✨ Slice A of #848: project REPL views from durable history (#849)

* ✨ Project REPL views from durable history

Slice A of #848: the durable reconstruction kernel. Code outside the runtime can
take an array of the repository's real `Yield | Close` events and obtain a
deeply frozen view of one execution, for the whole Journal or for one inclusive
checkpoint prefix, and can address any part of that view with a URL. There is no
REPL yet — no storage, no session, no component tree, no command — and nothing
in core's execution semantics changed.

`<Elicit>` now retains the compiled schema beside its answer. The validated
answer is still the record's result and the fingerprint over schema and message
is still the only guard; the schema travels in the same description under
`executablemd.elicitation-schema`, where a source position already travels, so
`type` and `name` still decide what a replay matches. Historical inspection
needs to know which fields the person was shown, and the provider that could
have said so is not running any more. `@executablemd/core/host` publishes the
field name and a parsing reader for it, because a description is journal data
and a schema that merely looked plausible would reach a form as one.

`packages/cli/src/repl/model.ts` projects the vocabulary an ordinary execution
already appends — root and nested `import_component`, `eval`, `generated_xmd`,
`elicit`, and the root `Close` — into immutable structural values, deep-frozen,
with no REPL record, no cache, and no `DurableEvent` leaving the module. Every
retained value is detached from the event that carried it — copied, then frozen
— so the model cannot be changed by whoever still holds the events, and the
events are neither frozen nor modified by having been read: a projector that
froze its input would make a caller's own data immutable as a side effect of
being looked at. A
checkpoint marker is derived from protocol identity, `yield:<coroutine>:<ordinal>`
or `close:<coroutine>`, so the same event has the same marker in every process
that reads the file and nothing extra is written down to make that true.
Attribution is by the source path a position names: an effect whose owner is
absent, ambiguous or unreadable refuses, because a binding attached to a guessed
scope is a value shown where nothing published it.

`packages/cli/src/repl/route.ts` is the pure half of navigation. `decodeLocation`
decides only what a grammar can decide, `encodeLocation` emits one canonical
spelling, and `resolveLocation` answers with the exact objects the projection
holds. The two are separate so that a typo in a location is never answered with
a guess about the history.

Evidence runs against a journal produced by really executing the reference entry
rather than a recorded array, so the projector is held to the vocabulary the
current runtime writes. The fixture holds one of each thing this slice projects:
a durable evaluation publishing JSON, one nested component occurrence whose
source the run retains, one generated fragment admitted from a value that
evaluation published, and one validated question whose answer changes what
renders after it.

One thing the vocabulary turned out to say that a reader has to handle: the root
`Close` records three outcomes, not one — a document result, a protocol `err`
for a run that failed before producing one, and `cancelled` — so `ReplTerminal`
has three statuses and only the first carries rendered output. A serialized
`err` also carries a stack naming host paths, so the transcript shows its
message and nothing else.

* ⚡ Remeasure test weights at 970bc0d

Slice A adds `repl-model.test.ts` and `repl-route.test.ts`, so the corpus moved
and every runtime's partition was reading a fallback weight for both. Measured
by **Measure test weights** run 36270414251 against `970bc0db`, on
`ubuntu-latest`, and committed exactly as the artifact came out.

The shard counts do not move. The measured floors are 14, 8 and 4 for Deno,
Node and Bun; the installed counts are 15, 10 and 5, so each is already above
its floor and no five-run evidence asks for a change.

Author: taras

packages/cli/src/repl/model.ts

@@ -0,0 +1,13 @@
+---
+title: Remaining work on one plan
+required: [title, steps]
+props:
+  title:
+    type: string
+  steps:
+    type: number
+---
+
+### {props.title}
+
+{props.steps} steps remain.

packages/cli/src/repl/route.ts

@@ -0,0 +1,18 @@
+```js eval
+const plan = { title: "Ship the REPL", steps: 2 };
+const summarySource = `<Json value={${JSON.stringify(plan)}} />`;
+const responseSchema = {
+  type: "object",
+  properties: { decision: { type: "string", enum: ["approve", "decline"] } },
+  required: ["decision"],
+  additionalProperties: false,
+};
+```
+
+<Checklist title={plan.title} steps={plan.steps} />
+
+<Evaluate text={summarySource} />
+
+<Elicit schema={responseSchema} as="response">Approve {plan.title}?</Elicit>
+
+Decision: {response.decision}

packages/cli/tests/fixtures/repl/Checklist.md

@@ -0,0 +1,104 @@
+/**
+ * The reference entry, executed for real.
+ *
+ * Every REPL test that needs a Journal gets one from here rather than from a
+ * recorded file, because the projector's whole claim is that it reads what the
+ * *current* runtime writes. A frozen event array would keep passing on the day
+ * core changed a record's shape, which is the day the claim stopped being true.
+ *
+ * The entry is one document deliberately holding one of each thing this slice
+ * projects: a durable evaluation that publishes JSON, one nested component
+ * occurrence whose source the run retains, one generated fragment admitted from
+ * a value that evaluation published, and one validated question whose answer
+ * changes what the document renders after it.
+ */
+
+import { readTextFile } from "@effectionx/fs";
+import { fileURLToPath } from "node:url";
+import { InMemoryStream } from "@executablemd/durable-streams";
+import type { DurableEvent, Json } from "@executablemd/durable-streams";
+import { collect, Elicitation } from "@executablemd/core";
+import type { ElicitationRequest } from "@executablemd/core";
+import { executeInstalled } from "@executablemd/core/host";
+import { inlineSource } from "@executablemd/core";
+import type { Operation } from "effection";
+import { scoped } from "effection";
+
+import { ordinaryEvaluationProfile } from "../../../src/evaluation-profile.ts";
+
+/** Where the entry and its nested component live. */
+export const REFERENCE_DIRECTORY = fileURLToPath(new URL("./", import.meta.url));
+
+/** The exact entry text this slice's evidence submits. */
+export function referenceSource(): Operation<string> {
+  return readTextFile(fileURLToPath(new URL("./entry.md", import.meta.url)));
+}
+
+/** What one reference execution produced. */
+export interface ReferenceRun {
+  readonly output: string;
+  readonly events: DurableEvent[];
+  readonly asked: ElicitationRequest[];
+  readonly failure: Error | undefined;
+}
+
+/**
+ * Run the reference entry once, over `stream`.
+ *
+ * `answer` decides what the installed provider hands back, so a test can answer,
+ * refuse, or count. Failures are captured rather than raised: how far a run got
+ * is most of what the negative controls are about.
+ */
+export function runReference(
+  answer: (request: ElicitationRequest) => Operation<unknown>,
+  stream: InMemoryStream = new InMemoryStream(),
+): Operation<ReferenceRun> {
+  return scoped(function* () {
+    const asked: ElicitationRequest[] = [];
+    yield* Elicitation.around(
+      {
+        *elicit([request]) {
+          asked.push(request);
+          return yield* answer(request);
+        },
+      },
+      { at: "min" },
+    );
+    const source = yield* referenceSource();
+    try {
+      const execution = yield* executeInstalled(
+        { ...inlineSource(source), stream, includes: [REFERENCE_DIRECTORY] },
+        [{ evaluation: ordinaryEvaluationProfile() }],
+      );
+      const output = yield* collect(execution);
+      return { output: String(output), events: yield* stream.readAll(), asked, failure: undefined };
+    } catch (error) {
+      return {
+        output: "",
+        events: yield* stream.readAll(),
+        asked,
+        failure: error instanceof Error ? error : new Error(String(error)),
+      };
+    }
+  });
+}
+
+/** The answer the reference journey submits. */
+export const REFERENCE_ANSWER: Json = { decision: "approve" };
+
+/** A provider that always answers the same way. */
+export function answering(value: Json): (request: ElicitationRequest) => Operation<unknown> {
+  // deno-lint-ignore require-yield
+  return function* () {
+    return value;
+  };
+}
+
+/** The complete reference Journal of one settled run. */
+export function* referenceEvents(): Operation<DurableEvent[]> {
+  const run = yield* runReference(answering(REFERENCE_ANSWER));
+  if (run.failure !== undefined) {
+    throw run.failure;
+  }
+  return run.events;
+}