openalgo-script 0.1.0-alpha.1 → 0.2.0

package/src/core/engine/verify-shape.ts

@@ -0,0 +1,164 @@
+/**
+ * Check 1 of `compiled-program.md` 3.5: every required field is present and of
+ * the declared type.
+ *
+ * This is the half of verification that reads an untrusted object and decides
+ * whether it is a compiled program at all. It runs before anything else,
+ * because every later check indexes into a table this one proves is a table.
+ *
+ * The failures are all one code. OS6018 covers a malformed instruction list, an
+ * unreadable encoding and a field of the wrong type because they are not
+ * separate fixes: each is a defect of the compiler that wrote the program, and
+ * none of them is repairable by hand. What varies is the location, and the
+ * location is a field path, so a compiler author is told `outputs.plots[2].
+ * channel` rather than "structure".
+ */
+import type { Diagnostic } from '../diagnostics/index.js';
+import { malformed } from './errors.js';
+
+type Unknown = Readonly<Record<string, unknown>>;
+
+/** Collects the first failure and stops: a malformed program has no second opinion. */
+export class ShapeCheck {
+  private failure: Diagnostic | undefined;
+
+  problem(): Diagnostic | undefined {
+    return this.failure;
+  }
+
+  fail(path: string, reason: string): false {
+    this.failure ??= malformed(path, reason);
+    return false;
+  }
+
+  object(value: unknown, path: string): value is Unknown {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+      return this.fail(path, 'an object was required');
+    }
+    return true;
+  }
+
+  array(value: unknown, path: string): value is readonly unknown[] {
+    if (!Array.isArray(value)) return this.fail(path, 'an array was required');
+    return true;
+  }
+
+  number(value: unknown, path: string): value is number {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+      return this.fail(path, 'a finite number was required');
+    }
+    return true;
+  }
+
+  whole(value: unknown, path: string): value is number {
+    if (!this.number(value, path)) return false;
+    if (!Number.isInteger(value)) return this.fail(path, 'a whole number was required');
+    return true;
+  }
+
+  string(value: unknown, path: string): value is string {
+    if (typeof value !== 'string') return this.fail(path, 'a string was required');
+    return true;
+  }
+
+  bool(value: unknown, path: string): value is boolean {
+    if (typeof value !== 'boolean') return this.fail(path, 'a true or false was required');
+    return true;
+  }
+
+  /** A whole number that indexes a table, with the table's size in the message. */
+  index(value: unknown, path: string, size: number, table: string): value is number {
+    if (!this.whole(value, path)) return false;
+    if (value < 0 || value >= size) {
+      return this.fail(path, `${value} is outside ${table}, which holds ${size}`);
+    }
+    return true;
+  }
+
+  one<T extends string>(value: unknown, path: string, allowed: readonly T[]): value is T {
+    if (!this.string(value, path)) return false;
+    if (!(allowed as readonly string[]).includes(value)) {
+      return this.fail(path, `${value} is not one of ${allowed.join(', ')}`);
+    }
+    return true;
+  }
+
+  /** A field that may be a value or null, which is a value the script could write. */
+  nullable(value: unknown, path: string, check: (v: unknown, p: string) => boolean): boolean {
+    return value === null ? true : check.call(this, value, path);
+  }
+}
+
+/** The tags of a constant pool entry, 2.9. */
+const CONSTANT_TAGS = ['z', 'b', 'n', 's', 'c'] as const;
+
+export function checkConstant(shape: ShapeCheck, value: unknown, path: string): boolean {
+  if (!shape.array(value, path)) return false;
+  if (value.length !== 2) return shape.fail(path, 'a pool entry is a tag and a value');
+  const tag = value[0];
+  if (!shape.one(tag, `${path}[0]`, CONSTANT_TAGS)) return false;
+  const held = value[1];
+  switch (tag) {
+    case 'z':
+      return held === null ? true : shape.fail(`${path}[1]`, 'the absent entry holds null');
+    case 'b':
+      return shape.bool(held, `${path}[1]`);
+    case 'n':
+      return shape.number(held, `${path}[1]`);
+    case 's':
+      return shape.string(held, `${path}[1]`);
+    default:
+      return checkColour(shape, held, `${path}[1]`);
+  }
+}
+
+export function checkColour(shape: ShapeCheck, value: unknown, path: string): boolean {
+  if (!shape.array(value, path)) return false;
+  if (value.length !== 4) return shape.fail(path, 'a colour is four numbers');
+  for (let i = 0; i < 3; i += 1) {
+    if (!shape.whole(value[i], `${path}[${i}]`)) return false;
+    const channel = value[i] as number;
+    if (channel < 0 || channel > 255) {
+      return shape.fail(`${path}[${i}]`, `a channel runs 0 to 255 and this is ${channel}`);
+    }
+  }
+  if (!shape.number(value[3], `${path}[3]`)) return false;
+  const alpha = value[3] as number;
+  if (alpha < 0 || alpha > 1) {
+    return shape.fail(`${path}[3]`, `an alpha runs 0 to 1 and this is ${alpha}`);
+  }
+  return true;
+}
+
+/**
+ * A declaration field, 2.3: a value, or the `{ "input": key }` reference.
+ *
+ * The key half of check 10 lives here, because this is the one walk that
+ * visits every field that may hold one. The value half runs later, with the
+ * host's settings in hand.
+ */
+export function checkField(
+  shape: ShapeCheck,
+  value: unknown,
+  path: string,
+  keys: ReadonlySet<string>,
+): boolean {
+  if (value === null) return true;
+  const kind = typeof value;
+  if (kind === 'boolean' || kind === 'string') return true;
+  if (kind === 'number') return shape.number(value, path);
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i += 1) {
+      if (!shape.number(value[i], `${path}[${i}]`)) return false;
+    }
+    return true;
+  }
+  if (!shape.object(value, path)) return false;
+  const key = value['input'];
+  if (key === undefined) return shape.fail(path, 'an object here is an input reference');
+  if (!shape.string(key, `${path}.input`)) return false;
+  if (!keys.has(key)) {
+    return shape.fail(path, `it names the input ${key}, which inputs[] does not declare`);
+  }
+  return true;
+}

package/src/core/engine/verify-tables.ts

@@ -0,0 +1,176 @@
+/**
+ * Check 1 of `compiled-program.md` 3.5 over the program's own tables, and check
+ * 10's key half.
+ *
+ * `verify-shape.ts` answers "is this field a number"; this walks the whole
+ * program asking it, table by table, and checks every index into a table is in
+ * range: constant pool, slots, cells, states, registers, channels, library
+ * functions, call sites, loops and functions. The tables a machine indexes and
+ * the `requests` table are in `verify-requests.ts`, because a read's body holds
+ * the same tables counted from zero and one walk has to serve both. Separate
+ * from `verify.ts` because
+ * it is one long traversal with no decisions in it, and because the decisions
+ * there, which version, which capability, which budget, are what a reader comes
+ * looking for.
+ */
+import type { ShapeCheck } from './verify-shape.js';
+import { checkConstant, checkField } from './verify-shape.js';
+import { checkMachineTables, checkRequests } from './verify-requests.js';
+
+const META_KINDS = ['study', 'strategy'] as const;
+const CHANNEL_TYPES = ['number', 'string', 'color', 'bool'] as const;
+const EFFECTS = ['none', 'signal', 'order', 'draw', 'log'] as const;
+
+/** Check 1 over every table the machine indexes, and every declaration field. */
+export function checkTables(shape: ShapeCheck, raw: Readonly<Record<string, unknown>>): boolean {
+  for (const name of ['requires', 'inputs', 'channels', 'consts', 'series', 'cells', 'states',
+    'functions', 'callSites', 'loops', 'code', 'requests']) {
+    if (!shape.array(raw[name], name)) return false;
+  }
+  for (const name of ['compiler', 'source', 'meta', 'limits', 'lib', 'outputs', 'frame', 'debug']) {
+    if (!shape.object(raw[name], name)) return false;
+  }
+
+  const limits = raw['limits'] as Readonly<Record<string, unknown>>;
+  if (!shape.whole(limits['loops'], 'limits.loops')) return false;
+  if (limits['history'] !== null && !shape.whole(limits['history'], 'limits.history')) return false;
+
+  const frame = raw['frame'] as Readonly<Record<string, unknown>>;
+  if (!shape.whole(frame['slots'], 'frame.slots')) return false;
+
+  const lib = raw['lib'] as Readonly<Record<string, unknown>>;
+  if (!shape.whole(lib['manifest'], 'lib.manifest')) return false;
+  if (!shape.array(lib['functions'], 'lib.functions')) return false;
+  for (let i = 0; i < lib['functions'].length; i += 1) {
+    const entry = lib['functions'][i];
+    const path = `lib.functions[${i}]`;
+    if (!shape.object(entry, path)) return false;
+    if (!shape.string(entry['name'], `${path}.name`)) return false;
+    if (!shape.whole(entry['arity'], `${path}.arity`)) return false;
+    if (!shape.bool(entry['state'], `${path}.state`)) return false;
+    if (!shape.one(entry['effect'], `${path}.effect`, EFFECTS)) return false;
+  }
+
+  const consts = raw['consts'] as readonly unknown[];
+  for (let i = 0; i < consts.length; i += 1) {
+    if (!checkConstant(shape, consts[i], `consts[${i}]`)) return false;
+  }
+
+  const keys = new Set<string>();
+  const inputs = raw['inputs'] as readonly unknown[];
+  for (let i = 0; i < inputs.length; i += 1) {
+    const input = inputs[i];
+    const path = `inputs[${i}]`;
+    if (!shape.object(input, path)) return false;
+    if (!shape.string(input['key'], `${path}.key`)) return false;
+    if (!shape.string(input['kind'], `${path}.kind`)) return false;
+    if (!shape.index(input['slot'], `${path}.slot`, Number(frame['slots']), 'the frame')) {
+      return false;
+    }
+    if (!checkConstant(shape, input['default'], `${path}.default`)) return false;
+    keys.add(input['key']);
+  }
+
+  const channels = raw['channels'] as readonly unknown[];
+  for (let i = 0; i < channels.length; i += 1) {
+    const channel = channels[i];
+    const path = `channels[${i}]`;
+    if (!shape.object(channel, path)) return false;
+    if (channel['id'] !== i) return shape.fail(`${path}.id`, 'a channel id is its position');
+    if (!shape.one(channel['type'], `${path}.type`, CHANNEL_TYPES)) return false;
+    if (!shape.bool(channel['defer'], `${path}.defer`)) return false;
+    if (!shape.bool(channel['once'], `${path}.once`)) return false;
+  }
+
+  const series = raw['series'] as readonly unknown[];
+  if (!checkMachineTables(shape, '', {
+    series,
+    cells: raw['cells'] as readonly unknown[],
+    states: raw['states'] as readonly unknown[],
+    functions: raw['functions'] as readonly unknown[],
+    callSites: raw['callSites'] as readonly unknown[],
+    loops: raw['loops'] as readonly unknown[],
+    slots: Number(frame['slots']),
+    libFunctions: lib['functions'].length,
+  })) {
+    return false;
+  }
+
+  // 2.16: a read's body is walked on the same terms, because the same machine
+  // executes it over another instrument's bars.
+  if (!checkRequests(shape, '', raw['requests'] as readonly unknown[], series.length,
+    lib['functions'].length, keys)) {
+    return false;
+  }
+
+  const meta = raw['meta'] as Readonly<Record<string, unknown>>;
+  if (!shape.one(meta['kind'], 'meta.kind', META_KINDS)) return false;
+  for (const field of ['title', 'short', 'overlay', 'precision', 'format', 'range', 'scale',
+    'group', 'onUnconfirmed']) {
+    if (!checkField(shape, meta[field], `meta.${field}`, keys)) return false;
+  }
+
+  const debug = raw['debug'] as Readonly<Record<string, unknown>>;
+  if (!shape.array(debug['pos'], 'debug.pos')) return false;
+  if (!shape.array(debug['fnPos'], 'debug.fnPos')) return false;
+
+  return checkOutputs(shape, raw['outputs'] as Readonly<Record<string, unknown>>,
+    channels.length, Number(frame['slots']), keys);
+}
+
+/** Every declaration in `outputs`, and every channel it points at. */
+function checkOutputs(
+  shape: ShapeCheck,
+  outputs: Readonly<Record<string, unknown>>,
+  channels: number,
+  slots: number,
+  keys: ReadonlySet<string>,
+): boolean {
+  for (const group of ['plots', 'fills', 'levels', 'markers', 'tables', 'alerts']) {
+    if (!shape.array(outputs[group], `outputs.${group}`)) return false;
+  }
+
+  const channelField = (holder: unknown, path: string, field: string): boolean => {
+    const value = (holder as Readonly<Record<string, unknown>>)[field];
+    return shape.index(value, `${path}.${field}`, channels, 'channels');
+  };
+
+  const declarations: readonly (readonly [string, readonly string[], readonly string[]])[] = [
+    ['plots', ['channel'], ['title', 'color', 'width', 'lineStyle', 'offset', 'overlay', 'scale']],
+    ['levels', ['channel'], ['title', 'color', 'lineStyle', 'lineWidth']],
+    ['markers', ['channel'], ['position', 'shape', 'color', 'textColor']],
+    ['alerts', ['condChannel'], ['title', 'frequency']],
+  ];
+  for (const [group, channelFields, valueFields] of declarations) {
+    const list = outputs[group] as readonly unknown[];
+    for (let i = 0; i < list.length; i += 1) {
+      const path = `outputs.${group}[${i}]`;
+      if (!shape.object(list[i], path)) return false;
+      for (const field of channelFields) if (!channelField(list[i], path, field)) return false;
+      for (const field of valueFields) {
+        const value = (list[i] as Readonly<Record<string, unknown>>)[field];
+        if (!checkField(shape, value, `${path}.${field}`, keys)) return false;
+      }
+    }
+  }
+
+  const tables = outputs['tables'] as readonly unknown[];
+  for (let i = 0; i < tables.length; i += 1) {
+    const path = `outputs.tables[${i}]`;
+    if (!shape.object(tables[i], path)) return false;
+    const grid = tables[i] as Readonly<Record<string, unknown>>;
+    if (!shape.index(grid['slot'], `${path}.slot`, slots, 'the frame')) return false;
+    for (const field of ['title', 'position', 'rows', 'cols']) {
+      if (!checkField(shape, grid[field], `${path}.${field}`, keys)) return false;
+    }
+  }
+
+  for (const paint of ['barColor', 'background']) {
+    const value = outputs[paint];
+    if (value === null) continue;
+    if (!shape.object(value, `outputs.${paint}`)) return false;
+    if (!channelField(value, `outputs.${paint}`, 'channel')) return false;
+  }
+
+  return true;
+}

package/src/core/engine/verify.ts

@@ -0,0 +1,341 @@
+/**
+ * Load-time verification, `compiled-program.md` 3.5, and the refusals a host
+ * makes beside it.
+ *
+ * Before executing a single bar an engine must verify the program. What is
+ * bought by doing it here rather than discovering a problem halfway through a
+ * bar is stated in the specification and is the reason the interpreter is as
+ * plain as it is: a verified program cannot underflow the stack, cannot jump
+ * out of bounds, cannot address a slot that does not exist and cannot loop
+ * without charging the budget. Every remaining failure is a script error with a
+ * source position, which is the only kind of failure a user should ever see.
+ *
+ * Three refusals that are not verification sit here too, because they happen at
+ * the same moment and for the same reason: a version this engine does not
+ * implement (OS6016, OS6017), a capability it does not have (OS6006), and a
+ * library entry that disagrees with its manifest (OS6004). Each names what it
+ * refused, and none of them silently accepts a program it cannot run. The
+ * fourth, the budgets a host is willing to spend, is `verify-budgets.ts`: it is
+ * a question about this host rather than about this program, and two hosts may
+ * honestly answer it differently.
+ *
+ * **The order of those refusals is the specification's, 9.4, and not an
+ * accident of where the code grew.** It is an ordered list that stops at the
+ * first failure, so a program that is wrong in two ways reports the one the
+ * list reaches first, and two engines hand the same program the same message.
+ * Each step below says which number it is.
+ */
+import { COMPILED_FORMAT_VERSION } from '../version/index.js';
+import type { Diagnostic } from '../diagnostics/index.js';
+import type { EngineLimits } from './budget.js';
+import { NO_POSITION, failure } from './errors.js';
+import { manifestEntry, manifestSays } from './library/index.js';
+import type { CompiledProgram, Request } from './types.js';
+import { checkList, checkOnce } from './verify-code.js';
+import type { ListLimits } from './verify-code.js';
+import { allCode, checkBudgets } from './verify-budgets.js';
+import { ShapeCheck } from './verify-shape.js';
+import { checkTables } from './verify-tables.js';
+
+/** The language versions whose library semantics this engine implements. */
+export const LANGUAGE_VERSIONS: readonly number[] = [1];
+
+/**
+ * The format major this engine loads, and the only part of the format version a
+ * refusal turns on.
+ *
+ * `COMPILED_FORMAT_VERSION` is the highest minor of that major this engine was
+ * built against, which is what 9.1 asks an engine to declare: the majors it can
+ * load, and the highest minor of each. 9.4 step 3 then says a higher minor
+ * continues, and that line is the whole compatibility promise in one decision.
+ *
+ * A minor bump is additive by 9.2: it may add a field an engine that ignores it
+ * still computes the same numbers from, and anything whose absence would change
+ * a number must be announced by a tag in `requires`, which step 4 checks
+ * immediately afterwards. So the tag is the real mechanism and the version is
+ * the coarse one. An engine that refused a higher minor would refuse every
+ * program in the world the day the format reached 1.1, including every program
+ * it can run perfectly, and a minor bump would be a major one wearing a smaller
+ * number. An older minor loads for the same reason from the other side: it
+ * carries a subset of the fields this engine already reads.
+ *
+ * A major is a different format that happens to share a name (9.3), so a major
+ * that is not this one, in either direction, is OS6016 and never a best effort.
+ */
+const ENGINE_FORMAT_MAJOR = majorOf(COMPILED_FORMAT_VERSION);
+
+/** The leading number of a dotted version, or nothing when it is not one. */
+function majorOf(version: string): number | undefined {
+  if (!/^\d+(\.\d+)*$/.test(version)) return undefined;
+  return Number(version.split('.')[0]);
+}
+
+/**
+ * What this engine can do, as the tags of 2.2.
+ *
+ * Two tags are not here, and both for the same reason: they are the host's
+ * rather than the engine's.
+ *
+ * `orders` is one. The engine turns an order call into a pending effect and
+ * hands it to whatever route the host supplied, so the capability belongs to
+ * the configuration, and `capabilitiesFor` adds it when a route exists.
+ *
+ * `req.symbol` is the other. A read of another instrument needs bars the engine
+ * does not hold and cannot derive, so a host with no request provider cannot
+ * serve one, and a program that makes one is refused at load with OS6006 naming
+ * the tag rather than drawing a study with a silently empty line through it.
+ * **`req.timeframe` is here unconditionally**, because a read of the chart's own
+ * instrument at a coarser interval is folded from the bars the engine already
+ * has (`host-interface.md` 5.1), so there is nothing for a host to supply and
+ * nothing for it to decline.
+ */
+const ENGINE_CAPABILITIES: readonly string[] = [
+  'core.1',
+  'arrays',
+  'functions',
+  'loops',
+  'objects',
+  'tables',
+  'alerts',
+  'req.timeframe',
+];
+
+export function capabilitiesFor(
+  hasOrderRoute: boolean,
+  hasRequestProvider = false,
+): readonly string[] {
+  const tags = [...ENGINE_CAPABILITIES];
+  if (hasOrderRoute) tags.push('orders');
+  if (hasRequestProvider) tags.push('req.symbol');
+  return tags;
+}
+
+export interface VerifyOptions {
+  readonly capabilities: readonly string[];
+  readonly limits: EngineLimits;
+}
+
+export type VerifyResult =
+  | { readonly ok: true; readonly program: CompiledProgram }
+  | { readonly ok: false; readonly diagnostic: Diagnostic };
+
+/** Which instruction needs which tag, the part of check 8 the program decides. */
+const INSTRUCTION_TAGS: Readonly<Record<string, string>> = {
+  ARRAY: 'arrays',
+  ELEM: 'arrays',
+  CALL_FN: 'functions',
+  TICK: 'loops',
+};
+
+export function verify(raw: unknown, options: VerifyOptions): VerifyResult {
+  const shape = new ShapeCheck();
+  const refused = (diagnostic: Diagnostic): VerifyResult => ({ ok: false, diagnostic });
+  const broken = (): VerifyResult =>
+    refused(shape.problem() ?? failure('OS6018', NO_POSITION, {
+      location: 'the program',
+      reason: 'it is not a compiled program',
+    }));
+
+  if (!shape.object(raw, 'the program')) return broken();
+
+  const version = raw['openscript'];
+  if (!shape.object(version, 'openscript')) return broken();
+  if (!shape.string(version['format'], 'openscript.format')) return broken();
+  if (!shape.whole(version['language'], 'openscript.language')) return broken();
+
+  // Steps 2 and 3: the major decides, and a higher minor loads.
+  const major = majorOf(version['format']);
+  if (major === undefined) {
+    shape.fail('openscript.format', 'a version of the form major.minor was required');
+    return broken();
+  }
+  if (major !== ENGINE_FORMAT_MAJOR) {
+    return refused(
+      failure('OS6016', NO_POSITION, {
+        found: version['format'],
+        max: COMPILED_FORMAT_VERSION,
+      }),
+    );
+  }
+
+  // Step 1's other half: the tables every later step indexes into.
+  if (!checkTables(shape, raw)) return broken();
+  const program = raw as unknown as CompiledProgram;
+
+  // Step 4, and it comes before the language version on purpose: a program that
+  // is both compiled from a language this engine lacks and dependent on a
+  // capability it lacks reports the capability, which names the feature that was
+  // refused rather than a number the reader has to look up.
+  for (const tag of program.requires) {
+    if (!options.capabilities.includes(tag)) {
+      return refused(failure('OS6006', NO_POSITION, { tag }));
+    }
+  }
+
+  // Step 5.
+  if (!LANGUAGE_VERSIONS.includes(program.openscript.language)) {
+    return refused(
+      failure('OS6017', NO_POSITION, {
+        found: program.openscript.language,
+        versions: LANGUAGE_VERSIONS.join(', '),
+      }),
+    );
+  }
+
+  // Step 6.
+  const library = checkLibrary(program);
+  if (library !== undefined) return refused(library);
+
+  // Step 7.
+  const budget = checkBudgets(program, options.limits);
+  if (budget !== undefined) return refused(budget);
+
+  // Step 8, which is 3.5 itself.
+  const sizes = tableSizes(program);
+  if (!checkList(shape, 'code', program.code, sizes, 'HALT')) return broken();
+  for (let f = 0; f < program.functions.length; f += 1) {
+    const body = program.functions[f]?.code ?? [];
+    if (!checkList(shape, `functions[${f}]`, body, bodySizes(sizes, program, f), 'RET')) {
+      return broken();
+    }
+  }
+  if (!checkOnce(shape, program.code, program.channels.map((one) => one.once))) return broken();
+  // 2.16.1: a body is an instruction list the same machine walks, so it gets
+  // the same walk. Its terminator is `RET` rather than `HALT`, because a body
+  // produces a value and `HALT` does not.
+  if (!checkBodies(shape, 'requests', program.requests, sizes)) return broken();
+
+  // Check 8, the program's half: an instruction whose tag it never declared.
+  const missing = missingTag(program);
+  if (missing !== undefined) {
+    return refused(
+      failure('OS6018', NO_POSITION, {
+        location: 'requires',
+        reason: `the program uses ${missing.opcode} and does not declare ${missing.tag}`,
+      }),
+    );
+  }
+
+  return { ok: true, program };
+}
+
+/** Check 9: every `lib.functions` entry agrees with this engine's manifest. */
+function checkLibrary(program: CompiledProgram): Diagnostic | undefined {
+  for (let index = 0; index < program.lib.functions.length; index += 1) {
+    const entry = program.lib.functions[index];
+    if (entry === undefined) continue;
+    const mine = manifestEntry(entry.name, entry.arity);
+    if (mine === undefined) {
+      return failure('OS6004', NO_POSITION, {
+        index,
+        name: entry.name,
+        arity: entry.arity,
+        manifest: manifestSays(entry.name),
+      });
+    }
+    if (mine.state !== entry.state || mine.effect !== entry.effect) {
+      return failure('OS6004', NO_POSITION, {
+        index,
+        name: entry.name,
+        arity: entry.arity,
+        manifest: `${entry.name} holding state ${String(mine.state)} with effect ${mine.effect}`,
+      });
+    }
+  }
+  return undefined;
+}
+/** Check 8's other half: an instruction whose tag the program did not declare. */
+function missingTag(
+  program: CompiledProgram,
+): { readonly opcode: string; readonly tag: string } | undefined {
+  for (const code of allCode(program)) {
+    for (const instruction of code) {
+      const tag = INSTRUCTION_TAGS[instruction[0]];
+      if (tag !== undefined && !program.requires.includes(tag)) {
+        return { opcode: instruction[0], tag };
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Check 8 over every read's body, and every read written inside one.
+ *
+ * The body's tables are its own and counted from zero, so the limits a walk is
+ * given are rebuilt for each of them; `consts` and `lib.functions` stay the
+ * program's, because those are the two the body shares (2.16.1). `channels` is
+ * zero, which is what refuses an `EMIT` inside a body without a rule of its
+ * own: a read carries no channel, no plot and no declaration.
+ */
+function checkBodies(
+  shape: ShapeCheck,
+  prefix: string,
+  requests: readonly Request[],
+  outer: ListLimits,
+): boolean {
+  for (let i = 0; i < requests.length; i += 1) {
+    const body = requests[i]?.body;
+    if (body === undefined) continue;
+    const at = `${prefix}[${i}].body`;
+    const sizes: ListLimits = {
+      ...outer,
+      slots: body.frame.slots,
+      cells: body.cells.length,
+      states: body.states.length,
+      registers: body.series.length,
+      channels: 0,
+      callSites: body.callSites.length,
+      loops: body.loops.length,
+      series: 0,
+      argcOf: (site: number) => body.callSites[site]?.argc ?? 0,
+    };
+    if (!checkList(shape, `${at}.code`, body.code, sizes, 'RET')) return false;
+    for (let f = 0; f < body.functions.length; f += 1) {
+      const fn = body.functions[f];
+      if (fn === undefined) continue;
+      let series = 0;
+      for (const site of body.callSites) {
+        if (site.fn === f) series = series === 0 ? site.series.length : Math.min(series, site.series.length);
+      }
+      if (!checkList(shape, `${at}.functions[${f}]`, fn.code, { ...sizes, slots: fn.slots, series },
+        'RET')) {
+        return false;
+      }
+    }
+    if (!checkBodies(shape, `${at}.requests`, body.requests, sizes)) return false;
+  }
+  return true;
+}
+
+function tableSizes(program: CompiledProgram): ListLimits {
+  return {
+    slots: program.frame.slots,
+    cells: program.cells.length,
+    states: program.states.length,
+    registers: program.series.length,
+    channels: program.channels.length,
+    libFunctions: program.lib.functions.length,
+    callSites: program.callSites.length,
+    loops: program.loops.length,
+    consts: program.consts.length,
+    series: 0,
+    argcOf: (site: number) => program.callSites[site]?.argc ?? 0,
+  };
+}
+
+/**
+ * The sizes inside a function body.
+ *
+ * A body's slots are its own frame's, and a `HISTP` indexes the series bindings
+ * of whichever call site reached it. Every site that calls this function has to
+ * bind the same number, because the operand is fixed in the body, so the
+ * smallest binding list is the one that decides what is in range.
+ */
+function bodySizes(base: ListLimits, program: CompiledProgram, fn: number): ListLimits {
+  let series = 0;
+  for (const site of program.callSites) {
+    if (site.fn === fn) series = series === 0 ? site.series.length : Math.min(series, site.series.length);
+  }
+  return { ...base, slots: program.functions[fn]?.slots ?? 0, series };
+}