyVerb`, `foldRows`, `foldKey`; leaves `paths.ts` / `equality.ts` / `merge.ts`; `utils.ts` re-exports them) and trace analysis (backtrack.ts causalChain, commitLogUtils.ts) |
+| memory/ | transactional state: SharedMemory heap, StageContext frames, `RecordFrame` (the record half of a frame, L3, C3: the address, the first-touch base, the two-tier read, the lazy buffer, the readKeys list, and the commit through `recordCommit`; StageContext composes it), TransactionBuffer staging (+ admission.ts, the admitted record's check; deltaEncoding.ts, the delta encoder's helpers), EventLog commit log — PLUS the ONE verb law (`verbs.ts`, L1: `applyVerb`, `foldRows`, `foldKey`; leaves `paths.ts` / `equality.ts` / `merge.ts`; `utils.ts` re-exports them) and trace analysis (backtrack.ts causalChain, commitLogUtils.ts) |
 | schema/ | duck-typed validation (`.safeParse/.parse` ⇒ 'parseable') |
 | builder/ | fluent DSL → FlowChartSpec → StageNode graph; build-time StructureRecorder channel. NOT standalone: imports runner's makeRunnable (FlowChartBuilder.ts:18) |
 | scope/ | ScopeFacade per stage (tracked get/set, $emit, frozen args/env); built-in ScopeRecorders in scope/recorders/ |
@@ -24,21 +24,21 @@ Entry points: `footprintjs` (public API) · `/recorders` (factories) · `/trace`
 | observer-queue/ | pure deferred-delivery pipeline (engine imports IT, never reverse) |
 | contract/, detach/ | I/O schema normalization (OpenAPI generation belongs to runner/RunnableChart); fire-and-forget child charts (drivers passed explicitly) |
 
-**The fence (F0):** a file imports only its own layer or BELOW — L0 values/leaves · L1 verbs · L2 staging+commit · L3 the log as a read model · L4 frame+run policy · L5 scope/recorders/hooks · L6 engine · L7 builder+executor · L8 the `src/*.ts` entry barrels. The table is DATA in `scripts/layering.config.cjs` (most specific pattern wins; an unplaced file is an error, and `memory/` has no directory default because it spans L0–L4) and has three readers, none with a copy: `.eslintrc.js` (generated `import/no-restricted-paths` zones + `import/no-cycle`, src only), `npm run check:layering` (value-level cycles at module AND file level + upward RUNTIME edges; type-only imports excluded — the set equals the compiled CJS `require` graph), `test/architecture/layering.test.ts`. Three edges are named on purpose — builder → `runner/RunnableChart.ts` (`makeRunnable`), engine → `reactive/handles.ts`, scope → `detach/spawn.ts` — plus a short `TYPE_ONLY_ALLOWANCES` list (upward imports tsc erases, which the lint rule cannot tell apart); both lists are live-checked and only shrink. A new src file under an unsplit directory inherits its layer; one under `memory/` (or an exact-path entry) must be added to LAYERS — an unplaced file fails lint and the script. Public symbols have ONE canonical door each — `test/architecture/exports.test.ts` fails on any symbol two of the six `package.json` doors both hand out unless it is in `SECOND_DOORS` (28 today, in four reasoned groups; an alias counts as a door).
+**The fence (F0):** a file imports only its own layer or BELOW — L0 values/leaves · L1 verbs · L2 staging+commit · L3 the log as a read model + the record half of a frame (`RecordFrame`) · L4 frame+run policy · L5 scope/recorders/hooks · L6 engine · L7 builder+executor · L8 the `src/*.ts` entry barrels. The table is DATA in `scripts/layering.config.cjs` (most specific pattern wins; an unplaced file is an error, and `memory/` has no directory default because it spans L0–L4) and has three readers, none with a copy: `.eslintrc.js` (generated `import/no-restricted-paths` zones + `import/no-cycle`, src only), `npm run check:layering` (value-level cycles at module AND file level + upward RUNTIME edges; type-only imports excluded — the set equals the compiled CJS `require` graph), `test/architecture/layering.test.ts`. Three edges are named on purpose — builder → `runner/RunnableChart.ts` (`makeRunnable`), engine → `reactive/handles.ts`, scope → `detach/spawn.ts` — plus a short `TYPE_ONLY_ALLOWANCES` list (upward imports tsc erases, which the lint rule cannot tell apart); both lists are live-checked and only shrink. A new src file under an unsplit directory inherits its layer; one under `memory/` (or an exact-path entry) must be added to LAYERS — an unplaced file fails lint and the script. Public symbols have ONE canonical door each — `test/architecture/exports.test.ts` fails on any symbol two of the six `package.json` doors both hand out unless it is in `SECOND_DOORS` (28 today, in four reasoned groups; an alias counts as a door).
 
 ## Core state & flow
-- `SharedMemory` (memory/SharedMemory.ts) — run-namespaced heap; committed state is **immutable-after-swap**, COPY-ON-WRITE since 9.29.0: every write (`applyPatch` → `verbs · nextGeneration`, `setValue`/`updateValue`) copies the root + the containers on each written path and SHARES every other subtree with the previous generation, then swaps. A generation is never edited; the seed is detached once at construction. Design: docs/design/2026-10-copy-on-write-commit.md.
-- `StageContext` (memory/StageContext.ts:29) — per-stage frame: lazy TransactionBuffer + first-touch view; `commit()` → `memory/recordCommit.ts · recordCommit` (live apply → scrub → mirror → `EventLog.record`; the ONE owner of the bundle's key order, C1, 9.44.3) → onCommit.
+- `SharedMemory` (memory/SharedMemory.ts) — address-scoped heap: the frame's record frame hands it the address (`RecordFrame · address`; the engine decides it in `StageContext.ts · runAddress` / `useAddressOf` from the ONE L4 constant `RUN_NAMESPACE`, C2/C3); committed state is **immutable-after-swap**, COPY-ON-WRITE since 9.29.0: every write (`applyPatch` → `verbs · nextGeneration`, `setValue`/`updateValue`) copies the root + the containers on each written path and SHARES every other subtree with the previous generation, then swaps. A generation is never edited; the seed is detached once at construction. Design: docs/design/2026-10-copy-on-write-commit.md.
+- `StageContext` (memory/StageContext.ts:29) — per-stage frame inside a run; composes `RecordFrame` (memory/RecordFrame.ts, L3, C3: the lazy TransactionBuffer, the first-touch base, the two-tier read, readKeys, the address); `commit()` → `RecordFrame · commit` (payload, then the names) → `memory/recordCommit.ts · recordCommit` (live apply → scrub → mirror → `EventLog.record`) → onCommit → `RecordFrame · release`. `runId` is readonly (the address is decided once, 9.46.0).
 - `CommitBundle`/`EventLog` — one bundle per executed stage, `bundle.idx` == array position; encoding governed by `commitValues: 'full'|'delta'`.
 - `TraversalContext` (engine/narrative/types.ts:172) — THE per-event context (runId, runtimeStageId, parentRuntimeStageId, subflowPath, loopIteration); stamped on every FlowRecorder event.
 - `runtimeStageId` = `[subflowPath/]stageId#executionIndex`; counter shared by reference into subflow traversers → globally unique; NOT reset on resume.
 - Subflows get a fresh isolated ExecutionRuntime (SubflowExecutor.ts:119); inputMapper seeds, outputMapper merges back (arrays CONCAT unless `arrayMerge: Replace`).
 
-**Retry (9.15.0):** `StageNode.retry` is a POLICY on a stage, not a kind — no new node type, no `computeNodeType` edit. The loop lives in `FlowchartTraverser.executeStage` (:720), so linear/streaming/pausable/decider/selector/fork-child/subflow-inner all get it from one implementation. A failed non-final attempt calls `StageContext.discardStaged()` (buffer + stateView + _stageWrites/_stageReads + _provenanceReads + _untrackedSources); the final attempt is today's law untouched. PauseSignal and abort are NEVER retried. One runtimeStageId + one CommitBundle per stage regardless of attempts; retries do not consume `maxIterations`.
+**Retry (9.15.0):** `StageNode.retry` is a POLICY on a stage, not a kind — no new node type, no `computeNodeType` edit. The loop lives in `FlowchartTraverser.executeStage` (:720), so linear/streaming/pausable/decider/selector/fork-child/subflow-inner all get it from one implementation. A failed non-final attempt calls `StageContext.discardStaged()` (`RecordFrame · discard`, which drops the buffer, the first-touch base and readKeys, plus _stageWrites/_stageReads + _untrackedSources); the final attempt is today's law untouched. PauseSignal and abort are NEVER retried. One runtimeStageId + one CommitBundle per stage regardless of attempts; retries do not consume `maxIterations`.
 
 **Declared tags (9.21.0):** `StageNode.tags?: readonly string[]` is a NAME on a stage, declared at build time — POLICY-like (the retry precedent): no node type, no `computeNodeType` edit, no type-union site, and the one prefixer (`engine/graph/prefixNodeTree.ts`, 9.37.0) spreads `{ ...node }` so it rides subflow prefixing untouched. ONE landing site `FlowChartBuilder.ts · applyTags` (twin of `applyRetryPolicy`) serves the `.tag(...names)` cursor modifier and every `options.tags` site; refuses empty/non-string/`~`/duplicate/double-declare at build. Stamp: `FlowchartTraverser.executeNodeStep` sets `context.tags = node.tags` beside `runtimeStageId` (unconditionally — a re-used context must not keep a prior node's names); `memory/recordCommit.ts · recordCommit` (C1, 9.44.3; was `StageContext · bundleFor`) stamps `tags` beside `untrackedSources` on BOTH commit paths and `StageContext · commit` RELEASES them, so a double-commit path (fork child fan-out repeat, mount exit) records it once — absent when empty (`CommitBundle.tags?`; pinned byte-identical to 9.20.0 by test/lib/engine/scenario/declared-tags-byte-identity.test.ts). NOT inherited by createNext/createChild; the one synthetic node that could lose it is `FlowChartExecutor.resume`'s stand-in for the paused stage — built by `runner/resume.ts · standInFor` from the paused node ITSELF (fn swapped), so it keeps the tags on both re-entries; it runs ONCE — a later visit of the paused id runs the chart's real node, which carries its own tags. The spec carries `tags` as-is (Map advertises the vocabulary; `RuntimeStructureManager.stageNodeToStructure` copies it for run-time-resolved nodes). Reader: `time-travel/tagStops.ts` = `filterStops(commitStops(...), any-of over log[stop.commitIdx].tags, meta = the array)`, exported from `/trace`. Never a runtime `$tag()` — a value would ride past every redaction point. Design: docs/design/2026-09-declared-tags.md.
 
-**Event order (code-verified; older docs had 3/4 swapped):** onStageStart → onRead/onWrite (live, PRE-commit) → **onStageEnd (StageRunner.ts:81) → onCommit (StageContext.ts:587)** → FlowRecorder onDecision/onFork/onSelected/onSubflowEntry → onStageExecuted (uniform, with stageType). Error path: commit STILL happens (FlowchartTraverser.ts:1088) before onError+rethrow — a failing stage's writes land. For ANY thrown value (null, null-prototype, hostile Proxy) catch blocks describe it with `errors/errorInfo · thrownText` (never throws), onError fires, and run() rejects with the ORIGINAL value; a failed commit (e.g. an uncloneable write) also fires onError (`handlers/commitStage.ts`, 9.40.0). `interrupt()` rides the ERROR path's shape, not the pausable one: the stage function threw, so onStageEnd does NOT fire (the `addPausableFunction` pause DOES fire it — there the function returned normally).
+**Event order (code-verified; older docs had 3/4 swapped):** onStageStart → onRead/onWrite (live, PRE-commit) → **onStageEnd (StageRunner.ts:81) → onCommit (`StageContext · commit`, after `RecordFrame · commit`)** → FlowRecorder onDecision/onFork/onSelected/onSubflowEntry → onStageExecuted (uniform, with stageType). Error path: commit STILL happens (FlowchartTraverser.ts:1088) before onError+rethrow — a failing stage's writes land. For ANY thrown value (null, null-prototype, hostile Proxy) catch blocks describe it with `errors/errorInfo · thrownText` (never throws), onError fires, and run() rejects with the ORIGINAL value; a failed commit (e.g. an uncloneable write) also fires onError (`handlers/commitStage.ts`, 9.40.0). `interrupt()` rides the ERROR path's shape, not the pausable one: the stage function threw, so onStageEnd does NOT fire (the `addPausableFunction` pause DOES fire it — there the function returned normally).
 
 ## Extension points
 - **New stage kind**: boolean flag on `StageNode` (engine/graph/StageNode.ts:39 — kinds are flags, not an enum) + builder method on FlowChartBuilder (pattern: addPausableFunction :1264; fire structure events endpoint-before-edge) + phase in the hard-coded chain `executeNodeStep` (FlowchartTraverser.ts:801 — no handler registry; new handler class takes HandlerDeps, engine/types.ts:344, instantiated in traverser ctor :402-413). Must also edit 5 type-union sites: engine/types.ts:477, builder/types.ts:50, builder/types.ts:104, engine/types.ts:427, and computeNodeType's flag→type mapping (RuntimeStructureManager.ts:19-21 — the only one the compiler won't flag; miss it and the new kind silently serializes as 'stage'). Zero-engine alternative: pure sugar over addFunction (pattern: addDetachAndForget :1343). WORKED EXAMPLE (9.14.0 addParallelForEach): flag `isDynamicParallel` + ParallelForEachHandler + Phase 0b (BEFORE Phase 1 VALIDATE — the node has no fn/children/decider by design); it added NO new node type — the spec carries a BOOLEAN and computeNodeType returns 'fork' (precedent: isPausable/isLazy/isStreaming are flags on a 'stage'), which is the cheaper choice whenever the new kind is a variant of an existing shape.
@@ -54,11 +54,12 @@ Entry points: `footprintjs` (public API) · `/recorders` (factories) · `/trace`
 
 ## Change-impact map
 - **Trace verbs** (`set|merge|append|delete`, memory/types.ts:42) → ONE law, `memory/verbs.ts` (L1) — F2 deleted the three replicas. `applyVerb` is the ONLY function with an arm per verb (a fifth verb in the union stops compiling there; `TRAITS` — `isTotal` / `recordsTail` — says what a verb IS, pinned against the step), `placeVerb` puts its value or removes the key (`ABSENT`), and two loops fold it: `foldRows` folds ONE bundle's rows into a state with the clone DISCIPLINE as a parameter (`'private'` = the PUBLIC `applySmartMerge`, which keeps its 9.28.0 contract: base deep-cloned, fully detached result — 9.29.0; `'pathCopy'` = the engine's `nextGeneration` — live commit + redacted mirror — and the folds' `applySmartMergeInto` — `stateAt`, `EventLog.materialise`; `'byReference'` = `dryFold`, the admitted record's comparison fold — 9.30.0), and `foldKey` folds ONE path's rows across a log — `commitLogUtils · commitValueAt` (anchored at the last total row) and `slice/elementProvenance · arrayProvenance` (an OBSERVER of that fold: it keeps the births and has no verb switch); causalChain/findLastWriter only match paths. A bundle's merge delta is detached ONCE per bundle (`RecordedPayload`): `deepSmartMerge` dedups an array union BY REFERENCE, so the merge rows of one bundle must see the same objects (a per-row clone made `commitValueAt` double the elements — the 9.29.0 reader bug, fixed here); `foldKey` narrows that copy to its one path. **An unknown verb is REFUSED** (`UnknownVerbError`, public on `/trace`; R2) by `foldRows` (so `applySmartMerge`), `commitValueAt`, `arrayProvenance` — they used to fold it as a `merge`; `time-travel/bundles · bundleRefusal` asks the same `isVerb` and makes it a GAP instead. Pinned: the three old replicas live on as the CONTROL in test/lib/memory/property/verb-law-differential.property.test.ts (kept for the packet's lifetime). The delta encoder keeps VOCABULARY only since 9.30.0 (it picks a verb; its values come from `dryFold` of the stage's 'full' rows — `TransactionBuffer · fullRowsValue`; `replayPathVerbs`/`replayFamilyVerbs` deleted). NOT a second loop (9.22.1): `verbs.ts · supersededByNextSet` — the ONE repeated-path skip (CONSECUTIVE same-path `set` rows: only the last is applied), asked by `foldRows` before its step; its commit-side twin is the last-materialised-path memo in `toChangeOnlyPayload`. Rows are never dropped from the log; a non-consecutive skip is WRONG (a descendant op in between coerces/shells the container) — pinned by test/lib/memory/scenario/repeated-path-byte-identity.test.ts. Since 9.23.0 the clone in that memo loop (and every `structuredClone` in `toDeltaPayload`) is THE clone — the patch trees hold references until commit; no verb switch was touched.
-- **StageContext.commit / dials** → ONE owner since 9.35.0 (F5): `memory/runPolicy.ts` — a frozen `RunPolicy` (the four dials + the `RedactionRule` + the mirror flag) built ONCE by `FlowChartExecutor · createTraverser` (run AND resume), handed to `ExecutionRuntime`, held BY REFERENCE by every `StageContext` (`inheritRun` in createNext/createChild) and passed by `SubflowExecutor · executeSubflow` to the nested runtime BEFORE the seed. A fifth dial = the policy type + its consumer. The old per-dial `use*`/`get*` and `enableRedactedMirror` were removed in 9.36.0 (no compat shims — owner ruling). `commit()`'s FIRST act (9.23.0) is `materialiseWrites` — the `writeTracking` retained form is taken there, once per key, from `_pendingWrites` (bare references + the write-time verdict); anything that reads `_stageWrites` goes through `retainedWrites()` (a non-consuming fold, so a mid-run snapshot is honest), and `discardStaged` drops the pending map with the rest.
+- **Write address** → ONE constant, `StageContext.ts · RUN_NAMESPACE` (L4), read by `runAddress` and `useAddressOf`; the frame's `RecordFrame` holds the address (C3). `SharedMemory` and the nested writers take the address as data and refuse a non-array; `TransactionBuffer` takes it too (C2, 9.45.0). `test/architecture/write-address.test.ts` refuses the namespace below L4, as a literal or a property (exceptions `RedactionRule · verdictOfRead` / `retainState` until C4).
+- **StageContext.commit / dials** → ONE owner since 9.35.0 (F5): `memory/runPolicy.ts` — a frozen `RunPolicy` (the four dials + the `RedactionRule` + the mirror flag) built ONCE by `FlowChartExecutor · createTraverser` (run AND resume), handed to `ExecutionRuntime`, held BY REFERENCE by every `StageContext` (`inheritRun` in createNext/createChild) and by its `RecordFrame` as its encoding (`useEncoding`, through `StageContext · adoptPolicy`, the one place a frame's policy changes) and passed by `SubflowExecutor · executeSubflow` to the nested runtime BEFORE the seed. A fifth dial = the policy type + its consumer. The old per-dial `use*`/`get*` and `enableRedactedMirror` were removed in 9.36.0 (no compat shims — owner ruling). `commit()`'s FIRST act (9.23.0) is `materialiseWrites` — the `writeTracking` retained form is taken there, once per key, from `_pendingWrites` (bare references + the write-time verdict); anything that reads `_stageWrites` goes through `retainedWrites()` (a non-consuming fold, so a mid-run snapshot is honest), and `discardStaged` drops the pending map with the rest.
 - **runtimeStageId format** (`#`/`/` delimiters) → ONE grammar owner since 9.37.0 (F7): `src/lib/ids/` (L0 leaf: `runtimeStageId.ts` — `parseRuntimeStageId`, `isExecutionKey`, `stageIdOf`, `subflowPathOf`, `refuseReservedId`; `branchSegment.ts` — the `~` grammar). Every parser (ScopeFacade subflow path, subflowResults dual-keying, narrative buffering, store keys) calls it; none re-derives the grammar. R5: every id door (22 at build, plus the run-time dynamic-StageNode door) refuses `#` and `/`; stage ids may contain `~`. `TraversalContext` has ONE constructor (`engine/traversalContext.ts`); `depth` = subflow nesting read off the runtimeStageId on every stamp. Brands `RuntimeStageId`/`ExecutionIndex`/`CommitIdx` on `/trace` (types only).
 - **Subflow id prefixing** → ONE prefixer since 9.37.0: `engine/graph/prefixNodeTree.ts`, used by the builder AND the traverser (eager, lazy and `parallelForEach` mounts — lazy/branch roots were unprefixed before 9.37.0, so branch ids collided); change it + stageMap key composition + resume drilling; the builder's eager mounts all go through `FlowChartBuilder · _mountSubflow` (F10). test/lib/engine/branch-segment-prefixer-equivalence.test.ts stays as a guard.
 - **Checkpoint shape** (format 2 since 9.44.0, LEAN: only what resume reads + the pause's record — no `executionTree`/`subflowResults`; size independent of run length, pinned by test/lib/pause/checkpoint-size.test.ts; 9.39–9.43 refuse format 2, so upgrade readers before writers) → `runner/checkpoint.ts · buildPauseCheckpoint` ↔ `pause/record.ts · decodeCheckpoint` (one upcaster drops v0/v1 fields) ↔ `runner/resume.ts · planResume` (validation via `pause/record.ts · decodeCheckpoint`) ↔ `ResumeEntry.plan` (the path's mounts + captures + dispatcher continuations, the `pendingPauses` queue; refused up front when unwalkable, ambiguous, or a pending record is not a sibling) ↔ `SubflowExecutor · executeSubflow` resume hop (seed from the capture in place of the mapper's values — the mapper still runs, for the args — FIRST entry only) ↔ `ChildrenExecutor · raisePauses` (fills `pendingPauses`). 9.28.0 adds ONE optional field, `pendingPauses` (present only when parallel siblings wait); the redaction law adds `redactionMarks` (names only, present only when the run marked something); every stored checkpoint enters through `pause/record.ts · decodeCheckpoint` (`checkpointVersion: 1`, one upcaster from unversioned v0 which drops the legacy `continuationStageId`, one validator, one message set; 9.39.0). Pinned: a 9.27.0 checkpoint resumes, test/lib/pause/resume-real-chart-9.27.0-checkpoints.test.ts.
-- **Committed-state writers** (copy-on-write, 9.29.0) → anything that writes into `SharedMemory`'s state, a fold's working copy or the buffer's working copy must copy before it writes: `pathOps · ownSpine` for the containers on the path, `ownedRootOf` for the root, `own`/`adopt` for what it created. An in-place edit of a container it did not create edits every generation sharing it — the counted guard stays green while the generations property fails. A new READ path through `TransactionBuffer` goes through `get` (private after the first write) unless it only compares (`peek`); a read the working copy cannot answer is served from LIVE state (`StageContext · readState`, as on 9.28.0) after `TransactionBuffer · detachBase` gives the diff base a private copy at that path — a private copy of the value handed out instead would change live state wherever 9.28.0 let an in-place edit in (a fork child's read of a parent key). `TransactionBuffer · merge` privatises its base first: `deepSmartMerge` dedups arrays BY REFERENCE, so the identity of the base is part of the bytes.
+- **Committed-state writers** (copy-on-write, 9.29.0) → anything that writes into `SharedMemory`'s state, a fold's working copy or the buffer's working copy must copy before it writes: `pathOps · ownSpine` for the containers on the path, `ownedRootOf` for the root, `own`/`adopt` for what it created. An in-place edit of a container it did not create edits every generation sharing it — the counted guard stays green while the generations property fails. A new READ path through `TransactionBuffer` goes through `get` (private after the first write) unless it only compares (`peek`); a read the working copy cannot answer is served from LIVE state (`RecordFrame · read`, as on 9.28.0) after `TransactionBuffer · detachBase` gives the diff base a private copy at that path — a private copy of the value handed out instead would change live state wherever 9.28.0 let an in-place edit in (a fork child's read of a parent key). `TransactionBuffer · merge` privatises its base first: `deepSmartMerge` dedups arrays BY REFERENCE, so the identity of the base is part of the bytes.
 - **Redaction** (9.19.0; the law restored to owner ruling (a)) has ONE owner: `memory/redaction.ts` `RedactionRule` (verdict per user-level path: `clear | whole | fields`), carried on the run's `RunPolicy` with the four dials (F5). THE LAW: a policy covers EVERYTHING the library retains or serves — log (both encodings), mirror, stageReads/stageWrites, every recorder event inline and deferred (and the rows built from them), narrative, snapshots, diagnostics, pause payloads, boundary records, logger lines — and NEVER the live heap or the resume checkpoint. The two true exceptions are the caller's own values: the `run()` rejection and the live fork result. It selects by NAME, never by content: state by path (`verdict`); a record handed out whole (root input/output — `FlowchartTraverser.execute`; subflow seed/exit — `SubflowExecutor`; pause payload — `engine/handlers/servedPause.ts`; thrown value — `retainStageError`) by its keys at every depth plus declared `fields` under a key of that name (`retainBoundary` — one decision per PATH via `servedByPath`: copy-on-write per path, the visited set only the current path's ancestor stack, a cycle edge landing on the served copy; a path rule is exact under shared references, a key-NAME rule masks a shared node everywhere); a diagnostic entry as the record `{ [name]: value }` (`retainDiagnostic`; `policy.diagnostics` ADDS diagnostic-only selectors, the only ones that reach flow-message text); a subflow mapper's copy by TAINT (`MapperTaint`, asked by `SubflowInputMapper` for both mappers; the `parallelForEach` items selector counts selected reads via `StageContext · selectedReads` and marks `item`/`into`): a value passed under its own name keeps that name's verdict, an object by reference (or the whole handed record, as fields) keeps its source's, anything computed after a selected read is marked whole (conservative); never value equality across names. A mark is a NAME, run-wide, until the key is deleted — and a pause carries the marks (names only) to the resumed run (`FlowchartCheckpoint.redactionMarks`, checked by `pause/record.ts`). A thrown value is walked with its `cause`/`errors`; an object a mapper passes on by reference is scanned for the selected values it read (planted → fields). Name-only patterns (`needsPath` false — no `.`, lookaround, or escape/class that can match `.`) are decided per object, so the walk shares decisions per (object, targets) — linear on a DAG or a linked history; only a path-dependent pattern walks paths, and past 1,000,000 visits it serves the unvisited remainder as the placeholder (one dev-mode warning), never fails the run. Inside a stage, an OBJECT read under a selected name and written under another keeps its rule (`StageContext · stageWrite`, by identity); a primitive or a new object copied across names is selected by its own name only. `StageContext.stageWrite` is the ONE write funnel (facade writes, subflow seed, outputMapper merge-back, resume re-seed) and `getValue` retention asks the same rule; the facade asks it for read/write recorder payloads. An inert rule never enumerates a payload. `emitPatterns` is the one separate scrub (`$emit` payloads, by event name). Two placeholders, historical: log/mirror `'REDACTED'`, scope-tier `'[REDACTED]'`. See `docs/guides/scope.md` → "The one law". Capture the retained form at runtime; no second tree walk or recorder-local policy.
 - **Diagnostic retention** → `DiagnosticCollector` asks the current run rule before merging/storing: a named entry maps to the state key of its name (the run's keys/patterns/marks/fields, at every depth of the value), then the opt-in `RedactionPolicy.diagnostics` selectors (same path algorithm, rooted at the channel). Its internal retained-write bridge supplies legacy facade emits. Existing writers stay void. Only flow-message description/rationale are payloads (no name — diagnostic selectors only); keys/topology/timing stay present. Dynamic capture uses a per-visit engine flag, not a diagnostic bag. A redacted `logs.deciderRationale` also reaches decision explanations. Checkpoints keep retained diagnostic bags but preserve operational state; no retroactive scrub. See the scope guide's diagnostic contract.
 - **Traverser phases** → node-shape reads must use eff* overlay accessors (:646-703) or dynamic StageNode returns break; tail continuations must return ContinuationHops or stacks regrow; decider flat-dispatch must keep InvokerStamp or pause loses its invoker.

package/dist/esm/lib/memory/DiagnosticCollector.js

@@ -33,7 +33,7 @@ export class DiagnosticCollector {
     write(channel, key, value, path, replace) {
         const kept = this.retain(channel, path, key, value);
         const write = replace ? setNestedValue : updateNestedValue;
-        write(this[BAG_FIELDS[channel]], '', path, key, kept);
+        write(this[BAG_FIELDS[channel]], [], path, key, kept);
         return kept;
     }
     /** @internal Add once, returning the retained incoming value for emit.
@@ -83,4 +83,4 @@ export class DiagnosticCollector {
         }
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRGlhZ25vc3RpY0NvbGxlY3Rvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9saWIvbWVtb3J5L0RpYWdub3N0aWNDb2xsZWN0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7O0dBUUc7QUFJSCxPQUFPLEVBQUUsY0FBYyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBSy9ELE1BQU0sVUFBVSxHQUFHO0lBQ2pCLElBQUksRUFBRSxZQUFZO0lBQ2xCLE1BQU0sRUFBRSxjQUFjO0lBQ3RCLE9BQU8sRUFBRSxlQUFlO0lBQ3hCLEtBQUssRUFBRSxhQUFhO0NBQ1osQ0FBQztBQUVYLE1BQU0sT0FBTyxtQkFBbUI7SUFRRDtJQVB0QixVQUFVLEdBQTJCLEVBQUUsQ0FBQztJQUN4QyxZQUFZLEdBQTJCLEVBQUUsQ0FBQztJQUMxQyxhQUFhLEdBQTJCLEVBQUUsQ0FBQztJQUMzQyxXQUFXLEdBQTJCLEVBQUUsQ0FBQztJQUN6QyxZQUFZLEdBQWtCLEVBQUUsQ0FBQztJQUV4QyxzRUFBc0U7SUFDdEUsWUFBNkIsUUFBMEM7UUFBMUMsYUFBUSxHQUFSLFFBQVEsQ0FBa0M7SUFBRyxDQUFDO0lBRTNFLHNHQUFzRztJQUM5RixNQUFNLENBQUMsT0FBMEIsRUFBRSxJQUFjLEVBQUUsR0FBVyxFQUFFLEtBQWM7UUFDcEYsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDL0IsT0FBTyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFDM0csQ0FBQztJQUVPLEtBQUssQ0FBQyxPQUEwQixFQUFFLEdBQVcsRUFBRSxLQUFjLEVBQUUsSUFBYyxFQUFFLE9BQWdCO1FBQ3JHLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDcEQsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixDQUFDO1FBQzNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7NEVBQ3dFO0lBQ3hFLEdBQUcsQ0FBQyxPQUEwQixFQUFFLEdBQVcsRUFBRSxLQUFjLEVBQUUsT0FBaUIsRUFBRTtRQUM5RSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRCxNQUFNLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ2pELElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDckMsQ0FBQztJQUVELE1BQU0sQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDakQsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVELFFBQVEsQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDbkQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQsU0FBUyxDQUFDLEdBQVcsRUFBRSxLQUFVLEVBQUUsT0FBaUIsRUFBRTtRQUNwRCxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxTQUFTLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ3BELElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFFRCxPQUFPLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ2xELElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVELE9BQU8sQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDbEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVELGNBQWMsQ0FBQyxXQUF3QjtRQUNyQyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxlQUFlLEVBQUUsRUFBRSxDQUFDO1lBQ3BDLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ3BDLE9BQU87UUFDVCxDQUFDO1FBQ0QsMkVBQTJFO1FBQzNFLHdFQUF3RTtRQUN4RSx1RUFBdUU7UUFDdkUsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLGNBQWMsRUFBRSxhQUFhLENBQUMsRUFBRSxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDbEcsTUFBTSxTQUFTLEdBQ2IsV0FBVyxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQ2pDLENBQUMsQ0FBQyxTQUFTO1lBQ1gsQ0FBQyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQyxjQUFjLEVBQUUsV0FBVyxDQUFDLEVBQUUsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksV0FBVyxLQUFLLFdBQVcsQ0FBQyxXQUFXLElBQUksU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNuRixJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN0QyxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxXQUFXLEVBQUUsV0FBVyxFQUFFLEdBQUcsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csQ0FBQztJQUNILENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRGlhZ25vc3RpY0NvbGxlY3RvciDigJQgUGVyLXN0YWdlIG1ldGFkYXRhIGNvbGxlY3RvclxuICpcbiAqIENvbGxlY3RzIG5vbi1leGVjdXRpb24gbWV0YWRhdGEgZHVyaW5nIGEgc3RhZ2UncyBydW46XG4gKiAtIGxvZ3MsIGVycm9ycywgbWV0cmljcywgZXZhbHMsIGZsb3dNZXNzYWdlc1xuICpcbiAqIExpa2UgYSBjb21waWxlcidzIGRpYWdub3N0aWMgY29sbGVjdG9yIOKAlCBnYXRoZXJzIHdhcm5pbmdzLCBlcnJvcnMsXG4gKiBhbmQgdGltaW5nIGluZm8gd2l0aG91dCBhZmZlY3RpbmcgdGhlIGNvbXBpbGF0aW9uIG91dHB1dC5cbiAqL1xuXG5pbXBvcnQgdHlwZSB7IFJlZGFjdGlvblJ1bGUgfSBmcm9tICcuL3JlZGFjdGlvbi5qcyc7XG5pbXBvcnQgdHlwZSB7IEZsb3dNZXNzYWdlIH0gZnJvbSAnLi90eXBlcy5qcyc7XG5pbXBvcnQgeyBzZXROZXN0ZWRWYWx1ZSwgdXBkYXRlTmVzdGVkVmFsdWUgfSBmcm9tICcuL3V0aWxzLmpzJztcblxuLyoqIEBpbnRlcm5hbCBEaWFnbm9zdGljIG5hbWVzcGFjZXMsIHNlcGFyYXRlIGZyb20gc3RhdGUgcGF0aHMuICovXG5leHBvcnQgdHlwZSBEaWFnbm9zdGljQ2hhbm5lbCA9ICdsb2dzJyB8ICdlcnJvcnMnIHwgJ21ldHJpY3MnIHwgJ2V2YWxzJztcblxuY29uc3QgQkFHX0ZJRUxEUyA9IHtcbiAgbG9nczogJ2xvZ0NvbnRleHQnLFxuICBlcnJvcnM6ICdlcnJvckNvbnRleHQnLFxuICBtZXRyaWNzOiAnbWV0cmljQ29udGV4dCcsXG4gIGV2YWxzOiAnZXZhbENvbnRleHQnLFxufSBhcyBjb25zdDtcblxuZXhwb3J0IGNsYXNzIERpYWdub3N0aWNDb2xsZWN0b3Ige1xuICBwdWJsaWMgbG9nQ29udGV4dDogeyBba2V5OiBzdHJpbmddOiBhbnkgfSA9IHt9O1xuICBwdWJsaWMgZXJyb3JDb250ZXh0OiB7IFtrZXk6IHN0cmluZ106IGFueSB9ID0ge307XG4gIHB1YmxpYyBtZXRyaWNDb250ZXh0OiB7IFtrZXk6IHN0cmluZ106IGFueSB9ID0ge307XG4gIHB1YmxpYyBldmFsQ29udGV4dDogeyBba2V5OiBzdHJpbmddOiBhbnkgfSA9IHt9O1xuICBwdWJsaWMgZmxvd01lc3NhZ2VzOiBGbG93TWVzc2FnZVtdID0gW107XG5cbiAgLyoqIFJlYWQgdGhlIGN1cnJlbnQgcnVuIHBvbGljeSwgaW5jbHVkaW5nIHBvbGljeSBzd2FwcyBhbmQgcmVzdW1lLiAqL1xuICBjb25zdHJ1Y3Rvcihwcml2YXRlIHJlYWRvbmx5IHJlYWRSdWxlPzogKCkgPT4gUmVkYWN0aW9uUnVsZSB8IHVuZGVmaW5lZCkge31cblxuICAvKiogQSBuYW1lZCBlbnRyeTogdGhlIHJ1bidzIHJ1bGUgbWFwcyBpdHMgbmFtZSB0byBhIHN0YXRlIGtleSwgdGhlbiBhZGRzIHRoZSBkaWFnbm9zdGljIHNlbGVjdG9ycy4gKi9cbiAgcHJpdmF0ZSByZXRhaW4oY2hhbm5lbDogRGlhZ25vc3RpY0NoYW5uZWwsIHBhdGg6IHN0cmluZ1tdLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24pOiB1bmtub3duIHtcbiAgICBjb25zdCBydWxlID0gdGhpcy5yZWFkUnVsZT8uKCk7XG4gICAgcmV0dXJuIHJ1bGUgJiYgIXJ1bGUuaXNEaWFnbm9zdGljSW5lcnQoKSA/IHJ1bGUucmV0YWluRGlhZ25vc3RpYyhbY2hhbm5lbCwgLi4ucGF0aCwga2V5XSwgdmFsdWUpIDogdmFsdWU7XG4gIH1cblxuICBwcml2YXRlIHdyaXRlKGNoYW5uZWw6IERpYWdub3N0aWNDaGFubmVsLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24sIHBhdGg6IHN0cmluZ1tdLCByZXBsYWNlOiBib29sZWFuKTogdW5rbm93biB7XG4gICAgY29uc3Qga2VwdCA9IHRoaXMucmV0YWluKGNoYW5uZWwsIHBhdGgsIGtleSwgdmFsdWUpO1xuICAgIGNvbnN0IHdyaXRlID0gcmVwbGFjZSA/IHNldE5lc3RlZFZhbHVlIDogdXBkYXRlTmVzdGVkVmFsdWU7XG4gICAgd3JpdGUodGhpc1tCQUdfRklFTERTW2NoYW5uZWxdXSwgJycsIHBhdGgsIGtleSwga2VwdCk7XG4gICAgcmV0dXJuIGtlcHQ7XG4gIH1cblxuICAvKiogQGludGVybmFsIEFkZCBvbmNlLCByZXR1cm5pbmcgdGhlIHJldGFpbmVkIGluY29taW5nIHZhbHVlIGZvciBlbWl0LlxuICAgKiBMZWdhY3kgd3JpdGVycyBzdGF5IHZvaWQ6IHRoZWlyIHJlc3VsdCBtYXkgYmUgcmV0dXJuZWQgYnkgYSBzdGFnZS4gKi9cbiAgYWRkKGNoYW5uZWw6IERpYWdub3N0aWNDaGFubmVsLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24sIHBhdGg6IHN0cmluZ1tdID0gW10pOiB1bmtub3duIHtcbiAgICByZXR1cm4gdGhpcy53cml0ZShjaGFubmVsLCBrZXksIHZhbHVlLCBwYXRoLCBmYWxzZSk7XG4gIH1cblxuICBhZGRMb2coa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnbG9ncycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0TG9nKGtleTogc3RyaW5nLCB2YWx1ZTogYW55LCBwYXRoOiBzdHJpbmdbXSA9IFtdKSB7XG4gICAgdGhpcy53cml0ZSgnbG9ncycsIGtleSwgdmFsdWUsIHBhdGgsIHRydWUpO1xuICB9XG5cbiAgYWRkRXJyb3Ioa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnZXJyb3JzJywga2V5LCB2YWx1ZSwgcGF0aCk7XG4gIH1cblxuICBhZGRNZXRyaWMoa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnbWV0cmljcycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0TWV0cmljKGtleTogc3RyaW5nLCB2YWx1ZTogYW55LCBwYXRoOiBzdHJpbmdbXSA9IFtdKSB7XG4gICAgdGhpcy53cml0ZSgnbWV0cmljcycsIGtleSwgdmFsdWUsIHBhdGgsIHRydWUpO1xuICB9XG5cbiAgYWRkRXZhbChrZXk6IHN0cmluZywgdmFsdWU6IGFueSwgcGF0aDogc3RyaW5nW10gPSBbXSkge1xuICAgIHRoaXMuYWRkKCdldmFscycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0RXZhbChrZXk6IHN0cmluZywgdmFsdWU6IGFueSwgcGF0aDogc3RyaW5nW10gPSBbXSkge1xuICAgIHRoaXMud3JpdGUoJ2V2YWxzJywga2V5LCB2YWx1ZSwgcGF0aCwgdHJ1ZSk7XG4gIH1cblxuICBhZGRGbG93TWVzc2FnZShmbG93TWVzc2FnZTogRmxvd01lc3NhZ2UpIHtcbiAgICBjb25zdCBydWxlID0gdGhpcy5yZWFkUnVsZT8uKCk7XG4gICAgaWYgKCFydWxlIHx8IHJ1bGUuaXNGbG93VGV4dEluZXJ0KCkpIHtcbiAgICAgIHRoaXMuZmxvd01lc3NhZ2VzLnB1c2goZmxvd01lc3NhZ2UpO1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICAvLyBPbmx5IHBheWxvYWQgdGV4dCBpcyBzZWxlY3RhYmxlIOKAlCBhbmQgaXQgaGFzIG5vIG5hbWUgb2YgaXRzIG93biwgc28gb25seVxuICAgIC8vIHRoZSBkaWFnbm9zdGljIHNlbGVjdG9ycyByZWFjaCBpdC4gS2VlcCB0aGUgZXZpZGVuY2Ugb2Ygd2hhdCBoYXBwZW5lZFxuICAgIC8vICh0eXBlLCB0YXJnZXRzLCB0aW1pbmcsIGNvdW50cykgZXZlbiB3aGVuIGl0cyBleHBsYW5hdGlvbiBpcyBtYXNrZWQuXG4gICAgY29uc3QgZGVzY3JpcHRpb24gPSBydWxlLnJldGFpbkZsb3dUZXh0KFsnZmxvd01lc3NhZ2VzJywgJ2Rlc2NyaXB0aW9uJ10sIGZsb3dNZXNzYWdlLmRlc2NyaXB0aW9uKTtcbiAgICBjb25zdCByYXRpb25hbGUgPVxuICAgICAgZmxvd01lc3NhZ2UucmF0aW9uYWxlID09PSB1bmRlZmluZWRcbiAgICAgICAgPyB1bmRlZmluZWRcbiAgICAgICAgOiBydWxlLnJldGFpbkZsb3dUZXh0KFsnZmxvd01lc3NhZ2VzJywgJ3JhdGlvbmFsZSddLCBmbG93TWVzc2FnZS5yYXRpb25hbGUpO1xuICAgIGlmIChkZXNjcmlwdGlvbiA9PT0gZmxvd01lc3NhZ2UuZGVzY3JpcHRpb24gJiYgcmF0aW9uYWxlID09PSBmbG93TWVzc2FnZS5yYXRpb25hbGUpIHtcbiAgICAgIHRoaXMuZmxvd01lc3NhZ2VzLnB1c2goZmxvd01lc3NhZ2UpO1xuICAgIH0gZWxzZSB7XG4gICAgICB0aGlzLmZsb3dNZXNzYWdlcy5wdXNoKHsgLi4uZmxvd01lc3NhZ2UsIGRlc2NyaXB0aW9uLCAuLi4ocmF0aW9uYWxlID09PSB1bmRlZmluZWQgPyB7fSA6IHsgcmF0aW9uYWxlIH0pIH0pO1xuICAgIH1cbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRGlhZ25vc3RpY0NvbGxlY3Rvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9saWIvbWVtb3J5L0RpYWdub3N0aWNDb2xsZWN0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7O0dBUUc7QUFJSCxPQUFPLEVBQUUsY0FBYyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBSy9ELE1BQU0sVUFBVSxHQUFHO0lBQ2pCLElBQUksRUFBRSxZQUFZO0lBQ2xCLE1BQU0sRUFBRSxjQUFjO0lBQ3RCLE9BQU8sRUFBRSxlQUFlO0lBQ3hCLEtBQUssRUFBRSxhQUFhO0NBQ1osQ0FBQztBQUVYLE1BQU0sT0FBTyxtQkFBbUI7SUFRRDtJQVB0QixVQUFVLEdBQTJCLEVBQUUsQ0FBQztJQUN4QyxZQUFZLEdBQTJCLEVBQUUsQ0FBQztJQUMxQyxhQUFhLEdBQTJCLEVBQUUsQ0FBQztJQUMzQyxXQUFXLEdBQTJCLEVBQUUsQ0FBQztJQUN6QyxZQUFZLEdBQWtCLEVBQUUsQ0FBQztJQUV4QyxzRUFBc0U7SUFDdEUsWUFBNkIsUUFBMEM7UUFBMUMsYUFBUSxHQUFSLFFBQVEsQ0FBa0M7SUFBRyxDQUFDO0lBRTNFLHNHQUFzRztJQUM5RixNQUFNLENBQUMsT0FBMEIsRUFBRSxJQUFjLEVBQUUsR0FBVyxFQUFFLEtBQWM7UUFDcEYsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDL0IsT0FBTyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFDM0csQ0FBQztJQUVPLEtBQUssQ0FBQyxPQUEwQixFQUFFLEdBQVcsRUFBRSxLQUFjLEVBQUUsSUFBYyxFQUFFLE9BQWdCO1FBQ3JHLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDcEQsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixDQUFDO1FBQzNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDdEQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7NEVBQ3dFO0lBQ3hFLEdBQUcsQ0FBQyxPQUEwQixFQUFFLEdBQVcsRUFBRSxLQUFjLEVBQUUsT0FBaUIsRUFBRTtRQUM5RSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRCxNQUFNLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ2pELElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDckMsQ0FBQztJQUVELE1BQU0sQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDakQsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVELFFBQVEsQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDbkQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQsU0FBUyxDQUFDLEdBQVcsRUFBRSxLQUFVLEVBQUUsT0FBaUIsRUFBRTtRQUNwRCxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxTQUFTLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ3BELElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFFRCxPQUFPLENBQUMsR0FBVyxFQUFFLEtBQVUsRUFBRSxPQUFpQixFQUFFO1FBQ2xELElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVELE9BQU8sQ0FBQyxHQUFXLEVBQUUsS0FBVSxFQUFFLE9BQWlCLEVBQUU7UUFDbEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVELGNBQWMsQ0FBQyxXQUF3QjtRQUNyQyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxlQUFlLEVBQUUsRUFBRSxDQUFDO1lBQ3BDLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ3BDLE9BQU87UUFDVCxDQUFDO1FBQ0QsMkVBQTJFO1FBQzNFLHdFQUF3RTtRQUN4RSx1RUFBdUU7UUFDdkUsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLGNBQWMsRUFBRSxhQUFhLENBQUMsRUFBRSxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDbEcsTUFBTSxTQUFTLEdBQ2IsV0FBVyxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQ2pDLENBQUMsQ0FBQyxTQUFTO1lBQ1gsQ0FBQyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQyxjQUFjLEVBQUUsV0FBVyxDQUFDLEVBQUUsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksV0FBVyxLQUFLLFdBQVcsQ0FBQyxXQUFXLElBQUksU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNuRixJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN0QyxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxXQUFXLEVBQUUsV0FBVyxFQUFFLEdBQUcsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csQ0FBQztJQUNILENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRGlhZ25vc3RpY0NvbGxlY3RvciDigJQgUGVyLXN0YWdlIG1ldGFkYXRhIGNvbGxlY3RvclxuICpcbiAqIENvbGxlY3RzIG5vbi1leGVjdXRpb24gbWV0YWRhdGEgZHVyaW5nIGEgc3RhZ2UncyBydW46XG4gKiAtIGxvZ3MsIGVycm9ycywgbWV0cmljcywgZXZhbHMsIGZsb3dNZXNzYWdlc1xuICpcbiAqIExpa2UgYSBjb21waWxlcidzIGRpYWdub3N0aWMgY29sbGVjdG9yIOKAlCBnYXRoZXJzIHdhcm5pbmdzLCBlcnJvcnMsXG4gKiBhbmQgdGltaW5nIGluZm8gd2l0aG91dCBhZmZlY3RpbmcgdGhlIGNvbXBpbGF0aW9uIG91dHB1dC5cbiAqL1xuXG5pbXBvcnQgdHlwZSB7IFJlZGFjdGlvblJ1bGUgfSBmcm9tICcuL3JlZGFjdGlvbi5qcyc7XG5pbXBvcnQgdHlwZSB7IEZsb3dNZXNzYWdlIH0gZnJvbSAnLi90eXBlcy5qcyc7XG5pbXBvcnQgeyBzZXROZXN0ZWRWYWx1ZSwgdXBkYXRlTmVzdGVkVmFsdWUgfSBmcm9tICcuL3V0aWxzLmpzJztcblxuLyoqIEBpbnRlcm5hbCBEaWFnbm9zdGljIG5hbWVzcGFjZXMsIHNlcGFyYXRlIGZyb20gc3RhdGUgcGF0aHMuICovXG5leHBvcnQgdHlwZSBEaWFnbm9zdGljQ2hhbm5lbCA9ICdsb2dzJyB8ICdlcnJvcnMnIHwgJ21ldHJpY3MnIHwgJ2V2YWxzJztcblxuY29uc3QgQkFHX0ZJRUxEUyA9IHtcbiAgbG9nczogJ2xvZ0NvbnRleHQnLFxuICBlcnJvcnM6ICdlcnJvckNvbnRleHQnLFxuICBtZXRyaWNzOiAnbWV0cmljQ29udGV4dCcsXG4gIGV2YWxzOiAnZXZhbENvbnRleHQnLFxufSBhcyBjb25zdDtcblxuZXhwb3J0IGNsYXNzIERpYWdub3N0aWNDb2xsZWN0b3Ige1xuICBwdWJsaWMgbG9nQ29udGV4dDogeyBba2V5OiBzdHJpbmddOiBhbnkgfSA9IHt9O1xuICBwdWJsaWMgZXJyb3JDb250ZXh0OiB7IFtrZXk6IHN0cmluZ106IGFueSB9ID0ge307XG4gIHB1YmxpYyBtZXRyaWNDb250ZXh0OiB7IFtrZXk6IHN0cmluZ106IGFueSB9ID0ge307XG4gIHB1YmxpYyBldmFsQ29udGV4dDogeyBba2V5OiBzdHJpbmddOiBhbnkgfSA9IHt9O1xuICBwdWJsaWMgZmxvd01lc3NhZ2VzOiBGbG93TWVzc2FnZVtdID0gW107XG5cbiAgLyoqIFJlYWQgdGhlIGN1cnJlbnQgcnVuIHBvbGljeSwgaW5jbHVkaW5nIHBvbGljeSBzd2FwcyBhbmQgcmVzdW1lLiAqL1xuICBjb25zdHJ1Y3Rvcihwcml2YXRlIHJlYWRvbmx5IHJlYWRSdWxlPzogKCkgPT4gUmVkYWN0aW9uUnVsZSB8IHVuZGVmaW5lZCkge31cblxuICAvKiogQSBuYW1lZCBlbnRyeTogdGhlIHJ1bidzIHJ1bGUgbWFwcyBpdHMgbmFtZSB0byBhIHN0YXRlIGtleSwgdGhlbiBhZGRzIHRoZSBkaWFnbm9zdGljIHNlbGVjdG9ycy4gKi9cbiAgcHJpdmF0ZSByZXRhaW4oY2hhbm5lbDogRGlhZ25vc3RpY0NoYW5uZWwsIHBhdGg6IHN0cmluZ1tdLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24pOiB1bmtub3duIHtcbiAgICBjb25zdCBydWxlID0gdGhpcy5yZWFkUnVsZT8uKCk7XG4gICAgcmV0dXJuIHJ1bGUgJiYgIXJ1bGUuaXNEaWFnbm9zdGljSW5lcnQoKSA/IHJ1bGUucmV0YWluRGlhZ25vc3RpYyhbY2hhbm5lbCwgLi4ucGF0aCwga2V5XSwgdmFsdWUpIDogdmFsdWU7XG4gIH1cblxuICBwcml2YXRlIHdyaXRlKGNoYW5uZWw6IERpYWdub3N0aWNDaGFubmVsLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24sIHBhdGg6IHN0cmluZ1tdLCByZXBsYWNlOiBib29sZWFuKTogdW5rbm93biB7XG4gICAgY29uc3Qga2VwdCA9IHRoaXMucmV0YWluKGNoYW5uZWwsIHBhdGgsIGtleSwgdmFsdWUpO1xuICAgIGNvbnN0IHdyaXRlID0gcmVwbGFjZSA/IHNldE5lc3RlZFZhbHVlIDogdXBkYXRlTmVzdGVkVmFsdWU7XG4gICAgd3JpdGUodGhpc1tCQUdfRklFTERTW2NoYW5uZWxdXSwgW10sIHBhdGgsIGtleSwga2VwdCk7XG4gICAgcmV0dXJuIGtlcHQ7XG4gIH1cblxuICAvKiogQGludGVybmFsIEFkZCBvbmNlLCByZXR1cm5pbmcgdGhlIHJldGFpbmVkIGluY29taW5nIHZhbHVlIGZvciBlbWl0LlxuICAgKiBMZWdhY3kgd3JpdGVycyBzdGF5IHZvaWQ6IHRoZWlyIHJlc3VsdCBtYXkgYmUgcmV0dXJuZWQgYnkgYSBzdGFnZS4gKi9cbiAgYWRkKGNoYW5uZWw6IERpYWdub3N0aWNDaGFubmVsLCBrZXk6IHN0cmluZywgdmFsdWU6IHVua25vd24sIHBhdGg6IHN0cmluZ1tdID0gW10pOiB1bmtub3duIHtcbiAgICByZXR1cm4gdGhpcy53cml0ZShjaGFubmVsLCBrZXksIHZhbHVlLCBwYXRoLCBmYWxzZSk7XG4gIH1cblxuICBhZGRMb2coa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnbG9ncycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0TG9nKGtleTogc3RyaW5nLCB2YWx1ZTogYW55LCBwYXRoOiBzdHJpbmdbXSA9IFtdKSB7XG4gICAgdGhpcy53cml0ZSgnbG9ncycsIGtleSwgdmFsdWUsIHBhdGgsIHRydWUpO1xuICB9XG5cbiAgYWRkRXJyb3Ioa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnZXJyb3JzJywga2V5LCB2YWx1ZSwgcGF0aCk7XG4gIH1cblxuICBhZGRNZXRyaWMoa2V5OiBzdHJpbmcsIHZhbHVlOiBhbnksIHBhdGg6IHN0cmluZ1tdID0gW10pIHtcbiAgICB0aGlzLmFkZCgnbWV0cmljcycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0TWV0cmljKGtleTogc3RyaW5nLCB2YWx1ZTogYW55LCBwYXRoOiBzdHJpbmdbXSA9IFtdKSB7XG4gICAgdGhpcy53cml0ZSgnbWV0cmljcycsIGtleSwgdmFsdWUsIHBhdGgsIHRydWUpO1xuICB9XG5cbiAgYWRkRXZhbChrZXk6IHN0cmluZywgdmFsdWU6IGFueSwgcGF0aDogc3RyaW5nW10gPSBbXSkge1xuICAgIHRoaXMuYWRkKCdldmFscycsIGtleSwgdmFsdWUsIHBhdGgpO1xuICB9XG5cbiAgc2V0RXZhbChrZXk6IHN0cmluZywgdmFsdWU6IGFueSwgcGF0aDogc3RyaW5nW10gPSBbXSkge1xuICAgIHRoaXMud3JpdGUoJ2V2YWxzJywga2V5LCB2YWx1ZSwgcGF0aCwgdHJ1ZSk7XG4gIH1cblxuICBhZGRGbG93TWVzc2FnZShmbG93TWVzc2FnZTogRmxvd01lc3NhZ2UpIHtcbiAgICBjb25zdCBydWxlID0gdGhpcy5yZWFkUnVsZT8uKCk7XG4gICAgaWYgKCFydWxlIHx8IHJ1bGUuaXNGbG93VGV4dEluZXJ0KCkpIHtcbiAgICAgIHRoaXMuZmxvd01lc3NhZ2VzLnB1c2goZmxvd01lc3NhZ2UpO1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICAvLyBPbmx5IHBheWxvYWQgdGV4dCBpcyBzZWxlY3RhYmxlIOKAlCBhbmQgaXQgaGFzIG5vIG5hbWUgb2YgaXRzIG93biwgc28gb25seVxuICAgIC8vIHRoZSBkaWFnbm9zdGljIHNlbGVjdG9ycyByZWFjaCBpdC4gS2VlcCB0aGUgZXZpZGVuY2Ugb2Ygd2hhdCBoYXBwZW5lZFxuICAgIC8vICh0eXBlLCB0YXJnZXRzLCB0aW1pbmcsIGNvdW50cykgZXZlbiB3aGVuIGl0cyBleHBsYW5hdGlvbiBpcyBtYXNrZWQuXG4gICAgY29uc3QgZGVzY3JpcHRpb24gPSBydWxlLnJldGFpbkZsb3dUZXh0KFsnZmxvd01lc3NhZ2VzJywgJ2Rlc2NyaXB0aW9uJ10sIGZsb3dNZXNzYWdlLmRlc2NyaXB0aW9uKTtcbiAgICBjb25zdCByYXRpb25hbGUgPVxuICAgICAgZmxvd01lc3NhZ2UucmF0aW9uYWxlID09PSB1bmRlZmluZWRcbiAgICAgICAgPyB1bmRlZmluZWRcbiAgICAgICAgOiBydWxlLnJldGFpbkZsb3dUZXh0KFsnZmxvd01lc3NhZ2VzJywgJ3JhdGlvbmFsZSddLCBmbG93TWVzc2FnZS5yYXRpb25hbGUpO1xuICAgIGlmIChkZXNjcmlwdGlvbiA9PT0gZmxvd01lc3NhZ2UuZGVzY3JpcHRpb24gJiYgcmF0aW9uYWxlID09PSBmbG93TWVzc2FnZS5yYXRpb25hbGUpIHtcbiAgICAgIHRoaXMuZmxvd01lc3NhZ2VzLnB1c2goZmxvd01lc3NhZ2UpO1xuICAgIH0gZWxzZSB7XG4gICAgICB0aGlzLmZsb3dNZXNzYWdlcy5wdXNoKHsgLi4uZmxvd01lc3NhZ2UsIGRlc2NyaXB0aW9uLCAuLi4ocmF0aW9uYWxlID09PSB1bmRlZmluZWQgPyB7fSA6IHsgcmF0aW9uYWxlIH0pIH0pO1xuICAgIH1cbiAgfVxufVxuIl19

package/dist/esm/lib/memory/RecordFrame.d.ts

@@ -0,0 +1,197 @@
+/**
+ * RecordFrame — the record half of one stage's frame (C3, L3).
+ *
+ * What a stage's frame needs to READ and WRITE the record, and nothing about the stage inside a run:
+ * where it writes (its address), what it read first (the first-touch base), what it staged (the lazy
+ * transaction buffer), which keys it read (the readKeys list), and where a commit lands (live state,
+ * the redacted mirror, the log — through `recordCommit`). The engine's frame (`StageContext`, L4)
+ * composes one and keeps the rest: retention, diagnostics, the dev-mode warnings, the commit observer
+ * and the redaction verdict.
+ *
+ * THE LAW:
+ *   1. ADDRESS. The frame reads and writes at its address, a path prefix the engine computed and hands
+ *      over as data (C2: `['runs', <id>]` or `[]`, the root). It moves only before the first write:
+ *      the buffer keeps the address it was built at (the engine refuses a later move).
+ *   2. FIRST TOUCH. The committed generation the frame first touched — its first read OR first write —
+ *      is held by reference, never cloned: the read view before the first write and the buffer's
+ *      net-change diff base after it.
+ *   3. TWO TIERS. A read is served from the stage's own view (the buffer's working copy once the stage
+ *      wrote, else the first-touch base); a key absent there is served from LIVE state (at the
+ *      address, then the root). After the first write the buffer's diff base is first given a private
+ *      copy at that path (`TransactionBuffer · detachBase`).
+ *   4. LAZY BUFFER. The buffer is built at the first write — on the first-touch base, at the address,
+ *      under the encoding. A frame that never writes builds none, and its commit is the empty bundle.
+ *   5. READ KEYS. Under `writeProvenance: 'reads-prefix'` every noted read puts its user-level key
+ *      (dotted for a nested path) on the frame's list, once, in order; each staged row carries a copy
+ *      of the list as it stands when the row is staged.
+ *   6. COMMIT, RELEASE, DISCARD. `commit` takes the buffer's payload (none = the empty commit), then
+ *      the names, and hands both to `recordCommit`. `release` drops the buffer and the base; a frame
+ *      touched again re-anchors on the state as it stands then. The readKeys list survives a release,
+ *      and goes with `discard` (a failed attempt never happened).
+ */
+import type { EventLog } from './EventLog.js';
+import { type CommitStamp } from './recordCommit.js';
+import type { SharedMemory } from './SharedMemory.js';
+import { TransactionBuffer } from './TransactionBuffer.js';
+import type { CommitValuesMode, WriteProvenanceMode } from './types.js';
+/**
+ * The two dials that shape a frame's bytes: the log's value encoding and the per-row read prefix.
+ * Held by reference and swapped whole (`useEncoding`), never edited — the engine hands the run's
+ * frozen policy itself. Absent: `'full'` values and no read prefix.
+ */
+export interface RecordEncoding {
+    readonly commitValues: CommitValuesMode;
+    readonly writeProvenance: WriteProvenanceMode;
+}
+export declare class RecordFrame {
+    /** Live committed state — the heap every frame of the run shares. */
+    readonly state: SharedMemory;
+    /** The log the frame's commits land on, when the run keeps one. */
+    readonly log?: EventLog;
+    /** The redacted mirror the frame's commits land on, when the run keeps one ({@link useMirror}). */
+    private _mirror?;
+    /** Where the frame reads and writes (law 1). */
+    private _address;
+    /** The two dials (law 4, 5); absent → the record's defaults. */
+    private encoding?;
+    /**
+     * The committed generation at the frame's FIRST touch (law 2) — held by REFERENCE, never cloned.
+     * See {@link firstTouch} for the algorithm and the immutability invariant that makes a bare
+     * reference safe.
+     */
+    private base?;
+    /** The stage's staged writes — built at its first write (law 4), released at commit. */
+    private buffer?;
+    /**
+     * Keys tracked-read so far, in order (law 5) — the source of each staged row's `readKeys`. Only
+     * allocated under `'reads-prefix'`; insertion-ordered (a Set) and monotonic, which is what makes
+     * "last write's prefix == union" hold in delta mode.
+     */
+    private readKeys?;
+    constructor(state: SharedMemory, log?: EventLog, address?: readonly string[]);
+    /** Where the frame reads and writes (law 1). */
+    get address(): readonly string[];
+    /**
+     * Read and write at `address` from now on — before the frame's first write (law 1): the buffer keeps
+     * the address it was built at. The engine's one caller, `StageContext · useAddressOf`, refuses a move
+     * once the frame has staged.
+     */
+    useAddress(address: readonly string[]): void;
+    /** The two dials the frame encodes under from its next buffer and its next read on (law 4, 5). */
+    useEncoding(encoding: RecordEncoding): void;
+    /** The redacted mirror, if the run keeps one. */
+    get mirror(): SharedMemory | undefined;
+    /** Land every commit from now on on `mirror` too, with the scrubbed rows the log takes (`recordCommit`). */
+    useMirror(mirror: SharedMemory | undefined): void;
+    /** The absolute path of `key` under `path`: the frame's address, then the path, then the key. */
+    at(path: readonly string[], key: string): string[];
+    /**
+     * ── The first-touch base (#13) ───────────────────────────────────────────
+     *
+     * WHAT: returns the committed shared state as it was at this frame's FIRST touch (first read or
+     * first write), capturing the reference on first call. Serves two consumers: reads before the first
+     * write ({@link read}) and the transaction buffer's diff base ({@link getTransactionBuffer}).
+     *
+     * WHY A BARE REFERENCE IS SAFE — the invariant this rests on: committed state is
+     * immutable-after-swap. Every write to `SharedMemory` builds the NEXT generation and swaps it in
+     * (copy-on-write, 9.29.0: `applyPatch` via `nextGeneration`, and `setValue`/`updateValue` too) — it
+     * copies the root and the containers on each written path, shares the rest, and never edits a
+     * container of the generation a stage captured here. Holding the reference therefore gives this
+     * stage a stable snapshot at zero cost — no clone, which is the entire point of #13. The transaction
+     * buffer's net-change diff base rests on the same guarantee: it IS this view.
+     *
+     * WHY FIRST TOUCH, not first write: the pre-#13 eager engine cloned the state into the buffer at
+     * the stage's first ACCESS, anchoring both its snapshot reads and its commit baseline (the
+     * net-change diff base) there. #13's first cut anchored the lazy buffer at first WRITE — observably
+     * different when something else commits in the gap between this stage's first read and its first
+     * write. That gap is REACHABLE: fork siblings are namespace-isolated for run-scoped keys (each child
+     * writes under `runs/<childId>/`), but ROOT-level keys are shared — written via `setGlobal` from
+     * consumer scope code and, critically, by `SubflowInputMapper`'s output mapping
+     * (`parentContext.setGlobal`), which is exactly what runs when a subflow is a fork branch. A
+     * sibling's root-key commit landing in the gap would shift this stage's diff base, making its
+     * CommitBundle record a phantom change (or swallow a real one) relative to the eager engine.
+     * Anchoring the view at first touch restores the EXACT eager semantics — sequential AND parallel —
+     * at zero clone cost.
+     *
+     * Read visibility is two-tier, matching eager byte-for-byte: keys present in the view at first
+     * touch read repeatably from it; keys ABSENT from it fall back to LIVE state (the eager engine's
+     * exact fallback — a mid-flight sibling root-key write was always visible to reads, and stays
+     * visible; only the DIFF BASE is pinned).
+     */
+    private firstTouch;
+    /**
+     * The transaction buffer, created lazily on the frame's FIRST WRITE (#13).
+     *
+     * Reads NEVER construct it: read-your-writes only matters once a staged write exists, so before that
+     * {@link read} serves from the first-touch base and {@link commit} records an empty bundle — all with
+     * ZERO `structuredClone`s of the shared state.
+     *
+     * The buffer's base is the FIRST-TOUCH view, NOT the live state at write time: under parallel forks
+     * a sibling may have committed between this frame's first read and this write, and the net-change
+     * diff base must stay anchored at first touch to match the eager engine — see {@link firstTouch}.
+     */
+    getTransactionBuffer(): TransactionBuffer;
+    /** Has the frame staged a write since its last release — does its buffer exist? */
+    get hasStaged(): boolean;
+    /**
+     * The frame's read, mirroring the eager engine's read order byte-for-byte (law 3):
+     *
+     *    1. staged writes + first-touch snapshot — `buffer.get` over its workingCopy when the buffer
+     *       exists, else `nativeGet` over the zero-clone first-touch base (the buffer's base IS that
+     *       view, so the two tiers agree on content);
+     *    2. LIVE state via `SharedMemory · getValue` for keys absent from the snapshot — including its
+     *       address→root fallback. The eager engine had this exact live fallback for snapshot-missing
+     *       keys; byte-identity over purity. After the frame's first write such a value can be the very
+     *       container the buffer's diff base holds at the path (the stage deleted or unset it, or
+     *       replaced a container above it), so the base is detached there first
+     *       (`TransactionBuffer · detachBase`): an in-place edit of the value (out of contract) written
+     *       back is recorded, as on 9.28.0, whose base was a clone taken at the first write.
+     *
+     * Reads never construct the buffer (#13): a frame that never writes performs zero clones of the
+     * shared state.
+     */
+    read(path: string[], key?: string): unknown;
+    /** Put a tracked read's user-level key on the readKeys list (law 5) — a no-op unless the frame keeps one. */
+    noteRead(path: readonly string[], key: string): void;
+    /**
+     * Live committed state at `key`: at the frame's address, else at the root — never the stage's own
+     * view. Typed as `SharedMemory · getValue` types it, which `StageContext · getRoot` hands on.
+     */
+    readLive(key: string): any;
+    /** Live committed state at `key` at the root — typed as `SharedMemory · getValue` (`StageContext · getGlobal`). */
+    readGlobal(key: string): any;
+    /** Did a staged op touch `path` — on it, above it or below it? (A report's question; never the hot path.) */
+    wasStaged(path: (string | number)[]): boolean;
+    /**
+     * The value at `path` in what the stage has seen — its working copy once it wrote, else its
+     * first-touch base — WITHOUT taking a private copy: for a report that only compares.
+     */
+    peek(path: (string | number)[]): unknown;
+    /** The value at `path` in the first-touch base — committed state as the frame first touched it. */
+    baseAt(path: (string | number)[]): unknown;
+    /**
+     * Record what the frame staged (law 6): the buffer's payload first — none, the empty commit, when
+     * it staged nothing (#13: zero clones) — then the names (`stampOf()`), read once the payload is
+     * built, and both to `recordCommit`. User code can run while the payload is built (a getter on a
+     * staged value, which the net-change compare and the clone invoke); what it adds to the names —
+     * an untracked read, say — is on the bundle.
+     */
+    commit(stampOf: () => CommitStamp): void;
+    /**
+     * End the frame's hold on state (#13b, law 6): drop the buffer (its working copy and whatever private
+     * copies its reads took) and the first-touch base (a reference that pins one committed-state
+     * GENERATION). Both re-create lazily: a later read re-anchors on the CURRENT committed state, and a
+     * later write builds a fresh buffer on it — so a second commit diffs against the state after the
+     * first. Without the release, the execution tree — which retains every frame for the lifetime of
+     * the run — retains one state generation per executed stage (measured O(N²) before copy-on-write;
+     * a 500-iteration agent OOMed a default Node heap, backlog #18).
+     */
+    release(): void;
+    /**
+     * Throw away everything the frame staged and read (law 6): the buffer, the first-touch base (the next
+     * attempt re-anchors on committed state as it stands NOW) and the readKeys list — a discarded
+     * attempt's reads must never reach the next attempt's `TraceEntry.readKeys`, or a backward slice
+     * would follow an edge that no committed write ever had. Nothing is recorded.
+     */
+    discard(): void;
+}