Reuse verified immutable plans and streamline cooperative hashing

Continue final hosted development reliability qualification.

src/execution-world/plan.ts

@@ -17,6 +17,7 @@ import { linkQueries, type LinkedQuery } from "../query/link.js";
 import { type BindingSchema } from "../bindings/index.js";
 import { unsupportedQueryOperator } from "./query-operators.js";
 import { packageBuildContexts } from "./build-contract.js";
+import { setImmediate } from "node:timers/promises";
 
 export class ExecutionPlanError extends Error {
   constructor(
@@ -31,6 +32,54 @@ export class ExecutionPlanError extends Error {
 export const hexDigest = (value: unknown): string => contentDigest(value).slice("sha256:".length);
 export const hexDigestAsync = async (value: unknown): Promise<string> =>
   (await contentDigestAsync(value)).slice("sha256:".length);
+// Checked runtime metadata is owned JSON, not live Graph data. Reuse its proof
+// only after every reachable record is immutable. Weak keys retain neither old
+// Candidates nor an application cache; unsealed compiler inputs are rehashed.
+const sealedPlanDigests = new WeakMap<ExecutionPlan, string>();
+export const executionPlanDigest = (plan: ExecutionPlan): string =>
+  sealedPlanDigests.get(plan) ?? hexDigest(plan.definition);
+export const executionPlanDigestAsync = async (plan: ExecutionPlan): Promise<string> =>
+  sealedPlanDigests.get(plan) ?? (await hexDigestAsync(plan.definition));
+/** Transfers owned parsed JSON into immutable runtime metadata. Freeze before
+ * yielding to hashing so concurrent mutation cannot invalidate the proof. */
+export async function sealExecutionPlan(plan: ExecutionPlan): Promise<boolean> {
+  if (sealedPlanDigests.has(plan)) return true;
+  if (!Object.hasOwn(plan, "definition") || !Object.hasOwn(plan, "digest")) return false;
+  const pending: object[] = [plan],
+    seen = new WeakSet<object>();
+  let sliceStarted = performance.now(),
+    count = 0;
+  while (pending.length) {
+    const value = pending.pop()!;
+    if (seen.has(value)) continue;
+    if (
+      !Array.isArray(value) &&
+      Object.getPrototypeOf(value) !== Object.prototype &&
+      Object.getPrototypeOf(value) !== null
+    )
+      throw new ExecutionPlanError("INVALID_PLAN_JSON", "plan", "Expected owned JSON records");
+    for (const key of Reflect.ownKeys(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key)!;
+      if (typeof key !== "string" || !Object.hasOwn(descriptor, "value"))
+        throw new ExecutionPlanError(
+          "INVALID_PLAN_JSON",
+          "plan",
+          "Runtime metadata cannot contain accessors or symbols",
+        );
+      if (descriptor.value !== null && typeof descriptor.value === "object") pending.push(descriptor.value);
+    }
+    Object.freeze(value);
+    seen.add(value);
+    if (++count % 1024 === 0 && performance.now() - sliceStarted >= 8) {
+      await setImmediate();
+      sliceStarted = performance.now();
+    }
+  }
+  const digest = await hexDigestAsync(plan.definition);
+  if (digest !== plan.digest) return false;
+  sealedPlanDigests.set(plan, digest);
+  return true;
+}
 const sorted = <T>(values: readonly T[], key: (value: T) => string): T[] =>
   [...values].sort((a, b) => (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0));
 export const publicOperationKey = (atom: string, iface: string, operation: string): string =>