Closes #364: the bridge is a view, not an editor — the doc-block
above (and applyJumpHandler's comment) argue at length that time
travel must be a read through snapshotAt, never a mutation
through commit, because a panel-driven mutation would forge a
fractional or out-of-order time. The full Graph parameter that
#257 left in place contradicted that comment: it let a future bridge
edit silently call graph.commit(...), graph.input(...),
graph.hydrate(...), or graph.derived(...) and reduced the
discipline to a code-review hope. Per §12.3 the parameter exposes
exactly the four methods the bridge actually calls:
subscribeCommits (forward each commit as an action), snapshot
(initial state and per-commit state hand-off to the panel),
snapshotAt (time-travel projection), and now (baseline-time
stamp).
Narrowing is type-level. A real Graph is still assignable, so the
call site keeps working; the discipline is enforced at compile time
inside the implementation. The Proxy-based runtime gate
narrowCapability from @causl/causl-wasm-ts/internal is not applied
here because it deliberately omits snapshot / snapshotAt (its
allow-list is read / subscribe / subscribeCommits / now —
the read-only slice for application code), and the bridge's
authority profile is bridge-specific (it must hand the panel a
GraphSnapshot, which narrowCapability does not expose).
Capability slice handed to connectDevtools.
Closes #364: the bridge is a view, not an editor — the doc-block above (and
applyJumpHandler's comment) argue at length that time travel must be a read throughsnapshotAt, never a mutation throughcommit, because a panel-driven mutation would forge a fractional or out-of-order time. The fullGraphparameter that #257 left in place contradicted that comment: it let a future bridge edit silently callgraph.commit(...),graph.input(...),graph.hydrate(...), orgraph.derived(...)and reduced the discipline to a code-review hope. Per §12.3 the parameter exposes exactly the four methods the bridge actually calls:subscribeCommits(forward each commit as an action),snapshot(initial state and per-commit state hand-off to the panel),snapshotAt(time-travel projection), andnow(baseline-time stamp).Narrowing is type-level. A real
Graphis still assignable, so the call site keeps working; the discipline is enforced at compile time inside the implementation. The Proxy-based runtime gatenarrowCapabilityfrom@causl/causl-wasm-ts/internalis not applied here because it deliberately omitssnapshot/snapshotAt(its allow-list isread/subscribe/subscribeCommits/now— the read-only slice for application code), and the bridge's authority profile is bridge-specific (it must hand the panel aGraphSnapshot, whichnarrowCapabilitydoes not expose).