partforge 0.139.0 → 0.141.0

package/src/framework/param-deps.js

@@ -1,72 +1,13 @@
-// Which raw parameters affect the parts on screen in the active view. A removable
-// relevance layer: the panel uses this to dim controls / hide sections that don't
-// affect what's visible. Pure — no DOM, no real geometry (reuses the geometry-free
-// probe kernel). Errs toward RELEVANT_ALL whenever it can't analyze a build.
+// Pure — no DOM, no real geometry.
+// PREDICTED param dependencies — computed before building, against the geometry-free probe kernel. The mesh cache, panel, pickers and oracle use the reads RECORDED from the real build and fall back to this only for sub-parts not yet built. It is wrong whenever a build branches on a geometry query (isEmpty, volume, …), which the probe answers with stand-ins.
+import { recorder, expandDerivedReads } from "./read-recorder.js";
+import { resolveDerivedAttributed } from "./derive.js";
 import { createProbeKernel } from "./geometry/probe.js";
 import { byteAwareReplacer } from "./geometry/solid-hash.js";
 import { viewSubParts } from "./part-model.js";
 
 export const RELEVANT_ALL = Symbol("relevant-all");
 
-// A read-recording Proxy over a shallow clone of `obj`: records each top-level
-// property key read into `seen`, returns the real value so the build's conditionals
-// evaluate correctly, and never mutates the original `obj` (writes hit the clone).
-function recorder(obj, seen) {
-  return new Proxy({ ...obj }, {
-    get(target, key) {
-      if (typeof key === "string") seen.add(key);
-      return Reflect.get(target, key);
-    },
-  });
-}
-
-// Run derive with recorders. `allInputs` is every raw param derive reads.
-// For the grouped form (derive as an object of group functions — see derive.js),
-// `depsOf` maps each derived key to the raw params of just its own group,
-// transitively including the groups whose outputs it read. For the single-function
-// form there is no per-key attribution, so depsOf is null and callers fall back to
-// treating every derive input as feeding every derived key.
-function analyzeDerive(part, params) {
-  const allInputs = new Set();
-  if (!part.derive) return { derived: {}, allInputs, depsOf: null };
-  if (typeof part.derive === "function") {
-    const derived = part.derive(recorder(params, allInputs)) ?? {};
-    return { derived, allInputs, depsOf: null };
-  }
-  const derived = {};
-  const depsOf = new Map();
-  for (const fn of Object.values(part.derive)) {
-    const raw = new Set();
-    const fromEarlier = new Set();
-    const written = new Set();
-    // Reads are recorded (and guarded against not-yet-produced keys, matching
-    // resolveDerived); writes pass THROUGH to the real accumulator so a group
-    // that mutates `d` in place analyzes exactly like it runs in production.
-    const dProxy = new Proxy(derived, {
-      get(t, key) {
-        if (typeof key === "string" && key !== "then") {
-          if (!(key in t)) throw new Error(`derive: group read "${key}" before any earlier group produced it`);
-          fromEarlier.add(key);
-        }
-        return Reflect.get(t, key);
-      },
-      set(t, key, v) {
-        if (typeof key === "string") written.add(key);
-        return Reflect.set(t, key, v);
-      },
-    });
-    const out = fn(recorder(params, raw), dProxy) ?? {};
-    const deps = new Set(raw);
-    for (const k of fromEarlier) for (const dep of depsOf.get(k) ?? []) deps.add(dep);
-    for (const r of raw) allInputs.add(r);
-    for (const key of [...Object.keys(out), ...written]) {
-      depsOf.set(key, deps);
-      if (Object.hasOwn(out, key)) derived[key] = out[key];
-    }
-  }
-  return { derived, allInputs, depsOf };
-}
-
 export function relevantParamKeys(part, view, params) {
   // The union of every on-screen sub-part's read set (that's exactly what
   // subPartReadKeys computes, derive attribution included)...
@@ -89,12 +30,13 @@ export function relevantParamKeys(part, view, params) {
 }
 
 // Per-sub-part version of relevantParamKeys: which raw params each ON-SCREEN
-// sub-part of the active view reads. Used by Layer 1 (mount.js) to skip
-// regenerating sub-parts whose inputs are unchanged. Errs to RELEVANT_ALL on any
+// sub-part of the active view reads. This is a PREDICTION: display consumers
+// (selection, measure) and the oracle use it until they move to recorded reads;
+// the mesh cache no longer does. Errs to RELEVANT_ALL on any
 // analysis failure (caller then treats every param as relevant — safe, just slower).
 export function subPartReadKeys(part, view, params) {
   try {
-    const { derived, allInputs, depsOf } = analyzeDerive(part, params);
+    const { d: derived, depsOf, allInputs } = resolveDerivedAttributed(part, params);
     const { kernel } = createProbeKernel();
     const map = new Map();
     for (const name of viewSubParts(part, view, params)) {
@@ -107,16 +49,7 @@ export function subPartReadKeys(part, view, params) {
       // mesh), so its reads count — without this, a param consumed only by place()
       // would let the mesh cache skip a rebuild and leave the sub-part misplaced.
       if (sp.place) sp.place(built, { view, purpose: "display", p: recorder(params, reads), d: recorder(derived, dSeen) });
-      if (dSeen.size > 0) {
-        if (depsOf && [...dSeen].every((k) => depsOf.has(k))) {
-          for (const k of dSeen) for (const dep of depsOf.get(k)) reads.add(dep);
-        } else {
-          // single-function derive, or a derived key no group produced: no
-          // attribution possible — fold every derive input in (safe, coarser).
-          for (const dep of allInputs) reads.add(dep);
-        }
-      }
-      map.set(name, reads);
+      map.set(name, expandDerivedReads(reads, dSeen, { depsOf, allInputs }));
     }
     return map;
   } catch {
@@ -133,3 +66,46 @@ export function subPartReadKeys(part, view, params) {
 export function relevanceHash(keys, params) {
   return JSON.stringify(keys.slice().sort().map((k) => [k, params[k]]), byteAwareReplacer);
 }
+
+// Which params one sub-part depends on, for DISPLAY consumers (pick scoping,
+// measure flash, runtime.controlsFor): its last real build's recorded reads
+// when there are any, else the prediction, else every param. The one ladder —
+// feature-level precision lands here later (spec §5).
+export function subPartParamKeys(part, view, params, readsOf, name) {
+  const rec = readsOf?.(name);
+  if (rec) {
+    // The worker records the BUILD's reads; the sub-part's own show/hide gate
+    // is added here, as the prediction rung does (subPartReadKeys runs enabled()).
+    const out = new Set(rec);
+    const sp = part.parts[name];
+    if (sp?.enabled) sp.enabled(recorder(params, out));
+    return [...out].sort();
+  }
+  const reads = subPartReadKeys(part, view, params);
+  const keys = reads === RELEVANT_ALL ? Object.keys(params) : [...(reads.get(name) ?? Object.keys(params))];
+  return keys.sort();
+}
+
+// Panel relevance from RECORDED reads: the union over on-screen sub-parts (a
+// not-yet-built one contributes its prediction — display only, so a wrong guess
+// costs one build's dimming), plus the gate params of every in-view sub-part.
+export function recordedRelevantKeys(part, view, params, readsOf) {
+  try {
+    const relevant = new Set();
+    let predicted = null;
+    for (const name of viewSubParts(part, view, params)) {
+      const rec = readsOf(name);
+      if (rec) { for (const k of rec) relevant.add(k); continue; }
+      predicted ??= subPartReadKeys(part, view, params);
+      if (predicted === RELEVANT_ALL) return RELEVANT_ALL;
+      for (const k of predicted.get(name) ?? []) relevant.add(k);
+    }
+    for (const name of Object.keys(part.parts)) {
+      const sp = part.parts[name];
+      if (sp.views.includes(view) && sp.enabled) sp.enabled(recorder(params, relevant));
+    }
+    return relevant;
+  } catch {
+    return RELEVANT_ALL;
+  }
+}

package/src/framework/part-model.js

@@ -9,7 +9,8 @@
 // (oracle/) all call it. Keeping those four functions out of jobs.js — which is
 // async, imports the kernels, and pulls in the whole export stack — is what lets the
 // oracle depend on the part model without an import cycle back through the job loop.
-import { resolveDerived } from "./derive.js";
+import { resolveDerived, resolveDerivedAttributed } from "./derive.js";
+import { recorder } from "./read-recorder.js";
 
 // Names of the sub-parts a view shows: declared in the view and enabled for these
 // params. Order follows Object.keys(part.parts) (definition order).
@@ -39,10 +40,34 @@ export function exportSubParts(part, view, params) {
 // build() will see, or a refused value still reaches the geometry through `d`.
 // A hook rather than a second copy of this function in the caller, so "resolve a
 // part's params" keeps one definition.
-export function resolveParams(part, params, sanitize) {
+// resolveParams plus derive attribution, plain objects. `p` is passed to derive
+// itself (through), so a derive that writes p behaves exactly as unrecorded.
+export function resolveParamsAttributed(part, params, sanitize) {
   const p = { ...part.defaults, ...params };
   sanitize?.(p);
-  return { p, d: resolveDerived(part, p) };
+  const { d, depsOf, allInputs } = resolveDerivedAttributed(part, p, { through: true });
+  return { p, d, attribution: { depsOf, allInputs } };
+}
+
+// Record-through views of a resolved (p, d) into one read sink. Everything that
+// reads them — viewSubParts' enabled(), build(), place(), expect(p, d) — lands in
+// the sink with no change to the reader.
+export function recordedParams({ p, d }, sink) {
+  return { p: recorder(p, sink.raw, { through: true }), d: recorder(d, sink.dSeen, { through: true }) };
+}
+
+// `reads` (optional): a newReadSink() (read-recorder.js). When given, the returned
+// p/d record every key read into it, and the sink keeps the derive attribution
+// expandReads needs. The single seam the oracle threads its sink through.
+export function resolveParams(part, params, sanitize, reads) {
+  if (!reads) {
+    const p = { ...part.defaults, ...params };
+    sanitize?.(p);
+    return { p, d: resolveDerived(part, p) };
+  }
+  const resolved = resolveParamsAttributed(part, params, sanitize);
+  reads.attribution ??= resolved.attribution;
+  return recordedParams(resolved, reads);
 }
 
 // Build one sub-part and apply its optional place() for the given purpose/view.

package/src/framework/pose-fast-path.js

@@ -1,31 +1,104 @@
-// Decision layer of the pose fast path (no DOM, no three.js — viewer/cache are
-// injected). At mesh delivery each subpart is STAMPED with its probe result at
-// the delivered params; on a later edit, a stale subpart whose baseHash is
-// unchanged gets its delivered mesh re-posed in the viewer (delta vs. the
-// delivered pose) and is re-stamped current — no worker job. Everything else
-// falls through to the normal regen loop.
+// The pose ladder: the decision layer that poses delivered meshes in the viewer
+// without a worker job (no DOM, no three.js — viewer/cache are injected). Every
+// matrix it applies is ABSOLUTE relative to the delivered mesh, so nothing
+// accumulates across frames and setSubGeometry's matrix reset stays correct.
+//
+// A mesh's delivery frame (the mesh cache's stamp, spec §3–4) picks the rung:
+// The applied matrix is place(now) · delta (canonical) or delta (posed), where
+// delta is the stamp's stored build/full delta: identity at every delivery (and
+// after forget), set only by a rung-2 or posed repair. Storing it is what keeps a
+// later rung-1 pose or apply() (an unrelated param, a view switch) from snapping
+// a delta-repaired mesh back to its delivered pose while the cache says current.
+//
+// - canonical + current — rung 1: posed by place() at the live params
+//   (place-scope probe) over the stored delta. An untrusted live place() clears
+//   the pose and forgets the cache stamp so the regen loop rebuilds it (posed, at
+//   those params) — except on mount's fresh-delivery apply ({ fresh: true }),
+//   where the mesh was just built at these params: there the pose is cleared and
+//   the stamp kept, so a host/worker probe disagreement cannot loop
+//   forget→rebuild. A matrix equal to the one last applied is never re-sent to
+//   the viewer (setSubPose restarts the contact shadow), and repair() reports a
+//   rung-1 name only when its matrix actually CHANGED, so the debug `posed`
+//   count ("produced a pose and no job") stays honest during playback: a
+//   sub-part whose place() ignores the animated param is not counted.
+// - canonical + stale — rung 2: a trailing transform INSIDE build. When the live
+//   build-scope probe is trusted with the delivered baseHash, the delta becomes
+//   delta(build now, build delivered), the matrix place(now) · delta, and the
+//   mesh is re-stamped with the build's reads alone (place() reads are rung 1's).
+//   An untrusted live place() refuses the rung (Ruling F): the regen loop rebuilds.
+// - posed (the worker baked place() in): today's full-scope delta; apply()
+//   re-applies the stored delta.
+// Anything else falls through to the normal regen loop.
 import { viewSubParts } from "./part-model.js";
 import { probePoses } from "./pose-probe.js";
-import { poseDelta } from "./geometry/pose.js";
+import { composePose, poseDelta, mulMat4 } from "./geometry/pose.js";
 
 export function createPoseFastPath(part, viewer, cache, { params, getView, getParamsVersion }) {
-  const stamps = {}; // name -> probe entry captured when that subpart's mesh was delivered
+  // name -> { frame, entry, delta }: the delivery frame; at the delivered params,
+  // the build-scope probe entry (canonical — rung 2's baseline) or the
+  // full-scope one (posed); and the delta the last repair applied (null =
+  // identity, as delivered).
+  const stamps = {};
 
-  // Memoize the probe per (paramsVersion, view) — same discipline as
-  // createMeshCache's readsFor; params is the live in-place-mutated object.
-  let probeKey = null, probeMap = null;
-  const probeFor = () => {
+  // Three probe maps memoized per (paramsVersion, view), each computed lazily on
+  // first use — a part with no canonical sub-parts never runs the place or build
+  // probe, and vice versa. params is the live in-place-mutated object.
+  let probeKey = null, probeMaps = {};
+  const probe = (scope) => {
     const key = `${getParamsVersion()}|${getView()}`;
-    if (probeKey !== key) { probeKey = key; probeMap = probePoses(part, getView(), params); }
-    return probeMap;
+    if (probeKey !== key) { probeKey = key; probeMaps = {}; }
+    return (probeMaps[scope] ??= probePoses(part, getView(), params, { scope }));
   };
 
+  // The matrix this module last applied per name (null = cleared, absent =
+  // never applied: unknown). An unchanged matrix never reaches the viewer:
+  // setSubPose bumps the match generation and restarts the realistic contact
+  // shadow, and rung 1 re-poses every current canonical sub-part on every param
+  // change. recordDelivered/forget set null because setSubGeometry reset the
+  // matrix, so a delivery's first non-identity pose always lands. Returns true
+  // only when a non-null matrix actually changed (repair's rung-1 count).
+  const shown = {};
+  const same = (a, b) => a === b || (a != null && b != null && a.every((v, i) => v === b[i]));
+  const setPose = (name, m) => {
+    if (name in shown && same(shown[name], m)) return false;
+    shown[name] = m;
+    viewer.setSubPose(name, m);
+    return m != null;
+  };
+
+  // Pose each in-view, meshed name from its frame (an override wins over the
+  // cache stamp's — mount's stale-shown branch forgets the stamp first).
+  // `fresh` (mount's fresh-delivery call only): an untrusted live place() clears
+  // the pose but keeps the cache stamp — the mesh was just built at these very
+  // params, so forgetting would rebuild at identical params and disagree again.
+  // Returns the names given a CHANGED place pose (used by repair's count).
+  function poseByFrame(names, frames, { fresh = false } = {}) {
+    const moved = [];
+    const inView = new Set(viewSubParts(part, getView(), params));
+    for (const name of names) {
+      if (!inView.has(name) || !viewer.hasSubMesh(name)) continue;
+      const frame = frames?.[name] ?? cache.frameOf(name);
+      const delta = stamps[name]?.delta ?? null; // no stamp (stale-shown): as delivered
+      if (frame === "posed") { setPose(name, delta); continue; }
+      if (frame !== "canonical") continue; // unknown frame: nothing to say about the mesh
+      const now = probe("place").get(name);
+      if (!now?.trusted) { if (!fresh) cache.forget(name); setPose(name, null); continue; }
+      const place = composePose(now.pose);
+      if (setPose(name, delta ? mulMat4(place, delta) : place)) moved.push(name);
+    }
+    return moved;
+  }
+  const apply = (names, frames, opts) => { poseByFrame(names, frames, opts); };
+
   return {
-    // Stamp a freshly delivered mesh with its probe result at the current params.
-    // (The caller only records on non-stale builds — buildDone() guarantees the
-    // live params are the ones the worker built with.)
+    // Stamp a freshly delivered mesh with its probe baseline at the current
+    // params, by the frame the cache recorded for it. (The caller only records on
+    // non-stale builds — buildDone() guarantees the live params are the ones the
+    // worker built with.)
     recordDelivered(name) {
-      stamps[name] = probeFor().get(name);
+      const frame = cache.frameOf(name) ?? "posed";
+      stamps[name] = { frame, entry: probe(frame === "canonical" ? "build" : "full").get(name), delta: null };
+      shown[name] = null; // setSubGeometry just reset the mesh's matrix
     },
 
     // Drop a subpart's stamp: the mesh in the viewer is no longer known to
@@ -37,24 +110,55 @@ export function createPoseFastPath(part, viewer, cache, { params, getView, getPa
     // apply a delta measured against geometry that is no longer on screen.
     forget(name) {
       delete stamps[name];
+      shown[name] = null; // the shown-unrecorded mesh arrived with its matrix reset
     },
 
-    // Re-pose every visible stale subpart whose base geometry is unchanged.
-    // Returns the NAMES repaired (empty = nothing pose-only to do). Names, not a
-    // count: a slider drag repairs the same subpart on every input event, so only
-    // the caller's set union across a drag is a meaningful "how many were posed".
+    // Pose names right after a delivery or a view switch. See the header.
+    apply,
+
+    // One call per param change. Re-poses every visible current canonical
+    // subpart from place() (rung 1) and every visible stale subpart whose base
+    // geometry is unchanged (rung 2, posed delta). Returns the NAMES that change
+    // posed without a job — rung 2 and posed repairs always, rung 1 only when
+    // its matrix moved (empty = nothing pose-only to do). Names, not a count: a
+    // slider drag poses the same subpart on every input event, so only the
+    // caller's set union across a drag is meaningful.
     repair() {
-      const posed = [];
-      const poses = probeFor();
+      const posed = [], placeOnly = [];
       for (const name of viewSubParts(part, getView(), params)) {
-        if (cache.isCurrent(name) || !viewer.hasSubMesh(name)) continue;
-        const now = poses.get(name), was = stamps[name];
-        if (!now?.trusted || !was?.trusted || now.baseHash !== was.baseHash) continue;
-        viewer.setSubPose(name, poseDelta(now.pose, was.pose));
-        cache.record(name); // current again at these params — regen loop sees nothing missing
+        if (!viewer.hasSubMesh(name)) continue;
+        if (cache.isCurrent(name)) {
+          if (cache.frameOf(name) === "canonical") placeOnly.push(name);
+          continue;
+        }
+        const was = stamps[name];
+        if (!was?.entry?.trusted) continue;
+        let matrix, delta, now;
+        if (was.frame === "canonical") {
+          now = probe("build").get(name);
+          if (!now?.trusted || now.baseHash !== was.entry.baseHash) continue;
+          const place = probe("place").get(name);
+          if (!place?.trusted) continue;
+          delta = poseDelta(now.pose, was.entry.pose);
+          matrix = mulMat4(composePose(place.pose), delta);
+        } else {
+          now = probe("full").get(name);
+          if (!now?.trusted || now.baseHash !== was.entry.baseHash) continue;
+          matrix = delta = poseDelta(now.pose, was.entry.pose);
+        }
+        was.delta = delta;
+        setPose(name, matrix);
+        // Same geometry, new pose: the delivered build's reads plus whatever the
+        // probe read at THIS pose, re-hashed at the live params (spec §2), keeping
+        // the delivery frame. A canonical stamp takes the build-scope probe's
+        // reads only — place() reads stay out, since rung 1 owns them (spec §3:
+        // recorded keys are the build's); a posed one the full scope's. An
+        // unknown stamp stays unknown.
+        const had = cache.readsOf(name);
+        cache.record(name, had ? [...had, ...(now.reads ?? [])] : undefined, getView(), was.frame); // current again — regen loop sees nothing missing
         posed.push(name);
       }
-      return posed;
+      return [...poseByFrame(placeOnly), ...posed];
     },
   };
 }

package/src/framework/pose-probe-core.js

@@ -5,7 +5,9 @@
 // are never compared to backend hashes, so they only need to be stable and to
 // fold every geometry-affecting argument.
 //
-// Trust model: any query op (boundingBox/volume/…) during a build marks that
+// Trust model (applies PER SCOPE — "full" = build+place, "build" = build alone,
+// "place" = place() alone on a canonical token whose rigidity test is its hash
+// staying CANONICAL): any query op (boundingBox/volume/…) during a build marks that
 // subpart untrusted — a query result could feed geometry OR pose, and the probe
 // returns dummies, so neither hash stability nor pose values can be believed.
 // A FUNCTION passed as (or nested inside) an op argument is untrusted for the
@@ -19,6 +21,9 @@ import { addSugar } from "./geometry/solid-sugar.js";
 import { SOLID_OPS, SOLID_OPTIONAL_OPS, SHAPE2D_OPS, OCCT_ONLY_OPS } from "./geometry/kernel.js";
 import { MAX_PROBE_OPS, ProbeRunawayError } from "./geometry/probe.js";
 
+// The fixed hash a place-scope probe starts from; a rigid place() leaves it unchanged.
+export const CANONICAL = h("canonical");
+
 const NAN3 = () => [NaN, NaN, NaN];
 
 function makeProbeSession() {
@@ -102,7 +107,7 @@ function makeProbeSession() {
     },
   });
 
-  return { kernel, state };
+  return { kernel, state, token };
 }
 
 const finiteVec = (v) => Array.isArray(v) && v.length === 3 && v.every(Number.isFinite);
@@ -111,16 +116,26 @@ const stepsFinite = (steps) => steps.every((st) =>
     ? finiteVec(st.v)
     : Number.isFinite(st.deg) && finiteVec(st.center) && finiteVec(st.axis));
 
-// Probe ONE sub-part's build+place at explicit params/purpose. The shared
-// primitive under probePoses (pose-probe.js) and the lint place/animation
-// rules — kept free of jobs.js imports so the lint import closure stays pure
-// (test/lint-purity.test.js). Never throws; a failing/queried/weird sub-part
-// yields { trusted: false }.
-export function probeSubPartPose(sp, { view, purpose = "display", p, d }) {
+// Probe ONE sub-part at explicit params/purpose. The shared primitive under
+// probePoses (pose-probe.js) and the lint place/animation rules — kept free of
+// jobs.js imports so the lint import closure stays pure (test/lint-purity.test.js).
+// Never throws; a failing/queried/weird sub-part yields { trusted: false }.
+// scope: "full" (build then place), "build" (build only), "place" (place() on a
+// canonical token; no build runs, so a querying build is irrelevant). In place
+// scope a readable but reshaping place() (scale/mirror/union) returns
+// { trusted: false, baseHash, pose } with baseHash !== CANONICAL — see Ruling A.
+export function probeSubPartPose(sp, { view, purpose = "display", p, d }, { scope = "full" } = {}) {
   try {
-    const { kernel, state } = makeProbeSession(); // fresh op budget + trust per subpart
+    const { kernel, state, token } = makeProbeSession(); // fresh op budget + trust per subpart
+    if (scope === "place") {
+      let s = token(CANONICAL, []);
+      if (!sp.place) return { trusted: true, baseHash: CANONICAL, pose: [] };
+      s = sp.place(s, { view, purpose, p, d });
+      if (!(s && s.__poseToken) || state.queried || state.unhashable || !stepsFinite(s._pose)) return { trusted: false };
+      return { trusted: s._hash === CANONICAL, baseHash: s._hash, pose: s._pose };
+    }
     let s = sp.build(kernel, p, d);
-    if (sp.place) s = sp.place(s, { view, purpose, p, d });
+    if (scope === "full" && sp.place) s = sp.place(s, { view, purpose, p, d });
     const ok = s && s.__poseToken && !state.queried && !state.unhashable && stepsFinite(s._pose);
     return ok ? { trusted: true, baseHash: s._hash, pose: s._pose } : { trusted: false };
   } catch {

package/src/framework/pose-probe.js

@@ -3,7 +3,8 @@
 // walks the view's sub-parts; it stays separate so lint can import the core
 // without dragging in the part-model/jobs layer (purity).
 import { probeSubPartPose } from "./pose-probe-core.js";
-import { viewSubParts, resolveParams } from "./part-model.js";
+import { viewSubParts, resolveParamsAttributed, recordedParams } from "./part-model.js";
+import { newReadSink, expandReads } from "./read-recorder.js";
 // From the import-free leaf, never fonts/images/vectors.js: vectors.js reaches paper
 // (test/mount-no-paper.test.js).
 import { fontsFor, imagesFor, vectorsFor } from "./asset-decls.js";
@@ -26,20 +27,26 @@ function assetSources(part, p) {
 
 // Probe every subpart the view shows. Never throws; a failing/queried/weird
 // subpart yields { trusted: false } and the others still probe.
-export function probePoses(part, view, params) {
+export function probePoses(part, view, params, { scope = "full", purpose = "display" } = {}) {
   const out = new Map();
   let resolved, assets;
   try {
-    resolved = resolveParams(part, params);
+    resolved = resolveParamsAttributed(part, params);
     assets = h("assets", JSON.stringify(assetSources(part, resolved.p), byteAwareReplacer));
   } catch {
     for (const name of viewSubParts(part, view, params)) out.set(name, { trusted: false });
     return out;
   }
-  const { p, d } = resolved;
   for (const name of viewSubParts(part, view, params)) {
-    const entry = probeSubPartPose(part.parts[name], { view, purpose: "display", p, d });
-    out.set(name, entry.trusted ? { ...entry, baseHash: h("with-assets", entry.baseHash, assets) } : entry);
+    const sink = newReadSink();
+    sink.attribution = resolved.attribution;
+    const rec = recordedParams(resolved, sink);
+    const entry = probeSubPartPose(part.parts[name], { view, purpose, p: rec.p, d: rec.d }, { scope });
+    // Assets fold in only outside place scope: a place probe hashes nothing
+    // geometry-dependent, and the mesh cache's asset reads cover the font case.
+    out.set(name, entry.trusted
+      ? { ...entry, baseHash: scope === "place" ? entry.baseHash : h("with-assets", entry.baseHash, assets), reads: expandReads(sink) }
+      : entry);
   }
   return out;
 }

package/src/framework/read-recorder.js

@@ -0,0 +1,50 @@
+// Read recording shared by the relevance PREDICTION (param-deps.js, against the
+// probe kernel) and the REAL build path (part-model.js resolveParams, jobs.js,
+// the oracle). A LEAF: no imports, so part-model.js may depend on it.
+//
+// Three traps record: get (p.x), has ("x" in p), ownKeys (Object.keys / spread /
+// entries / JSON.stringify — enumerating p makes the result depend on every key).
+// Default: a shallow CLONE, so a probe build can't mutate the caller's params.
+// `through: true` wraps the object itself — the real path, where derive() and
+// build() must see each other's writes exactly as they did unrecorded.
+export function recorder(obj, seen, { through = false } = {}) {
+  return new Proxy(through ? obj : { ...obj }, {
+    get(target, key) {
+      if (typeof key === "string" && key !== "then" && key !== "toJSON") seen.add(key);
+      return Reflect.get(target, key);
+    },
+    has(target, key) {
+      if (typeof key === "string" && key !== "then" && key !== "toJSON") seen.add(key);
+      return Reflect.has(target, key);
+    },
+    ownKeys(target) {
+      const keys = Reflect.ownKeys(target);
+      for (const k of keys) if (typeof k === "string") seen.add(k);
+      return keys;
+    },
+  });
+}
+
+// One build's reads: raw param keys, derived keys, and the derive attribution
+// that maps the second onto the first (set by resolveParams).
+export function newReadSink() {
+  return { raw: new Set(), dSeen: new Set(), attribution: null };
+}
+
+// Raw params behind a build's reads. With no per-key attribution (single-function
+// derive, or a key no group produced) every derive input counts — coarser, sound.
+export function expandDerivedReads(raw, dSeen, attribution) {
+  const out = new Set(raw);
+  if (dSeen.size === 0) return out;
+  const depsOf = attribution?.depsOf;
+  if (depsOf && [...dSeen].every((k) => depsOf.has(k))) {
+    for (const k of dSeen) for (const dep of depsOf.get(k)) out.add(dep);
+  } else {
+    for (const dep of attribution?.allInputs ?? []) out.add(dep);
+  }
+  return out;
+}
+
+export function expandReads(sink) {
+  return [...expandDerivedReads(sink.raw, sink.dSeen, sink.attribution)].sort();
+}

package/src/framework/selection/resolve.js

@@ -1,6 +1,6 @@
 // Pure core: turn a backend-agnostic raycast hit into a semantic Selection.
 // No three.js, no DOM, no kernel — only the param-deps read-key analysis.
-import { subPartReadKeys, RELEVANT_ALL } from "../param-deps.js";
+import { subPartParamKeys } from "../param-deps.js";
 
 const COS_3DEG = 0.99863; // a normal within 3° of an axis snaps to that axis
 const q2 = (x) => { const r = Math.round(x * 100) / 100; return r === 0 ? 0 : r; }; // 0.01mm, kill -0
@@ -23,14 +23,12 @@ export function snapNormal(n) {
   return [q2(u[0]), q2(u[1]), q2(u[2])];
 }
 
-// Only the params the clicked sub-part actually reads — "this geometry, at these inputs".
-function scopeParams(part, view, params, subPart) {
-  const reads = subPartReadKeys(part, view, params);
-  const keys = reads === RELEVANT_ALL
-    ? Object.keys(params)
-    : [...(reads.get(subPart) ?? Object.keys(params))];
+// Only the params the clicked sub-part reads — "this geometry, at these inputs".
+// Recorded from its last real build when the host passes ctx.readsOf (mount's
+// mesh cache), else predicted (param-deps.subPartParamKeys).
+function scopeParams(part, ctx, subPart) {
   const out = {};
-  for (const k of keys) out[k] = params[k];
+  for (const k of subPartParamKeys(part, ctx.view, ctx.params, ctx.readsOf, subPart)) out[k] = ctx.params[k];
   return out;
 }
 
@@ -40,7 +38,7 @@ export function resolveSelection(part, ctx, hit) {
     subPart: hit.subPart,
     point,
     normal: snapNormal(hit.normalLocal),
-    params: scopeParams(part, ctx.view, ctx.params, hit.subPart),
+    params: scopeParams(part, ctx, hit.subPart),
   };
   // Feature attribution from the mesh payload (Solid.label() in the part's build) —
   // the same name the hover tooltip shows, so user, agent, and viewer share vocabulary.

package/types/derive.d.ts

@@ -12,3 +12,17 @@ import type { Derived, PartDefinition, ResolvedParams } from "./part.js";
  * Returns `{}` when the part declares no `derive`.
  */
 export function resolveDerived(part: Pick<PartDefinition, "derive">, p: ResolvedParams): Derived;
+
+/**
+ * Resolve a part's `derive` plus attribution: which raw params each derived key came from.
+ *
+ * Produces the same `d` as `resolveDerived`, throws its errors, and (with `through`)
+ * leaves its writes on `p`. For grouped forms, `depsOf` maps each key to its group's
+ * raw reads, transitively through earlier groups it read. For single-function form,
+ * `depsOf` is null.
+ */
+export function resolveDerivedAttributed(
+  part: Pick<PartDefinition, "derive">,
+  p: ResolvedParams,
+  options?: { through?: boolean }
+): { d: Derived; depsOf: Map<string, Set<string>> | null; allInputs: Set<string> };

package/types/index.d.ts

@@ -617,6 +617,8 @@ export interface PartRuntime {
   getPanelState(): PanelState;
   /** What custom controls reported failing this mount, in order. */
   getPanelErrors(): PanelError[];
+  /** The param keys that shape a pick: the clicked sub-part's recorded build reads (else predicted, else all). */
+  controlsFor(selection: { subPart: string }): string[];
   /**
    * Subscribe to WebGL context loss — i.e. the GPU or the OS gave up — so a host
    * can say so rather than showing a dead canvas. The listener takes no