Publish quixos-protocol from 473886a58fdacf15f2c873b77da96faf3be7fa65

.quixos-subtree-source.json

@@ -1,8 +1,8 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea.internal.quixos.org/quixos/quixos.git",
-  "sourceCommit": "e4393946ba63cfef75580f6aa6ba840035e7d43c",
+  "sourceCommit": "473886a58fdacf15f2c873b77da96faf3be7fa65",
   "sourcePath": "quixos-protocol",
   "exportName": "quixos-protocol",
-  "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
+  "mirrorRemote": "https://repos.quixos.org/quixos-toolchain/quixos-protocol.git"
 }

nix/checked-candidate.nix

@@ -407,12 +407,19 @@ pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate")
       ${pkgs.nodejs_24}/bin/node ${./check-execution.mjs} \
         ${protocol}/libexec/quixos-protocol/execution-world.mjs \
         "$out/execution-plan.json" "$out/checks.json" "$out"
-      mkdir -p "$out/bin"
-      cat > "$out/bin/run-isolated" <<EOF
-      #!${pkgs.runtimeShell}
-      exec ${runtimePackages.camino-isolated-workspace}/bin/camino-isolated-workspace "$out" "\$@"
-      EOF
-      chmod +x "$out/bin/run-isolated"
+      # The optional development host is acquired only when explicitly run.
+      # Embedding its executable here made every source check build Web Studio
+      # and a full host even when only checked Package outputs were consumed.
+      cp ${
+        pkgs.writeText "qx-isolated-runtime.json" (
+          builtins.toJSON {
+            codec = "quixos-isolated-runtime/1";
+            source = {
+              inherit (root.lock.quixos) repository commit;
+            };
+          }
+        )
+      } "$out/isolated-runtime.json"
     ''}
   ''}
   ${pkgs.lib.optionalString (

src/bindings/presentation-queries.ts

@@ -41,15 +41,19 @@ export function presentationQueries(pkg: PackageRevision, interfaces: readonly I
       ];
     });
     const stem = `PresentationNavigation${createHash("sha256").update(id).digest("hex").slice(0, 12)}`;
-    const inputs = `presentation:navigation:${id}:inputs`;
-    for (const local of [false, true]) {
-      const name = `${stem}${local ? "View" : "Inputs"}`;
-      const document = `generated/${name}.graphql`;
-      documents.set(
-        document,
-        `query ${name}($presentationMount: QxRef_PresentationMount!) {
+    // Retain full state for operations and hidden occurrences, independently
+    // from the identity projection used to prepare a rendering occurrence.
+    for (const identity of [false, true]) {
+      const prefix = `presentation:navigation:${id}:${identity ? "identity-" : ""}`;
+      const inputs = prefix + "inputs";
+      for (const local of [false, true]) {
+        const name = `${stem}${identity ? "Identity" : ""}${local ? "View" : "Inputs"}`;
+        const document = `generated/${name}.graphql`;
+        documents.set(
+          document,
+          `query ${name}($presentationMount: QxRef_PresentationMount!) {
         root { ${local ? "availableObjects" : "objects"}(all:512, where:{_camino:{as:{PresentationState:{presentationMount:{eq:$presentationMount}}}}}) {
-          entries { node { ${fields.join("\n")}
+          entries { node { ${identity ? "" : fields.join("\n")}
             ... on PresentationState {
               _presentationOccurrence: occurrence
               _presentationSource: source {_camino {ref}}
@@ -59,20 +63,21 @@ export function presentationQueries(pkg: PackageRevision, interfaces: readonly I
           } }
         } }
       }`,
-      );
-      generated.push({
-        id: local ? `presentation:navigation:${id}:view` : inputs,
-        displayName: name,
-        root: { kind: "workspace-interface", interface: contract.revisionId },
-        document,
-        operation: name,
-        fragments: [],
-        views: [],
-        allowances: [],
-        budgets: { ...defaultQueryBudgets, rows: 5000, candidates: 5000, resultBytes: 8388608 },
-        watch: local,
-        placement: local ? { kind: "local", sourceQueryId: inputs } : { kind: "replica" },
-      });
+        );
+        generated.push({
+          id: local ? prefix + "view" : inputs,
+          displayName: name,
+          root: { kind: "workspace-interface", interface: contract.revisionId },
+          document,
+          operation: name,
+          fragments: [],
+          views: [],
+          allowances: [],
+          budgets: { ...defaultQueryBudgets, rows: 5000, candidates: 5000, resultBytes: 8388608 },
+          watch: local,
+          placement: local ? { kind: "local", sourceQueryId: inputs } : { kind: "replica" },
+        });
+      }
     }
   }
   for (const query of generated)

src/capability-language/authoring-context.ts

@@ -21,6 +21,8 @@ export async function authoringContext(start: string) {
     }
     if (text !== undefined) {
       const graph = JSON.parse(text) as { resources: AuthoringResource[]; workspaceId?: string };
+      if (!graph || typeof graph !== "object" || Array.isArray(graph))
+        throw new Error("Managed resource inventory is malformed");
       if (
         graph.workspaceId !== undefined &&
         (typeof graph.workspaceId !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}$/.test(graph.workspaceId))
@@ -30,27 +32,68 @@ export async function authoringContext(start: string) {
       const resources: AuthoringResource[] = [{ kind: "workspace", directory: "root" }];
       const identities = new Set<string>(),
         directories = new Set<string>(["root"]);
-      for (const entry of graph.resources) {
-        // Compiler graphs carry resolved paths; the authoring API presents
-        // stable workbench-relative names and validates containment here.
-        if (typeof entry.directory === "string" && path.isAbsolute(entry.directory))
-          entry.directory = path.relative(workbench, entry.directory);
+      for (const [index, entry] of graph.resources.entries()) {
+        const invalid = (reason: string): never => {
+          throw new Error(`Invalid managed resource registration at entry ${index + 1}: ${reason}`);
+        };
         if (
-          !["interface", "package", "build"].includes(entry.kind) ||
-          !entry.source ||
-          !/^resources\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(entry.directory)
-        ) {
-          throw new Error("Invalid managed resource registration");
+          !entry ||
+          typeof entry !== "object" ||
+          Array.isArray(entry) ||
+          !["interface", "package", "build"].includes(entry.kind)
+        )
+          invalid("unsupported resource kind");
+        if (
+          entry.resourceId !== undefined &&
+          (typeof entry.resourceId !== "string" ||
+            entry.resourceId.length < 1 ||
+            entry.resourceId.length > 256 ||
+            entry.resourceId.includes("\0"))
+        )
+          invalid("resource identity must be a bounded nonempty identifier");
+        const source = entry.source;
+        if (
+          !source ||
+          typeof source !== "object" ||
+          Array.isArray(source) ||
+          source.resolver !== "git" ||
+          typeof source.repository !== "string" ||
+          !source.repository ||
+          source.repository.length > 4096 ||
+          source.repository.includes("\0") ||
+          typeof source.commit !== "string" ||
+          !/^([0-9a-f]{40}|[0-9a-f]{64})$/.test(source.commit)
+        )
+          invalid("expected an immutable Git source");
+        // Git transport policy belongs to the source resolver, including its
+        // maintained local/file fixtures; registration validates only its shape.
+        if (
+          typeof entry.directory !== "string" ||
+          !entry.directory ||
+          entry.directory.length > 4096 ||
+          entry.directory.includes("\0")
+        )
+          invalid("directory must be a bounded path");
+        // Bootstrap intentionally records stable aliases for native histories.
+        // Compare physical paths on BOTH sides, then expose the same canonical
+        // workbench-relative selection for alias and physical working dirs.
+        let directory: string;
+        try {
+          directory = path.relative(workbench, await realpath(path.resolve(workbench, entry.directory)));
+        } catch {
+          invalid("registered directory is unavailable");
         }
-        const identity = `${entry.kind}\0${entry.resourceId ?? entry.source.repository}`;
-        if (identities.has(identity) || directories.has(entry.directory)) {
-          throw new Error(`Multiple editable selections for ${entry.resourceId ?? entry.source.repository}`);
+        if (!/^resources\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(directory!))
+          invalid("registered directory must resolve beneath workbench resources");
+        const identity = `${entry.kind}\0${entry.resourceId ?? source!.repository}`;
+        if (identities.has(identity) || directories.has(directory!)) {
+          throw new Error(`Multiple editable selections for ${directory!}`);
         }
         identities.add(identity);
-        directories.add(entry.directory);
+        directories.add(directory!);
         resources.push({
           kind: entry.kind,
-          directory: entry.directory,
+          directory: directory!,
           resourceId: entry.resourceId,
           source: entry.source,
         });

src/capability-language/authoring-converge.ts

@@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process";
 import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import { authoringContext } from "./authoring-context.js";
+import { managedResourcePath } from "./managed-source-path.js";
 import { snapshotCommit } from "./checked-build.js";
 import { profile } from "./profile.js";
 import {
@@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") {
   const context = await authoringContext(start);
   const graphFile = path.join(context.workbench, ".quixos/resource-graph.json");
   const graphBefore = await readFile(graphFile, "utf8");
+  const graph = JSON.parse(graphBefore);
+  // Discovery resolves outer guest aliases. Persist those same physical
+  // selections, without accepting symlinks within the managed workbench.
+  for (const resource of graph.resources)
+    resource.directory = await managedResourcePath(context.workbench, resource.directory);
   const blockers: AuthoringBlocker[] = [];
   const nodes = new Map<string, { directory: string; kind: string; source: GitSource; dependencies: string[] }>();
   const selected = new Map<string, string>();
@@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") {
   profile("capture-recheck", recheckStarted, { repositories: complete.size });
   // Persist successful selections even if another repository is still broken.
   // Recovery must not depend on all parents succeeding in the same invocation.
-  const graph = JSON.parse(graphBefore);
-  for (const resource of graph.resources)
-    resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory));
   const replacements = new Map<string, string>();
   for (const resource of graph.resources) {
     const source = complete.get(resource.directory);

src/capability-language/managed-source-path.ts

@@ -0,0 +1,19 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+
+/** Registration may name the workbench through its guest alias. Only that
+ * outer alias is permitted: resources and each checkout remain physical,
+ * directly contained directories. Persist the resulting root-relative path.
+ */
+export async function managedResourcePath(workbench: string, directory: string): Promise<string> {
+  const root = await realpath(workbench);
+  const selected = path.resolve(root, directory);
+  const name = path.basename(selected);
+  const resources = path.dirname(selected);
+  if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
+    throw new Error(`Repository is outside the managed workbench: ${directory}`);
+  const relative = `resources/${name}`;
+  if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative))
+    throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`);
+  return relative;
+}

src/capability-language/pin-upgrades.ts

@@ -22,6 +22,7 @@ import {
   type EvolutionReview,
 } from "../capability-model/index.js";
 import { withFileLock } from "./file-lock.js";
+import { managedResourcePath } from "./managed-source-path.js";
 const execFile = promisify(callback);
 type Source = { repository: string; commit: string };
 export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source };
@@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => {
   }
 };
 
-export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpec> => {
+export const discoverUpgradeSpec = async (workbenchPath: string): Promise<UpgradeSpec> => {
+  const workbench = await fs.realpath(workbenchPath);
   const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
   const root = await location(workbench, "root");
   const nodes: UpgradeNode[] = [
@@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpe
         commit: await command(root, "jj", ["--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "commit_id"]),
       },
     },
-    ...graph.resources.map((entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
-      kind: entry.kind,
-      source: entry.source,
-      directory: path.relative(workbench, path.resolve(workbench, entry.directory)),
-    })),
+    ...(await Promise.all(
+      graph.resources.map(
+        async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
+          kind: entry.kind,
+          source: entry.source,
+          directory: await managedResourcePath(workbench, entry.directory),
+        }),
+      ),
+    )),
   ];
   let baseline: string | undefined;
   try {
@@ -406,10 +412,7 @@ export const applyPinUpgrades = async (
           previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({
             kind: entry.kind,
             ...entry.source,
-            directory: await location(
-              plan.workbench,
-              path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)),
-            ),
+            directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)),
           })),
         );
         for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) {

src/capability-language/tool-cli.ts

@@ -595,6 +595,30 @@ const main = async () => {
     process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
     return;
   }
+  if (command === "format" && (args[0] === "--check" || args[0] === "--write")) {
+    const check = args[0] === "--check",
+      files = args.slice(1);
+    if (!files.length || files.some((file) => file.startsWith("-")))
+      throw new Error("usage: quixos-qx format --check|--write FILE...");
+    for (const file of files) {
+      try {
+        const source = await readFile(file, "utf8"),
+          formatted = formatQx(source);
+        if (formatted === source) continue;
+        if (check) {
+          console.error(`Needs formatting: ${file}`);
+          process.exitCode = 1;
+        } else {
+          await writeFile(file, formatted);
+          console.log(`Formatted ${file}`);
+        }
+      } catch (error) {
+        console.error(`${file}: ${error instanceof Error ? error.message : error}`);
+        process.exitCode = 1;
+      }
+    }
+    return;
+  }
   const [file, flag, ...rest] = args;
   if (
     !file ||

src/execution-world/client-contracts.ts

@@ -258,17 +258,7 @@ export function generatePackageComponentBindings(
           target.kind === "atom"
             ? `ManagedReference<"atom", ${JSON.stringify(target.atomId)}>`
             : `ManagedReference<"interface", ${JSON.stringify(target.interfaceRevisionId)}>`;
-        const fields =
-          target.kind === "interface"
-            ? find(target.interfaceRevisionId).members.flatMap((member) => {
-                if ((member.kind !== "value" && member.kind !== "relationship") || !member.queryRead) return [];
-                const getter = member.operations.find(
-                  (operation) => operation.displayName === (member.kind === "value" ? "get" : "resolve"),
-                );
-                return getter ? [`readonly ${JSON.stringify(member.displayName)}: ${tsType(getter.outputType)}`] : [];
-              })
-            : [];
-        return `{readonly reference: ${reference}; readonly values: {${fields.join(";")}}}`;
+        return `{readonly reference: ${reference}}`;
       })
       .join(",")}]`;
   const interfaces = generateInterfaceClientBindings(imports, "@quixos/camino-react", props);

src/execution-world/metadata.ts

@@ -1,6 +1,9 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 
+const admissionFailure = (code: string, kind: "file-bytes", measured: number, limit: number) =>
+  Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
+
 /** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
  * still required. Charge input, parse trees and derived indexes before reading
  * or parsing. Each live candidate retains its reservation until explicit close. */
@@ -116,8 +119,8 @@ export async function readCandidateMetadata(
   let releaseInput: (() => void) | undefined;
   try {
     const stat = await handle.stat();
-    if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > limit)
-      throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (!stat.isFile() || !Number.isSafeInteger(stat.size)) throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (stat.size > limit) throw admissionFailure("CANDIDATE_METADATA_FILE_LIMIT", "file-bytes", stat.size, limit);
     // Reserve the input buffer and UTF-16 decoding before allocating either.
     releaseInput = scope.reserve((stat.size + 1) * 3);
     const bytes = Buffer.alloc(stat.size + 1);

src/query/tree.ts

@@ -113,6 +113,13 @@ export function lowerQueryTree(
   if (!root || selection.some((field) => field !== root))
     throw new QueryCompileError("QUERY_TREE_ROOT", "A Query Tree requires one unaliased root selection");
   const plan: QueryTreePlan = { root: "root", nodes: [], projections: [], maxOccurrences: 0 };
+  const collectionBound = (field: QuerySelection): number | undefined => {
+    const limit = field.arguments.first ?? field.arguments.all;
+    // Checked GraphQL Int literals retain their decimal spelling in the IR.
+    if (limit?.kind !== "literal" || !["string", "number"].includes(typeof limit.value)) return;
+    const value = Number(limit.value);
+    return Number.isSafeInteger(value) && value > 0 ? Math.min(value, declaration.budgets.rows) : undefined;
+  };
   const project = (id: string, subject: InterfaceRevisionId, fields: QuerySelection[], shape: ValueType) => {
     if (plan.projections.length >= 256)
       throw new QueryCompileError("QUERY_TREE_LIMIT", "Query Tree exceeds 256 projections");
@@ -153,9 +160,15 @@ export function lowerQueryTree(
     for (const field of fields) {
       if (field.boundary || !containsBoundary(field.selection)) continue;
       const targets: { path: string[]; node: string }[] = [];
-      const prune = (fields: QuerySelection[], shape: ValueType, path: string[], bound: number): QuerySelection[] => {
-        if (shape.kind === "optional") return prune(fields, shape.value, path, bound);
-        if (shape.kind === "list") return prune(fields, shape.value, [...path, "[]"], bound * declaration.budgets.rows);
+      const prune = (
+        fields: QuerySelection[],
+        shape: ValueType,
+        path: string[],
+        bound: number,
+        listLimit = declaration.budgets.rows,
+      ): QuerySelection[] => {
+        if (shape.kind === "optional") return prune(fields, shape.value, path, bound, listLimit);
+        if (shape.kind === "list") return prune(fields, shape.value, [...path, "[]"], bound * listLimit);
         const target = objectInterface(fields);
         if (target) {
           targets.push({
@@ -168,7 +181,13 @@ export function lowerQueryTree(
           .filter((field) => containsBoundary(field.selection))
           .map((field) => ({
             ...field,
-            selection: prune(field.selection, fieldType(shape, field.key), [...path, field.key], bound),
+            selection: prune(
+              field.selection,
+              fieldType(shape, field.key),
+              [...path, field.key],
+              bound,
+              collectionBound(field) ?? listLimit,
+            ),
           }));
         // Relationship occurrence identity is its entry key, including duplicate
         // target Objects. Never substitute list position or Object identity.
@@ -177,7 +196,10 @@ export function lowerQueryTree(
         return minimal;
       };
       const type = fieldType(shape, field.key);
-      const minimal = { ...field, selection: prune(field.selection, type, [field.key], occurrences) };
+      const minimal = {
+        ...field,
+        selection: prune(field.selection, type, [field.key], occurrences, collectionBound(field)),
+      };
       const selected = [...identity(fields), minimal];
       current.bindings.push({
         name: field.key,

src/react-build/expansion.ts

@@ -364,6 +364,9 @@ export async function expandPresentationQueries(workspace: WorkspaceRevision): P
   for (const pkg of workspace.packageImports) {
     for (const original of [...(pkg.checkedQueries ?? [])]) {
       if (!original.declaration.id.startsWith("presentation:navigation:")) continue;
+      // Identity must remain independent of every occurrence's data projection.
+      // Full retained acquisition may include those requirements together.
+      if (/:identity-(inputs|view)$/.test(original.declaration.id)) continue;
       const inputs = (stateInputs.get(original.declaration.root.interface) ?? []).map((input) => ({
         ...input,
         query:

test/managed-source-path.test.ts

@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { managedResourcePath } from "../src/capability-language/managed-source-path.js";
+
+test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => {
+  const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-"));
+  t.after(() => fs.rm(scratch, { recursive: true, force: true }));
+  const root = path.join(scratch, "retained/workbench"),
+    alias = path.join(scratch, "guest"),
+    outside = path.join(scratch, "outside");
+  await fs.mkdir(path.join(root, "resources/Package"), { recursive: true });
+  await fs.mkdir(outside);
+  await fs.symlink(root, alias);
+  for (const registered of [
+    "resources/Package",
+    path.join(alias, "resources/Package"),
+    path.relative(root, path.join(alias, "resources/Package")),
+  ])
+    assert.equal(await managedResourcePath(alias, registered), "resources/Package");
+  await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias"));
+  await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/);
+  await fs.symlink(outside, path.join(root, "resources/Escape"));
+  await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/);
+  await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true });
+  await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/);
+  await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources"));
+  await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources"));
+  await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/);
+});

test/pin-upgrades.test.ts

@@ -176,6 +176,9 @@ for (const dependencyKind of ["interface", "build"] as const)
   test(`${dependencyKind} pin upgrades publish children before parent locks and resume without republishing completed nodes`, async (context) => {
     const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-test-"));
     context.after(() => fs.rm(workbench, { recursive: true, force: true }));
+    const alias = `${workbench}-guest-alias`;
+    await fs.symlink(workbench, alias);
+    context.after(() => fs.unlink(alias));
     const from = "a".repeat(40),
       to = "b".repeat(40),
       framework = "c".repeat(40);
@@ -244,7 +247,15 @@ for (const dependencyKind of ["interface", "build"] as const)
     await fs.mkdir(path.join(workbench, ".quixos"), { recursive: true });
     await fs.writeFile(
       path.join(workbench, ".quixos/resource-graph.json"),
-      JSON.stringify({ resources: [{ ...sources[1], source: { resolver: "git", ...sources[1].source } }] }),
+      JSON.stringify({
+        resources: [
+          {
+            ...sources[1],
+            directory: path.join(alias, sources[1].directory),
+            source: { resolver: "git", ...sources[1].source },
+          },
+        ],
+      }),
     );
     assert.deepEqual(
       plan.nodes.map((node) => node.directory),
@@ -275,6 +286,7 @@ for (const dependencyKind of ["interface", "build"] as const)
     assert.deepEqual(published, ["resources/Named", "root"]);
     const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
     assert.equal(graph.resources.length, 1);
+    assert.equal(graph.resources[0].directory, "resources/Named");
     assert.equal(graph.resources[0].source.commit, to);
     const next = await planPinUpgrades(workbench, {
       nodes: [sources[0], { ...sources[1], source: graph.resources[0].source }],

test/query-compiler.test.ts

@@ -520,7 +520,7 @@ test("React tooling generates checked owner queries from imported closed navigat
   if (parsed.resource.kind !== "package") throw Error("package required");
   const contracts = [...dependencies, ...(parsed.resource.specializations ?? [])];
   const documents = presentationQueries(parsed.resource.revision, contracts);
-  assert.equal(documents.size, 2);
+  assert.equal(documents.size, 4);
   const checked = await Promise.all(
     parsed.resource.revision.queries!.map((query) =>
       compileQuery(query, contracts, async (name) => documents.get(name)!),
@@ -528,10 +528,16 @@ test("React tooling generates checked owner queries from imported closed navigat
   );
   assert.deepEqual(
     checked.map((query) => query.declaration.placement?.kind),
-    ["replica", "local"],
+    ["replica", "local", "replica", "local"],
   );
   assert.match(JSON.stringify(checked[0]!.output), /"custom":\{"kind":"record","fields":\{"label"/);
   assert.match(JSON.stringify(checked[0]!.selection), /"kind":"as"/);
+  for (const identity of checked.slice(2)) {
+    assert.match(identity.declaration.id, /:identity-(inputs|view)$/);
+    assert.doesNotMatch(JSON.stringify(identity.output), /"custom"/);
+    assert.match(JSON.stringify(identity.output), /_presentationOccurrence/);
+    assert.match(JSON.stringify(identity.output), /_presentationSource/);
+  }
   assert(
     checked.every((query) =>
       query.effects.some((effect) => effect.memberId === "mount" && effect.uses.includes("predicate")),

test/query-tree.test.ts

@@ -29,12 +29,15 @@ const navigation = iface(
 }`,
   [item],
 );
-function declaration(root: InterfaceRevision = item) {
+function declaration(root: InterfaceRevision = item, dependencies: InterfaceRevision[] = []) {
   const result = compileCapabilityResourceSource(
     `import interface ${root.displayName}; package Views id "views" revision "views@1" {
     query Open id "open" root ${root.displayName} document "open.graphql" operation "Open" {replica; max rows 10;}
   }`,
-    { source, environment: { interfaces: new Map([[root.displayName, root]]), interfaceClosure: [root, item] } },
+    {
+      source,
+      environment: { interfaces: new Map([[root.displayName, root]]), interfaceClosure: [root, item, ...dependencies] },
+    },
   );
   assert.ok(result.ok, JSON.stringify(result.diagnostics));
   if (result.resource.kind !== "package") throw Error("Expected Package");
@@ -103,6 +106,44 @@ test("bounded list bindings preserve entry identity without requesting details",
   assert(!JSON.stringify(projection.selection).includes('"name":"body"'));
   assert(tree.maxOccurrences <= 256);
 });
+test("literal collection windows bound handles independently of detail row budgets", async () => {
+  const source = { ...declaration(navigation), budgets: { ...declaration(navigation).budgets, rows: 20000 } };
+  const query = (limit: string, variables = "") => `query Open${variables} {root {
+    items(first: ${limit}) {entries {node {...Body @boundary(name:"body")}}}
+  }} fragment Body on Item {body}`;
+  const checked = await compileQuery(source, [item, navigation], async () => query("3"));
+  assert.equal(checked.tree!.maxOccurrences, 7);
+  await assert.rejects(
+    compileQuery(source, [item, navigation], async () => query("200")),
+    /QUERY_TREE_LIMIT/,
+  );
+  await assert.rejects(
+    compileQuery(source, [item, navigation], async () => query("$first", "($first:Int!)")),
+    /QUERY_TREE_LIMIT/,
+  );
+  const group = iface(
+    `import interface Item; interface Group id "group" revision "group@1" {
+    queryable relation items id "group:items" : many interface Item ordered {resolve id "group:items:resolve" execution snapshot;}
+  }`,
+    [item],
+  );
+  const groups = iface(
+    `import interface Group; interface Groups id "groups" revision "groups@1" {
+    queryable relation groups id "groups:groups" : many interface Group ordered {resolve id "groups:groups:resolve" execution snapshot;}
+  }`,
+    [item, group],
+  );
+  const nested = { ...declaration(groups, [group]), budgets: source.budgets };
+  const nestedQuery = (outer: number, inner: number) => `query Open {root {
+    groups(first:${outer}) {entries {node {items(first:${inner}) {entries {node {...Body @boundary(name:"body")}}}}}}
+  }} fragment Body on Item {body}`;
+  const bounded = await compileQuery(nested, [item, group, groups], async () => nestedQuery(2, 3));
+  assert.equal(bounded.tree!.maxOccurrences, 15, "Nested windows multiply instead of reusing the outer bound");
+  await assert.rejects(
+    compileQuery(nested, [item, group, groups], async () => nestedQuery(20, 20)),
+    /QUERY_TREE_LIMIT/,
+  );
+});
 test("guards control boundary participation and invalid syntax fails checking", async () => {
   const checked = await compileQuery(
     declaration(),

test/qx-format-cli.test.ts

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import test from "node:test";
+import { formatQx } from "../src/capability-language/source.js";
+
+const cli = resolve(process.cwd(), "dist/src/capability-language/tool-cli.js");
+const run = (...args: string[]) => spawnSync(process.execPath, [cli, "format", ...args], { encoding: "utf8" });
+const source = `workspace Test id "w" revision "w@1" commit "${"1".repeat(40)}" {\n// 雪 🦊 comment preserved\n}\n`;
+
+test("QX batch checks are read-only; writes match single-file formatting and remain idempotent", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "qx-format-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const files = [join(root, "one.qx"), join(root, "two 雪.qx")];
+  for (const file of files) writeFileSync(file, source);
+  const check = run("--check", ...files);
+  assert.notEqual(check.status, 0, check.stderr);
+  for (const file of files) {
+    assert(check.stderr.includes(file));
+    assert.equal(readFileSync(file, "utf8"), source);
+  }
+  const single = run(files[0]!);
+  assert.equal(single.status, 0, single.stderr);
+  assert.equal(single.stdout, formatQx(source));
+  const write = run("--write", ...files);
+  assert.equal(write.status, 0, write.stderr);
+  for (const file of files) assert.equal(readFileSync(file, "utf8"), single.stdout);
+  assert.equal(run("--check", ...files).status, 0);
+  assert.equal(run("--write", ...files).stdout, "");
+  writeFileSync(files[0]!, source);
+  assert.equal(run(files[0]!, "--write").status, 0);
+  assert.equal(readFileSync(files[0]!, "utf8"), single.stdout);
+});
+
+test("QX batch errors report every failure and do not truncate valid work", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "qx-format-errors-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const broken = join(root, "broken.qx"),
+    missing = join(root, "missing.qx"),
+    valid = join(root, "valid.qx");
+  writeFileSync(broken, "workspace { invalid");
+  writeFileSync(valid, source);
+  const result = run("--write", broken, missing, valid);
+  assert.notEqual(result.status, 0);
+  assert(result.stderr.includes(broken));
+  assert(result.stderr.includes(missing));
+  assert.equal(readFileSync(broken, "utf8"), "workspace { invalid");
+  assert.equal(readFileSync(valid, "utf8"), formatQx(source));
+  writeFileSync(valid, source);
+  assert.notEqual(run("--write", valid, "--unknown").status, 0);
+  assert.equal(readFileSync(valid, "utf8"), source, "Validate arguments before writing any file");
+  assert.notEqual(run("--check").status, 0);
+});