emergent_testing: the sequential plan, and the second sharing attempt's record - #1759

Steps 5 and 7 of todo/share-browser-console-runner.md, together, because
neither has a consumer without the other: an interpreter nothing runs is
speculative, and the page cannot run the shared walk without one.

fjs/effects/browser/module.mjs implements sandbox, catch and all — and
nothing else. That set is a measurement, not a starting point, and it
settles the question step 4 and effects/todo/node-module-layering.md had
recorded as unsettled: await belongs to the registration path no browser
runs, and the page loads modules, measures its clock and fetches nothing
through its own impure shell rather than through operations. So now,
fetch and import stay in effects/node. Both files now say so, including
that the earlier guess there was wrong about two of them — reasoning
from what a host *can* do predicted one answer, reading what the
interpreter had to implement gave another.

browser.mjs no longer discovers leaves, applies the throw expectation,
walks return values or counts anything. It supplies a Reporter and an
interpreter. Its batchSize = 25 and setTimeout yield are deleted: this
issue said the batching should be decided at this step rather than
inherited, nothing had asked for it, and it was the origin of six review
rounds in the reverted attempt.

The skeleton grew one thing rather than the browser keeping one: the
traversal threads a RunOutcome<R>, the folded totals plus each host's own
leaf records in the walk's order. The browser's report needs its results
ordered by structure, and completion order would have pinned the
scheduler's behaviour instead of the suite's. fjs t answers void there
and collects nothing.

Reading a module's exported tree stays the page's own guard, as before:
there is no leaf to attribute that failure to.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

…on-runners-7wvd1q

# Conflicts:
#	fjs/emergent_testing/browser.mjs

The page enumerated every export twice: once in a preliminary
`collectTests` that only asked whether the tree could be read, and again
inside the shared traversal. Enumerating is not idempotent — a getter in
the export runs on every read — so a value that succeeded once and threw
next escaped as a synchronous throw from `runBrowserProofs`, leaving the
page in `running` with no report at all.

The leaves collected by that one guarded read now go straight to
`runEntries`, a new seam in the shared traversal for a host that
enumerates its own modules. Because the page then no longer needs a
`ModuleMap`, its modules stay the list they arrive as: two entries naming
the same module are two runs in the order passed, where
`Object.fromEntries` had kept only the last and repeated it for both.

A module that will not enumerate is handed to the same `report`
operation as a leaf, so it is rendered in the position it was passed in
and the separate announcement pass is gone.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

…cile the todo

The browser interpreter's `catch` spelled out a `try`/`catch` that
`types/result/module.mjs` already exports as `tryCatch` — the helper
`effects/node` uses for the same operation, and one that carries no host
dependency, so there was nothing for a browser to do differently.

The todo's Tasks list still read as open where the merged steps had
settled it: the shared API, the named parts, `collectTests` as the single
source of truth, the `effects/browser/` decision, the cross-runner
equivalence proofs, and the two behaviours the shared core does not keep.
The one branch of the page still without a proof — the run's own dispatch
failure — is a task now, with what makes it hard to reach.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

Joining siblings once fixed the fan-out, but a parent still rebuilt an
array holding every record its children had produced, so a chain of
depth N cost N² copies — the same defect one level down.

The walk now accumulates a `_RunAcc`: the totals, and the records as a
`List`, where a join is one node. The rope is walked out to an array
exactly once, where a run ends, so no level pays for the levels below it.
`runModuleMap` joins modules that have each already flattened, which
copies each record once and nothing more.

Each record is boxed, because a `List` reads a bare array or function in
an element position as a sub-list to splice. `R` is the host's own leaf
record and this module has no business restricting what it may be.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

`joinAcc` names both lists at once through `flat`, so `concat` was
imported and never called.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

`asyncRun` dispatches by exact match and panics on a command no handler
claims, so an operation the page does not implement rejected the run's
promise. `runBrowserProofs` handled only the error channel, so that
rejection escaped: no report, no completion event, and a page left in
`running` — the one outcome it must never reach. Both routes now end in
the same `infrastructure-error` report.

`browserRun` asked for a `Partial` map, which promised a recovery it does
not perform. It asks for a complete one, and says where a host that wants
a hole to be an ordinary outcome should build instead.

`effects/browser/proof.mjs` pins the interpreter's own contract: a throw
answered rather than propagated, an awaited leaf timed by what it did,
argument-order answers from `all`, and the panic on an unclaimed command.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

`browserRun` answered `(effect: unknown) => Promise<unknown>`, so both
call sites cast their way past it — the casts were the evidence. It is
generic now, over the effect it accepts and the `Result` it resolves
with, so an effect this runner cannot dispatch is a type error rather
than a rejected promise. One cast remains, where `all` ties the loop
through a self-reference, and it stops at that line.

The page types its `report` handler and reads the outcome directly, and
the interpreter's proofs narrow through the answered `Result` instead of
indexing into `any`. The one deliberate cast left fabricates a command no
handler claims, which is the panic that proof is about.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

The proof's `okValue` read a run's answer behind a hand-written
`if`/`throw`, which `fjs/AGENTS.md` §1.3 rules out: a local branch whose
failing side never runs is a permanently uncovered branch, while
`assertEq`'s own are covered where it lives.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

`extra` was spread over the three operations the interpreter has of its
own, so a handler named `sandbox`, `catch` or `all` replaced one
silently — and the runner's answer is typed by those three, so a
replacement made the type a lie.

It panics on a collision instead. Letting the core win would have been
just as silent in the other direction, discarding a handler written on
purpose; a program claiming an operation this runner already has is the
same class of bug as one asking for an operation it lacks, and the
panic on that is what this runner already does.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

Step 4 recorded the measured answer and left the paragraph that called
the same three operations unsettled and predicted two of them would
move. An implementer reading it got two designs, one of which this work
disproved.

The surviving paragraph says what was expected and why it was wrong —
"a browser proof run needs a clock and dynamic import" is true of the
page and false of the effect set — rather than restating a question the
measurement answered.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

The numbered order of work still stated step 1 unconditionally while
the port-separation rule below it admits the idea-first order. Step 1
now says the core is taken with its behaviour unchanged as it stands
when the port begins: an idea landed first already lives in the core,
the port copies it, and the port stays separate from the policy it
acquires because the policy's argument was reviewed in its own change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

…rlaps

Running the full suite finds concurrency-dependent proofs but cannot
defend the sequential contract: the suite is green under the concurrent
traversal too, so a later edit restoring a fan-out would pass it. 7a now
requires a mutation-sensitive proof — enter/exit ordering under a mock
interpreter, or asserting the chain issues no all command — checked by
restoring one fan-out and watching it fail, per catalog item 11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

allvoid-combinator's sketch spread allOk(...items.map(f)) — an
arbitrary-length fan-out combinator that would rebuild the argument
ceiling inside itself, the same correction allreduce-combinator already
carries. The proposal now hands allOk the list, names the dependency on
all-argument-limit's list-shaped operation, and gains the matching task;
all-argument-limit's migration task names both future combinators as
consumers born list-shaped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

If the variadic wrapper keeps the published allOk name, a body passing
one array cannot type-check against it. all-argument-limit now pins the
naming: a kept wrapper keeps all/allOk (that is what narrows the break)
with the list-shaped operation exported beside it (allList/allOkList);
a dropped wrapper hands the old names to the list shape. allVoid's note
says which callable its sketch names under each branch — the call shape
is one array argument either way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

The sketch folded raw all's continuation values as R, but all answers
readonly Result<R, E>[] — the failures arrive inside the value — so the
monoid either fails to type-check or aggregates failure tuples as data,
where its named consumers (registration, dev loading) propagate failures
through allOk today. The proposal now builds on the list-shaped allOk
(per all-argument-limit's naming rule), parameterizes E, and inherits
NotImplemented from the runner; allvoid-combinator's caveat about the
old sketch is updated to record it as superseded rather than current.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

…tial

Two linked issues still assumed the batched page. browser-test-controls
checked its cancellation token 'between execution batches' — batching is
gone, so the cooperative boundary is between one leaf's whole chain and
the next, finer-grained than the batch boundary was; the token task now
names it. timer-precision's accumulate-over-a-group idea objected to
concurrency interleaving siblings' work into a group's span — that
objection retires with the sequential plan, replaced by the smaller one
that between-leaves overhead lands in the span; its prototype task now
runs under the sequential traversal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

…children

Two follow-ups on the last round's fixes. The per-name re-export test is
applied to effects/node as it stands after the move: errorExit's call to
error moves to the console module with its body, so error is not kept by
errorExit's keeping and joins the hard cutovers. The cancellation check
point is before each leaf invocation, returned child and next sibling
alike — a cancel landing during a parent's awaited report keeps its
unstarted children unstarted; the un-interruptible unit is one leaf's
own test and report.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

The task shipped 7b with a branch known to be untested — a page stuck
in running forever if the guard is wrong — and deferred the proof to
step 8's layout split. Superseded: 7b carries the seam at its smallest,
the page's run core taking its interpreter as an argument and exported
for proofs from the page's own module, so one failing operation drives
the infrastructure-error report, mutation-tested like 7a's contract.
The published entry point is unchanged, which is what the rejected
widen-the-API alternative got wrong; step 8 absorbs the seam rather
than creating it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

Appending a DOM node does not paint it: without a macrotask yield after
rendering the pending row, a proof that runs synchronously for seconds
would run and settle the row before the first paint, and the running
test this issue exists to show would never be visible. The start
handler now awaits one macrotask, exactly as the report handler does
after a result; the yield lands before the sandbox's adjacent clock
reads, so the duration constraint is unaffected; the task proves the
pending row observable before the proof body starts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg

Three proof requirements were coincidence-shaped by the catalog's own
standard. The run-failure guard's proof now drives each failure route
separately — error-channel answer and interpreter rejection — with one
mutation per half of the guard. The browser start-yield proof is an
ordering sentinel (a macrotask enqueued before the handler must fire
before the proof body), since a DOM-reading body sees the same DOM with
the yield deleted and a blocking body cannot see paint from inside its
own task. 7b's per-result await — the port's only boundary against the
single-task freeze — gets the same sentinel proof, because the fake-
document page proof stays green without it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PyLwDNkPQM1uD1Tg5ApBg