From a4ba6169a6fe40600e051815d4ded8a96d8bfe57 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Mon, 12 Oct 2026 18:24:48 -0700
Subject: [PATCH] Reuse checked reflection inputs before acquiring controller
 ownership

---
 src/execution-world/public-reflection.ts | 25 ++++++++++--------------
 test/execution-world.test.ts             | 13 ++++++++++--
 2 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/src/execution-world/public-reflection.ts b/src/execution-world/public-reflection.ts
index d828670..c40ef0b 100644
--- a/src/execution-world/public-reflection.ts
+++ b/src/execution-world/public-reflection.ts
@@ -1,26 +1,21 @@
-import { compileInspectionTemplates } from "./inspection.js";
-import { compileKernelProgram } from "./kernel.js";
+import { compileInspectionTemplates, type InspectionKernel } from "./inspection.js";
 import { hexDigest, type ExecutionPlan } from "./plan.js";
 import { clientContractCatalog, type ExecutionInstallation } from "./installation.js";
 import { publicOperationContract, publicQueryContract } from "./client-contracts.js";
 
-/** Explicit public projection. Never serialize conformance storage or package ports. */
-export function publicDefinitionSnapshot(plan: ExecutionPlan, installation: ExecutionInstallation) {
+/** Explicit public projection of checked inputs. Never serialize conformance
+ * storage or package ports, or recompile a historical Candidate at runtime. */
+export function publicDefinitionSnapshot(
+  plan: ExecutionPlan,
+  installation: ExecutionInstallation,
+  kernel: InspectionKernel,
+) {
   const workspace = plan.definition.workspace;
-  const kernel = compileKernelProgram(plan) as {
-    operations: {
-      atom: string;
-      interface: string;
-      operation: string;
-      unsupported: string | null;
-      effect: string;
-      targets: string[];
-    }[];
-  };
   const catalog = clientContractCatalog(
     plan,
     installation,
     installation.packages.map((pkg) => pkg.revision),
+    kernel,
   );
   const rows = {
     atoms: workspace.atoms.map((atom) => ({ id: atom.id, name: atom.displayName, documentation: atom.documentation })),
@@ -68,7 +63,7 @@ export function publicDefinitionSnapshot(plan: ExecutionPlan, installation: Exec
       ),
     })),
     queries: [
-      ...compileInspectionTemplates(plan).contracts.map((descriptor) => ({
+      ...compileInspectionTemplates(plan, kernel).contracts.map((descriptor) => ({
         id: JSON.stringify([descriptor.package, descriptor.query]),
         name: "Public inspection",
         package: descriptor.package,
diff --git a/test/execution-world.test.ts b/test/execution-world.test.ts
index 072d13a..9000ab4 100644
--- a/test/execution-world.test.ts
+++ b/test/execution-world.test.ts
@@ -385,7 +385,8 @@ test("public reflection contains nominal contracts and callable descriptors with
     components: [],
     routes: {},
   };
-  const snapshot = publicDefinitionSnapshot(plan, installation);
+  const kernel = compileKernelProgram(plan) as import("../src/execution-world/inspection.js").InspectionKernel;
+  const snapshot = publicDefinitionSnapshot(plan, installation, kernel);
   assert.ok(snapshot.rows.interfaces.length);
   assert.ok(snapshot.rows.queries.length);
   assert.ok(snapshot.rows.conformances.length);
@@ -400,5 +401,13 @@ test("public reflection contains nominal contracts and callable descriptors with
     assert.ok(!publicText.includes('"' + privateKey + '"'), privateKey);
   assert.ok(publicText.includes('"descriptor"'));
   assert.ok(publicText.includes('"scope":"class"'));
-  assert.equal(snapshot.id, publicDefinitionSnapshot(plan, installation).id);
+  assert.equal(snapshot.id, publicDefinitionSnapshot(plan, installation, kernel).id);
+  // Historical checked availability must survive a newer host compiler. If
+  // reflection silently regenerates the Kernel, this evidence disappears.
+  const historical = structuredClone(kernel);
+  const installed = historical.operations.find((operation) => !operation.unsupported)!;
+  assert.ok(installed);
+  installed.unsupported = "CHECKED_HISTORICAL_UNSUPPORTED";
+  const historicalSnapshot = publicDefinitionSnapshot(plan, installation, historical);
+  assert.match(JSON.stringify(historicalSnapshot.rows.conformances), /CHECKED_HISTORICAL_UNSUPPORTED/);
 });