foottrace 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-present Sanjay Krishna Anbalagan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,74 @@
-# Temporary Holding Version
+# foottrace
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Execution records and the tools to read them: replay, time travel, slices, and evidence about where values came from. No flowchart engine, AI provider, or runtime dependency is required.
+
+This package extracts FootPrint's established record layer. It does not introduce a second writer or a different replay law. The first release preserves the frozen record fixtures from footprintjs 9.48.1 and includes the coordinated 9.48.2 copy-safety correction: an own `__proto__` payload field stays data, never the copy's prototype. See the [changelog](CHANGELOG.md) for the limited rich-value behavior change.
+
+**Release status:** extraction candidate. Version 1.0.0 is not ready to publish until review and release checks are complete.
+
+## Three entry points
+
+| Import | Responsibility |
+| --- | --- |
+| `foottrace` | Record types, runtime IDs, replay, time-travel cursors, causal and variable slices, honesty codes |
+| `foottrace/write` | `SharedMemory`, `EventLog`, `RecordFrame`, encoding and write types, writer-owned freezing |
+| `foottrace/paths` | Record-path encoding/decoding, nested access and safe diagnostic writes |
+
+Every declaration has one public entry point. There are no public deep imports or `/testing` entry point. FootPrint's engine, observer channels, recorders and stores remain in `footprintjs`.
+
+## Write and replay
+
+```ts
+import { stateAt } from 'foottrace';
+import { EventLog, RecordFrame, SharedMemory } from 'foottrace/write';
+
+const state = new SharedMemory(undefined, { count: 0 });
+const log = new EventLog(state.getState());
+const frame = new RecordFrame(state, log);
+frame.useEncoding({ commitValues: 'full', writeProvenance: 'reads-prefix' });
+const count = frame.read([], 'count') as number;
+frame.noteRead([], 'count');
+frame.write(frame.at([], 'count'), count + 1, 'set');
+frame.commit(() => ({
+  stage: 'Increment', stageId: 'increment', runtimeStageId: 'increment#0',
+}));
+frame.release();
+
+const result = stateAt({ initialState: log.getInitialState(), commitLog: log.list() }, 0);
+console.log(result.state); // { count: 1 }
+```
+
+Writers record during execution. Readers query what was recorded; they do not reconstruct missing events or infer certainty from absent evidence. A slice can be conservative or incomplete: retain its honesty codes when presenting it to a person or a model.
+
+See the [record contract](docs/guides/record-contract.md), [time-travel contract](src/lib/time-travel/README.md), and [slice contract](src/lib/slice/README.md).
+
+## Paths are not interchangeable
+
+- `idPathSegments` (root entry) splits runtime IDs on `/` and drops empty segments. `isExecutionKey` detects `#`; it is not a complete validator.
+- `pathSegments` and `normaliseStateKey` (`/paths`) decode/encode record paths with the existing unit-separator codec. Empty segments and literal dots are preserved.
+- `nativeGet` and `nativeHas` accept dot-selector strings or literal segment arrays. Use arrays for literal dotted keys.
+- `nativeHas` recognizes own properties, including an own `undefined` and dangerous-name data keys. `nativeGet` refuses dangerous segments and returns its default for `undefined`.
+- `setNestedValue` and `updateNestedValue` refuse `__proto__`, `constructor`, or `prototype` anywhere in the target address before making any write. Refusal is a silent no-op, as in 9.48.1. Payload keys are data and are not filtered. Updates retain the existing shallow object merge and duplicate-preserving array concatenation; empty arrays replace. These helpers are not the record replay merge law.
+
+## Ownership and equality
+
+`freezeRecord` (`/write`) operates on **writer-owned** data in place and registers mutable built-in values for safe serving. It can replace a sliced buffer view. Do not pass an object whose ownership belongs to a caller. `serveRecord` (root entry) uses that registration to serve protected copies; it does not secure an arbitrary unregistered object. The entries share one freezing module within each module format.
+
+`deepFreeze` (`/write`) is ordinary object freezing, not full immutability of Date/Map internals, and it does not descend through an already frozen object. Do not substitute it for `freezeRecord`.
+
+`deepEqual` is the record's equality rule, not general-purpose deep equality: absent and own-undefined properties can compare equal, signed zero compares equal, array expando properties are ignored, and Map object keys use identity. The `'copies'` option treats opaque values of the same kind as equivalent. Preserve these distinctions when using it for change detection.
+
+## Compatibility and development
+
+Node.js 22 or newer; develop with Node.js 24 and npm 11. Both CommonJS and ESM are provided. Browser-capable source uses no Node runtime APIs. Use one module format consistently in an application; CJS and ESM have separate module instances.
+
+```sh
+npm ci
+npm run check
+```
+
+No engine is installed in this package's test environment. Engine integration and the original flowchart byte fixtures are checked separately in FootPrint. Runtime dependencies remain empty. The original file history was retained with `git filter-repo`; see [extraction evidence](docs/extraction.md).
+
+Record bytes are part of the versioning promise: refactors never re-pin; a named law fix requires a documented minor release; any other byte change requires a major. See the [fixture policy](test/fixtures/README.md).
+
+MIT license. Contact: sanjay@footprintjs.dev.

package/dist/esm/index.d.ts

@@ -0,0 +1,27 @@
+/** Read a recorded execution: replay, time travel, slicing and attribution. */
+export type { CommitIdx, ExecutionCounter, ExecutionIndex, RuntimeStageId } from './lib/ids/runtimeStageId.js';
+export { buildRuntimeStageId, createExecutionCounter, parseRuntimeStageId, splitStageId, } from './lib/ids/runtimeStageId.js';
+export { UnknownVerbError } from './lib/memory/verbs.js';
+export type { CommitBundle, MemoryPatch, TraceEntry } from './lib/memory/types.js';
+export type { ExecutionTree } from './lib/memory/types.js';
+export { applySmartMerge } from './lib/memory/verbs.js';
+export type { ValueBasis, ValueBasisOptions, ValueWithBasis, WriterBasis, WriterWithBasis, } from './lib/memory/commitLogUtils.js';
+export { buildCommitIndex, commitIndexOf, commitValueAt, commitValueAtWithBasis, findCommit, findCommits, findLastWriter, findLastWriterWithBasis, inferLegacyPhases, recordsPhases, } from './lib/memory/commitLogUtils.js';
+export type { CommitPhase } from './lib/memory/types.js';
+export type { AxisRefusal, AxisSplit, BookendedAxis, FoldBasis, FoldedState, FoldSource, LogGap, Mark, Move, MoveRefusal, Stop, StopFilter, StopKind, TimeTravel, TimeTravelOptions, TimeTravelSource, TimeTravelStrategy, } from './lib/time-travel/index.js';
+export { commitStops, commitStopsStrategy, filterStops, isCommitBundle, splitAxis, stateAt, tagStops, timeTravel, } from './lib/time-travel/index.js';
+export type { CausalChainOptions, CausalEdge, CausalNode, ControlDependency, ControlDepLookup, EdgeWeigher, KeysReadLookup, } from './lib/memory/backtrack.js';
+export { causalChain, flattenCausalDAG, formatCausalChain } from './lib/memory/backtrack.js';
+export type { UntrackedSource } from './lib/memory/types.js';
+export type { ArrayProvenance, AttributionBasis, ElementBirth, FedBasis, ForwardEdge, ForwardNode, ForwardRead, ForwardSlice, ForwardSliceJSON, HonestyNote, HonestyNoteCode, KeyMoment, KeysReadSource, KeyTimeline, MissingProvenanceReason, MissingSliceReason, ReadsCoverage, SliceJSON, StateKey, VariableSlice, } from './lib/slice/index.js';
+export type { ForwardSliceForKeyOptions, KeyTimelineOptions, SliceForKeyOptions } from './lib/slice/index.js';
+export { arrayProvenance, elementProvenance, formatForwardSlice, formatSlice, formatTimeline, forwardSliceForKey, forwardSliceToJSON, keysReadFromExecutionTree, keysReadFromMap, keyTimeline, resolveKeysReadSource, sliceForKey, sliceToJSON, } from './lib/slice/index.js';
+export type { HonestyCode } from './lib/memory/honesty.js';
+export { HONESTY_CODES } from './lib/memory/honesty.js';
+export type { RangeEntry, RangeToken } from './lib/recorder/CommitRangeIndex.js';
+export { CommitRangeIndex } from './lib/recorder/CommitRangeIndex.js';
+export type { CommitValuesMode } from './lib/memory/types.js';
+export type { EmitSourcePosition, LogAddress } from './lib/memory/eventPosition.js';
+export { EXECUTION_DELIMITER, PATH_DELIMITER, isExecutionKey, joinPath, pathSegments as idPathSegments, stageIdOf, subflowSegmentsOf, } from './lib/ids/runtimeStageId.js';
+export { deepEqual } from './lib/memory/equality.js';
+export { serveRecord } from './lib/capture/freeze.js';

package/dist/esm/index.js

@@ -0,0 +1,12 @@
+export { buildRuntimeStageId, createExecutionCounter, parseRuntimeStageId, splitStageId, } from './lib/ids/runtimeStageId.js';
+export { UnknownVerbError } from './lib/memory/verbs.js';
+export { applySmartMerge } from './lib/memory/verbs.js';
+export { buildCommitIndex, commitIndexOf, commitValueAt, commitValueAtWithBasis, findCommit, findCommits, findLastWriter, findLastWriterWithBasis, inferLegacyPhases, recordsPhases, } from './lib/memory/commitLogUtils.js';
+export { commitStops, commitStopsStrategy, filterStops, isCommitBundle, splitAxis, stateAt, tagStops, timeTravel, } from './lib/time-travel/index.js';
+export { causalChain, flattenCausalDAG, formatCausalChain } from './lib/memory/backtrack.js';
+export { arrayProvenance, elementProvenance, formatForwardSlice, formatSlice, formatTimeline, forwardSliceForKey, forwardSliceToJSON, keysReadFromExecutionTree, keysReadFromMap, keyTimeline, resolveKeysReadSource, sliceForKey, sliceToJSON, } from './lib/slice/index.js';
+export { HONESTY_CODES } from './lib/memory/honesty.js';
+export { CommitRangeIndex } from './lib/recorder/CommitRangeIndex.js';
+export { EXECUTION_DELIMITER, PATH_DELIMITER, isExecutionKey, joinPath, pathSegments as idPathSegments, stageIdOf, subflowSegmentsOf, } from './lib/ids/runtimeStageId.js';
+export { deepEqual } from './lib/memory/equality.js';
+export { serveRecord } from './lib/capture/freeze.js';

package/dist/esm/lib/capture/freeze.d.ts

@@ -0,0 +1,91 @@
+/**
+ * freeze.ts — the ONE deep-freeze walk (moved here from `scope/protection/readonlyInput.ts` in F3),
+ * and the serve-time law for the commit log (9.44.2).
+ *
+ * WHY HERE. Saved trees freeze through this walk: the fold base served as
+ * `initialState` (`ExecutionRuntime · getFoldBase`), the
+ * dev-mode snapshot (`runner/snapshot.ts · servedSnapshot`), every state `stateAt` hands out
+ * (`time-travel/stateAt.ts`) and, since F3, every commit bundle (`EventLog · record`). `memory/` must
+ * not import `scope/` (that edge closed the memory ⇄ scope ⇄ recorder module cycle F0 removed), so the
+ * walk lives in this leaf folder, which imports nothing outside itself. Args use an ownership snapshot
+ * instead (`scope/protection/readonlyInput.ts · createFrozenArgs`): never freeze borrowed caller values.
+ *
+ * FREEZE WHAT CAN BE FROZEN, COPY WHAT CAN'T (9.44.2). `Object.freeze` cannot seal a Date's time, a
+ * Map's or Set's entries, a buffer's bytes, a RegExp (`compile()` rewrites a frozen one) or an Error
+ * (V8's own `stack` accessor writes through a frozen one). A fresh tree handed to one caller (a `stateAt`
+ * state, the dev-mode snapshot) is that caller's own, so freezing it is a guard and nothing more. The
+ * COMMIT LOG — each bundle, and the fold base — is served to every reader, so {@link freezeRecord}
+ * remembers that a record holds such a value, its first serve maps the containers on the way to each
+ * one (its open PATHS), and {@link serveRecord} hands a reader a copy of those paths only: a fresh copy
+ * of each such value, fresh frozen containers on the way to it, and every other part shared, frozen, as
+ * it is. Until 9.44.2 `snapshot.commitLog[i].overwrite.when.setTime(0)` rewrote every later snapshot,
+ * `stateAt`, `commitValueAt`, slice and cursor answer.
+ *
+ * Every walk here is ITERATIVE (an explicit stack): a record's depth is not bounded by the call stack.
+ *
+ * @example
+ * ```typescript
+ * import { deepFreeze, freezeRecord, serveRecord } from './freeze.js';
+ *
+ * const args = deepFreeze({ order: { lines: [{ sku: 'A' }] }, bytes: new Uint8Array([1]) });
+ * Object.isFrozen(args.order.lines[0]); // true
+ * Object.isFrozen(args.bytes); // false — a typed array cannot be frozen; it is skipped
+ *
+ * const record = freezeRecord({ when: new Date(0), tags: ['a'] });
+ * const served = serveRecord(record);
+ * served.when.setTime(5); // changes the reader's copy
+ * serveRecord(record).when.getTime(); // 0 — every serve is the record as recorded
+ * served.tags === record.tags; // true — the sealed part is shared, not copied
+ * serveRecord(freezeRecord({ n: 1 })); // a record freezing sealed whole: served as itself
+ * ```
+ */
+/**
+ * How {@link deepFreeze} walks an ARRAY.
+ *
+ * - `'every-key'` (the default) — every own property, as for any other object: the index elements
+ *   AND any expando (`arr.note = { … }`). The dev-mode snapshot relies on this contract.
+ * - `'indices'` — the index elements only, so no key string is allocated per element; this is what
+ *   keeps freezing a 10,000-element commit inside its budget (`bench/element-writes.ts`). An object
+ *   hung on an array EXPANDO is then left unfrozen, and unseen by {@link serveRecord} — the commit
+ *   log's named hole (`EventLog · record`; an array expando is out of contract for state).
+ */
+export type ArrayWalk = 'every-key' | 'indices';
+/**
+ * Freezes `obj` and every object reachable through its own properties, and returns `obj`.
+ *
+ * - An object that is ALREADY frozen is left as it is, and not descended — 9.32.0's contract, kept:
+ *   args may hold a caller's frozen object with live parts inside (a class instance a stage calls),
+ *   and freezing past it would break them. It is also what ends a cycle. The commit log never meets
+ *   one: its payloads are fresh `structuredClone`s.
+ * - ArrayBuffer views (typed arrays, `DataView`) are skipped: `Object.freeze` throws on a non-empty
+ *   typed array, so a `Uint8Array` in state, args or the fold base used to fail the run or the
+ *   snapshot here.
+ * - What `Object.freeze` cannot reach stays mutable — Map and Set contents, a Date's time, the
+ *   bytes behind a buffer. A frozen RegExp's `lastIndex` is read-only, so a `/g` or `/y` regex
+ *   taken from a frozen tree throws when `exec` or `replace` advance it. The commit log goes through
+ *   {@link freezeRecord} and {@link serveRecord} instead.
+ * - Functions are not descended (they are not values the engine stores).
+ */
+export declare function deepFreeze<T>(obj: T, arrays?: ArrayWalk): T;
+/**
+ * {@link deepFreeze} for a record many readers are SERVED (a commit bundle, the fold base), and two more
+ * things on the same walk:
+ *
+ *   - it remembers THAT the record holds a value freezing cannot seal — one flag; the record's first
+ *     serve maps WHERE (the containers on the way to each such value, its open paths), so the run pays
+ *     nothing more and {@link serveRecord} copies those paths and nothing else;
+ *   - a typed array or `DataView` that views a SLICE of a bigger buffer (a Node `Buffer` views its
+ *     shared pool) is replaced, in the record, by a copy of the bytes it views — the record keeps the
+ *     view's bytes, never the rest of the buffer (a resizable or shared buffer is kept as it is).
+ *
+ * A part frozen before is not frozen past (deepFreeze's contract) but is looked through, so a value
+ * freezing cannot seal inside it still opens the record. Returns `record`.
+ */
+export declare function freezeRecord<T extends object>(record: T, arrays?: ArrayWalk): T;
+/**
+ * The record as a reader may hold it — THE serve-time law: a record freezing sealed whole is served as
+ * itself (shared, no cost); any other as a copy of its open paths ({@link freezeRecord}): fresh frozen
+ * containers down to each value freezing cannot seal, a fresh copy of that value, and every other part
+ * shared, frozen, as it is. A copy is served the same way again.
+ */
+export declare function serveRecord<T>(record: T): T;

package/dist/esm/lib/capture/freeze.js

@@ -0,0 +1,313 @@
+/**
+ * freeze.ts — the ONE deep-freeze walk (moved here from `scope/protection/readonlyInput.ts` in F3),
+ * and the serve-time law for the commit log (9.44.2).
+ *
+ * WHY HERE. Saved trees freeze through this walk: the fold base served as
+ * `initialState` (`ExecutionRuntime · getFoldBase`), the
+ * dev-mode snapshot (`runner/snapshot.ts · servedSnapshot`), every state `stateAt` hands out
+ * (`time-travel/stateAt.ts`) and, since F3, every commit bundle (`EventLog · record`). `memory/` must
+ * not import `scope/` (that edge closed the memory ⇄ scope ⇄ recorder module cycle F0 removed), so the
+ * walk lives in this leaf folder, which imports nothing outside itself. Args use an ownership snapshot
+ * instead (`scope/protection/readonlyInput.ts · createFrozenArgs`): never freeze borrowed caller values.
+ *
+ * FREEZE WHAT CAN BE FROZEN, COPY WHAT CAN'T (9.44.2). `Object.freeze` cannot seal a Date's time, a
+ * Map's or Set's entries, a buffer's bytes, a RegExp (`compile()` rewrites a frozen one) or an Error
+ * (V8's own `stack` accessor writes through a frozen one). A fresh tree handed to one caller (a `stateAt`
+ * state, the dev-mode snapshot) is that caller's own, so freezing it is a guard and nothing more. The
+ * COMMIT LOG — each bundle, and the fold base — is served to every reader, so {@link freezeRecord}
+ * remembers that a record holds such a value, its first serve maps the containers on the way to each
+ * one (its open PATHS), and {@link serveRecord} hands a reader a copy of those paths only: a fresh copy
+ * of each such value, fresh frozen containers on the way to it, and every other part shared, frozen, as
+ * it is. Until 9.44.2 `snapshot.commitLog[i].overwrite.when.setTime(0)` rewrote every later snapshot,
+ * `stateAt`, `commitValueAt`, slice and cursor answer.
+ *
+ * Every walk here is ITERATIVE (an explicit stack): a record's depth is not bounded by the call stack.
+ *
+ * @example
+ * ```typescript
+ * import { deepFreeze, freezeRecord, serveRecord } from './freeze.js';
+ *
+ * const args = deepFreeze({ order: { lines: [{ sku: 'A' }] }, bytes: new Uint8Array([1]) });
+ * Object.isFrozen(args.order.lines[0]); // true
+ * Object.isFrozen(args.bytes); // false — a typed array cannot be frozen; it is skipped
+ *
+ * const record = freezeRecord({ when: new Date(0), tags: ['a'] });
+ * const served = serveRecord(record);
+ * served.when.setTime(5); // changes the reader's copy
+ * serveRecord(record).when.getTime(); // 0 — every serve is the record as recorded
+ * served.tags === record.tags; // true — the sealed part is shared, not copied
+ * serveRecord(freezeRecord({ n: 1 })); // a record freezing sealed whole: served as itself
+ * ```
+ */
+import { putOwn } from './ownData.js';
+import { kindOf, SEALABLE } from './valueKinds.js';
+/**
+ * Freezes `obj` and every object reachable through its own properties, and returns `obj`.
+ *
+ * - An object that is ALREADY frozen is left as it is, and not descended — 9.32.0's contract, kept:
+ *   args may hold a caller's frozen object with live parts inside (a class instance a stage calls),
+ *   and freezing past it would break them. It is also what ends a cycle. The commit log never meets
+ *   one: its payloads are fresh `structuredClone`s.
+ * - ArrayBuffer views (typed arrays, `DataView`) are skipped: `Object.freeze` throws on a non-empty
+ *   typed array, so a `Uint8Array` in state, args or the fold base used to fail the run or the
+ *   snapshot here.
+ * - What `Object.freeze` cannot reach stays mutable — Map and Set contents, a Date's time, the
+ *   bytes behind a buffer. A frozen RegExp's `lastIndex` is read-only, so a `/g` or `/y` regex
+ *   taken from a frozen tree throws when `exec` or `replace` advance it. The commit log goes through
+ *   {@link freezeRecord} and {@link serveRecord} instead.
+ * - Functions are not descended (they are not values the engine stores).
+ */
+export function deepFreeze(obj, arrays = 'every-key') {
+    if (obj !== null && typeof obj === 'object')
+        walkAndFreeze(obj, arrays === 'indices', false);
+    return obj;
+}
+/**
+ * Containers of a record that hold — on some path below them — a value freezing cannot seal: `true` once
+ * mapped (the container is on an open path), `false` for a record {@link freezeRecord} found open whose
+ * paths no serve has mapped yet. A container absent here is sealed whole.
+ */
+const OPEN = new WeakMap();
+/**
+ * {@link deepFreeze} for a record many readers are SERVED (a commit bundle, the fold base), and two more
+ * things on the same walk:
+ *
+ *   - it remembers THAT the record holds a value freezing cannot seal — one flag; the record's first
+ *     serve maps WHERE (the containers on the way to each such value, its open paths), so the run pays
+ *     nothing more and {@link serveRecord} copies those paths and nothing else;
+ *   - a typed array or `DataView` that views a SLICE of a bigger buffer (a Node `Buffer` views its
+ *     shared pool) is replaced, in the record, by a copy of the bytes it views — the record keeps the
+ *     view's bytes, never the rest of the buffer (a resizable or shared buffer is kept as it is).
+ *
+ * A part frozen before is not frozen past (deepFreeze's contract) but is looked through, so a value
+ * freezing cannot seal inside it still opens the record. Returns `record`.
+ */
+export function freezeRecord(record, arrays = 'every-key') {
+    if (!OPEN.has(record) && walkAndFreeze(record, arrays === 'indices', true))
+        OPEN.set(record, false);
+    return record;
+}
+/**
+ * The record as a reader may hold it — THE serve-time law: a record freezing sealed whole is served as
+ * itself (shared, no cost); any other as a copy of its open paths ({@link freezeRecord}): fresh frozen
+ * containers down to each value freezing cannot seal, a fresh copy of that value, and every other part
+ * shared, frozen, as it is. A copy is served the same way again.
+ */
+export function serveRecord(record) {
+    if (record === null || typeof record !== 'object')
+        return record;
+    const mapped = OPEN.get(record);
+    if (mapped === undefined)
+        return record;
+    if (!mapped)
+        mapOpenPaths(record);
+    return OPEN.get(record) === true ? copyOpenPaths(record) : record;
+}
+/** A value freezing cannot seal — a view, or a kind `SEALABLE` says no to (a Date, a Map, an Error …). */
+function isUnsealable(value) {
+    return ArrayBuffer.isView(value) || !SEALABLE[kindOf(value)];
+}
+/**
+ * Freeze `root` and every container under it, iteratively; `record` adds the look-through of parts
+ * frozen before and the compaction of views over a slice. `true` when something under `root` (or `root`
+ * itself) cannot be sealed.
+ */
+function walkAndFreeze(root, indices, record) {
+    let open = false;
+    let lookedThrough;
+    const stack = [root];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (ArrayBuffer.isView(node)) {
+            open = true; // its bytes — and a non-empty one cannot be frozen at all
+            continue;
+        }
+        const frozenBefore = Object.isFrozen(node);
+        if (frozenBefore) {
+            if (!record || OPEN.has(node)) {
+                open ||= record;
+                continue;
+            }
+            if ((lookedThrough ??= new Set()).has(node))
+                continue;
+            lookedThrough.add(node); // a part frozen before: looked through, never frozen past
+        }
+        if (record && !open && !SEALABLE[kindOf(node)])
+            open = true;
+        // Children first, while `node` is still open to the compaction below; then the freeze.
+        const compacting = record && !frozenBefore;
+        if (indices && Array.isArray(node)) {
+            for (let i = 0; i < node.length; i++) {
+                const child = node[i];
+                if (child === null || typeof child !== 'object')
+                    continue;
+                stack.push(compacting && ArrayBuffer.isView(child) ? compact(node, i, child) : child);
+            }
+        }
+        else {
+            const names = Object.getOwnPropertyNames(node);
+            for (let i = 0; i < names.length; i++) {
+                const child = node[names[i]];
+                if (child === null || typeof child !== 'object')
+                    continue;
+                stack.push(compacting && ArrayBuffer.isView(child) ? compact(node, names[i], child) : child);
+            }
+        }
+        if (!frozenBefore)
+            Object.freeze(node);
+    }
+    return open;
+}
+/**
+ * A view over a SLICE of a bigger buffer, replaced in `container` by a copy of the bytes it views
+ * (the type it is — a Node `Buffer` comes out a `Uint8Array`, as a clone of it does). Anything else is
+ * returned as it is. A resizable or shared buffer is kept: a copy would change what it is.
+ */
+function compact(container, key, child) {
+    const buffer = child.buffer;
+    if (child.byteOffset === 0 && child.byteLength === buffer.byteLength)
+        return child;
+    if (buffer.resizable === true || !(buffer instanceof ArrayBuffer))
+        return child;
+    const bytes = buffer.slice(child.byteOffset, child.byteOffset + child.byteLength);
+    const tag = Object.prototype.toString.call(child).slice(8, -1);
+    const Ctor = globalThis[tag];
+    if (typeof Ctor !== 'function')
+        return child;
+    const copy = new Ctor(bytes);
+    try {
+        container[key] = copy;
+    }
+    catch {
+        return child; // a property the record does not let be replaced (a hand-built bundle)
+    }
+    return copy;
+}
+/**
+ * Map the open paths of `root` — mark every container that reaches a value freezing cannot seal, so a
+ * serve copies exactly those (DAGs and cycles included: the marks run UP the reverse edges from each
+ * such value). Runs once per open record, at its first serve. A node's first holder is kept in one map;
+ * any other holder (a shared part, a cycle) in a second, made only when there is one.
+ */
+function mapOpenPaths(root) {
+    const holder = new Map();
+    let moreHolders;
+    const leaves = [];
+    const stack = [root];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (isUnsealable(node)) {
+            leaves.push(node); // a leaf: its contents are copied with it
+            continue;
+        }
+        const names = Object.keys(node);
+        for (let i = 0; i < names.length; i++) {
+            const child = node[names[i]];
+            if (child === null || typeof child !== 'object')
+                continue;
+            if (child !== root && !holder.has(child)) {
+                holder.set(child, node);
+                stack.push(child);
+                continue;
+            }
+            const more = (moreHolders ??= new Map()).get(child);
+            if (more === undefined)
+                moreHolders.set(child, [node]);
+            else
+                more.push(node);
+        }
+    }
+    // Marked in THIS map, not by an earlier one: a part another record already mapped still opens
+    // every container of this record on the way to it.
+    const marked = new Set();
+    const up = [];
+    const holdersOf = (node) => {
+        const first = holder.get(node);
+        if (first !== undefined)
+            up.push(first);
+        const more = moreHolders?.get(node);
+        // One push per holder: a spread passes every holder as a call argument, and one object held by
+        // 120,000 containers overflowed the stack.
+        if (more !== undefined)
+            for (let i = 0; i < more.length; i++)
+                up.push(more[i]);
+    };
+    for (const leaf of leaves) {
+        if (leaf === root)
+            marked.add(root);
+        holdersOf(leaf);
+    }
+    while (up.length > 0) {
+        const node = up.pop();
+        if (marked.has(node))
+            continue;
+        marked.add(node);
+        holdersOf(node);
+    }
+    // Only now, the walk done, does the record's flag give way to its map: a mapping that throws leaves
+    // the record flagged, so the next serve maps again — it never hands out the record itself.
+    if (!marked.has(root))
+        OPEN.delete(root);
+    for (const node of marked)
+        OPEN.set(node, true);
+}
+/**
+ * The served copy of an open record: its open containers copied (fresh, then frozen, and themselves
+ * open — a copy is served by copy again), each value freezing cannot seal copied, every sealed part
+ * shared. Iterative; one copy per original, so containers shared or cyclic stay shared in the copy. The
+ * values freezing cannot seal are copied ONE BY ONE: two of them that share a part (an `ArrayBuffer`
+ * and a view of it, an error whose `cause` is another key's Date) come out as separate copies — equal
+ * values, the sharing between them not kept.
+ */
+function copyOpenPaths(root) {
+    const copies = new Map();
+    const shells = [];
+    const copyOf = (value, pending) => {
+        const done = copies.get(value);
+        if (done !== undefined)
+            return done;
+        let copy;
+        if (isUnsealable(value)) {
+            copy = copyLeaf(value);
+        }
+        else {
+            copy = Array.isArray(value) ? new Array(value.length) : {};
+            shells.push(copy);
+            pending.push(value);
+        }
+        copies.set(value, copy);
+        return copy;
+    };
+    const pending = [];
+    const out = copyOf(root, pending);
+    while (pending.length > 0) {
+        const node = pending.pop();
+        const copy = copies.get(node);
+        for (const name of Object.keys(node)) {
+            const child = node[name];
+            putOwn(copy, name, child !== null && typeof child === 'object' && (OPEN.has(child) || isUnsealable(child))
+                ? copyOf(child, pending)
+                : child);
+        }
+    }
+    for (const shell of shells) {
+        Object.freeze(shell);
+        OPEN.set(shell, true);
+    }
+    // A leaf copy is the reader's own; frozen where freezing reaches, as the record's parts are.
+    for (const copy of copies.values())
+        if (!ArrayBuffer.isView(copy))
+            Object.freeze(copy);
+    return out;
+}
+/** A fresh copy of a value freezing cannot seal. One the clone refuses (hand-built) is served as it is. */
+function copyLeaf(value) {
+    if (kindOf(value) === 'date')
+        return new Date(Date.prototype.getTime.call(value));
+    try {
+        return structuredClone(value);
+    }
+    catch {
+        return value;
+    }
+}

package/dist/esm/lib/capture/ownData.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The private L0 owner of own-slot writes. Selector validation belongs to
+ * pathOps: payload names (including `__proto__`) are ordinary data here.
+ * Neither operation flattens an existing own accessor or changes its flags.
+ */
+/**
+ * `target[name] = value`, preserving existing own-slot behavior while making
+ * a missing inherited name an OWN data property. Payload names such as
+ * `__proto__` are data, not setters or selector instructions. Shared by the
+ * record-serving and copy-on-write copies; this is not a public helper.
+ */
+export declare function putOwn(target: Record<string, unknown>, name: string | number, value: unknown): void;
+/**
+ * Nested diagnostic writers require a missing slot to be CREATED, not merely
+ * assigned. Keep that contract separate from putOwn: an out-of-range typed
+ * array index is an assignment no-op, but cannot be defined as an own slot.
+ */
+export declare function setOwnValue(target: Record<string, unknown>, name: string | number, value: unknown): void;

package/dist/esm/lib/capture/ownData.js

@@ -0,0 +1,35 @@
+/**
+ * The private L0 owner of own-slot writes. Selector validation belongs to
+ * pathOps: payload names (including `__proto__`) are ordinary data here.
+ * Neither operation flattens an existing own accessor or changes its flags.
+ */
+/**
+ * `target[name] = value`, preserving existing own-slot behavior while making
+ * a missing inherited name an OWN data property. Payload names such as
+ * `__proto__` are data, not setters or selector instructions. Shared by the
+ * record-serving and copy-on-write copies; this is not a public helper.
+ */
+export function putOwn(target, name, value) {
+    if (!Object.prototype.hasOwnProperty.call(target, name) && Reflect.has(target, name)) {
+        defineOwnData(target, name, value);
+    }
+    else {
+        target[name] = value;
+    }
+}
+/**
+ * Nested diagnostic writers require a missing slot to be CREATED, not merely
+ * assigned. Keep that contract separate from putOwn: an out-of-range typed
+ * array index is an assignment no-op, but cannot be defined as an own slot.
+ */
+export function setOwnValue(target, name, value) {
+    if (Object.prototype.hasOwnProperty.call(target, name)) {
+        putOwn(target, name, value);
+    }
+    else {
+        defineOwnData(target, name, value);
+    }
+}
+function defineOwnData(target, name, value) {
+    Object.defineProperty(target, name, { value, enumerable: true, writable: true, configurable: true });
+}