openscript 0.4.0__py3-none-any.whl

openscript/surface/plots.py

@@ -0,0 +1,44 @@
+"""What the other surfaces need of a plot: the column a declared key names.
+
+A plot's own column is not a surface channel. ``conformance.md`` section 4 puts
+one value per bar in ``expected.csv``, one column per plot, and the adapter
+reads a column's name against this program's plots and takes the channel behind
+it. That is where a plot's values are compared and this module does not repeat
+it. What is here is the one question the band next door asks: which channel does
+a plot key name, since ``compiled-program.md`` 2.8 carries a band's two sides as
+the plot keys of ``fills[].between`` rather than as channels.
+
+**A plot's per-bar colour has no channel to be asserted through, and that is a
+gap in the page rather than in this engine.** 2.8 gives a plot a
+``colorChannel`` for the bars where the colour is computed rather than declared,
+and 4.11 lists "a plot's per-bar colour" among the values an ``EMIT`` writes, so
+it is a per-bar output like any other. Section 2's list of channels a case may
+assert has no name for it: ``values`` names a plot by its title or its key and
+reads the channel carrying its value, and there is no spelling that would reach
+the colour beside it. So a study that paints a histogram by sign produces output
+no case can compare, on either engine. The same is true of the four colour
+channels of a candle. The stage's report carries it.
+"""
+
+from typing import Any, Dict
+
+from ..diagnostics import ScriptError, malformed
+
+
+def channel_of_key(raw: Dict[str, Any], key: Any, path: str) -> int:
+    """The channel of the plot a declaration names by key, 2.8's ``between``.
+
+    A key naming no declared plot is OS6018 at the field that named it, which is
+    the code 3.5 check 1 refuses an index out of range with. This engine's
+    verification reads the indexes and not this pair of names, so a band drawn
+    between a column the program never declared would otherwise be a band drawn
+    nowhere and nothing said. The stage's report carries the change that moves
+    the refusal into verification, where the rest of check 1 is.
+    """
+    for one in raw["outputs"]["plots"]:
+        if one.get("key") == key:
+            return int(one["channel"])
+    raise ScriptError(
+        malformed(path, f"names the plot {key!r} and this program declares no plot with that key")
+    )
+

openscript/surface/published.py

@@ -0,0 +1,119 @@
+"""What a bar left the machine, after however many times that bar was executed.
+
+Every surface here is read from the same two things: the columns step 8
+published for a bar, and the deferred channels step 9 applied on it
+(``compiled-program.md`` 5.1). This module turns a run's executions into that
+pair, once, so that no surface module counts a bar twice or reads a channel the
+engine held back.
+
+**The last execution of a bar is the bar.** Section 6.4: a bar that
+re-executes has rolled its state back first, so the set of drawings after five
+updates to a moving bar is the set after one. An engine that appended a marker
+per execution would draw five where a host redrawing what it is handed draws
+one, and the difference would only ever show up on a live chart. So an
+execution of a bar replaces the one before it rather than adding to it.
+
+**A deferred channel reaches a host only on a bar the engine decided.** Section
+5.4 holds back the channels declared ``defer``, which are the markers and the
+alert conditions, until step 9, and step 9 runs only on a bar that was confirmed
+or under ``meta.onUnconfirmed``. ``reached`` is that rule, and it is asked of
+every channel rather than of the markers alone: a channel that is not deferred
+is published at step 8 on every execution, and a surface that assumed which of
+its channels carried the flag would be reading the compiler's habits rather than
+the program in front of it.
+
+**A field the verifier does not reach is checked here.** ``compiled-program.md``
+3.5 check 1 holds every index into the channel table in range, and this engine's
+verification reads the required ones: a plot's ``channel``, a level's, a
+marker's, an alert's ``condChannel`` and the two paint channels. The nullable
+ones beside them, ``plots[].colorChannel``, ``fills[].colorUpChannel``,
+``fills[].colorDownChannel``, the four of ``plots[].ohlc`` and an alert's
+``messageChannel``, are not read there, so a program naming a channel past the
+end of the table would be read past the end of a list here. ``channel_named``
+refuses it with OS6018 naming the field, which is the code check 1 refuses with,
+rather than answering a colour nobody wrote. The stage's report carries the
+verification change that would make this unreachable.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional, Sequence
+
+from ..diagnostics import ScriptError, malformed
+from ..program import LoadedProgram
+from ..run import BarResult
+from ..values import ABSENT
+
+
+@dataclass(frozen=True)
+class Published:
+    """One bar, as the last execution of it left the machine.
+
+    ``columns`` is what step 8 published and ``applied`` is the deferred
+    channels step 9 applied, which is empty on a bar the engine did not decide.
+    """
+
+    index: int
+    columns: Sequence[Any]
+    applied: Sequence[int]
+
+
+def published(executions: Sequence[BarResult]) -> List[Published]:
+    """Every bar the run published, in bar order, each as its last execution.
+
+    An execution that failed published nothing: ``run.py`` returns the columns
+    the bar began with and a diagnostic, and the bar keeps whatever a previous
+    execution published, which is section 5.1's own sentence about an error
+    during step 6. So a failed execution is not a bar here, and a bar that
+    failed after an earlier execution succeeded keeps that earlier one.
+    """
+    found: Dict[int, Published] = {}
+    for one in executions:
+        if one.diagnostic is not None:
+            continue
+        found[one.index] = Published(one.index, list(one.columns), list(one.applied_channels))
+    return [found[at] for at in sorted(found)]
+
+
+def reached(program: LoadedProgram, bar: Published, channel: int) -> bool:
+    """Whether what a channel held for this bar reached the host, section 5.4."""
+    if channel < 0 or channel >= len(program.defer):
+        return False
+    if program.defer[channel]:
+        return channel in bar.applied
+    return True
+
+
+def value_of(program: LoadedProgram, bar: Published, channel: int) -> Any:
+    """What a channel held for this bar, or absence where nothing reached the host.
+
+    Absence is the whole of the rule 2.7 states and 18 repeats: a channel
+    nothing wrote is absent, and absence reaching a surface is a gap in a plot,
+    no marker, a bar left its own colour. Never a zero and never a default.
+    """
+    if not reached(program, bar, channel):
+        return ABSENT
+    if channel < 0 or channel >= len(bar.columns):
+        return ABSENT
+    return bar.columns[channel]
+
+
+def channel_named(raw: Dict[str, Any], holder: Any, field: str, path: str) -> Optional[int]:
+    """A channel a nullable declaration field names, held to the program's table.
+
+    ``None`` where the field is null, which is what every one of these fields
+    holds in the common case: a plot with a constant colour, a band with two,
+    an alert with no message.
+    """
+    held = holder.get(field)
+    if held is None:
+        return None
+    count = len(raw["channels"])
+    whole = isinstance(held, int) and not isinstance(held, bool)
+    if not whole or held < 0 or held >= count:
+        raise ScriptError(
+            malformed(
+                f"{path}.{field}",
+                f"names channel {held} and the program declares {count} of them",
+            )
+        )
+    return held

openscript/values.py

@@ -0,0 +1,210 @@
+"""The six things a value on this machine can be, and what absence does to each.
+
+``compiled-program.md`` section 3.1 fixes the set and the rules that hold
+everywhere, and section 7 says the whole of warmup is the absent value. So this
+module is the one place absence is decided, and every instruction in
+``machine.py`` reaches it through the operations below rather than testing for
+absence itself. An engine that special cases absence anywhere else has a bug.
+
+**Absence is a tag and never a number.** A sentinel such as not-a-number would
+make absence propagate through arithmetic by accident, which is the right answer
+for four operators and the wrong answer for six, and it would turn equality into
+a floating point comparison. Here it is this interpreter's own null: the pool
+entry ``["z", null]`` on the way in, and the ``null`` section 3.4 requires on the
+way out to a host, with nothing to convert at either boundary.
+
+**A number is a float and always finite.** Every arithmetic result goes through
+``finite``, which answers absence for anything that is not, checked after each
+individual operation rather than at the end of an expression: ``(1e308 * 10) /
+10`` is absent and not ``1e307``. The same function normalises a negative zero
+away, at every result and every store, because nothing in the language can
+observe the sign of a zero and a difference nobody can act on is still a
+difference two engines could reach text with.
+
+**A boolean is not a number here.** This interpreter's own ``True`` is equal to
+``1`` and orders against it, so every comparison below reads the tag first. That
+single habit is what keeps ``true == 1`` false, as ``language.md`` section 9.3
+requires, and it is the mistake this module exists to make unavailable.
+"""
+
+import math
+from dataclasses import dataclass, field
+from typing import Any, List
+
+#: The absent value, written ``none`` in a script.
+#:
+#: The library package spells it the same way, and the two have to agree: a
+#: value crosses that boundary on every ``CALL_LIB``, in both directions.
+ABSENT = None
+
+
+@dataclass(frozen=True)
+class Colour:
+    """Red, green and blue as whole numbers from 0 to 255, alpha from 0 to 1."""
+
+    red: float
+    green: float
+    blue: float
+    alpha: float
+
+
+class Reference:
+    """Something in the object heap. Equality on two of them is identity."""
+
+    __slots__ = ()
+
+
+@dataclass(eq=False)
+class ArrayValue(Reference):
+    """An array. ``ARRAY`` allocates a new one every time it executes."""
+
+    elements: List[Any] = field(default_factory=list)
+
+
+def is_absent(value: Any) -> bool:
+    return value is ABSENT
+
+
+def tag(value: Any) -> str:
+    """The value's tag, in the spelling section 3.1's table uses."""
+    if value is ABSENT:
+        return "absent"
+    if isinstance(value, bool):
+        return "bool"
+    if isinstance(value, (int, float)):
+        return "number"
+    if isinstance(value, str):
+        return "string"
+    if isinstance(value, Colour):
+        return "color"
+    if isinstance(value, Reference):
+        return "reference"
+    return "unknown"
+
+
+def finite(result: float) -> Any:
+    """An arithmetic result: absent when it is not finite, and never a minus zero."""
+    if not math.isfinite(result):
+        return ABSENT
+    return 0.0 if result == 0.0 else float(result)
+
+
+def stored(value: Any) -> Any:
+    """A value on its way into a slot, a cell, a register or a channel.
+
+    Section 8.1 normalises a negative zero at every store as well as at every
+    result, because a value can reach a store without an arithmetic instruction
+    having touched it: a library function's answer, or a constant.
+    """
+    if is_number(value) and value == 0.0:
+        return 0.0
+    return value
+
+
+def is_number(value: Any) -> bool:
+    """Whether a value is a number, which a bool is not."""
+    return isinstance(value, (int, float)) and not isinstance(value, bool)
+
+
+def is_whole(value: Any) -> bool:
+    """A number with nothing after the point, which is what a history index must be."""
+    return is_number(value) and math.isfinite(value) and float(value) == math.floor(value)
+
+
+def equal(left: Any, right: Any) -> bool:
+    """``EQ``: total, and always a boolean.
+
+    Absent equals absent and equals nothing else. Two colours are equal when all
+    four channels match. Two references are equal when they are the same object,
+    which is why the library has a call for comparing an array's contents.
+    """
+    left_tag, right_tag = tag(left), tag(right)
+    if left_tag != right_tag:
+        return False
+    if left_tag == "absent":
+        return True
+    if left_tag == "reference":
+        return left is right
+    return bool(left == right)
+
+
+def ordered(left: Any, right: Any) -> Any:
+    """The comparison the four ordering instructions share: -1, 0, 1, or absent.
+
+    Absence propagates rather than answering false, which is ``language.md``
+    section 6.4 and the one thing that keeps a warming up study from drawing a
+    confident line. Two numbers compare numerically and two strings by code
+    point; anything else is a program the checker should have rejected, and an
+    engine answers it with absence rather than inventing a conversion.
+    """
+    if left is ABSENT or right is ABSENT:
+        return ABSENT
+    both_numbers = is_number(left) and is_number(right)
+    both_strings = isinstance(left, str) and isinstance(right, str)
+    if not both_numbers and not both_strings:
+        return ABSENT
+    if left < right:
+        return -1.0
+    return 1.0 if left > right else 0.0
+
+
+#: The three valued conjunction of ``language.md`` section 6.6, as a table.
+#:
+#: Written out rather than computed so that the page and the code are read side
+#: by side. Each table holds only the cases its short circuit leaves to it:
+#: ``AND_SHORT`` has already decided a false left operand, ``OR_SHORT`` a true
+#: one, and absence on the left short circuits neither because the other side
+#: can still decide the answer by itself. A pair neither table holds cannot
+#: arise once the short circuit has run, and a program that produced one is
+#: corrupt rather than unusual, so it is answered with absence rather than with
+#: a row this page never wrote.
+_ABSENT_KEY = "absent"
+
+_AND = {
+    (True, True): True,
+    (True, False): False,
+    (True, _ABSENT_KEY): ABSENT,
+    (_ABSENT_KEY, True): ABSENT,
+    (_ABSENT_KEY, False): False,
+    (_ABSENT_KEY, _ABSENT_KEY): ABSENT,
+}
+
+_OR = {
+    (False, True): True,
+    (False, False): False,
+    (False, _ABSENT_KEY): ABSENT,
+    (_ABSENT_KEY, True): True,
+    (_ABSENT_KEY, False): ABSENT,
+    (_ABSENT_KEY, _ABSENT_KEY): ABSENT,
+}
+
+
+def _key(value: Any) -> Any:
+    """A boolean, or the stand-in the two tables are keyed by for anything else."""
+    return value if isinstance(value, bool) else _ABSENT_KEY
+
+
+def conjunction(left: Any, right: Any) -> Any:
+    return _AND.get((_key(left), _key(right)), ABSENT)
+
+
+def disjunction(left: Any, right: Any) -> Any:
+    return _OR.get((_key(left), _key(right)), ABSENT)
+
+
+def negation(value: Any) -> Any:
+    """``NOT``: true becomes false, false becomes true, absent stays absent."""
+    if isinstance(value, bool):
+        return not value
+    return ABSENT
+
+
+def truthy(value: Any) -> bool:
+    """What ``JUMP_FALSE`` asks.
+
+    The one place absence is absorbed rather than propagated, and it is
+    unavoidable: execution has to go somewhere. It serves ``if``, ``else if``,
+    ``while``, the ternary and a ``switch`` arm, so the rule is written once
+    here and once in the instruction that reads it.
+    """
+    return value is True

openscript/verify.py

@@ -0,0 +1,301 @@
+"""Load-time verification, section 3.5, and the refusals a host makes beside it.
+
+Before executing a single bar an engine must verify the program. What is bought
+by doing it here rather than discovering a problem halfway through a bar is
+stated in the specification and is the reason the interpreter next door is as
+plain as it is: a verified program cannot underflow the stack, cannot jump out
+of bounds, cannot address a slot that does not exist and cannot loop without
+charging the budget. Every remaining failure is a script error with a source
+position, which is the only kind of failure a user should ever see.
+
+Three refusals that are not verification sit here too, because they happen at
+the same moment and for the same reason: a version this engine does not
+implement (OS6016, OS6017), a capability it does not have (OS6006) and a library
+entry that disagrees with its manifest (OS6004). The fourth, the budgets a host
+is willing to spend, is ``budget.py``: that is a question about this host rather
+than about this program, and two hosts may honestly answer it differently.
+
+**The order of those refusals is the specification's, 9.4, and not an accident
+of where the code grew.** It is an ordered list that stops at the first failure,
+so a program that is wrong in two ways reports the one the list reaches first,
+and two engines hand the same program the same message. Each step below says
+which number it is.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional, Sequence, Tuple
+
+from .budget import EngineLimits, all_code, check_budgets
+from .contracts import Library, NoLibrary
+from .diagnostics import Diagnostic, failure, malformed
+from .verify_code import ListLimits, check_list, check_once, missing_tag
+from .verify_shape import ShapeCheck
+from .verify_tables import check_tables
+from .version import FORMAT, LANGUAGE_VERSIONS, format_major
+
+#: What this engine can do on its own, as the tags of section 2.2.
+#:
+#: Five of the ten, and the five that are the machine's. The others are not
+#: refusals of this module's making: ``orders`` needs an order route and a
+#: ledger, ``objects`` and ``tables`` need the library calls that build one, and
+#: the two read tags need bars this engine is not given. Each is added by the
+#: stage that serves it, through ``capabilities`` below, so a program that needs
+#: one is refused at load naming the feature rather than drawing a study with a
+#: silently empty line through it.
+MACHINE_CAPABILITIES: Tuple[str, ...] = ("core.1", "arrays", "functions", "loops", "alerts")
+
+
+def capabilities(*served: str) -> Tuple[str, ...]:
+    """The machine's tags, plus whatever the stages wired in this run serve."""
+    return MACHINE_CAPABILITIES + tuple(tag for tag in served if tag not in MACHINE_CAPABILITIES)
+
+
+@dataclass(frozen=True)
+class VerifyOptions:
+    capabilities: Sequence[str] = MACHINE_CAPABILITIES
+    limits: EngineLimits = EngineLimits()
+    library: Library = NoLibrary()
+
+
+@dataclass(frozen=True)
+class VerifyResult:
+    program: Optional[Dict[str, Any]]
+    diagnostic: Optional[Diagnostic]
+
+    @property
+    def ok(self) -> bool:
+        return self.diagnostic is None
+
+
+def _major_of(version: str) -> Optional[int]:
+    parts = version.split(".")
+    if not parts or not all(part.isdigit() for part in parts):
+        return None
+    return int(parts[0])
+
+
+def verify(raw: Any, options: VerifyOptions = VerifyOptions()) -> VerifyResult:
+    """Steps 2 to 8 of section 9.4, stopping at the first failure."""
+    shape = ShapeCheck()
+
+    def broken() -> VerifyResult:
+        found = shape.problem()
+        if found is None:
+            found = malformed("the program", "it is not a compiled program")
+        return VerifyResult(None, found)
+
+    def refused(diagnostic: Diagnostic) -> VerifyResult:
+        return VerifyResult(None, diagnostic)
+
+    if not shape.object(raw, "the program"):
+        return broken()
+    version = raw.get("openscript")
+    if not shape.object(version, "openscript"):
+        return broken()
+    if not shape.string(version.get("format"), "openscript.format"):
+        return broken()
+    if not shape.whole(version.get("language"), "openscript.language"):
+        return broken()
+
+    # Steps 2 and 3: the major decides, and a minor in either direction loads.
+    major = _major_of(version["format"])
+    if major is None:
+        shape.fail("openscript.format", "a version of the form major.minor was required")
+        return broken()
+    if major != format_major():
+        return refused(failure("OS6016", found=version["format"], max=FORMAT))
+
+    # Step 1's other half: the tables every later step indexes into.
+    if not check_tables(shape, raw):
+        return broken()
+
+    # Step 4, and it comes before the language version on purpose: a program
+    # that is both compiled from a language this engine lacks and dependent on a
+    # capability it lacks reports the capability, which names the feature that
+    # was refused rather than a number the reader has to look up.
+    for tag in raw["requires"]:
+        if not isinstance(tag, str):
+            return VerifyResult(None, malformed("requires", "a capability tag is a string"))
+        if tag not in options.capabilities:
+            return refused(failure("OS6006", tag=tag))
+
+    # Step 5.
+    language = raw["openscript"]["language"]
+    if language not in LANGUAGE_VERSIONS:
+        return refused(
+            failure(
+                "OS6017",
+                found=language,
+                versions=", ".join(str(one) for one in LANGUAGE_VERSIONS),
+            )
+        )
+
+    # Step 6.
+    disagreement = _check_library(raw, options.library)
+    if disagreement is not None:
+        return refused(disagreement)
+
+    # Step 7.
+    over = check_budgets(raw, options.limits)
+    if over is not None:
+        return refused(over)
+
+    # Step 8, which is section 3.5 itself.
+    sizes = _table_sizes(raw)
+    if not check_list(shape, "code", raw["code"], sizes, "HALT"):
+        return broken()
+    for at in range(len(raw["functions"])):
+        body = raw["functions"][at]["code"]
+        if not check_list(shape, f"functions[{at}]", body, _body_sizes(sizes, raw, at), "RET"):
+            return broken()
+    if not check_once(shape, raw["code"], [one["once"] for one in raw["channels"]]):
+        return broken()
+    # 2.16.1: a read's body is an instruction list the same machine walks, so it
+    # gets the same walk. Its terminator is RET rather than HALT, because a body
+    # produces a value and HALT does not.
+    if not _check_bodies(shape, "requests", raw["requests"], sizes):
+        return broken()
+
+    # Check 8, the program's half: an instruction whose tag it never declared.
+    missing = missing_tag(all_code(raw), raw["requires"])
+    if missing is not None:
+        return refused(
+            failure(
+                "OS6018",
+                location="requires",
+                reason=f"the program uses {missing['opcode']} and does not declare {missing['tag']}",
+            )
+        )
+
+    return VerifyResult(raw, None)
+
+
+def _check_library(raw: Any, library: Library) -> Optional[Diagnostic]:
+    """Check 9: every ``lib.functions`` entry agrees with this engine's manifest.
+
+    This catches a program compiled against a newer library before it computes a
+    single wrong number, which is why the entries carry facts the engine already
+    knows: they are there to be disagreed with.
+    """
+    for at, entry in enumerate(raw["lib"]["functions"]):
+        mine = library.entry(entry["name"], entry["arity"])
+        if mine is None:
+            return failure(
+                "OS6004",
+                index=at,
+                name=entry["name"],
+                arity=entry["arity"],
+                manifest=library.describe(entry["name"]),
+            )
+        if mine.state != entry["state"] or mine.effect != entry["effect"]:
+            held = f"{entry['name']} holding state {mine.state} with effect {mine.effect}"
+            return failure(
+                "OS6004", index=at, name=entry["name"], arity=entry["arity"], manifest=held
+            )
+    return None
+
+
+def _argc_reader(sites: Sequence[Any]):
+    def argc_of(site: int) -> int:
+        return sites[site]["argc"] if 0 <= site < len(sites) else 0
+
+    return argc_of
+
+
+def _table_sizes(raw: Any) -> ListLimits:
+    return ListLimits(
+        slots=raw["frame"]["slots"],
+        cells=len(raw["cells"]),
+        states=len(raw["states"]),
+        registers=len(raw["series"]),
+        channels=len(raw["channels"]),
+        libFunctions=len(raw["lib"]["functions"]),
+        callSites=len(raw["callSites"]),
+        loops=len(raw["loops"]),
+        consts=len(raw["consts"]),
+        bindings=0,
+        argc_of=_argc_reader(raw["callSites"]),
+    )
+
+
+def _bindings_for(sites: Sequence[Any], fn: int) -> int:
+    """How many series bindings a ``HISTP`` inside this function body may index.
+
+    Every site that calls the function has to bind the same number, because the
+    operand is fixed in the body, so the smallest binding list is the one that
+    decides what is in range.
+    """
+    found = 0
+    for site in sites:
+        if site["fn"] != fn:
+            continue
+        found = len(site["series"]) if found == 0 else min(found, len(site["series"]))
+    return found
+
+
+def _with(sizes: ListLimits, **changed: Any) -> ListLimits:
+    fields = dict(
+        slots=sizes.slots,
+        cells=sizes.cells,
+        states=sizes.states,
+        registers=sizes.registers,
+        channels=sizes.channels,
+        libFunctions=sizes.libFunctions,
+        callSites=sizes.callSites,
+        loops=sizes.loops,
+        consts=sizes.consts,
+        bindings=sizes.bindings,
+        argc_of=sizes.argc_of,
+    )
+    fields.update(changed)
+    return ListLimits(**fields)
+
+
+def _body_sizes(base: ListLimits, raw: Any, fn: int) -> ListLimits:
+    return _with(
+        base,
+        slots=raw["functions"][fn]["slots"],
+        bindings=_bindings_for(raw["callSites"], fn),
+    )
+
+
+def _check_bodies(
+    shape: ShapeCheck, prefix: str, requests: Sequence[Any], outer: ListLimits
+) -> bool:
+    """Check 8 over every read's body, and every read written inside one.
+
+    The body's tables are its own and counted from zero, so the sizes are rebuilt
+    for each of them; ``consts`` and ``lib.functions`` stay the program's,
+    because those are the two a body shares. ``channels`` is zero, which is what
+    refuses an ``EMIT`` inside a body without a rule of its own: a read carries
+    no channel, no plot and no declaration.
+    """
+    for at, request in enumerate(requests):
+        body = request["body"]
+        where = f"{prefix}[{at}].body"
+        sizes = _with(
+            outer,
+            slots=body["frame"]["slots"],
+            cells=len(body["cells"]),
+            states=len(body["states"]),
+            registers=len(body["series"]),
+            channels=0,
+            callSites=len(body["callSites"]),
+            loops=len(body["loops"]),
+            bindings=0,
+            argc_of=_argc_reader(body["callSites"]),
+        )
+        if not check_list(shape, f"{where}.code", body["code"], sizes, "RET"):
+            return False
+        for which in range(len(body["functions"])):
+            one = body["functions"][which]
+            inner = _with(
+                sizes,
+                slots=one["slots"],
+                bindings=_bindings_for(body["callSites"], which),
+            )
+            if not check_list(shape, f"{where}.functions[{which}]", one["code"], inner, "RET"):
+                return False
+        if not _check_bodies(shape, f"{where}.requests", body["requests"], sizes):
+            return False
+    return True