Selectors must be pure and read only through the supplied graph
handle. The denotational model treats every value as a
Behavior a := GraphTime → a, and a derived value at time t is a
pure function of its inputs at the same time t: there is no
intermediate "B updated but C did not" state because there is no
intermediate time. Reading from anywhere other than the supplied
handle (or smuggling state in via closure that doesn't go through
the engine) breaks that invariant — two slices read in one render
could observe inconsistent GraphTimes and the selector would
return a glitched value.
The handle passed in is a ReadOnlyGraph — Mark Miller's
principle of least authority applied at the React boundary. The
selector cannot reach commit, input, derived, or
exportModel; any attempt throws CapabilityViolation from
@causl/causl-wasm-ts/internal (the type narrowing forbids it at compile
time, the Proxy enforces it at runtime against as any coerced
leaks). See #229.
A pure selector projecting a value from the engine.