Core-1 State Preview

Status: normative preview; reference and compiled live executors implemented

C1-STATE-001 — Surface. The canonical types are Cell<T>, State<T>, Snapshot<T>, unforgeable Txn<T>, Transition<T,Signature>, Derived<T>, Topic<T,Policy>, read-only Stream<T>, owned Subscription, and Store.transact.

C1-STATE-002 — Transaction. Scheduling is serializable, single-threaded, and run-to-completion. A transition stages candidate values and events. Success atomically commits value, version, and event visibility; error changes none of them. Events cannot synchronously re-enter the active transaction.

C1-STATE-003 — Reactivity. Derived nodes update in deterministic topological order. An instantaneous cycle rejects unless an explicit delay node breaks it.

C1-STATE-004 — Explicit policy. Topic construction must select buffering, overflow, and subscriber-failure policy. A stale compute result must select reject, accept, merge, or recompute. Neither facility has a hidden default.

C1-STATE-005 — Executors. Conformance requires a pure candidate/commit/ reactivity stepper and an independent compiled C live store/scheduler consuming the same checked state graph.

The implemented source profile lowers straight-line checked integer expressions to a dedicated transaction/dependency scalar region. Its typed transition boundary has separate recursive-reference and sequential compiled evaluators. The Store.transact source adapter injects the current cell value, evaluates under the store’s unforgeable transaction authority, and atomically commits the returned candidate; evaluation faults leave the value and version unchanged. Same-domain scalar calls with up to two arguments are retained in the checked graph, including closure-wide imported targets, and share the runtime call-depth bound. Control flow and richer transition bodies remain unmaterialized and reject at typed admission.

An interpreted algorithm spells the bounded source boundary as Store.transact(Type.transition, arguments...). The referenced public state message must take current state as its first scalar parameter. The checked AST retains state-transact; declaring state without using this operation does not create store authority. Embedding invocation binds one live store-owned cell, and each source boundary commits as one ordinary transaction. A direct algorithm-to-state call, including one resolved through a package import, remains ZL-DOMAIN-0004.