{ "base": "53baf62fdaf9dae6824bc9c5a0da812a64b95d6c", "instrumentationPatch": "--- a/packages/runner/src/cfc/prepare.ts\n+++ b/packages/runner/src/cfc/prepare.ts\n@@ -5562,6 +5562,7 @@\n */\n sources: readonly ConsumedAtomSource[];\n } => {\n+ tx.noteCfcConsumedLabelWalk?.();\n const atoms: unknown[] = [];\n const modulePolicySpaces = new Map>();\n const sources: ConsumedAtomSource[] = [];\n--- a/packages/runner/src/runtime.ts\n+++ b/packages/runner/src/runtime.ts\n@@ -831,6 +831,13 @@\n dereferenceTracesRecorded: number;\n \n dereferenceTracesMax: number;\n+\n+ /** Structured refusal details recorded across transaction prepares. */\n+ refusalDetailsRecorded: number;\n+\n+ /** Full consumed-label collections, including sink and host release checks. */\n+ consumedLabelWalks: number;\n+\n cfcPreparedTx: number;\n cfcPrepareRejects: number;\n cfcDigestInvalidations: number;\n@@ -876,6 +883,8 @@\n flowLabelProbeMemoHits: 0,\n dereferenceTracesRecorded: 0,\n dereferenceTracesMax: 0,\n+ refusalDetailsRecorded: 0,\n+ consumedLabelWalks: 0,\n cfcPreparedTx: 0,\n cfcPrepareRejects: 0,\n cfcDigestInvalidations: 0,\n@@ -2308,6 +2317,12 @@\n },\n onPreparedTx: () => {\n this.#cfcStats.cfcPreparedTx += 1;\n+ },\n+ onRefusalDetail: () => {\n+ this.#cfcStats.refusalDetailsRecorded += 1;\n+ },\n+ onConsumedLabelWalk: () => {\n+ this.#cfcStats.consumedLabelWalks += 1;\n },\n onPrepareReject: (refusal) => {\n this.#cfcStats.cfcPrepareRejects += 1;\n--- a/packages/runner/src/storage/extended-storage-transaction.ts\n+++ b/packages/runner/src/storage/extended-storage-transaction.ts\n@@ -211,6 +211,12 @@\n \n onPreparedTx?(): void;\n \n+ /** One structured refusal detail was recorded. Measurement only. */\n+ onRefusalDetail?(): void;\n+\n+ /** One full consumed-label collection was started. Measurement only. */\n+ onConsumedLabelWalk?(): void;\n+\n /** One dereference trace was recorded, and how many the transaction holds\n * after it. `probeBelongsToDereference` scans this set once per read\n * activity at commit preparation, so its size is a per-read multiplier.\n@@ -1999,6 +2005,12 @@\n // this transaction already made; letting it move the enforcement state\n // would make the description part of the decision.\n this.#cfcState.refusalDetails.push(deepFreeze(detail));\n+ this.#cfcInstrumentation.onRefusalDetail?.();\n+ }\n+\n+ /** @inheritDoc */\n+ noteCfcConsumedLabelWalk(): void {\n+ this.#cfcInstrumentation.onConsumedLabelWalk?.();\n }\n \n writeCfcGrant(input: CfcGrantWriteInput): { space: MemorySpace; id: string } {\n@@ -3946,6 +3958,11 @@\n this.#wrapped.recordCfcRefusalDetail(detail);\n }\n \n+ /** @inheritDoc */\n+ noteCfcConsumedLabelWalk(): void {\n+ this.#wrapped.noteCfcConsumedLabelWalk();\n+ }\n+\n writeCfcGrant(input: CfcGrantWriteInput): { space: MemorySpace; id: string } {\n return this.#wrapped.writeCfcGrant(input);\n }\n--- a/packages/runner/src/storage/interface.ts\n+++ b/packages/runner/src/storage/interface.ts\n@@ -2234,6 +2234,9 @@\n */\n recordCfcRefusalDetail(detail: CfcRefusalDetail): void;\n \n+ /** Counts a full consumed-label collection without changing CFC state. */\n+ noteCfcConsumedLabelWalk(): void;\n+\n /**\n * The trusted policy-writer path for CFC grant documents (\u00a78.12.7 route\n * 2a; cfc/grants.ts module doc). Requires the transaction's CURRENT\n", "optimizationPatch": "--- a/packages/runner/src/cfc/prepare.ts\n+++ b/packages/runner/src/cfc/prepare.ts\n@@ -6337,9 +6337,10 @@\n // Read provenance for a refusal's remedy channel, computed only if a gate\n // below actually refuses. `collectConsumedLabel` walks every read against\n // every label-map entry of the document it resolved to, which is work no\n- // committing transaction should do just in case; a misfit is rare and pays\n- // for it then. The set is transaction-global \u2014 wider than the per-write\n- // prefix the writer-fit decision itself runs on \u2014 so a named input is a\n+ // committing transaction should do just in case. Strict writer-fit refusals\n+ // pay for it; persist-and-flag diagnostics need only the atoms. The set is\n+ // transaction-global \u2014 wider than the per-write prefix the writer-fit\n+ // decision itself runs on \u2014 so a named input is a\n // read that genuinely carried the atom, while `attribution` stays the\n // honest statement of whether the named ones account for all of them.\n let memoizedRefusalSources: readonly ConsumedAtomSource[] | undefined;\n@@ -7632,19 +7633,19 @@\n path.join(\"/\")\n } (canWrite, \u00a78.12.4): ` +\n offendingAtoms.join(\", \");\n- tx.recordCfcRefusalDetail?.({\n- gate: \"writer-fit\",\n- target: {\n- space: target.space,\n- id,\n- scope: target.scope,\n- path: [...path],\n- } as CfcAddress,\n- offendingAtoms,\n- ...describeRefusalInputs(offending, refusalSources()),\n- reason: misfit,\n- });\n if (writerFitRejects) {\n+ tx.recordCfcRefusalDetail?.({\n+ gate: \"writer-fit\",\n+ target: {\n+ space: target.space,\n+ id,\n+ scope: target.scope,\n+ path: [...path],\n+ } as CfcAddress,\n+ offendingAtoms,\n+ ...describeRefusalInputs(offending, refusalSources()),\n+ reason: misfit,\n+ });\n reasons.push(verdictReason(misfit));\n } else {\n tx.noteCfcDiagnostic(`writer-fit(persist-and-flag): ${misfit}`);\n", "harnessPatch": "--- a/packages/cli/lib/test-runner.ts\n+++ b/packages/cli/lib/test-runner.ts\n@@ -1,3 +1,4 @@\n+import { recordError } from \"../../../.writer-fit-profile.ts\";\n /**\n * Test runner for pattern-native tests.\n *\n@@ -1146,7 +1147,7 @@\n // pattern tests act as a regression net for CFC without this site\n // restating the production default. Params below are this harness's\n // declared deltas.\n- new Runtime(runtimePresets.patternTest({\n+ new Runtime({...runtimePresets.patternTest({\n apiUrl: new URL(import.meta.url),\n storageManager,\n experimental: experimentalOptionsFromEnv(Deno.env.get),\n@@ -1162,7 +1163,7 @@\n ...(options.storageHost?.onPatternInstantiated !== undefined\n ? { onPatternInstantiated: options.storageHost.onPatternInstantiated }\n : {}),\n- errorHandlers: [(error: ErrorWithContext) => runtimeErrors.push(error)],\n+ errorHandlers: [(error: ErrorWithContext) => { runtimeErrors.push(error); recordError(error); }],\n navigateCallback: (target) => {\n const name = (target.key(\"$NAME\") as Cell).get();\n navigations.push({\n@@ -1174,8 +1175,9 @@\n console.log(` \u2192 navigateTo: ${label}`);\n }\n },\n- })),\n+ }), cfcFlowLabels: \"persist\"}),\n );\n+ console.error(\"WRITER_FIT_POSTURE\", runtime.cfcEnforcementMode, runtime.cfcFlowLabels);\n if (!options.noIdempotencyCheck) runtime.enableIdempotencyCheck();\n else if (options.verbose) {\n console.log(\" Idempotency verification disabled for this measurement.\");\n@@ -1679,6 +1681,10 @@\n if (isRender) {\n renderCount++;\n const renderName = `render_${renderCount}`;\n+ const measure = await import(\"../../../.writer-fit-profile.ts\");\n+ const before = runtime.getCfcStats();\n+ await measure.start();\n+ const renderStart = performance.now();\n try {\n if (!stepValue.skip) {\n await materializeTestVDOM(\n@@ -1690,6 +1696,13 @@\n console.log(` \u2298 ${renderName} (skipped)`);\n }\n } finally {\n+ const renderMs = performance.now() - renderStart;\n+ await measure.stop(renderName);\n+ const after = runtime.getCfcStats();\n+ console.error(\"WRITER_FIT_RENDER \" + JSON.stringify({\n+ n: [11, 50, 150][renderCount - 1], renderMs,\n+ before, after,\n+ }));\n printReadCost(renderName, itemStart);\n }\n continue;\n@@ -1740,57 +1753,69 @@\n lastActionIndex = i;\n currentActionIndex = i;\n const actionName = `action_${actionCount}`;\n-\n- if (options.verbose) {\n- console.log(` \u2192 Running ${actionName}...`);\n- }\n-\n- // Snapshot action stats before running (for delta tracking)\n+ const actionMeasure = await import(\"../../../.writer-fit-profile.ts\");\n+ const actionBefore = runtime.getCfcStats();\n+ await actionMeasure.start();\n+ const actionStart = performance.now();\n+\n const statsThreshold = options.statsThreshold ?? 5000;\n let preRunCounts: Map | undefined;\n- if (options.verbose) {\n- preRunCounts = new Map();\n- for (const node of runtime.scheduler.getGraphSnapshot().nodes) {\n- if (node.stats) {\n- preRunCounts.set(node.id, node.stats.runCount);\n+ try {\n+ if (options.verbose) {\n+ console.log(` \u2192 Running ${actionName}...`);\n+ }\n+\n+ // Snapshot action stats before running (for delta tracking)\n+ if (options.verbose) {\n+ preRunCounts = new Map();\n+ for (const node of runtime.scheduler.getGraphSnapshot().nodes) {\n+ if (node.stats) {\n+ preRunCounts.set(node.id, node.stats.runCount);\n+ }\n }\n }\n+\n+ // Get the action stream via .key()\n+ const actionStream = await withPhase(\n+ [\"runTestPattern\", \"step\", actionName, \"stream\"],\n+ () => actionStreamForStep(stepCell),\n+ );\n+\n+ // Send the step's event (undefined for plain void actions), wrapped\n+ // with renderer-trusted provenance when the step declares `trustedUi`.\n+ await withPhase(\n+ [\"runTestPattern\", \"step\", actionName, \"send\"],\n+ () => {\n+ actionStream.send(\n+ buildActionEvent(stepValue.event, stepValue.trustedUi),\n+ );\n+ },\n+ );\n+\n+ // Wait for idle, then settle commits and re-idle.\n+ // Optimistic commits can fail (CAS conflicts), causing rollbacks\n+ // and reactive re-scheduling. We loop idle\u2192synced until both\n+ // resolve quickly (< 1ms), indicating quiescence. Max iterations\n+ // as a safety net against infinite loops.\n+ try {\n+ await settleRuntime(actionName, 20);\n+ } catch (err) {\n+ results.push({\n+ name: actionName,\n+ passed: false,\n+ afterAction: null,\n+ error: err instanceof Error ? err.message : String(err),\n+ durationMs: performance.now() - itemStart,\n+ });\n+ }\n+\n+ } finally {\n+ const actionMs = performance.now() - actionStart;\n+ await actionMeasure.stop(actionName);\n+ console.error(\"WRITER_FIT_ACTION \" + JSON.stringify({\n+ actionName, actionMs, before: actionBefore, after: runtime.getCfcStats(),\n+ }));\n }\n-\n- // Get the action stream via .key()\n- const actionStream = await withPhase(\n- [\"runTestPattern\", \"step\", actionName, \"stream\"],\n- () => actionStreamForStep(stepCell),\n- );\n-\n- // Send the step's event (undefined for plain void actions), wrapped\n- // with renderer-trusted provenance when the step declares `trustedUi`.\n- await withPhase(\n- [\"runTestPattern\", \"step\", actionName, \"send\"],\n- () => {\n- actionStream.send(\n- buildActionEvent(stepValue.event, stepValue.trustedUi),\n- );\n- },\n- );\n-\n- // Wait for idle, then settle commits and re-idle.\n- // Optimistic commits can fail (CAS conflicts), causing rollbacks\n- // and reactive re-scheduling. We loop idle\u2192synced until both\n- // resolve quickly (< 1ms), indicating quiescence. Max iterations\n- // as a safety net against infinite loops.\n- try {\n- await settleRuntime(actionName, 20);\n- } catch (err) {\n- results.push({\n- name: actionName,\n- passed: false,\n- afterAction: null,\n- error: err instanceof Error ? err.message : String(err),\n- durationMs: performance.now() - itemStart,\n- });\n- }\n-\n // Print per-action run deltas for slow actions\n if (\n options.verbose && preRunCounts &&\n", "strictHarnessPatch": "--- a/packages/cli/lib/writer-fit-strict-runner.ts\n+++ b/packages/cli/lib/writer-fit-strict-runner.ts\n@@ -1422,7 +1422,13 @@\n \n try {\n // Run the pattern with proper space context\n- const value = runtime.run(tx, testPatternFactory, {}, resultCell);\n+ const target = runtime.getCell(space, \"strict-copy-target\", {\n+ type: \"array\",\n+ items: { type: \"object\", properties: { id: {type:\"number\"}, title:{type:\"string\"} } },\n+ ifc: { confidentiality: [\"unrelated-store-policy\"] },\n+ }, tx);\n+ target.set([]);\n+ const value = runtime.run(tx, testPatternFactory, {copied: target}, resultCell);\n \n // Commit the transaction\n runtime.prepareTxForCommit?.(tx);\n", "files": { ".writer-fit-profile.ts": "import { Session } from \"node:inspector\";\nconst enabled = Deno.env.get(\"WRITER_FIT_PROFILE\") === \"1\";\nconst session = new Session();\nif (enabled) session.connect();\nconst post = (method: string, params = {}) => new Promise((resolve, reject) => session.post(method, params, (err, result) => err ? reject(err) : resolve(result)));\nexport async function start() {\n if (!enabled) return;\n await post(\"Profiler.enable\");\n await post(\"Profiler.setSamplingInterval\", { interval: 500 });\n await post(\"Profiler.start\");\n}\nexport async function stop(name: string) {\n if (!enabled) return;\n const { profile } = await post(\"Profiler.stop\");\n await Deno.writeTextFile(Deno.env.get(\"WRITER_FIT_OUT\") + \"-\" + name + \".cpuprofile\", JSON.stringify(profile));\n}\n\nexport const errors: unknown[] = [];\nexport function recordError(error: any) { errors.push({name:error.name, message:error.message, refusals:error.refusals}); }\n", ".writer-fit-run.ts": "import { runTestPattern } from \"./packages/cli/lib/test-runner.ts\";\nconst result = await runTestPattern((Deno.env.get(\"WRITER_FIT_MODE\") === \"enforce-strict\" ? './packages/cli/test/fixtures/cfc-flow-labels/strict.test.tsx' : './packages/cli/test/fixtures/cfc-flow-labels/mapped-render.test.tsx'), {\n cfcEnforcementMode: (Deno.env.get(\"WRITER_FIT_MODE\") ?? \"enforce-explicit\") as any, noIdempotencyCheck: Deno.env.get(\"WRITER_FIT_IDEMPOTENCY\") !== \"1\",\n});\nconsole.error(\"WRITER_FIT_RESULT \" + JSON.stringify(result));\nconst { errors } = await import(\"./.writer-fit-profile.ts\");\nconsole.error(\"WRITER_FIT_ERRORS \" + JSON.stringify(errors));\nif (Deno.env.get(\"WRITER_FIT_MODE\") === \"enforce-strict\") {\n const details = errors.flatMap((error:any) => error.refusals ?? []);\n if (!details.length || details.some((detail:any) => detail.gate !== \"writer-fit\" || !detail.inputs?.length || detail.attribution !== \"complete\" || !detail.reason.includes(\"writer-fit confidentiality misfit\"))) throw new Error(\"Strict detail invariant failed\");\n console.error(\"WRITER_FIT_STRICT_VERIFIED \" + details.length);\n Deno.exit(0);\n}\nDeno.exit(result.error || result.runtimeErrors.length || result.results.some(r => !r.passed) ? 1 : 0);\n", ".writer-fit-strict-run.ts": "import { runTestPattern } from \"./packages/cli/lib/writer-fit-strict-runner.ts\";\nconst result = await runTestPattern((Deno.env.get(\"WRITER_FIT_MODE\") === \"enforce-strict\" ? './packages/cli/test/fixtures/cfc-flow-labels/strict.test.tsx' : './packages/cli/test/fixtures/cfc-flow-labels/mapped-render.test.tsx'), {\n cfcEnforcementMode: (Deno.env.get(\"WRITER_FIT_MODE\") ?? \"enforce-explicit\") as any, noIdempotencyCheck: Deno.env.get(\"WRITER_FIT_IDEMPOTENCY\") !== \"1\",\n});\nconsole.error(\"WRITER_FIT_RESULT \" + JSON.stringify(result));\nconst { errors } = await import(\"./.writer-fit-profile.ts\");\nconsole.error(\"WRITER_FIT_ERRORS \" + JSON.stringify(errors));\nDeno.exit(0);\n", "packages/cli/test/fixtures/cfc-flow-labels/mapped-render.test.tsx": "/**\n * Labeled SQLite mapped-render scaling fixture. Each render demands the full\n * mapped view at the named row count; seeding precedes the render intervals.\n * Run the same file with --cfc-enforcement-mode disabled --cfc-flow-labels off\n * and with --cfc-shell-posture, adding --verbose --stats-threshold 0 to both.\n */\nimport {\n action,\n assert,\n pattern,\n sqliteDatabase,\n type SqliteDb,\n table,\n TESTS,\n UI,\n Writable,\n} from \"commonfabric\";\n\ninterface Row {\n id: number;\n title: string;\n}\n\nconst MappedRows = pattern<{ db: SqliteDb; count: number }>(({ db, count }) => {\n const query = db.query(\n \"SELECT id, title FROM messages ORDER BY id LIMIT ?\",\n { params: [count] },\n );\n return {\n query,\n [UI]:
{query.result?.map((row) =>

{row.title}

)}
,\n };\n});\n\nexport default pattern(() => {\n const db = sqliteDatabase({\n tables: {\n messages: table({\n id: \"integer primary key\",\n title: {\n type: \"string\",\n sqlType: \"text\",\n ifc: { confidentiality: [\"fixture-private\"] },\n },\n }),\n },\n });\n const seed = action(() => {\n for (let i = 1; i <= 150; i++) {\n db.exec(\"INSERT INTO messages (id, title) VALUES (?, ?)\", [\n i,\n `Message ${i}`,\n ]);\n }\n });\n const small = MappedRows({ db, count: 11 });\n const medium = MappedRows({ db, count: 50 });\n const large = MappedRows({ db, count: 150 });\n\n const copied = new Writable([]);\n\n return {\n small,\n copied,\n [TESTS]: [\n { action: seed },\n { action: action(() => console.log(\"Mapped render N=11\")) },\n { assertion: assert(() => small.query.result?.length === 11) },\n { render: small[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=11\");\n copied.set((small.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 11) },\n { action: action(() => console.log(\"Mapped render N=50\")) },\n { assertion: assert(() => medium.query.result?.length === 50) },\n { render: medium[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=50\");\n copied.set((medium.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 50) },\n { action: action(() => console.log(\"Mapped render N=150\")) },\n { assertion: assert(() => large.query.result?.length === 150) },\n { render: large[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=150\");\n copied.set((large.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 150) },\n { settle: true },\n ],\n };\n});\n", "packages/cli/test/fixtures/cfc-flow-labels/strict.test.tsx": "/**\n * Labeled SQLite mapped-render scaling fixture. Each render demands the full\n * mapped view at the named row count; seeding precedes the render intervals.\n * Run the same file with --cfc-enforcement-mode disabled --cfc-flow-labels off\n * and with --cfc-shell-posture, adding --verbose --stats-threshold 0 to both.\n */\nimport {\n type Confidential,\n type Default,\n action,\n assert,\n pattern,\n sqliteDatabase,\n type SqliteDb,\n table,\n TESTS,\n UI,\n Writable,\n} from \"commonfabric\";\n\ninterface Row {\n id: number;\n title: string;\n}\n\nconst MappedRows = pattern<{ db: SqliteDb; count: number }>(({ db, count }) => {\n const query = db.query(\n \"SELECT id, title FROM messages ORDER BY id LIMIT ?\",\n { params: [count] },\n );\n return {\n query,\n [UI]:
{query.result?.map((row) =>

{row.title}

)}
,\n };\n});\n\nexport default pattern<{ copied: Writable | Default<[]>> }>(({ copied }) => {\n const db = sqliteDatabase({\n tables: {\n messages: table({\n id: \"integer primary key\",\n title: {\n type: \"string\",\n sqlType: \"text\",\n ifc: { confidentiality: [\"fixture-private\"] },\n },\n }),\n },\n });\n const seed = action(() => {\n for (let i = 1; i <= 150; i++) {\n db.exec(\"INSERT INTO messages (id, title) VALUES (?, ?)\", [\n i,\n `Message ${i}`,\n ]);\n }\n });\n const small = MappedRows({ db, count: 11 });\n const medium = MappedRows({ db, count: 50 });\n const large = MappedRows({ db, count: 150 });\n\n\n\n return {\n small,\n copied,\n [TESTS]: [\n { action: seed },\n { action: action(() => console.log(\"Mapped render N=11\")) },\n { assertion: assert(() => small.query.result?.length === 11) },\n { render: small[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=11\");\n copied.set((small.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 11) },\n { action: action(() => console.log(\"Mapped render N=50\")) },\n { assertion: assert(() => medium.query.result?.length === 50) },\n { render: medium[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=50\");\n copied.set((medium.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 50) },\n { action: action(() => console.log(\"Mapped render N=150\")) },\n { assertion: assert(() => large.query.result?.length === 150) },\n { render: large[UI] },\n {\n action: action(() => {\n console.log(\"Labeled copy N=150\");\n copied.set((large.query.result ?? []).map((row: Row) => ({\n id: row.id,\n title: row.title,\n })));\n }),\n },\n { assertion: assert(() => copied.get().length === 150) },\n { settle: true },\n ],\n };\n});\n" }, "strictInstrumentationPatch": "--- a/packages/runner/src/runtime.ts\n+++ b/packages/runner/src/runtime.ts\n@@ -2325,6 +2325,7 @@\n this.#cfcStats.consumedLabelWalks += 1;\n },\n onPrepareReject: (refusal) => {\n+ console.error(\"WRITER_FIT_REFUSAL \" + JSON.stringify(refusal));\n this.#cfcStats.cfcPrepareRejects += 1;\n // Every refusal is reported here, terminal or not. The scheduler's\n // error channel carries only the terminal ones (a refusal a fresh\n", "fixtureSha256": "f5b1b159ff6ccb98174931ef8a2553adb6de80cf8868aba42c6e849a0ea7edc0" }