// SCOPE DECLARATION - [norun] declaration collected by collect-scopes
~[comptime|transform] pub tor register {
    source: Source,
    invocation: *const Invocation,
    item: std/compiler:*const Item,
    program: std/compiler:*const Program,
    allocator: std.mem.Allocator
} -> SiteResult

// The scope introspection tors — get-scope, scope-vocabulary,
// scope-manifest, scope-grammar (and the scope-affordances tor decl) —
// moved to the `scopeverbs` part.
//
// EXPLAIN-RUNTIME - the `[explainer]` for the scope registry
//
// koruc's `koru_explain_gather` calls every discovered `[explainer]` once with
// the program AST; the `explain` command renders whatever this returns. This
// explainer builds every registered scope's manifest through the SAME shared
// producer (`scopeManifestForScope`) the register emission uses, then reports:
// a note (the human vocabulary lines) plus a `manifest` property carrying the
// EXACT JSON the `scope-manifest` tor serves — so `explain` shows the served
// contract bytes, never a hand-written copy.
//
// @retain: explain_runtime_event is referenced from generated code (koruc's
// koru_explain_gather invokes every discovered [explainer]).
~[comptime|explainer] pub tor explain-runtime {
    program: *const ast.Program,
    allocator: std.mem.Allocator
} -> ExplainReport

// PARSE - Parse interpreter source without executing it
//
// Delegates to `std/interpreter:parse`, which is the interpreter's own parser.
// It takes no file name on purpose: interpreted source has no file, therefore
// no host half and no ``. This entry point used to hold a copy of the
// COMPILER's file parser (`std/koru:parse.source`), which derives its
// host/pure mode from the filename extension — so a synthetic `"x.kz"`
// silently put interpreted source in host mode and made `` mandatory, the
// exact inverse of the rule `run` enforces.
~pub tor parse.source { source: string, allocator: std.mem.Allocator }
| parsed *const ast.Flow
| parse-error { message: string, line: u32, column: u32 }

~part eval koru_std/runtime.eval.kz

Koru Standard Library: the eval part. Joined via `~part eval` in runtime.kz. EVAL - Run a parsed AST against a named scope

// Koru Standard Library: the eval part. Joined via `~part eval` in runtime.kz.
//
// EVAL - Run a parsed AST against a named scope
~pub tor eval {
    flow: *const ast.Flow,
    scope: string,
    budget: ?u64,
    handle_pool: ?*@import("root").koru_std.koru_interpreter.HandlePool,
    auto_discharge: bool,
    defined: ?*@import("root").koru_std.koru_interpreter.DefinedFlows
}
| result {
    value: @import("root").koru_std.koru_interpreter.Value,
    used: u64,
    handles: u32
}
| unhandled-branch {
    branch: string,
    payload: string,
    handles: string,
    bound: string
}
| exhausted { used: u64, last_event: string, handles: u32 }
| validation-error string
| event-denied string
| dispatch-error { event_name: string, message: string }
| scope-not-found string

~part parsewire koru_std/runtime.parsewire.kz

Koru Standard Library: the `parsewire` part of runtime.kz. Joined via `~part parsewire` in runtime.kz; merged into the runtime module at load. PARSE.WIRE - the wire grammar: one flow, arms included A model's turn is `verb(field: "value", ...)` with `|` arms chaining the fresh outcomes (`| ok h |> verb(handle: h)` binds what the call just issued — the composition partial programs are). Quoted string values; prose and trailing text are refused at PARSE time, with a diagnostic written to be fed back to the model that emitted it. Two things are deliberately NOT checked here: - **Vocabulary membership.** An in-shape call naming a verb outside the scope is `event-denied` at dispatch — "a real verb that is not yours", a different and load-bearing meaning from "that was not Koru" (430_055 pins the confusion this split exists to prevent). - **Field membership.** An unknown field on a known verb is `validation-error` at dispatch, for the same reason. Validation only shapes the line; the AST is still built by the interpreter's own parser, so the wire can never accept a shape that eval would execute differently. The wire's shape rules and the validator that enforces them — WIRE_GRAMMAR_TEXT and wireValidate — live in the `wireval` part; the two must move together or the prompt starts lying about the parser. The type-directed scanner (wireScan) and this tor's proc live in the `wirescan` part — declared field types decide what a value position admits, and admitted captured text is normalized to canonical quoted wire before parse_event sees it.

// Koru Standard Library: the `parsewire` part of runtime.kz.
// Joined via `~part parsewire` in runtime.kz; merged into the runtime
// module at load.
// PARSE.WIRE - the wire grammar: one flow, arms included
//
// A model's turn is `verb(field: "value", ...)` with `|` arms chaining the
// fresh outcomes (`| ok h |> verb(handle: h)` binds what the call just
// issued — the composition partial programs are). Quoted string values;
// prose and trailing text are refused at PARSE time, with a diagnostic
// written to be fed back to the model that emitted it.
//
// Two things are deliberately NOT checked here:
//
// - **Vocabulary membership.** An in-shape call naming a verb outside the
//   scope is `event-denied` at dispatch — "a real verb that is not yours",
//   a different and load-bearing meaning from "that was not Koru" (430_055
//   pins the confusion this split exists to prevent).
// - **Field membership.** An unknown field on a known verb is
//   `validation-error` at dispatch, for the same reason.
//
// Validation only shapes the line; the AST is still built by the
// interpreter's own parser, so the wire can never accept a shape that eval
// would execute differently.
//
// The wire's shape rules and the validator that enforces them —
// WIRE_GRAMMAR_TEXT and wireValidate — live in the `wireval` part; the
// two must move together or the prompt starts lying about the parser.
// The type-directed scanner (wireScan) and this tor's proc live in the
// `wirescan` part — declared field types decide what a value position
// admits, and admitted captured text is normalized to canonical quoted
// wire before parse_event sees it.
~[retain] pub tor parse.wire {
    source: string,
    input_fn: ?InputLookupFn,
    host_input_fn: ?InputLookupFn
}
| parsed { flow: *const ast.Flow, wire: string }
| parse-error { message: string, line: u32, column: u32, not_invocation: bool }

~part example koru_std/runtime.example.kz

Koru Standard Library: the `example` part of runtime.kz. Joined via `~part example` in runtime.kz; merged into the runtime module at load. PARSE.WIRE.EXAMPLE - the chain rule's worked example, derived per scope The shape rules in WIRE_GRAMMAR_TEXT are fixed prose — they describe the grammar itself, which is one law for every scope. The chain rule's worked EXAMPLE is different: it names verbs, and verbs belong to a scope. A fixed cast teaches notes on every register (kopium hole 9: on calc, `open` and `append` are event-denied and nothing mints a handle). So the cast is synthesized from the scope's own manifest — the same record the dispatcher and the vocabulary render are minted from — and a scope with nothing provably chainable gets the rule with no fabricated example. The chain rule's worked example, synthesized from the scope's own manifest — the only cast that cannot drift from what the wall enforces. The head is the first verb that provably hands a value to an arm: a branch carrying a payload field (required beats optional), or a bare return minting an obligation on `__type_ref` — which the wire meets branchless, as `ok`. The chain target is the possession edge when one exists (the verb that discharges what the head mints); on a handle-free scope it is the lightest sink that can carry the binding. Returns null when nothing is provably chainable — the caller renders the rule with no fabricated example.

~part run koru_std/runtime.run.kz

Koru Standard Library: the `run` part of runtime.kz — the scoped run / run-cached tors. Joined via `~part run` in runtime.kz.

// Koru Standard Library: the `run` part of runtime.kz — the scoped
// run / run-cached tors. Joined via `~part run` in runtime.kz.
~[retain] pub tor run {
    source: string,
    scope: string,
    budget: ?u64,
    handle_pool: ?*@import("root").koru_std.koru_interpreter.HandlePool,
    fail_fast: bool,
    auto_discharge: bool,
    shape: ?string,
    defined: ?*@import("root").koru_std.koru_interpreter.DefinedFlows,
    lenient: bool,
    host_dispatch: ?@import("root").koru_std.koru_interpreter.HostDispatchFn,
    session_env: ?*@import("root").koru_std.koru_interpreter.Environment,
    session_bind_fn: ?@import("root").koru_std.koru_interpreter.SessionBindFn,
    session_bind_env: ?*@import("root").koru_std.koru_interpreter.Environment,
    session_bind_counter: ?*u64,
    turn_env: ?*@import("root").koru_std.koru_interpreter.Environment
}
| result {
    value: @import("root").koru_std.koru_interpreter.Value,
    used: u64,
    handles: u32,
    bound: string,
    trace: string
}
| unhandled-branch {
    branch: string,
    payload: string,
    handles: string,
    bound: string
}
| exhausted { used: u64, last_event: string, handles: u32 }
| parse-error { message: string, line: u32, column: u32 }
| validation-error string
| shape-error { branch: string, field: ?string, message: string }
| event-denied string
| dispatch-error { event_name: string, message: string, trace: string }
| scope-not-found string

~part runcached koru_std/runtime.runcached.kz

Koru Standard Library: the `runcached` part of runtime — the cached run variant's signature. Joined via `~part runcached` in runtime.kz; merged into the runtime module at load. Its Zig impl rides in the `runcimpl` part. `run-cached` is `run` with parse reuse — identical contract, cached parsing for repeated source.

// Koru Standard Library: the `runcached` part of runtime — the cached
// run variant's signature. Joined via `~part runcached` in runtime.kz;
// merged into the runtime module at load. Its Zig impl rides in the
// `runcimpl` part.
//
// `run-cached` is `run` with parse reuse — identical contract, cached
// parsing for repeated source.
~pub tor run-cached {
    source: string,
    scope: string,
    budget: ?u64,
    handle_pool: ?*@import("root").koru_std.koru_interpreter.HandlePool,
    fail_fast: bool,
    auto_discharge: bool,
    shape: ?string,
    lenient: bool,
    host_dispatch: ?@import("root").koru_std.koru_interpreter.HostDispatchFn,
    session_env: ?*@import("root").koru_std.koru_interpreter.Environment,
    session_bind_fn: ?@import("root").koru_std.koru_interpreter.SessionBindFn,
    session_bind_env: ?*@import("root").koru_std.koru_interpreter.Environment,
    session_bind_counter: ?*u64,
    turn_env: ?*@import("root").koru_std.koru_interpreter.Environment
}
| result {
    value: @import("root").koru_std.koru_interpreter.Value,
    used: u64,
    handles: u32,
    bound: string,
    trace: string
}
| unhandled-branch {
    branch: string,
    payload: string,
    handles: string,
    bound: string
}
| exhausted { used: u64, last_event: string, handles: u32 }
| parse-error { message: string, line: u32, column: u32 }
| validation-error string
| shape-error { branch: string, field: ?string, message: string }
| event-denied string
| dispatch-error { event_name: string, message: string, trace: string }
| scope-not-found string

~part outcome koru_std/runtime.outcome.kz

Koru Standard Library: the `outcome` part of runtime.kz — how the interpreter's result union becomes the `run` / `run-cached` tors' result union, with the shape contract applied on the way. Joined via `~part outcome` in runtime.kz; merged into the runtime module at load. The interpreter's run outcome, relabeled into the `run` tor's result union. `shape` validates a `.result` against the named tor's branch contract before it is handed back. `run-cached`'s proc carries its own copy inline — the cached tor is not `~retain`, so its `run_cached_event` struct is emitted only when invoked and cannot be named in a signature.

~part specs koru_std/runtime.specs.kz

Koru Standard Library: the `specs` part of runtime — the branch/input/ scope metadata types the generated dispatchers and the shape checker speak. Joined via `~part specs` in runtime.kz; merged into the runtime module at load. Branch field metadata for shape validation

~part wireval koru_std/runtime.wireval.kz

Koru Standard Library: the `wireval` part of runtime — the wire grammar's rejection vocabulary; the teaching prose lives in the `grammartext` part (flat sibling — parts cannot nest). Joined via `~part wireval` in runtime.kz; merged into the runtime module at load. WIRE_GRAMMAR_TEXT (the `grammartext` part) and the `wirescan` scanner move as one: the text describes exactly what the scanner enforces. `not_invocation` marks the refusals where nothing ever lexed as `verb(` — prose, markdown fences, a lone arm — as opposed to a malformed invocation. The bridge binds those items as residue so the model's own words become a session value it can re-emit through a real verb.

~part grammartext koru_std/runtime.grammartext.kz

Koru Standard Library: the `grammartext` part of runtime — the wire grammar's teaching prose, kept apart so the rejection vocabulary file stays under its pin. Joined via `~part grammartext` in runtime.kz. WIRE_GRAMMAR_TEXT and the `wirescan` scanner move as one: the text describes exactly what the scanner enforces.

~part wirescan koru_std/runtime.wirescan.kz

Koru Standard Library: the `wirescan` part of runtime — the wire scanner and parse.wire's proc. Joined via `~part wirescan` in runtime.kz; merged into the runtime module at load. The wire is one grammar: `verb(field: value)` with `|` arms. A value is a double-quoted string or a bare Koru expression — literal, bound name, field path, or computed (`n * 2`) — judged by the expression parser, not by a field's declared type. There is no capture channel: Expression and Source are comptime types the wire does not speak. The post-`)` region (balanced bare-value capture, the two arm shapes and their commitment rule) lives in the `wiretail` part; the character predicates, rejection builders, and line/column diagnostic live in `wirelex`.

~part wiretail koru_std/runtime.wiretail.kz

Koru Standard Library: the `wiretail` part of runtime — what follows the closing `)`, and how a bare value is captured. Joined via `~part wiretail` in runtime.kz; merged into the runtime module at load. Two arm shapes, self-announcing: a `|` on the call's own line is a predicted-branch chain and the program IS that one line — a `|` arm on a later line has nothing to hang on and refuses. A bare call line takes indented `|` arms, one per line, deeper indent arming a mid-chain step. Bare values are Koru expressions — the expression parser must accept the text whole, or it is prose wearing arg clothes and refuses here.

~part wirelex koru_std/runtime.wirelex.kz

Koru Standard Library: the `wirelex` part of runtime — the wire grammar's character predicates, rejection builders, and the line/column diagnostic. Joined via `~part wirelex` in runtime.kz; merged into the runtime module at load.

~part obtainvia koru_std/runtime.obtainvia.kz

Koru Standard Library: the `obtainvia` part of runtime — the wire grammar's obtain-via lines. Joined via `~part obtainvia` in runtime.kz; merged into the runtime module at load. Obtain-via lines: every obligation the scope can mint, rendered as WHO mints it (verb + the arm word the model binds it through) and WHO spends it (verb + arg). Derived from the same creates/discharges edges the dispatcher enforces — the prompt's teaching and the refusal's law are one table, so a scope whose register block changes cannot drift its grammar away from its wall.

~part affordances koru_std/runtime.affordances.kz

Koru Standard Library: the possession-shaped callable surface. Joined via `~part affordances` in runtime.kz; merged into the runtime module at load. SCOPE-AFFORDANCES - the callable surface, possession-shaped (HATEOAS rooms) `scope-vocabulary` is the static surface: everything the scope declares. This is the live half: what may be called GIVEN the resource types the caller holds. An tor is callable now iff every discharge-kind phantom it consumes (`!open`) names a held type; tors with no possession requirement are always callable. `held` is a comma-separated list of resource-type names (the `created_by_event` segments of the caller's live handles). The render uses the same signature spelling as scope-vocabulary, so the callable subset and the static vocabulary are the same bytes filtered. The projection is structural — it reads the scope's declared input fields and phantoms, never a rendered string — so the filter and the enforcement cannot drift (same contract as scope-manifest). The tor decl moved to the `scopeverbs` part — the scope verbs sit together; the proc stays here.

~part manifest koru_std/runtime.manifest.kz

Koru Standard Library: the `manifest` part of runtime — serializing a scope manifest to JSON and to text (the scope-manifest / explain-runtime verb bodies). Joined via `~part manifest` in runtime.kz; merged into the runtime module at load. jsonAppendString/jsonAppendNumber moved to the `jsonemit` part. Serialize a scope manifest to JSON. The record is the contract; this is one projection of it (the `explain` host and the Orisha endpoint consume the same record — or this same function — never a hand-written copy).

~part wiretext koru_std/runtime.wiretext.kz

Koru Standard Library: the `wiretext` part of runtime — wire grammar text helpers: the chain-rule wording, the per-scope rules render, and the line/column diagnostic the wire validator reports with. Joined via `~part wiretext` in runtime.kz; merged into the runtime module at load. `{s}` is the worked example `scope-grammar` derives from the scope's own verbs — a real chain, rendered because the preamble's examples are cast in invented verbs that exist in no vocabulary.

~part contract koru_std/runtime.contract.kz

Koru Standard Library: the `contract` part of runtime — the signature line's full render for the wire prompt. Joined via `~part contract` in runtime.kz; merged into the runtime module at load. The vocabulary line IS the declaration — `pub tor name { field: type }`, then `-> type<obligation!>` for a bare return or `| branch payload` for declared outcomes. One surface: the text that defines the verb is the text that teaches it, so the prompt cannot describe a call the law would refuse — or hide an outcome the law would fire. The declaration head: `pub tor name { field: type, field: type<phantom> }`.

~part registry koru_std/runtime.registry.kz

Koru Standard Library: the `registry` part of runtime.kz. Joined via `~part registry` in runtime.kz; merged into the runtime module at load. REGISTRY COMMON - shared comptime machinery: register's emission, the scope-manifest builder, and the [explainer] all derive from these. Includes the scope-def marker protocol: a register site leaves a __KORU_SCOPE_DEF__ host_line so `scope(other)` entries at later sites resolve order-free (the site's own transform consumes its flow).

~part scopeverbs koru_std/runtime.scopeverbs.kz

Koru Standard Library: the `scopeverbs` part of runtime — the scope introspection tors: get-scope, scope-vocabulary, scope-manifest, scope-grammar, and the scope-affordances tor decl. Joined via `~part scopeverbs` in runtime.kz; merged into the runtime module at load.

// Koru Standard Library: the `scopeverbs` part of runtime — the scope
// introspection tors: get-scope, scope-vocabulary, scope-manifest,
// scope-grammar, and the scope-affordances tor decl. Joined via
// `~part scopeverbs` in runtime.kz; merged into the runtime module at load.
~[retain] pub tor get-scope { name: string }
| scope {
    dispatcher: DispatchFn,
    cost_fn: ?CostFn,
    creates_obligations_fn: ?ObligationsArrayFn,
    discharges_obligations_fn: ?ObligationsArrayFn,
    discharge_event_fn: ?DischargeEventFn,
    creates_spec_fn: ?CreatesSpecFn,
    discharges_spec_fn: ?DischargesSpecFn,
    events_fn: ?EventsLookupFn,
    input_fn: ?InputLookupFn,
    branches_fn: ?BranchesLookupFn,
    doc_fn: ?DocLookupFn
}
| not-found

// SCOPE-VOCABULARY - Render a scope's vocabulary for an external reader
//
// The whole point of the enumeration surface: a model driving this interpreter
// must be told, accurately, what it may call — and that description must come
// from the register declaration, not a hand-typed script that can drift. This
// renders exactly the surface the register block enforces, as one line per
// tor with its named arguments and possession phantoms:
//
//   open(path: string)
//   append(handle: string<!open>, text: string)
//   close(handle: string<!open>)
//   say(text: string)
//
// No JSON schema, no second source of truth: the prompt and the enforcement
// are the same bytes.
//
// @retain: scope_vocabulary_event is referenced from generated Zig code in user
// pipelines (std/bridge:vocabulary compiles to scope_vocabulary_event.handler).
~[retain] pub tor scope-vocabulary { name: string }
| ok string
| not-found

// SCOPE-MANIFEST - Serve a scope's vocabulary as a data contract (JSON)
//
// The manifest record is minted at scope creation (register) from the same
// EventEntry data the dispatch tables are emitted from; this tor serializes
// it to JSON so a running program can serve it as a contract endpoint
// (Orisha) or hand it to a tool. The emitted JSON has no hand-authored bytes:
// every field derives from the scope declaration, so the served contract and
// the enforcement cannot drift. Defined flows (session growth) are NOT part
// of this record — it is the compiled base, minted before any session exists.
//
// @retain: scope_manifest_event is referenced from generated Zig code in user
// pipelines (Orisha serves it as the .json endpoint; explain consumes it).
~[retain] pub tor scope-manifest { name: string }
| ok string
| not-found

// SCOPE-GRAMMAR - the wire grammar, rendered from the register block
//
// The third render from the scope table, and the one that closes the R2
// loop: scope-vocabulary tells a model WHAT it may call, scope-manifest
// serves it as data, and scope-grammar teaches HOW a call is written — the
// wire's shape rules (the constant half, WIRE_GRAMMAR_TEXT, kept beside the
// parser that enforces it) above this scope's own verb lines (rendered by
// scope-vocabulary, so the signatures cannot drift from enforcement either).
// A prompt built from this render and a turn judged by parse.wire are the
// same declaration read twice: the lesson and the law.
//
// @retain: scope_grammar_event is referenced from generated Zig code in user
// pipelines (kopium's agent prompt is built from it).
~[retain] pub tor scope-grammar { name: string }
| ok string
| not-found

// SCOPE-AFFORDANCES tor decl — its `~proc` lives in the `affordances` part.
//
// @retain: scope_affordances_event is referenced from generated Zig code in
// user pipelines (std/bridge:affordances compiles to its handler).
~[retain] pub tor scope-affordances { name: string, held: string }
| ok string
| not-found

~part scopelines koru_std/runtime.scopelines.kz

Koru Standard Library: the `scopelines` part of runtime — the per-scope line emitters behind `scope-vocabulary` and `scope-grammar`. Joined via `~part scopelines` in runtime.kz; merged into the runtime module at load. One emitter per surface, shared by every caller that spells a scope's verbs: the compiled-table walk below, the bridge's `vocabulary`/`grammar` for mounted scopes, and any host that renders a ScopeRuntime. A `.dylib` verb is spelled through the same bytes a register-block verb is. The per-scope body of the vocabulary render, factored out so a runtime- mounted scope (a `.dylib` the bridge installed) renders through the same bytes — `std/bridge`'s vocabulary/grammar call this for every mounted scope, so the mounted verbs are spelled exactly like compiled ones.

~part jsonemit koru_std/runtime.jsonemit.kz

Koru Standard Library: the `jsonemit` part of runtime — the JSON append primitives the manifest serializer composes. Joined via `~part jsonemit` in runtime.kz; merged into the runtime module at load.

~part runcimpl koru_std/runtime.runcimpl.kz

Koru Standard Library: the `runcimpl` part of runtime — the cached run variant's Zig impl. Joined via `~part runcimpl` in runtime.kz; merged into the runtime module at load. The tor decl rides in the `runcached` part, which owns the signature.

~part lookups koru_std/runtime.lookups.kz

Koru Standard Library: the `lookups` part of runtime — the fn-ptr vocabulary a scope descriptor answers through. Joined via `~part lookups` in runtime.kz; merged into the runtime module at load. Branches lookup function type for shape validation

~part branchex koru_std/runtime.branchex.kz

Koru Standard Library: the `branchex` part of runtime — the outcome spec types and their extraction from EventDecls. Joined via `~part branchex` in runtime.kz; merged into the runtime module at load. Local branch specs for codegen (mirrors runtime BranchSpec/BranchField)