sim-expr-tree-calc

sim-expr-tree-calc pull-verifies ordinary sim_kernel::Expr cell sources and retains ordinary sim_kernel::Value results. It layers expression-tree lookup policy over sim-incremental-core: runtime references record cells, missing names, lookup steps, listings, mount epochs, inherited policy, codec registry, and authority observations.

Edited source is decoded through inherited installed-codec policy under explicit positions, bounded DecodeLimits, trusted caller policy, and diminished cell authority. Source and result presentation faces use independent hard-clamped byte/depth/item budgets and report truncation, unsupported values, and codec failures as metadata. Callable and otherwise non-projectable results remain ordinary calculation values and are never stringified by the face path.

Canonical as_expr projections, including Citizen/read-construct values where available, receive stable fingerprints for value cutoff. Valid values without a canonical projection remain ordinary values, are labelled volatile, and conservatively count as changed. Failed recalculations commit failure memos and make current-result reads fail while retaining a separately labelled last-good value.

Calculation always runs outside the expression-tree state lock. Requested work, observation, query-depth, expression-depth, and output limits are clamped to hard host ceilings. The checked specimen covers dependency-first diamond verification, changing and unchanged branches against full recomputation, deterministic dynamic cycles and recovery, deep chains, macro and callable/lambda evaluation, Table, Dir and opaque values, failure recovery, cancellation, and lock-boundary probes.

Calculation policy inherits field by field from tree to ancestor directories to cell. Automatic, on-demand, manual, and frozen triggers use the same verify, force-roots, and force-recursive engine. Automatic mutations enter a bounded, debounced, priority-aware queue with bounded-bypass fairness; queue snapshots and incremental continuation tokens make unfinished work explicit and restartable.

Opening a calculator captures one immutable CapabilitySet ceiling. Cell authority can only shrink through allow intersections and accumulated denials, and required capabilities are checked before evaluation. Each fresh evaluation context is diminished to that effective set, while ordinary kernel effect ledger records are summarized into the calculation receipt.

Every attempt produces a bounded receipt containing source, policy, authority, dependency, logical tick, optional wall-clock, effect, result fingerprint, outcome, and reason evidence. explain reads that evidence without evaluating. Progress and changes flow through sim-lib-stream-core::StreamValue with an explicit BufferPolicy, observable overflow, ordinary stream next, and cancellation.

Derived calculation state is a versioned ordinary Table record. It includes source/control generations and identities, dependency observations, reverse edges, memos, receipts, backend refresh observations, and pending automatic continuations. Reopen validates the complete record before rehydrating the incremental graph. A missing, corrupt, incompatible, or mismatched record is deleted and rebuilt without modifying authored source or operational control state, so damage costs performance rather than semantics.

Mounted backends without a watch contract can install a MountRefreshSource. Only an explicit refresh samples those backends; it compares epochs, directory listings, and entry stamps and invalidates the corresponding observed query keys. Ordinary current reads, verification, and explanation never poll all backends, and watch-managed mounts are never polled by refresh.