Capability handed to persistedInput. Applies the §13
leak-fence discipline at the persistence boundary: a storage
adapter crosses a trust boundary and gets only the authority its
job demands.
persistedInput registers exactly one input, watches the commit
stream for changes, and reads the post-commit value to serialise.
Those three capabilities — input + subscribeCommits + read —
are the entire surface; commit, derived, hydrate, snapshot,
exportModel, readAt/snapshotAt, commitLog, and per-node
subscribe are intentionally unreachable.
Narrowing is type-level rather than runtime-Proxy-level: the call
site already passes a real Graph (a full Graph is assignable to
this narrowed view), and the discipline is enforced at compile time
inside the implementation.
Capability handed to persistedInput. Applies the §13 leak-fence discipline at the persistence boundary: a storage adapter crosses a trust boundary and gets only the authority its job demands.
persistedInputregisters exactly one input, watches the commit stream for changes, and reads the post-commit value to serialise. Those three capabilities —input+subscribeCommits+read— are the entire surface;commit,derived,hydrate,snapshot,exportModel,readAt/snapshotAt,commitLog, and per-nodesubscribeare intentionally unreachable.Narrowing is type-level rather than runtime-Proxy-level: the call site already passes a real
Graph(a fullGraphis assignable to this narrowed view), and the discipline is enforced at compile time inside the implementation.