💥 Scope engine state to the operation that owns it

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Closes#323. Carries out architecture.md's State ownership rule (#314).

Why

All state is scoped to the operation that owns it, so it is torn down when the
operation is torn down: created inside the run it describes, provided via
context. No module-scoped registries — not as collections, not hidden inside
library objects that accumulate. One exception: metadata an author declares at
module evaluation, about a value the author owns, may live on that value.

Five declarations in packages/core were on the wrong side of it. Each was one
table per process, shared by every run, that nothing in a caller's scope could
see, override, or clear.

What changes

Site	Before	After
component-failures.ts	printing WeakSet	a module-private Symbol on the function
errors.ts	segmentCauses WeakMap	SegmentCauses, opened per run
validate.ts	module Ajv + two compile caches	PropsCompiler, opened per run; caches gone
components/parse-schema.ts	module Ajv	ParseCompiler, opened per run

The printErrors(fn) mark takes the exception, not context. It runs while a
component module is evaluated — outside any operation, with no run to own a
table and no scope to reach — and records what an author declared about a
function the author owns. So it lives on that function: a module-private
Symbol() (not Symbol.for, which anyone could forge), defined non-enumerable
so a wrapper built by copying own properties does not inherit a decision its
author never made, read with Object.hasOwn. This is the exception's one open
application.

The rest become run-scoped.useSegmentCauses(), usePropsCompiler() and
useParseCompiler() are installed where the execution begins and reclaimed with
it. DocumentationError's constructor cannot reach a scope, so reading the
cause moved to a documentationError() builder that runs before it — the cause
is still attached before any observer can see the failure. Expansion driven
directly (a test, a tool describing a document) has no execution around it, so
the outermost expandSegments opens the table for exactly its own lifetime, and
compiling outside a run gets an instance that lives as long as the call.

The two compile caches go rather than move. Ajv memoizes by schema object
within a run already, so a per-run instance is the whole cache. A second table
beside it would only reintroduce the question of which root contract a
remembered validator was compiled under.

Why the Ajv instances count as state

In ajv@8.20.0, _cache is a plain Map and _addSchema does

letsch=this._cache.get(schema);if(sch!==undefined)returnsch;…this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){…}

The set is unconditional and precedes the addUsedSchema guard the engine
already sets to false. A module-scoped instance therefore holds a strong
reference to every schema object any run ever compiled, for the life of the
process — and because the key is object identity, it answers a schema object
mutated between runs with the first run's validator. That is not a leak in the
abstract: SO13 demonstrates it through public api alone (a host registers a
component, tightens its props schema, runs again — and the second run accepts
props the schema no longer allows).

The parse path is different and the PR says so: it normalizes its declaration
through parseJson, handing Ajv a fresh object every call, so it never hits the
identity cache. Its harm is unbounded growth rather than a wrong answer, which
is why SO9 asserts the lifetime rather than a stale validator.

The lint rule

local/no-module-scoped-registry (ported from #312's 0673f7d, its
documentation reconciled with the exception this PR applies) reports a Map,
Set, WeakMap or WeakSet built at module scope — declared, exported,
assigned later, held inside another module-scoped value, or a static class
field — with the remedy "create it inside the operation that owns it and provide
it via context." It accepts a table built from its own contents (a constant), an
instance field, and a table handed straight to a call.

Before the conversions it reported 4 of the 5 sites
(component-failures.ts:27, errors.ts:63, validate.ts:85, validate.ts:86).
After them it reports none, and deno task lint is 0 errors.

It does not catch a module-scoped new Ajv(…) — it matches collection
constructors, and the accumulation there is inside a library object rather than
a table this repository wrote. The architecture rule covers it anyway ("not
hidden inside library objects that accumulate"); the rule's own header now says
so, and a reviewer holds that half.

How to verify it

packages/core/tests/state-ownership.test.ts — Tier SO, 13 tests.

SO13 is red on origin/main (verified at f413545, in a throwaway worktree,
using only registerComponents + execute): main renders widget:two where
the schema now requires b. Every other Tier SO test names api this PR
introduces, so "red on main" would only mean the module does not import — no
evidence at all. They are discriminated by mutation instead. All seven were run,
and each reddens exactly the tests that claim its behavior:

Mutation	Reddens
the declaration key is Symbol.for	SO4
the declaration is enumerable	SO2
the cause table is one per process	SO5, SO6
the props compiler is one per process	SO8, SO11, SO13
useParseCompiler hands out one shared instance	SO9
a compile cache beside Ajv comes back	SO8, SO11, SO13
a fresh compiler per call, even inside a run	SO10

Two earlier attempts at these tests reddened under no mutation and were
rewritten rather than kept: SO2 asserted Object.keys, which never lists a
symbol key whatever its enumerability, and SO9 asserted a stale validator on the
path that clones its declaration. SO1, SO3, SO7 and SO12 are ordinary
behavior pins with no mutation of their own.

scripts/tests/no-module-scoped-registry.test.ts covers the rule against both
fixtures.

Breaking

Six published functions become operations. A caller writes yield* where it
previously called; nothing else about any of them changes.

• compilePropsSchema, compileReturnsSchema, validateProps,
  validateReturnValue — they reach the run's compiler.
• parseMarkdownDefinition — it compiles the schemas it parses.
• prepareElicitation, elicit — they compile the question's schema.

compileParseSchema is internal and changes the same way. The use* installers
are deliberately not exported: execute() installs them, direct expansion
opens what it needs, and a call outside a run gets its own instance — so no host
has to learn about them.

A generator conversion has a silent failure mode worth knowing about in
review: a discarded call (compilePropsSchema(props); as a statement) type-checks
and then validates nothing, because nothing iterates it. Every such site was
converted — definition.ts, registration.ts, execute.ts, and the
expect(() => …).toThrow(…) assertions across five test files, which would
otherwise have gone quietly green.

Scope

Included

• The five conversions, the lint rule, and Tier SO.
• The mechanical yield* at every call site, including tests.

Intentionally unchanged

• <Retry>, <Result as>, suspension and the error middleware Js api stay
  defined and unbuilt. No semantics change and no vocabulary change.
• packages/web already builds a fresh Ajv per call via createServerAjv(), so
  it needed nothing.
• The remaining module-scoped Sets in packages/ (EACH_PROPS,
  RESERVED_STRUCTURAL, the secret-scanner word lists) are constants built from
  their own contents. The rule accepts them by design.

Verification

Gate	Result
deno task lint	0 errors, formatting clean
deno task check	0 errors
deno task test	349 passed, 0 failed
deno task check:jsr	Success Dry run complete
pnpm exec tsc --project tsconfig.node.json --noEmit	clean
compiled-binary smoke	pass — main suite, value root, -e '<Badge />', test-agent worker, <WebForm> preflight

Test counts: 344 → 349 passed, 2352 → 2367 steps. The delta is exactly the
new tests — Tier SO's 4 suites (13 steps) and the rule's 1 suite (2 steps).
Nothing else moved.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #325: 💥 Scope engine state to the operation that owns it

28 files, +979 / -200

Scope

🔴 PR has 1179 lines changed. Split into focused PRs.

🟡 1179 lines changed. PRs under 400 receive more thorough review.

🟡 28 files changed. Are all changes related?

🟡 PR mixes config and source changes.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.