Language Feature Matrix

This page is the checklist for Grid's language surface.

Most entries below are fully supported. Entries marked syntax-only are recognized for compatibility or diagnostics, but should not be used as working model features yet.

Status Key

• supported: accepted by Grid and available to model authors.
• syntax-only: syntax is recognized, but execution is not claimed.
• diagnostic: negative syntax that exists to produce a precise error.

Media descriptions

• **Portable Media graphs** (**syntax-only**) —

  MEDIA Name … END MEDIA exports ordinary named graph descriptions and lowers to MEDIA_SESSION. This entry records block syntax coverage. Precise typing and selected synthetic-session verification are documented separately; physical-camera/RTSP acceptance and product packaging remain in progress. See Media.

• **Media result typing** (**supported**) —

  distinct opaque tracks, callback-shaped MediaAnalysis<T>, named session outputs, closed Latest/Status records and lossless frame identity. This static contract does not itself authorize capture or image sending. See inferred types and results.

• **Admitted Media outputs** (**supported**) —

  ready RGBA leases use the existing Render driver; completed results become native Stream values, with explicitly selected durable source/checkpoint delivery. Read-only AI observations require an exclusive existing task, explicit image consent and trustworthy capture time. Local verification includes a built-in macOS camera through authenticated native-document activation, synthetic media and deterministic AI fixtures. Physical capture-time extraction, presentation wiring and product packaging remain pending. See connected outputs.

Signal processing

• **Native oscillator mixing** (**supported**) -

  SIGNAL_MIX(first, second, ...) composes matching-format oscillators and nested mixes into one ordered bank, capped at 4,096 voices. Mixing processed branches selects the bounded Signal v5 schedule. Signed gains support polarity inversion. See additive synthesis.

• **Reusable bounded graph queries** (**supported**) - Define a `match` body with ordinary function parameters and call it in a named `frame` assignment. Expansion preserves schemas, path syntax, static bounds, and reactive inputs. [Language reference](graph-authoring.md#reusable-graph-queries). Computed scalar arguments elaborate to private bindings; graph arguments remain named.
• **Optional and negative graph paths** (**supported**) - [Language reference](graph-authoring.md#optional-paths-and-permitted-routes).
• **Route-constrained optimal paths** (**supported**) - [Language reference](graph-authoring.md#optional-paths-and-permitted-routes).
• **Multi-edge immutable graph rewrites** (**supported**) - [Language reference](graph-authoring.md#multi-edge-immutable-rewrites).
• **Sample-rate filter controls** (**supported**) - [Language reference](signal.md#filter-modulation-delayed-feedback-and-audio-sources).
• **Pure delayed feedback helpers** (**supported**) - [Language reference](signal.md#filter-modulation-delayed-feedback-and-audio-sources).
• **Bounded file and live audio sources** (**supported**) - [Language reference](signal.md#filter-modulation-delayed-feedback-and-audio-sources).
• **Static Signal stage comprehensions** (**supported**) - [Signal music and DSP](signal.md#musical-instruments-and-sample-rate-controls).
• **Sample-rate modulation and envelopes** (**supported**) - [Signal music and DSP](signal.md#musical-instruments-and-sample-rate-controls).
• **Bounded Signal echo** (**supported**) - [Signal music and DSP](signal.md#musical-instruments-and-sample-rate-controls).
• **Score-driven DSP instruments** (**supported**) - [Signal music and DSP](signal.md#musical-instruments-and-sample-rate-controls).
• **Composable native Signal stages** (**supported**) -

  Pure DO … END, DO SYNC and LET bindings inside a RENDER source name stages, scalar controls and static configuration. The returned composition compiles into one native Signal plan. See local composition.

• **Reusable DSP helpers** (**supported**) -

  Pure named Grid functions compose stages with lexical scalar captures. Inline numeric controls settle through ordinary compiled evaluation. See helpers and parallel effects.

• **Parallel DSP branches** (**supported**) -

  Mix independently processed branches. Shared stages execute once per block in a bounded acyclic schedule with buffers prepared at admission. See helpers and parallel effects.

• **Settled Signal equalizers** (**supported**) -

  Inside RENDER, SIGNAL_BELL, SIGNAL_LOW_SHELF and SIGNAL_HIGH_SHELF accept source, center frequency in Hz, Q and linear amplitude gain. SIGNAL_NOTCH accepts source, center and Q. Bounded Signal v4 processors execute real or complex f32 blocks and expose frozen-control magnitude, phase and delay through the selected native/HTTP response inspector. Controls share one Workbook settlement; device callbacks retain native scheduling. See Signal processing.

Source And Statements

• **Ledger declarations and transaction source**

  (syntax-only) - Contextual LEDGER, PROFILE, ASSET and CONTRACT declarations retain typed parameters/state, ordered REQUIRE, SET, MOVE, EMIT and bounded WHEN statements with explicit END. Source capture, formatting and canonical restoration preserve owning operands and identities. The selected native ledger capability compiles an inert whole-program compiled model and verifies source/artifact/schema/genesis agreement. Its complete emitted proof checks exact domains, bounded collections/text, failure rollback, same-asset quantities, nominal MATCH guards and finite local helpers through the existing evaluator. Legacy numeric/shape inspection remains partial. Native data plans preserve full-width quantities and versioned logical text without numeric coercion. Selected native executable admission connects verified signed intents to current stored instance, policy and reservation records and returns a private snapshot-bound proposal. Selected native input admission binds pinned imports, indexed contract snapshots and registered facts; unsupported erased generic fact domains still refuse. Operational deployment remains proposed; ordinary compilation refuses GRID_LEDGER_ADMISSION_REQUIRED. This grants no posting authority or network service. The selected private owner additionally supports certificate-bound local atomic business application, portable first reconstruction and native original-outcome restoration. Replay preserves original receipts and advances only duplicate application position. Fixed native issue/burn/transfer additionally share the certified authority/receipt owner and cold replay. Selected signed cancel/expire/time now retain original control authority preimages and share atomic publication/restoration. Native reserve now validates admitted previews, creates reservations/shared counters and recovers originals; the retained 90-check record fixes that observation's source identity. A selected read-only spend-policy preparation checks complete admitted target/asset allowlists before future native delegation challenges. It grants no consent or spending authority. Selected native consent, policy administration and accepted Process fact evidence now join authoritative application; public operation installation and retirement remain unfinished. The optional native validator connection joins independent live validation, indexed Raft application, original receipt inspection and signed majority finality over pinned TLS. Executable startup/incarnation fencing, full-size certified packet transport, complete snapshot-generation replacement and full operational evidence remain open. This is development source outside product defaults. Selected development ledger/wallet operation metadata now shares exact intent types, and the optional Process adapter retains original command mappings and fences uncertain continuation. An explicit native installation now connects the five submission exports to the validator, durable issuer and original operation recovery. Remaining exports, product startup and wallet lifecycle stay unfinished. Optional V3 decision/reference data and indexed decision storage now connect to the selected Raft transaction. Native reference value/provenance/outcome records share the existing codec WAL. Process catalogs/adapters, production provenance/capture, startup, scheduling and language getters remain uninstalled.

• **Compiler tools and syntax values**

  (supported) - Source-free binding refactors query revision-bound native declaration IDs, derive rename/extraction/signature/caller updates through the existing native scope consumer and check whole candidates before atomic application. Unproved affected uses, capture, stale inputs and cancellation refuse the entire transaction. Checked expression replacements and new signature arguments use the shared owning expression grammar before whole-program native validation. AST.QUOTE captures unevaluated expressions and AST.DEFINITION reflects local declarations. Immutable syntax values support traversal, construction, rendering, and capture-avoiding substitution in expressions and plain constructed named declarations/modules. Generated module bindings include forward and recursive uses; annotated and incomplete source forms retain explicit refusals. View phrase boundaries remain semantic fields in detached canonical trees; reconstruction barriers name owning compiler fields. Retained definition inputs preserve PART owners through detached admission; native composition still checks membership and requires its own authorization. Native hosts can retain native HIR with its referenced pools and pending dialect inputs, then consume it through the shared MIR and compiled-model continuation without resolving imports or executing handlers again. Native checks still run at their established stages; externally supplied HIR is not admitted by this compiler-owned API. Source locations stay in separate bounded inspection metadata; portable owner codecs do not carry source or admission authority. Default, authored and canonical inspection return the same actual owning artifacts and a separate revision-bound occurrence index for source navigation. Whole-module definition reflection uses native declaration identities and actual function or assignment owners, including forward definitions and declaration modifiers. Walk and selection preserve validated inspection locations; detached artifacts have none. Editor inspection and the shipped examples use that same representation, while inferred facts remain separate semantic-service results. AST.CHECK accepts complete owning modules through native admission; public projected-canonical checking is retired. The isolated Generate worker accepts owning modules without rendering source, under its unchanged state/effect/import restrictions and encoded byte limit. V3 also accepts the explicit grid.compiler.artifact.v1 syntax-stage envelope through AST.CHECK: generated owner records undergo native admission without source reconstruction. AST.PARSE(source, "artifact") and AST.EXPRESSION(source, "artifact") use the shared recognizer directly. Root, walk, selection, subtree and rewrite operations use generated owner fields and child order, validate all stored owners, and preserve unaffected shared nodes. AST.RENDER emits supported actual expression owners directly, preserving numeric intent, native string escaping and named arguments. Rendering support is checked for each subtree; ambiguous spellings and contextual productions refuse explicitly. Plain modules, scalar assignments and functions render from their actual fields, preserving declaration modifiers and the explicit compiler-handler contract. Attached documentation and contextual clauses still refuse rendering. Owner free-name analysis and substitution preserve lexical binding order, forward module bindings, capture avoidance and sharing within each lexical scope. All replacement artifacts are checked, including unused ones; native handlers share the existing cumulative invocation budget across these operations. AST.NODE constructs actual SourceNode variants and joins supplied child artifacts through generated codec fields; projected AST.NODE shapes are retired. Convenience literal/reference/operator/call and plain declaration constructors now return those same owners. Quotation captures owners before semantic lowering and retains source metadata separately. Template expansion uses owner hygiene, preserves call/array splice shape and records generated locations in preorder. Generate reconstructs expansion inputs and admits their owning modules directly; claimed rendered text and origins never authorize execution. Complete presentation clauses and attached documentation survive owner transport and retain native checking and live compiled-model behavior. Complete call/value OF owners also retain native call, placeholder and operand checks after transport and structural rewriting; source-region ambiguities remain explicit refusals. Adjacent assignments and complete model FORMAT policies use actual ordered owners to resolve their shared tentative clause; missing or mismatched policy owners still refuse, and policy inputs remain live after cold compiled-model loading. AST.PARSE(source, { imports: { "ui.grid": libraryArtifact } }) borrows immutable View grammar without resolving imports or granting import authority. Imported Grid declarations with RETURNS CompilerContribution<syntax, expression> produce actual expression owners through the existing bounded native callable executor and normal compiled-model compilation. CompilerContribution<source, expression> returns one complete expression string, parsed by the same authoritative recognizer under the same operation budget. Source/Syntax handlers may also declare declarations or module and run at a standalone module-item tag. Native consumption checks the actual returned module owners under the receiving resolver and shared construction allowance. Declaration results reject executable statements; module results retain generated imports and live bindings. A module category cannot become a scalar. Module holes bind actual owning subgraphs hygienically and remain live in the ordinary compiled model. Contributed Source/Syntax View owners join the completed compiler forest. Selected hir/mir/lir handlers retain complete actual native owners, connect live ports, and publish checked Value, Callable and closed Process interfaces. Frame resource ports use an actual unbound INPUT Port is frame = BLANK declaration and bind genuine receiving Frame owners. Public owning MIR retains the real parameter producer; unbound parameters cannot emit an executable compiled model. Generic graph, path and partition input tags still require a separate receiving interface and refuse; their source-owned declarations and projections remain supported. Reader requests retain their actual host/provider boundary. Source/Syntax callable and region fragments expose exactly one actual native function or Process definition, respectively, with explicit imports and checked native interfaces. Live expression holes remain explicit inputs to the common hygienic linker; runtime values never become generated source. Registered handlers share one budget across actual-owner construction, inspection and rewriting. Their defining module may also declare a Process without granting the handler Process execution authority. The composed pricing example covers live holes, defining-module helpers, imported Process and contextual Views. General polymorphic Process specialization, richer typed/resource/dialect receiving domains and comparative Performance remain open. Native Process root plans, private/public-room children and COLLECT admission retain actual signatures, roles, finite bounds and reachable effects. Forwarded closed Process names retain private source-compiler custody; no sample plan supplies the executable layout. Missing receiving capabilities refuse explicitly. This development contract is separate from the legacy grid.syntax.v1 inspection format; unsupported source-only checkpoints still refuse. AST.SELECT and AST.REWRITE provide bounded bulk operations; AST.CAPABILITIES explains supported operations at a selected node, including compiler reconstruction availability and its separate execution-admission limit. Canonical View inspection uses the same contextual compiler records as source inspection for local types, presentation clauses, expressions, and actions. native owning codecs restore bounded normalized backing for span-owned expressions and embedded fields, keeping original source separate. Full View/module admission remains unfinished. AST.PARSE and AST.EXPRESSION accept an explicit "canonical" mode for the legacy projected tooling representation; authored inspection remains the default. The selected native compiler service supplies parse, analysis, check, and checked rename. Source-only forms retain exact text and refuse unsafe emission. Whole-source inspection includes rule policies/actions, assignment schedules, solve goals, function signatures, graph/predicate schemas, and View outlines. MATCH, CASE, and TRY inspection retains the compiler's written branches, patterns, guards, and optional fallbacks before lowering; process MATCH shares that pattern structure. Generated validation cells are excluded. View invocation and continuation phrases reuse compiler contract segmentation; indented writes reuse rule-parser records. Semantic element instances share one authored local record. Contextual forms without retained records remain explicitly incomplete. Composite arguments and frozen View expressions retain their written operands. Member chains, predicate attachments, numeric sequences and canonical grammar derivations now use compiler-owned source structure; embedded JavaScript and CSS retain explicit foreign-language boundaries. Selected call syntax retains source-order AS interface labels with links to canonical operands, including resident graph producers. Selected choice expressions retain constructor calls and flag-member spellings before lowering; explicit generic type applications remain visible incomplete fragments with conservative rendering capabilities. Retained graph paths, partitions, patterns and fixed points expose nested records derived from compiler definitions, with validated local child links and source spans kept separately from field data. Internal lowering calls are not presented as their authored structure. Unit declarations and unit: choice-field types expose atoms, products, quotients and powers from the compiler's unit grammar; unsupported edits and malformed inner expressions remain explicit. Local USE syntax exposes its quoted path, alias or ordered exposures, and View renames from the compiler recognizer. Resolver-free inspection retains those nodes while reporting unresolved imports and incomplete module status. Local REQUIRES syntax exposes authored aliases, selector literals and the written network method before canonical capability IDs are assigned; syntax inspection does not grant external authority. Symbol declarations expose their authored names through generated compiler records. Retained statement origins replace their synthetic assignments; complete inspection does not grant rendering or substitution support. Choice declarations expose ordered members, parameters, variants and fields before deduplication/type normalization. Constructor expressions and written HAS operands use selected pre-lowering compiler provenance. Explicit generic choice constructors reuse the compiler's nested type capture; contextual flag semantics and other type-annotation sites retain gaps. Top-level FORMAT policies retain ordered source occurrences and expression structure at recognition, with generated policy assignments excluded by their compiler identity. Per-assignment presentation clauses now link to their compiler assignment and can report complete structure when fully recognized. Logical facts, laws, rules, evidence claims, expectations, publications and qualitative queries expose compiler-derived fields and nested propositions. Aggregate placement follows compiler ownership; expanded or implicit syntax remains explicitly incomplete. Model headers, strictness and per-axis policies, and evidence time retain each authored occurrence before later settings overwrite it. Generated directive nodes keep exact source separately and expose skipped trailing text as incomplete fragments. Decision-package inputs/outputs, cardinalities and exchange-rate targets also use generated compiler fields captured at recognition. Package clause ordering and nested locations remain incomplete; unknown FX suffixes remain fragments. View outlines, library items and graph/predicate schemas use the same generated compiler-record structure. Explicit span roles distinguish embedded expressions from retained fragments, and nested lists, names and guards preserve their compiler-owned shape without a second View/schema visitor. Selected View expression fields use the compiler's lowering parse where it owns the exact span, leaving unmatched fields as source-linked fallbacks. Revision-bound expression meaning can also select those compiler-retained View expressions and their nested operands; surface-scoped browser locals resolve through the compiler's admitted local records. The type of a local initializer is available as partial information because the browser state may change later. View-local PRESENT policies retain their tag, AS separator and element with exact source locations in that compiler outline. ALLOW capability names and element/action parameters are likewise compiler-owned source nodes. View-local FORMAT, PRESENT, and VALIDATE clauses reuse the compiler's presentation records after lowering, retaining their written order and source. View-local IS tags expose the compiler's canonical type and reuse its selected source scanner for simple, collection, unit and compiler-validated qualified type structure such as currency:USD; unsupported composite spellings stay explicitly incomplete. Choice fields expose nested type names/applications from the compiler's tag scanner, retaining argument spelling and spans. Record field tags expose separately located names and values, including nested collection and record values. Assignment tags use the same source capture, while remaining annotation sites still need structural coverage. Functions derive names, parameters, keys and bodies from compiler records, separating inferred signatures, captures and dependencies into bounded metadata. Whole-source inspection captures source structure before finalization, preserving authored reflection calls and arguments while keeping final compiler diagnostics and semantic metadata. Ordinary compilation retains no inspection snapshot. Relationships, qualitative assertions and knowledge projections expose their retained typed records and nested expression fields. Logical path declarations preserve aliases and grouping through the compiler's selected production builder; path uses and relationship expansions remain explicitly incomplete. Conditional, guard and infix-call expressions project their compiler lowering inputs, retaining written branches, optional fallbacks and operator locations instead of generated helper calls. The inspector follows the generated fields for checked function edits. Rule triggers, actions, nested policies and assignment schedules also derive from compiler records; valueless actions exclude internal placeholder expressions. Selected inspection retains the rule trigger's and each action's authored source range. Assignment, rule, table-mutation and solve statements now derive their fields, including tensor shape/precision and solver goals. Retained target spans are separate location nodes; plain named constructors remain renderable. Tensor assignment values follow compiler-recorded authored-expression origins, preserving their value spans without exposing the generated type wrapper. Prefix and postfix assignment tags now link to the compiler's type-name and type-application syntax. The compiler's readable collection grammar also supplies nested type nodes and exact spans for natural spellings; invalid type grammar remains an incomplete fragment. Incomplete clauses remain explicit; structure coverage and emission support are distinct properties. AST.MEANING and Code's Explain expression bind semantic facts to exact source revisions, with resolved bindings, contextual types, known effects, direct source dependencies (including compiler-recognized unresolved cell and range targets), and retained assignment facts. Partial and unknown information remains explicit; changed revisions refuse stale selections. Owning modules also expose native roots through AST.MEANING(module) and accept compilation-bound { revision, root, children } selections. Batches share one native admission; native paths are not source-artifact node IDs. AST.EDIT prepares revision-bound expression replacement, extraction, and signature changes with resolved direct caller updates. AST.APPLY reconstructs and compiles a reviewed transaction before returning source. Code shows focused edits and diagnostics and stages atomically against the original draft. Lexical capture, stale revisions, altered edits and unsupported call uses are refused; compilation is not presented as behavioral equivalence. AST.DIAGNOSTICS validates revision-bound authored findings and inert suggested edit requests. Explicit Grid analyzers feed Code Problems and source markers; suggested fixes open checked transaction previews before atomic draft staging. Analyzer results remain distinct from compiler validity and proofs. AST.HOLE, AST.SPLICE, and AST.EXPAND add explicit quoted templates, expression/argument/array substitution, and bounded per-node generated origins. Code's expansion viewer reconstructs input claims, checks declaration source without executing it, and follows compiler findings to template/input locations. Constructed template locations may be structural only; declaration-list splices and complete origin preservation through constructors remain unsupported. Working models cover auditing, refactoring, native TREE invoice translation, and generated calculations. Code offers a source-linked syntax inspector, checked rename previews, example scratchpads, and explicit generation previews. A bounded native worker compiles generated source and executes requested outputs in a fresh compiled formula model; staging requires review and an explicit save. See compiler tools for the schema, limits, and host support.

  Assignment FORMAT, PRESENT, and VALIDATE clauses expose ordered, compiler-owned inspection records, including exact locations for PRESENT elements, validation operators and literal messages. Standalone field contracts expose their record-key paths and validation bodies. Bound ## notes retain their statement links and individual source lines. Numeric validation sugar exposes its authored bounds, optional step and exclusive marker. Bound notes on retained assignments survive coordination finalization. Population, team, room, process and consumed-plan declarations expose compiler-retained names, roles and pure operands as structured records. Team responder profile literals retain exact source ranges and structured member links. Process bodies now expose compiler-retained statements and nested expressions, including authored records behind generated process expansions. Execution-admission diagnostics remain unchanged. Expanded logical paths and contextual View forms still prevent a complete syntax model. Rule write actions link their parser-retained authored target, operator and value locations to the compiler's target, write mode, and value expression records. View actions expose compiler-owned command and verb boundaries. Plain expression operands, named calls, routes, value options, recognized writes, rate limits and admission policies reuse compiler source records and expression syntax; other contextual argument grammars remain explicit incomplete fragments. Decision-package inspection now retains interleaved clause order and source locations for header values, list members, and artifact contract fields; ordinary compilation continues to use its grouped semantic contract.

  Tree declarations expose compiler-owned parameters, clauses and policy records; grammar fragments retain text and physical source locations with explicit incompleteness. See the tree-pattern inspection example in the guide.

  Native hosts can retain complete compiler-produced MIR with compile_source_to_mir or compile_source_module_artifact_to_mir, then consume CompiledMir::into_lir without repeating frontend work. This native continuation does not admit external HIR/MIR contributions or complete the five-stage compiler contract.

• **Team and process declarations**

  (supported) - TEAM, PROCESS, POPULATION and ROOM are contextual words. Each begins a declaration only with its complete header (TEAM name ending its line, PROCESS name(, POPULATION name FOR, ROOM name USING); otherwise the same words stay ordinary names, typed assignments and predicate subjects such as process depends_on api. Process values may use the total builtins analysis admits, including NOT, ISBLANK, EXPM1, SUMPRODUCT, COUNT, COUNTA and AVERAGE, with typed boolean or numeric results. An error may be handled inside the expression that produced it with IFERROR, IFNA, ISERROR, ISERR, ISNA or TRY ... THEN ... ELSE, for example safe = TRY total / count ELSE 0; a TRY keeps its own THEN and ELSE, and the words after it still form a process conditional. An error that is not handled stops the run at the binding, request input or final result it reaches, before later work. The sequential Desktop subset of TEAM and PROCESS declarations retains addressed ASK, SHARE, UNSHARE, child RUN, bounded repetition, lexical scope and source imports for analysis and formatting. SHARE VIEW Board WITH reviewer lets a role's later turns read one of the model's views through a read tool, and UNSHARE VIEW withdraws it; the person starting the run chooses which of the plan's views it may share. SHARE VIEW Board WITH reviewer TO ACT also lets the role run the view's actions, each sent once and recorded in the run; the person starting the run may still grant that view for reading only. Native environments with an explicitly installed issuer also support matching owner-only snapshots and passing them through child processes to another operation. Source construction and durable capture of these values remain refused. An installed native session owner also supports SHARE and UNSHARE addressed to an exact MEMBERS snapshot, including aliases and child parameters. Later session EACH/COLLECT uses that root's exact committed successor heads; arbitrary arrays or stale recipients cannot substitute for the snapshot. Empty audiences make no model calls. Original session-scope recovery remains unavailable. Fixed service package metadata now exposes typed READ/RESTART/VERIFY signatures and required resource, consent and durable-owner contracts; it does not authorize execution. Explicitly installed native environments now bind direct room.services operation resource arguments once at Start and reuse their issued identity in child processes. Missing or forged bindings refuse before dispatch. Service installation uses explicitly installed host grants, with durable restoration through the selected recovery store (see the API workflow guide). Selected document capabilities may also be bound as story = room.story or passed directly to a child RUN. Selection performs no document I/O and requires both read and revise rights at Start; direct operation operands keep their exact operation rights. The current pinned workspace contracts still govern reads, revisions and retained conflicts. Selected workspace read/revise operations declare native document partitions for COLLECT ALL; grant aliases of one document overlap, and disputes remain sequential. An explicitly installed ops:grid/media@1.0.0 original source supports media.RETRIEVE(room.footage, "clip", 16384). The exact-key read is bounded by original encoded bytes. Its issued observation preserves admitted image bytes, source identity and historical/snapshot timing through explicit child arguments. Selected media responders check recipient roles and current access before each disclosure. Plain summaries and display records carry no original-media rights. This native volatile source does not install acquisition, durable recovery or a product upload endpoint; missing owners and unsupported composition refuse. workspace.assessment(document, snapshot) reports revision-bound assessments; workspace.dispute(document, snapshot, reason, expected_head) requires native dispute rights and an exact assessment-head comparison. Disputes expose dependent revisions without rewriting their document contents. In an explicitly installed immutable movement simulator, simulation.branch(state) creates a checkpoint with the same population, seed, simulated time and remaining horizon; simulation.reset(state) restores the installed initial population and seed. Both require native simulator state, keep ancestry and charge the original Process operation budget. Live document owners refuse these simulator operations before effects. The exact bundled ops:grid/ai-workbench@1.0.0 package now declares capture, predict, train, evaluate, publish and version-selection contracts for source analysis. Its artifacts require native issuance. These declarations do not install the AI adapters or enable durable operation execution. Internal evaluation preparation can derive a new captured plan from frozen cases and the original sealed imports. Native conformance retains exact JSON shapes through isolated published inputs and ordinary compiled formula execution. This adds no syntax or Start argument override; fresh Process evaluation in the AI service and UI still requires owner isolation and recovery integration. The native isolated-input component now retains case/plan identities and exact values through the existing Process Start and recovery records. Its static evaluation policy now checks the selected child closure and all branch arms, refusing writes and Room access without an isolated adapter. Prepared cases now use the native shared Process service for explicit model/human Start, with tool-free model bindings and original attempt reconciliation. Parent evaluation coordination and public fresh-case execution remain pending. Native parent owners can now subscribe to a case's settlement without polling; a notification still requires inspection of the original outcome and does not authorize continuation or establish physical drain. New host Starts default to one contribution at a time. Inspection reports that default in Run limits; lost-response retries still reconcile roots admitted under earlier defaults. PRIVATELY ... END is a scoped value block in the internal runner: histories continue and only the returned value escapes. The selected internal runner also executes fresh ROOM plans, sequential public turns, room SHARE/UNSHARE, and child RUN ... IN room with exact role keys. READ(room) returns bounded public metadata that ordinary FILTER and MAP expressions can query. Public and private histories remain separate. The internal Processes panel can inspect bounded room metadata at waiting and terminal checkpoints, without an authored read or further model call. Live room handles and room resources are still unavailable. Installed sequential ops: exports now compile as typed PROCESS steps: status = service.read_status(target) or an unbound call before another step. Installed operations may also occupy MATCH and conditional arms. Only the selected arm runs; nominal payload bindings supply its arguments. No matching arm fails before dispatch, and predicates and arguments remain pure. Imported processes and saved-source replay retain the exact descriptor. Calls lower to explicit operation nodes; formulas, nested effects and independent operation groups refuse. A selected internal volatile environment now executes operation calls, suspends pending work without polling and accepts typed results before acknowledging receipts. Results can feed SHARE and ASK. The internal process service binds operation authority per principal/model, exposes pending metadata and queues explicit settlement on its shared executor. Stale operation identities or revisions refuse without another lookup. Desktop binds installed single GET/HEAD API queries through that environment. API results are schema checked before SHARE or ASK; writes, pagination and durable operation recovery remain unavailable through this adapter. See the API and agent workflow. INDEPENDENTLY EACH item IN items supports isolated fresh RUN children and an ordered join; outer conversations, carried state, borrowed rooms and transitive external operations are refused. See the newsroom walkthrough. Sequential EACH item IN items produces ordered position/value rows; WITH state = seed folds over the same items. Dynamic collections reserve the 32-item ceiling. Direct literals and immutable local lists/aliases use a smaller authenticated extent checked before body work; conditional local lists reserve the larger branch. Any unknown branch keeps 32. Empty literals reserve one body and perform no turns. See the collection review. A local method = careful THEN reviewed ELSE brief can select between two named procedures or static PROCESS parameters before RUN method(...). Both alternatives are checked; only the chosen child executes. Local aliases retain the decision and remain excluded from payload data. See method selection. A later choice can select an earlier method binding, retaining its captured predicate and lexical identity. Inline nested reference conditionals and container choices remain open. A named or locally selected child can receive independent selected decisions through PROCESS parameters, including repeated aliases; static forwarding can continue through further children. All combinations are validated within bounded compiler expansion; admission reserves the most expensive execution path. Compilation lowers the executable subset into an inert, validated process artifact beside the model's callables. Desktop selects the sequential runtime: save a model, open Agent → Tasks → Processes, select models and explicitly Start. Saving or evaluating a plan performs no inference. Process plans and their local bindings are excluded from workbook cell lowering and named-value hydration. The panel shows each retained reply and the final result. See the guided debate. Server, Cloud and Embedded do not select this capability by default; hosts without it refuse with PROCESS_UNAVAILABLE. The alternating debate and draft/review/revise samples execute in the internal deterministic harness, including continuing/fresh histories, explicit sharing, bounded stopping and validated published inputs. Ordinary bindings named evidence remain distinct from EVIDENCE claim declarations. Code completes retained process data and participant scopes, static child targets, and root team selections. Suggestions exclude later locals and independent sibling results; malformed declarations withhold suggestions. Process rename remains unfinished. Ordinary formulas and unaddressed ASK keep their existing behavior. The broader coordination language remains under implementation. The supported Desktop subset does not include API writes, browser operations, live room handles, population generators or distributed execution. See Teams and processes.

• **Process collection clauses and effectful MATCH**

  (syntax-only) - Grid recognizes, retains, formats and type-checks INDEPENDENTLY EACH item IN items COLLECT ALL and COLLECT k, plus a process MATCH with an arm value that starts with a process step such as RUN or ASK. Arm payload bindings are visible only inside their arm. COLLECT on a sequential or carried EACH, and literal targets outside 1 through 32, refuse while parsing. Analysis types the collection report {values, outcomes, enough} whose outcome rows carry the owner-issued Completion<T> from the pinned data-only package ops:grid/coordination@2.0.0 (source can match it but never construct it). Analysis also charges static bounds from the proven membership, rejects a literal target larger than that membership, and rejects room reads and public room work inside a member. A member may run an operation only as its package's version 2 contract allows: a snapshot read or an exclusive partition beside siblings, a sequential-only operation when the collection has exactly one member, and, under COLLECT k, only an observation-only operation. A version 1 operation declares none of this and is rejected. At run time a member's operation settles before a sibling's next step, a failure of a class the operation declares becomes that member's Failed outcome with the operation in its Ledger, and two members that claim the same written partition stop the root with PROCESS_OPERATION_CLAIM. A resumable root retains a captured operation failure and replays it after a restart without contacting the provider. A process MATCH must be exhaustive and its arms must share one result type. Constructor arms over a non-generic CHOICE type that family as a nominal value, exactly as a generic CHOICE is typed. Both forms lower to a validated process artifact. A COLLECT becomes a member-scoped collection node under the collect_outcomes_v1 artifact contract. The volatile process owner runs members in bounded lanes on its one thread: at most the root's concurrency, and never more than the membership, are started at once. A member yields when it commits a provider call and makes that call on its next turn. The owner freezes the membership and any numeric target before the first member; a target that is not an integer from 1 to the membership stops the root with PROCESS_ADMISSION before any member runs. Once the target is reached or becomes impossible, no member starts new work: a call already in flight finishes, a member that then completes is an unselected value, a started member settles as cancelled at its next call or child step, and unstarted members settle as not started. A human wait or nested COLLECT in a member first lets sibling calls finish. Start refuses a plan whose lanes' prepared turns cannot fit the root's retention. Each member settles exactly one owner-issued Completion with its effect Ledger, and the report lists values and outcomes in membership order with acceptance ordinals. Only a fully received answer the owner refuses to decode or validate, or a failure that a trusted responder declares as a known class, becomes Failed. Unknown work, root cancellation, deadlines, limits and untyped provider failures still stop the root, and no report is produced. A journaled root recovers a COLLECT by replaying its retained turns: a member settled before a restart is never called again, and every recovered Completion is identical to the one issued before. Its journal must also retain captured member failures, and concurrent lanes when concurrency is above 1; otherwise the root refuses with PROCESS_COLLECTION_DURABILITY before any member runs. The host's durable process store now retains captured member failures and interleaved lane turns when process-runtime is selected, including through journal compaction. Broader product collection workflows have not been validated, so model authors should not rely on them yet. A COLLECT over a collective role (member-identity keys) refuses at lowering with GRID_PROCESS_UNSUPPORTED. A process MATCH lowers to a chain of branches in which only a declined test reaches the next arm and the last arm's test is re-checked before any of its effects; outside COLLECT it runs on the existing sequential runtime, and an unselected arm's RUN is retained but never started. The ordinary COLLECT(...) frame function and pure or operation-arm MATCH are unchanged. See Teams and processes.

• **Population declarations and sequential member traversal**

  (supported) - Native subset: POPULATION readers FOR person IN people defines stable string keys, a named profile and optional private WITH person data. TEAM panel binds readers USING readers_population. Native Start freezes one admitted membership and published revision; sequential EACH member IN readers returns ordered {key, value} rows, or a typed WITH fold. Repeated traversals continue each member's own conversation. Member-to-child and collective-to-child RUN mappings create fresh participant histories while preserving private initial data. SHARE/UNSHARE can address a collective or a scoped member; overlapping audiences are a union. Empty populations issue no turns and folds return the seed. Members cannot escape their lexical traversal or become ordinary data values. INDEPENDENTLY EACH member IN readers runs each member in a fresh child conversation; members run in turn on one owner thread. Durable Start retains the frozen roster and private data, and recovery restores them without re-reading the generator or repeating accepted turns. The host starts population plans from the Process surface. A population imported from a .gs library may build its membership from that library's own private constants: Start evaluates them once, in dependency order, without reading the importing workbook's same-named publications. Imported published-read bindings and population rooms remain unavailable, and no product walkthrough of a population workflow is recorded. See Teams and processes.

• **Grid Views outline and element libraries**

  Game Rules embeds the native strategy laboratory with an optional renderer Renderer binding. Embedded views inspect retained state; starting or advancing a match requires the standalone Game surface. Composites can declare read-only values, direct writable bindings, typed action parameters and trailing literal defaults. Scoped BODY "name"(values) / SLOT "name"(aliases) content retains caller scope and instance-owned state. Source component packages preserve and verify the explicit interface; App-template export refuses contracts it cannot retain. A source: read table interface preserves a resident handle without granting row writes. Repeated components keep independent local query filters and paging; stale query responses cannot replace newer rows. Native query specialization retains general compiled formula lowering when a predicate uses a user-defined callable. Tree contracts admit keyed model hierarchies and bounded native tree inspection, with a scoped row(node) template. Relationships and row expressions run in native; malformed updates are refused. Atomic compiler source transactions retain source hashes and expression ownership. Code and Builder share a source session. Tree selection/expansion can write stored input/local record fields with owner revision guards and Form staging. A local declared remembered keeps its last committed value in the viewer's browser across reloads of the same model, partition and surface, re-validated against its declaration on read; a sensitive local cannot be remembered. Whole-record View edits preserve supported nested native scalar tags; incompatible carriers or type changes are refused. Typed-string construction retains existing scalar tags. Scalar equality reads refined payloads without coercing numeric-looking text or erasing symbol identity; filtering retains record tags. Offset datetimes keep temporal identity and exact text through nested records and input serialization. Focused native regressions cover the numeric/string families and existing structured/spatial carriers. These 0.67.1 additions remain under development; complete native-host journeys and performance assessment are tracked in the 0.67.1 Views roadmap.

  (supported) - Code exports portable top-level composite ELEMENTs as .gridui packages with author-selected parameter types and named content slots with defaults. The compiler checks the draft with its current imports before download. Independent stateful composites can instead use .gridcomponent source packages in Code: local state and actions recompile for each receiving instance. Captured bindings, model-relative calls and unproven dependencies are refused. Export bundles local element and named action helpers transitively as private nested declarations, including custom PRESENT controls and action callbacks passed to local elements. Code/App import reviews list helpers, named actions and complete source. Shared Grid functions and imported closures still use libraries. New View creation and reviewed App conversions insert at the compiler boundary in one rich-Code Undo step, retain Whole model and open the new inspector after analysis; explicit Save applies the draft. Conversion handoffs retain App/source identity, support cancellation during editor loading and never replay refusals. The plain editor retains its limited staging commands. Selected component instances identify their compiler-owned shared definition, with exact Code navigation for local composite/native contracts and caller USE links plus dependency navigation for imported definitions. Custom PRESENT components preserve private/transitive library ownership. Stale links are disabled. Code can create a bound View instance during import, reviewing the element and SURFACE as one staged edit. The compiler checks bindings and generates separate local state and native rules. Repeated rendered instances keep their own labels, help, validation descriptions, tab panels and page headings while preserving compiler identity for Code navigation. App Builder can place saved View instances through Insert View…, with binding review, private local state, guarded live source updates and ordinary App document recovery. React ejection retains those Views through the shared ui.App renderer, including nested Form guards and the enclosing Component write permissions. Framework downloads and published Apps capture referenced View documents, static scripts and admitted assets together; model values stay live and source edits require re-export. Builder also imports source packages through Import View component…, with reviewed bindings, guarded source saving and recoverable App placement. App Undo retains the reusable View in Code. App conversion now gives library components distinct declaration names and reviews original IDs/names, translation gaps and source links in Code. Full App identity reconstruction remains incomplete. Code also imports one selected package component through a source review and checked insertion, with name-collision refusals, draft staging and one-step Undo. Bounded source annotations retain App library identity, version, descriptions, parameter and slot metadata through formatting and selected import/export. Code preselects retained parameter types and reviews labels/defaults; Grid argument semantics remain unchanged. BODY "name" declares a composite slot with optional fallback children; SLOT "name" supplies caller-owned content, including an explicit empty fill. Code offers the declared slots as checked source edits and completions. App insertion retains defaults and avoids capturing caller bindings. Contextual SURFACE Name outlines preserve ordinary bindings named surface. Indentation, pages, elements, actions, locals, guards, arrangements, contracts (including split/close-only boolean lenses), checks, and verbatim JavaScript/CSS blocks have source-mapped syntax trees. Locked React contracts can select SCRIPT JSX adapters with phrase props, lens pairs, declared events and explicit part attributes; published adapters are prepared module files using the host React instance. Selected composite import/export bridges portable App templates, concrete binding parameters and named slots with retained container styling; App migration retains those library definitions as ELEMENT source and retains model-dependent library records as source-owned metadata. Node IDs, workbench references and saved View placements survive migration. Closed local/imported Grid function dependencies travel with source components under private names; native admission still refuses captured model state and authority. Imported contracts also check known literal tuple positions/lengths, choices and discriminated record alternatives. Intersection contracts check each member and combine their event-field hints. Importing tuple contracts preserves optional entries and trailing rest items; known values and event fields retain their cardinality and positional types. Code completes contract phrase and part names and reports invalid tells at their source. Locked JSX imports offer native prop types from admitted contracts with isolated completion and diagnostics; full package declarations remain incomplete. Named local and imported SCRIPT helpers carry per-use contract expectations into Code, preserving property-context and asks-callback calls. Lens converters carry separate model-side and foreign-side parameter/result types, including bounded known model records. Generated View wires retain bounded source excerpts, hashes and locations in compiled metadata, including separate imported definitions; native WHY uses the traced source revision. Native event signatures type captured JavaScript values and USING members; shared browser functions retain each use’s lexical types in Code. Built-in Kanban/Calendar/Map events expose fixed payload types and bounded known-row field hints. Grid handlers diagnose missing known-row fields and invalid scalar field reads at their source locations. Grid member completion uses those same scoped row names and finite imported record shapes, including nested records and array items. It inserts quoted brackets for nonidentifier fields, respects local parameter shadowing and intersects union alternatives. Shared element uses offer common fields. Imported parts declarations require a component adapter at placement, which receives each declared data-part attribute object for its actual DOM element. Recursive serializable imported records retain bounded graph references in contract types. Code checks recursive fields and Grid checks known values, lenses and event paths without expanding cycles into an infinite schema. Code and headless CHECK expand each graph into named type aliases, so a cycle that closes at a union (type Json = string | Json[] | { [k: string]: Json }) reports ordinary member and assignment errors instead of an "excessively deep" instantiation that silently dropped every check. Installed component prop declarations can retain required and unmapped props and callbacks in isolated Code imports. Older library locks retain the admitted contract fallback; bounded type metadata never enters runtime documents. App-to-View migration preserves executable legacy Button contracts and their styling when an arrow cannot express the complete settings. Literal JSON lists and records retain their exact shape as admitted View properties. Migration also retains App label defaults and table paging/selection defaults; it does not acquire those from the View placement policy. Page conversion uses one collision-free name plan for declarations and navigation, preserving valid names before assigning aliases. Code reviews the original names, routes, home page and changed order, with source links into the candidate. Static route lookup follows App case and slash normalization; duplicate routes remain explicit gaps. Identity and order differences remain in the comparison. Repeater migration retains custom row aliases, nested row scopes, filters, limits, empty text and windowing settings. Resident queries stay page-bounded; non-windowed arrays render the admitted row limit without a pager. Calendar end-column continuations remain distinct from END lines. Closed composite argument lists accept shared label/layout phrases and continuations without treating parameter values as phrase names. The formatter preserves expression and foreign payload bytes. This entry covers authoring syntax; see Grid Views for the evaluation boundary and the implementation contract.

  The 2026-09-29 audit remediation tightened the outline. Contract words (means tells asks holds set by goes in as comes out as always parts adapter) are contextual inside ELEMENT bodies only, so show holds or a column named parts is an ordinary line elsewhere. An ELSE "…" is a list's empty sentence as the last line of a FOR, picker or explicit Table block, or a button's refusal handler directly under it; after an IF / UNLESS block it is refused with the opposite-guard spelling (GRID_SURFACE_ELSE), and an empty block head is a GRID_SURFACE_BLOCK warning. Duplicate page names and paths are refused (GRID_SURFACE_PAGE). class takes several names (class :a :b, class [:a, :b], class "a b"). A rate clause may trail the arrow line ("Go" -> Picked = 1 THROTTLE 50ms), and button lines accept the universal phrases (tone, class, help, width, AS) inline or on body lines. A named action that nothing calls is a GRID_VIEW_UNUSED_ACTION warning; backtick templates are accepted in every quoted text position of an outline line, including confirm. Text positions recognize interpolation through comments and parentheses around the actual leading template operand, including confirmation text and download filenames. Literal-only headers, paths and table-action headings retain their native restrictions. On the V3 development branch, implicit template-label action identities ignore comments, grouping and locations; event action identities use the native recognized kind and decoded key. These rename existing unkeyed template/event IDs, while literal-label and explicit-key button IDs keep their existing rules. A page's locals, named actions and ELEMENTs are scoped to that page whether its lines are written flat after the PAGE line or indented beneath it (2026-09-30); using one from another page, or from the lines before the first PAGE, is GRID_SURFACE_SCOPE naming the owning page. A shell drawer, DRAWER left "Filters" or DRAWER right above a block, is written before the first PAGE (at most one per side, 2026-09-30). It lowers to the App document's shellPanels entry over a shared Stack, so the workbench shows it in its left or right drawer beside every page and other renderers keep it in the canvas; its declarations are scoped to it, and any other Drawer line stays the standard element.

  Conditional record and row-set presentation retains field tags shared by all outcomes; proven whole-row selection/reordering carries those hints into Forms and tables. Date/datetime row hints preserve the native temporal carrier for formatting without reinterpreting ordinary text. Checked column format edits retain explicit-over-inherited precedence. Unknown and conflicting tags are withheld; this is admission metadata, not a browser evaluator.

  Native model input batches check contracts against all proposed values before committing any member. Computed validation operands see that proposed state, including defaults restored by a clear. The detached resolve uses the ordinary evaluator and refuses missing/error/external operands without committing. View controls and Forms now ask the native host to check proposed values. Check values returns field messages without a write; Save checks again before its guarded batch. Computed/equality contracts use native operands, not committed browser projections. Private copies check their own session. Missing/old hosts refuse without saving; managed learning batches remain unsupported.

  Model text contracts (LIKE, ILIKE, STARTS WITH, ENDS WITH, CONTAINS) and text/Boolean equality reach controls with their declared messages. Direct model operands and plain aliases read staged Form inputs; computed operands remain native wires. Code edits the owning clause through checked source transactions. Numeric/structured equality feedback remains host-owned.

  Analyze supplies contract-derived completion spans and a read-only source outline; these editor inventories add no ordinary formula compilation or runtime work. Browser-local collections admit stored-field repeaters with direct field keys. Literal, nested row and explicit JavaScript row sources survive the shared document and renderer, including empty arrays. Checked row-identity edits retain browser ownership; computed browser row expressions remain explicitly refused. Model row derivations retain the native path. Compiler-admitted repeated local templates instantiate by element path and typed row key, retain state while hidden or paged away, and share their declaration's constraints and defaults. Repetition binds lexical row names before component arguments and restores the enclosing scope. Properties edits a direct row-local contract at its exact declaration, including same-named outer locals. Inline edits now also target declared local arrays and arrays inside local records, including repeated-element locals. A bounded private operation uses typed keys, checks the current field and whole-local validation, and preserves neighboring data and Grid vector shape. Duplicate/missing keys are refused; conflicts retain the draft for reapplication. Checked column controls, native formatting, paging and reset share the same source and renderer. Nested private tables follow explicit enclosing stored-field keys through multiple repeaters and component arguments. Compiler-owned row identities survive binder shadowing and per-instance local roots; admission checks all declared ancestor schemas and mutation checks the current keyed path. Nested table column Properties preserves those paths in a checked source transaction. Row-source validation follows stored private collections to their containing local declaration, including read-only lists and repeated body locals. Properties separates the whole-local rule from displayed rows, keeps source navigation, and rejects changed or ambiguous ownership. Direct columns with dynamic schemas remain row fields in Code's diagnostics. Editable table/picker columns retain literal format, heading, alignment and width through compiler-checked source edits; they keep their input control. Native format plans drive precise numeric editing while keyed row lenses preserve model write ownership. Model FORMAT policies reach row fields through bounded native tag-lattice selection, including reactive patterns and explicit column overrides. Compiler-owned field metadata retains uniform declared row tags through local JSON and replacement edits. Nested record forms inherit policies while preserving one guarded Save and active numeric draft units. Date, date-time, text and boolean fields show native formatted readouts beside their original controls; raw edits and zoned date-time text survive Save. Pending/retried scalar formatting stays editable and print shares the result. Numeric local literals reuse native compilation; exact numeric defaults stay text. Native tables and table views pass current column types/units to the evaluator for inherited policy selection; currency, percent, physical units and date columns retain their metadata, numeric blank repair and keyed writes. Mixed/computed local schemas still need per-row presentation hints. View admission retains exact subject spans for automatic tables, maps and generated record forms. Code exposes their shared options and checked appearance edits, retaining row columns and record-field ownership. Record inspectors list nested object-literal fields and edit their source defaults at the owning input or local declaration, including plain aliases and shared component definitions. Checked transactions preserve sibling fields, whole-record validation and Code Undo. Sensitive defaults stay in Code; computed record schemas explain the source editing boundary. Add, rename and remove fields or nested records through checked schema edits, preserving other defaults, comments, validation and one Code Undo step. Rename updates proven field uses, aliases and model validation paths together; unresolved dynamic, shared or opaque uses retain source links and prevent a partial rename. Optional component arguments can be inserted through Properties, spelling intervening defaults explicitly, or removed from the end of the argument list. Reusable record constraints remain separate work. Structural moves across repeater, page or declaration scopes prepare an exact source review with compiler checks before Apply. Invalid references remain refused; scope changes may deliberately rebind a valid same-spelling name. The reviewed candidate shares Code Undo and cannot apply to a changed editor. Availability controls edit needs conditions and explanations together, including separate action requirements, through checked source transactions. Ordinary and direct native arrow requirements can be added or removed individually, preserving nested actions, requirement order and refusal handlers. Native action requirements have a separate inspector section from component availability, with the selected activation event's values listed. Named native and embedded event handlers also expose requirement controls, with independent event scopes and preserved neighboring handlers, slots and refusal actions. Availability groups can wrap supported blocks, edit an explanation or redirect, and remove their wrapper while retaining contents and separate visibility. Compiler-checked source transactions preserve payloads. Wrapping or lifting declaration-owning blocks shows an exact source review before Apply, with duplicate names and invalid references refused; condition-only edits stay direct. Reusable-element inspectors combine required arguments and shared options, preserving caller content and existing argument spellings when a bare call needs parentheses or a continuation must move onto its header. Validation ownership follows admitted component instances into nested and transitive helpers, native slots and consumed caller bodies. Definition paths distinguish same-named locals; repeated instances share one source contract. Unused helpers and unconsumed content contribute no owners. Imported locals stay in library source, and bounded inventories explain their editing limits. Table and picker inspectors add, update, remove and reorder column declarations, including display expressions, headings, literal presentation settings and keyed inline editing. Plain row-source aliases follow their input/default or native table owner, preserving qualified named/cell targets and native commits. Local shadowing never grants writes to a same-named model input. Row-action controls create buttons, edit captions and inline bodies, expose scoped requirements, and move/remove complete blocks with attached refusals. Existing action keys and table settings are preserved. Literal table-column FORMAT patterns now use the native TEXT formatter through bounded display batches, retaining date types and raw sorting/edit values. Scalar Text/Metric/Stat/Badge displays use the same native operation for declaration and host-resolved patterns, preserving line-option precedence, private local state, unit labels, cancellation and export readiness. Table columns, row actions, pickers and repeated controls expose the surrounding row source's whole-collection validation, exact source/declaration navigation and checked edits with Undo. Pickers keep their selected-value owner separate; nested repetitions use the nearest collection. Plain aliases and admitted View locals retain declaration ownership. Computed/native sources without a direct owner explain the source editing boundary instead of guessing one. Private record field refactors retain page, component, repeated-body and native Tree-row-slot owners. Same-named row and scoped-slot formals do not become outer private-record references. Shared-contract refusals link to a local contract declaration; readonly default expressions retain definition navigation. Individual field-validation editing and native-host acceptance remain incomplete. Explicit literal arrow keys pin rule identity across label and wrapper edits. Link "text" to "url" binds its caption and destination separately. CHECK setup supports reset Name for input/local defaults and literal JSON with INTO/TYPE_TAG annotations, without adding production computations. Code captures staged private-preview preparations through checked source edits. Shared-rule authoring reviews local RECORD definitions and their transitive model/private uses, retains import provenance and refuses removing used rules. Private-preview recording saves bounded, reviewed gesture and expectation traces through the same compiler source-edit lane. CHECK type keeps the field focused; a literal key step replays Enter/Escape and radio navigation without turning an implicit submit into a duplicate press. Ordinary rendering adds no recording listener; the recorder loads only in the selected private preview. Recording retains initialized row-private state through compiler-admitted local "declaration" in row "captured instance" targets. Setup seeds each occurrence independently; assertions require actual row admission, not seed data alone. Unsupported gestures and unproven blank setup refuse capture. Covered baseline and nested native row traces have replay and exact source Undo/Redo evidence. Dirty initial Forms and staged value expectations refuse capture; a reviewed control-value expectation can assert a visible draft. Enclosing row reads retain their lexical boundary through nested repetitions. Tree row navigation and selection use named treeitem CHECK targets; tree container expectations retain the same accessible role/name contract. Scoped-slot and page component recordings retain independent instance drafts and shared caller-owned slot locals. Source-package import retains the same interface and state ownership; the receiving model owns its supplied fills. Covered native traces and package imports have exact source inverses. Repeated scoped fills retain per-row nested component drafts even when separate component instances reuse the same row keys. Source packaging admits the compiler’s pure row projection while refusing external captures. React-owned portal gestures refuse recording and pause during review; independent React-root portal capture remains unverified. Complete paired Performance verification remains open in the roadmap. undoable arrows join the open view's undo/redo history: +=/-= targets undo by their own delta, other values and keyed table rows are restored from what the runtime reports the click committed. undoable within <duration> holds an arrow's effects so an undo can cancel them, and undo -> … declares how to reverse effects that have run. Capture is selected per arrow at model admission; ordinary arrows and rules pay nothing.

  Private table record/list fields have bounded JSON drafts with explicit Save/Cancel, content-aware conflicts and keyed field replacement. Compiler array/object hints retain blank repair, and browser projection preserves nested list shapes. Admitted model input/default record lists use the same editor with native field/list-position types, exact/date text and matrix axes retained. Typed record actions preserve row keys and values through the existing model rule and outcome. Literal row admission retains shallow field roots even when nested lists have mixed types. Unsupported native carriers and individual field contracts remain outside this editor; native-host acceptance is pending. Stored record paths such as Order.shipping.lines now retain keyed edits at the containing input/default, with current parent and neighboring values preserved by the existing rule. Code exposes checked columns and the containing input's whole-value validation, including context for repeated readouts. Keyed enclosing model rows and shared element arguments now retain this owner. Native ancestor keys and one edited field cross the action boundary; root guards reject missing/duplicate keys before staging. Code offers columns and the containing input contract inside shared definitions. Dynamic/dotted INDEX fallback keys stay outside this contract. Admission is bounded to 32 stored field/key steps and 65,536 visits per helper; native acceptance remains pending.

  Numeric controls and editable columns accept native fractions and decorated accounting, scientific and scaled entry across format sections. Ambiguous signs/scales retain the draft; plain decimals keep its active display units. Invalid numeric fields block Form Save until repaired. Code's existing column editor changes these patterns through one checked source transaction and Undo.

  Inline <js> glue reads model bindings by their exact name without USING. Every setting an imported React component declares is a phrase (ruling 37): a setting no model value can satisfy takes <js>, a SCRIPT export or, when component-valued, an imported element by name; a model value there is GRID_ELEMENT_PHRASE_TYPE. A surface line that is one <jsx>…</jsx> block is a React subtree (ruling 36) with bindings, locals and their setters, viewer and imported elements in scope; its indented block is {children}, a writable input it sets has a setter (setQty), and a named action it calls is a function that runs one ordinary touch. Surface client events (on key, resize, visible, mount, unmount) run an ordinary arrow body at the surface's top level or in a PAGE, and FOR r IN <js>…</js> prepares a row source in the browser. A composite ELEMENT may place itself where the data can stop it (ruling 35), expanded to a bounded depth. In on key "<combo>" the word key names the event, never an arrow's touch key. examples/canonical/grid-view-react.grid shows these together. A surface whose whole body is one <jsx> block holding a Component program (ending in render(…)) is a Component surface declared in source (ruling 39): it lowers to the Component kind, and its reads and writes are derived from the symbol names the program states. A computed name is GRID_VIEW_NOT_STAGEABLE and a write to a non-input is GRID_VIEW_NOT_WRITABLE. Code's Convert to SURFACE reviews a hand-written Component in that form without changing its program.

• **Grid Views browser-time Grid**

  (supported) - A View's Grid expression that reads a local or a viewer fact, placed as a value, used as a guard or given as a local action's value, compiles to the surface's browser module and runs on the shared Grid evaluator in the viewer's browser. Model values it names are read from the host; a local's value reaches the model only as an action payload. The module is checked against the portable function catalog when the model compiles, and a construct outside it is GRID_VIEW_NOT_STAGEABLE naming the function. Rows held in a local can be filtered (FOR … IF), keyed and given computed fields or table columns the same way, keeping their stored fields. In a FOR body such an expression may read the row and that row's own locals; each row instance is evaluated separately, and an edit to one row's local recomputes that row only. Enclosing rows, event fields and callbacks for imported components still use JavaScript glue.

• **CAD evaluation declaration**

  (syntax-only) - A3 = CAD.EVALUATE(A2) declares a guarded, read-only CAD result depending on a separate description cell. The native compiler emits the bounded CAD region, but ordinary runtime admission refuses its execution. CAD.EVALUATE(A2, "bodies") fixes an explicit body-keyed result contract; the optional selector must be that literal. Selected native CAD remains Experimental, not a callable geometry function or a general support claim. Its bounded native workplane selection can describe parented sketches and revision-bound planar-face/datum attachments; geometry and references still require native admission, with no nearest-face or implicit-join fallback. See programmable CAD descriptions.

• **CAD description notation**

  (supported) - part = CAD … END constructs a typed description; part = CAD(key, width, depth) … END defines a reusable description function. Unit-checked rectangles, circles, axis-aligned slots, signed-axis datums, profiles and extruded bodies elaborate to existing constructors. Native geometry uses the explicitly selected, bounded composition source profile. See CAD notation.

• **CAD description constructors**

  (supported) - CAD.DESIGN and its typed child constructors return bounded, immutable v2 authoring data. Construction validates declarations and dependencies, not geometry. Explicit v1 migration retains original source bytes. Endpoint-defined arcs can be described without reinterpreting radian arcs; mixed-arc solids and workbench admission remain unfinished. This does not imply a reactive CAD evaluation region or graduation of the described geometry; see the function reference.

• **Multiple statements** (**supported**) -

  statements are separated by newlines or semicolons. Example: A1 = 1, then B1 = A1 + 1.

• **Model directives** (**supported**) -

  metadata headers such as MODEL "Portfolio", DESCRIPTION "...", VERSION "1.0.0", AUTHOR "...", and TAGS "audit".

• **Module imports** (**supported**) -

  USE "shared/finance.gs" AS finance imports reusable definitions under a namespace; EXPOSING (...) selects flat imports. Definitions-only .gs libraries may import transitively, while cycles, duplicate aliases, and executable library statements fail with diagnostics. Legacy .grid definitions modules import the same way; a .grid file whose first declaration is a Grid View item is a view library instead, and a file mixing the two is rejected. Header metadata such as TAGS may precede either kind.

• **Named model PART declarations**

  (syntax-only) - Closed literal records declare stable parts, explicit members/imports, duplication modes, source selectors, pins and override policy. Native source inspection, canonical editing and formatting retain typed compiler records. Ordinary compilation returns GRID_MODEL_PART_COMPOSITION_REQUIRED; no PART declaration supplies inheritance, shared references or execution authority. Separately selected native lifecycle composition can construct read-only shared literals from exact accepted captures under current native custody. That capability does not make source text or a portable capture an admission token.

• **Decision-package declarations**

  (supported) - DECISION PACKAGE pins a native computation's version, domain, dialects, capabilities, and typed artifact contracts in module metadata. Resident loading matches the complete declaration against the native registry and fails closed on unavailable or mismatched contracts.

• **Capability requirements**

  (supported) - REQUIRES crm = NETWORK("https://api.example.com", GET) and REQUIRES auth = SECRET("crm.read") declare exact authority metadata for NETWORK.GET_JSON. Requirement aliases never become ordinary values or captured secrets; compiler-owned call contracts retain the normalized origin, method, secret purpose, and effect route.

• **Assignment operators**

  (supported) - =, ~=, and ?= are production-lowered at top level; +=, -=, *=, and /= are production-lowered in rule actions and their documented typed mutation contexts.

• **Conditional assignment**

  (supported) - A1 ?= MAYBE_FAIL() preserves the previous value if the RHS returns an error.

• **Compound assignment** (**supported**) -

  rule actions perform native read-modify-write updates. Top-level arithmetic compound assignment is rejected because a declarative binding has no prior-value source; typed mutation contexts retain their own operator contracts.

• **Typed assignments** (**supported**) -

  A1 IS currency = 125000 or currency A1 = 125000.

• **Tensor and accelerator

  declarations** (supported) - shaped declarations such as A1 IS Tensor[2, 2] with precision 32 = SQUARE(values) lower to resident Tensor graphs when the optional accelerator is present and retain the same typed Workbook result when it is absent. Bounded ITERATE, PARAMETER, and TRAIN_ADAMW provide portable inference and training syntax. See Tensor shape, precision, and training for axis conventions, bounds, and the non-training array fallback.

• **Infix `INTO` cast** (**supported**) -

  amount INTO currency overlays a type tag on an expression value; lowers to TYPE_TAG(amount, "currency"). Same semantic overlay as declaration-level IS, but usable inside expressions.

• **Type-tag hierarchy** (**supported**) -

  tags refine one another (USD is a currency is a number; json is an object), a leaf implies its ancestors, and currencies take the currency:<code> qualifier (bare USD too) — unit: is for physical units.

• **Strictness — `strict` / `loose`**

  (supported) - one header keyword sets both the dimensional and coercion axes; strict except <axis> differs on one. Under strict, a lossy arithmetic coercion or an incompatible type-tag is a #TYPE!, and the static analyses harden too: matrix-shape mismatches (GRID_MATRIX_SHAPE_MISMATCH) and refuted VALIDATE assertions (GRID_VALIDATE_UNSATISFIABLE) become compile errors.

• **Dimensional checking

  directive** (supported) - dimensions strict, dimensions warn, and dimensions off select the dimensional-analysis policy independently of value coercion.

• **Nested-array transpose

  advice** (diagnostic) - GRID_NESTED_ARRAY_TRANSPOSE explains the outer dimensions of statically known literal nested arrays and the semicolon row syntax for scalar matrices. It remains advisory under strict dimensional checking and never rewrites intentional nested data or evaluates live inputs.

• **Unit-scale checking** (**supported**) -

  unit_scales warn, unit_scales strict, and unit_scales off select a compile-time audit of numeric unit representations. Explicit strict enforcement rejects known scale conflicts and unverified unit-sensitive expressions. It does not convert arithmetic, select another evaluator, or change the existing strict/loose axes. See unit scales.

• **Declared presentation —

  FORMAT / VALIDATE / PRESENT / ## notes** (supported) - trailing declarative clauses attach a format pattern, a validation clause, a preferred Grid View element, and doc notes to the cell in source. VALIDATE on an input cell is the write contract enforced at every write surface; on a computed cell it is a static assertion the compiler proves, refutes, or flags unverified via interval analysis. Top-level FORMAT <tag> <expr> declares tag policies; rule FORMAT actions and RESET FORMAT manage the override layer. PRESENT <Kind> selects a binding's usual standard, declared, or imported view element (a native subject contract or one-subject composite); an explicit kind on a view line has higher priority. Direct cell-address inputs retain their writable binding, validation and presentation in Views, including equivalent A1/R1C1 references and sheet-qualified addresses. Standalone VALIDATE FIELD declarations now lower exact model-input record paths to mandatory native contracts, sharing whole-record and proposed-batch semantics. Named RECORD CONTRACT definitions compose exact paths with INCLUDE ... AT ...; VALIDATE RECORD ... USING ... reuses them across model input owners. Expansion is bounded at admission and retains the same native contracts. Code's Field rules dialog includes shared definitions, transitive uses and source-owned create/update/remove transactions with an exact inverse. Imported rules remain read-only in the receiver; refused edits keep their draft. Private record locals reuse literal rules without model bound cells; computed operands are refused. Each reached private record bound is limited to 64 KiB of JSON-serialized literal value, including direct and imported bounds; unused bounds are not checked. Comments and grouping do not count toward that limit. Expanded private constraints retain their 8 MiB per View limit. VALIDATE ROWS local USING contract applies a contract to every row of a private list of records in a View. Rejected row edits identify the row and exact field path, retain the table-cell draft after sorting, and leave other component instances unchanged. Private row validation also precedes model writes in a mixed Form submission. At model scope, VALIDATE ROWS checks root or exact nested input collections against proposed-batch bounds using native validation; each field clause identifies its first failing row. Computed imported bounds retain their defining module's function identities and private helper dependencies; builtin calls also stay in that closed scope when caller functions share their names. Definitions-module imports retain private includes and immutable bound values without caller capture. Qualified or exposed definitions can serve both model owners and private View drafts. View libraries retain private contract dependencies and resolve draft rules in their defining module; exported rules also serve caller model owners. Source component packages retain private record/row contract closure, exact keys and closed bounds under names owned by the imported component. Compiler authoring create/update/remove/undo is exercised natively. Full field-contract delivery verification (including host recovery, performance and browser save/reopen) remains in progress.

• **Unary predicates** (**supported**) -

  predicate reviewed(by: string) declares a typed payload schema. x is :reviewed(reviewer) = 1 attaches it; the readability articles in x is a :reviewed(...) and x is an :reviewed(...) are optional. Declarations are single-valued by default; many by (id) permits several instances and defines their identity. In rules, += upserts one identity, keyed -= removes one, and bare -= removes all. Read single fields as scalars and many fields as arrays through PREDICATES(x).reviewed.by or x.predicates.reviewed.by. Field contracts fail closed; absent fields read as BLANK. Fieldless predicates such as :happy remain open and declaration-free. MODEL.PREDICATES.NEIGHBORS(:reviewed) performs a reactive reverse lookup through the unified Predicate graph; predicate vertices use colon-symbol identity, model symbols use canonical text identity, and many instances remain parallel :applies edges. Direct cell identity unifies A1, R1C1, absolute spelling and equivalent qualifier quoting in the same context; named aliases and explicit qualifier distinctions remain. Native static reference folding precedes predicate lookup. MODEL.TAGS displays direct cells with canonical A1 labels.

• **General predicate programs**

  (supported) - predicate releasable means ... defines a proposition about its implicit subject. Facts, natural predicate laws, EXISTS/EVERY, named structural routes (THEN, OR, *, REVERSE), Boolean NO path, result-valued REACHABLE, checked therefore conclusions, and WHY share one Predicate engine. Recursive EVERY components use dependency-SCC-scoped greatest fixed points. General modality uses independent support/refutation evidence: EVIDENCE(atom) returns neither, supported, refuted, or both; MUST reads support, MAY means not refuted, and CANNOT reads refutation. The both state is paraconsistent and does not invalidate unrelated inference. Structured unary facts retain their declared payload and reactive state.

• **Qualitative binary predicates**

  (supported) - temporal facts such as design before build and topology facts such as parcel inside district share bounded family-local inference with conceptual-set facts such as vip included in active. Topology is authored as separate from, touches, partially overlaps, coincides with, inside, encloses, and intersects, with optional with boundary contact / without boundary contact refinement. Conceptual sets use included in, includes, disjoint from, overlaps with, and same members as, with optional strictly refinement. Empty extents retain exact equality, inclusion, overlap, and disjointness meaning. Plain queries mean MUST; MAY, CANNOT, alternatives, complements, reactive IF/UNLESS, RELATION, RELATION_STATUS, WHY, family selection, and contradiction isolation are supported.

• **`default` / `RESET` / `CLEAR`**

  (supported) - default B1 = … marks an overridable base a rule may set, RESET to the base, or CLEAR.

• **`STATE` declarations** (**supported**) -

  STATE counter = 0 declares model-owned mutable state with an initial/reset base and sticky rule-written revisions.

• **Input/output decorators**

  (supported) - input price = 0, output total = price * qty.

• **Target references** (**supported**) -

  ordinary target cells such as D5 = 1.

• **Surface namespace slots**

  (supported) - component slots such as Name!type, Name!config, Name!data, and Name!source are qualified named wires that can be assigned and referenced without requiring grid coordinates.

• **Range target expansion**

  (supported) - A1:A5 = 0 expands to per-cell assignments.

• **Destructuring assignment**

  (supported) - [total, avg, ...rest] = SUMMARY(B1:B10).

• **Schedule modifiers** (**supported**) -

  A1 = NOW() ONCE, A1 = NOW() EVERY 5min, and A1 = TRUE AT dt"...".

• **Rule blocks** (**supported**) - touch and

  predicate WHEN, settled-value CHANGES / BECOMES, and scheduled EVERY / AT blocks with eager rule-action assignments. WHEN supports SERIAL/bounded CONCURRENT admission and LATEST, bounded QUEUE, or durable LEDGER event retention using captured event-time inputs. Optional RULE <name> gives a block a stable definition identity. Selected Lineage PART membership names rules explicitly; child execution state remains local.

• **Simulated-time authoring**

  (supported) - STOCK, PREV, and DELAY declare model-time state while SIM_TIME() and SIM_STEP() expose the active simulation clock. Simulation resolves use explicit or persisted t0/dt/step configuration and isolated scenario inputs; Euler is the default integrator, while RK4 is available for all-STOCK models and rejects discrete-state mixtures. SIM_AGENTS also admits authored arrays, native geometry model tables and immutable, model-owned geometry Frames containing point-bearing records with checked authored behavior and pure SIM_AGENT_COUNT predicates on the same deterministic Euler clock. Direct lambdas and portable helpers can use identity/step/stream draws, spatial queries and simulation clock reads. Portable helpers retain explicit simulation-context requirements through imports and source-free compiled format minor version 28; context-free contracts cannot hide these reads. Authored population, step and query bindings retain the same workbook clock. Authored state also preserves dates/datetimes, exact integers/decimals, complex numbers and admitted scalar refinements. A complete stateSchema freezes scalar type tags and explicitly nullable columns before workers start; omitted schema keeps nonnullable inference. Expanded retained state carries a closed versioned scalar payload and its schema, without changing primitive wires. Frame capture reads complete model-owned sources once at Analysis ingress and retains their revisions. Tables retain native geometry and supply complete transactional snapshots with real primary keys. GEO_MOVE_TOWARD supports same-CRS native points in ordinary formulas and pure behaviors, with WGS84 geodesic metres or Euclidean coordinate units. Native JSON movement and SIR sensing now share those metrics and reuse an immutable index per population version; nearest-k ties follow stable identity. Older WGS84 JSON speeds/contact radii expressed as degrees require adjustment. Direct authored lambdas now use NEIGHBORS_WITHIN and bounded NEAREST_AGENTS over retained previous-population indexes, including aliases and cross-population queries. Materialized authored runs retain geometry-bearing trajectories and matching workbook observations in one bounded Frame. Retained experiment inspection offers WGS84 Map scrubbing without rerunning the model. Saved Time experiments also own immutable table/Frame population inputs: live edits and source removal do not alter replay. New WGS84 saved runs scrub bounded run-owned Frame pages under the existing Map controls; legacy retained JSON remains inspectable. Frame publication requires recorded positions in one explicit CRS. Context-free portable query behaviors, dedicated Sim lowering and Scene playback remain under development.

• **Rigid-body physics worlds**

  (supported) - world = PHYSICS_WORLD({ bodies: [...], config: {...}, bindings: [...] }) declares balls, boxes, capsules, cylinders, cones, convex hulls, compounds of convex pieces, and fixed triangle meshes, optionally connected by fixed, spherical, hinge, or slider joints, with a fixed-step clock. Bodies are dynamic or fixed. A body's shape can also be read from a cell (shape: { kind: "cell", symbol }), which is how a solid published from the Sketch surface becomes a collider. The cell keeps its literal specification; the compiler admits it as a physics Sim region that runs only when the physics lane or a physics experiment requests it. Bindings let model cells set positions, velocities, materials, or gravity for each run, and scenario overlays stay request-scoped. A live session can bind cells both ways: observe writes readings (poses, velocities, contact counts, removal, tick) into input cells every tick, and drive turns a changed cell into an input (velocity, pose, removal), so a game's rules live in the model. PHYSICS_RUN(world, inputs) returns a run's final state to formulas, so results follow their inputs and numeric solvers can search through a run. Results are identical on every supported platform. See simulation.md.

• **`SOLVE` statements** (**supported**) -

  declarative goal-seek and bounded optimization over cells: SOLVE Z9 = A2 IN [0, 1] GOAL A3 = 200000, or MINIMIZE / MAXIMIZE an objective cell. Result, variable, and goal accept cell addresses or named wires; bounds and goal targets accept expressions evaluated from the current inputs. For example, SOLVE Recommended = Candidate IN [0, Capacity] GOAL Residual = Target. The result cell receives the solved value; solves are reactive and never mutate the variable cell. See assignments.md.

• **Reaction networks** (**supported**) - `name = REACTIONS … END` (also `REACTIONS name`) declares species, captured parameters, shared `LET` rates, directed/reversible fluxes, and explicit `MASS_ACTION` laws. `REACTION_SOLVE`, `REACTION_FINAL`, and `REACTION_REPORT` use native ODE integration with per-solve parameter/initial overrides; `REACTION_SPECIES` returns labels. See [Dynamics](dynamics.md). `OBSERVE` exports sampled outputs; `REACTION_SOLUTION`/`EQUATION_SOLUTION` return named series, terminal values and diagnostics from one integration. Named `EVENT … WHEN left = right` conditions support explicit first-crossing operations with direction filters, named state and observations; DAE event states preserve algebraic constraints. Physical annotations check dimensions and normalize compatible scales. Pure numeric helpers and `COMPONENT` definitions support shared laws and coupled models; dynamic `INPUT` bindings remain separate from constant parameters. Fixed indexed state/species families and named equation/reaction rows expand over immutable domains. Named `INVARIANT` clauses check admitted states against an explicit absolute tolerance and fail the selected operation with the check name and time. `definition WITH settings` and `DYNAMICS.CONFIGURE(definition, settings)` reuse checked model-local parameter/initial settings; reading the configuration is inert and later overrides do not mutate the original definition.
• **Differential and algebraic equations** (**supported**) - `name = EQUATIONS … END` (also `EQUATIONS name`) declares states, shared `LET` forces, and affine derivative equations whose coefficients may use captured parameters. Solve/final/report functions use native ODE or constant-mass index-1 DAE integration with independent scenarios; `EQUATION_STATES` returns labels. Unsupported implicit systems fail closed. See [Dynamics](dynamics.md). `OBSERVE` exports sampled outputs; `REACTION_SOLUTION`/`EQUATION_SOLUTION` return named series, terminal values and diagnostics from one integration. Named `EVENT … WHEN left = right` conditions support explicit first-crossing operations with direction filters, named state and observations; DAE event states preserve algebraic constraints. Physical annotations check dimensions and normalize compatible scales. Pure numeric helpers and `COMPONENT` definitions support shared laws and coupled models; dynamic `INPUT` bindings remain separate from constant parameters. Fixed indexed state/species families and named equation/reaction rows expand over immutable domains. Named `INVARIANT` clauses check admitted states against an explicit absolute tolerance and fail the selected operation with the check name and time. `definition WITH settings` and `DYNAMICS.CONFIGURE(definition, settings)` reuse checked model-local parameter/initial settings; reading the configuration is inert and later overrides do not mutate the original definition.
• **Named Planning declarations** (**supported**) - `name = PLAN TICK duration` (also `PLAN name TICK duration`) binds a resident definition reference and declares scalar activities, capacities, calendars, alternatives, predecessors and result destinations for the existing native Planning runtime. Exact fixed durations and pure compile-time arithmetic only; explicit Planning operations solve and publish. Named `USING role FROM [resources] AND role FROM [resources]` groups select simultaneous v5 resource reservations; scalar-only plans retain v4. `OPTIONAL PENALTY` and `DUE … PENALTY … PER` expose omission and soft completion costs under explicit `MINIMIZE total_cost`. Rates convert exactly to native ticks. Local `PARAMETER name[key IN domain] = data` views provide immutable vector or matrix data with typed domain keys. Indexed `RESOURCE` and `ACTIVITY` declarations expand one or two finite axes, with keyed member references and explicit `[*]` alternatives, calendars and predecessor barriers. `SETUP class` and directed `CHANGEOVER resource FROM class TO class DURATION duration` expose native sequence-dependent preparation, including indexed resources and exact parameter durations. `CHOICE (role = resource, ...) DURING [start, end]`, `NO CHOICES` and `FIXED AT` expose the existing v6 correlated tuples, occupancy windows and appointments. `MINIMIZE omission_cost THEN tardiness_cost THEN makespan` selects the native exact priority order, requiring finite hard deadlines and positive optional weights. See [Planning declarations](assignments.md#13-planning-declarations).
• **Spatial layout constraints** (**supported**) -

  name = LAYOUT … END (also LAYOUT name) places fixed-size axis-aligned rectangles using directional, contact, containment and explicit non-overlap requirements. Pure numeric inputs can drive dimensions, pins and finite signed bounds; requirement labels identify generated rows. COORDINATES local IN m admits compatible typed scalar and fixed-shape array lengths and returns tagged coordinates. Directional gap limits, uniform containment margins and positive shared-edge lengths use the same reactive inputs. Ordinary LP/MIP reports expose coordinates and solver status; unsupported integer solving fails closed. LAYOUT(parameters) declares an inert module or lexical callable with scalar arguments, named calls, partial application, returned wrappers and independent instances. Immutable values, transitive pure helpers and bounded numeric callbacks retain their actual binding identities through ordinary callable transport and imports. Finite indexed rectangles preserve immutable numeric, text or symbol keys in v3 results and CHECK/QUERY evidence. Numeric edits reuse the admitted structure; changed key sets require readmission. Explicit finite bounds and validation also select typed edge/center/size anchors with affine =, <= and >= requirements. Dimensionless COEFFICIENT formals retain separate contracts; independent exact CHECK and outward QUERY bounds use the complete hard set. This profile returns v4 with compatible typed candidate metadata. PARAMETER widths SHAPE 1 BY 2 declares complete numeric or quantity-array contracts, including unread entries. Declared EXPOSE region/anchor interfaces and bounded COMPONENT instances flatten into one coupled solve with retained child bounds and fixed quarter-turn transforms. Public v5 results retain instance paths, local-to-parent frames and interface handles. Structural key domains remain separate from numeric array inputs. VALIDATE selects independently checked v2 placements with definition/input/frame identities; .CHECK validates supplied candidates without invoking a solver and rejects stale inputs. Legacy v1 remains the default. Validated reusable layouts can declare directional QUERY clauses and call .QUERY with literal MAY, MUST or CANNOT selectors. Bounded search returns checked witnesses/counterexamples, verified affine bounds, undetermined or infeasible_base; exhausted search never becomes a Boolean proof. R2 native correctness and local Performance checks are complete for the supported directional affine profile. R3a lexical composition also has source-bound compiler, resident/interpreted/MIP and ordinary/selected Performance acceptance. The finite indexed profile also passes compiler, native/interpreted/MIP and ordinary/selected Performance checks under its unchanged budgets. Raw scalar/array guards, once-per- operation capture evaluation, owner hygiene and aggregate limits remain enforced. The bounded typed-affine profile also passes source-bound compiler, native/interpreted/MIP and ordinary/selected Performance checks under the same limits. Validated layouts also admit bounded dimension/aspect intervals, fixed-size ORIENT {0,90} choices, fixed rectangular obstacles and explicit collection non-overlap. Ordered arrangements, alignment, mirrored centers, Manhattan/Chebyshev upper, lower and exact distances, snapping and finite Boolean alternatives retain the complete hard set in CHECK and QUERY. Scaled PREFER/MINIMIZE priorities select native lexicographic reports; .MOVE takes an explicit prior placement and a final movement objective. .REGION independently validates immutable local polygons; explicit .TRANSFORM binds source/target frames and compatible units before native topology grounding. WHY reads committed resident evidence without solving. .CONFLICT performs bounded authored-group analysis with honest native infeasibility evidence. .REPAIR ranks permitted finite numeric revisions, and .CHECK_REPAIR independently rechecks supplied proposals without a solver. Repairs never apply themselves or silently reevaluate source parameters. See Spatial layouts.

• **Named and indexed optimization** (**supported**) -

  multiline name = SOLVE … END blocks (also SOLVE name … END) bind reactive results and declare bounded continuous, integer, or binary unknowns, labeled affine REQUIRE constraints, and an objective or ordered THEN priorities. Static indexed domains and binder SUM expand to the existing LP/MIP report calls. Results expose named values, ordered axes, the objective, exact solver status, and a sparse v2 report with native signed variable bounds. Fixed-shape numeric parameter arrays supply reactive coefficients and bounds through local PARAMETER profit[product IN products] = data views or checked INDEX(data, row, column) reads. One or two ordered axes map domain keys to vector or matrix positions. Whole-array shape and numeric validity are enforced before solving. Convex ABS/MAX objectives express weighted soft requirements, target deviations and worst-case affine costs; generated continuous helpers use the same sparse LP/MIP path. Hard REQUIRE clauses retain their meaning. Lexicographic objectives accept explicit absolute and relative degradation tolerances and a shared reserved effort budget; reports distinguish completed priorities from unfinished candidates. Coefficient storage follows actual terms. See assignments.md.

• **Comments and documentation** (**supported**) -

  single # comments occupy their own physical line (indentation is allowed); /* notes */ comments may follow code, span lines, and nest. ## introduces documentation, including after an assignment. Completed Symbol declarations and View outline lines retain a spaced # explanation suffix; expression, View binding and action operands do not. Postfix spill and recognized error literals keep their grammatical roles regardless of bindings or imports. See reference.md.

• **Diagnostics** (**supported**) - parser errors

  carry specific spans and recovery messages.

• **Reserved words** (**diagnostic**) -

  Grid's grammar is contextual rather than lexically reserved. Structural and operator keywords such as WHEN, END, MODEL, WITH, and NOT are treated as grammar when that parse is available, so ambiguous uses produce a diagnostic instead of silently becoming a binding reference. Contextual words may remain valid names where no structural parse applies; authors should avoid all names listed in the reference.

• **First-class grammars and parsers**

  (supported) - GRAMMAR name IS CFG|PEG|REGULAR ... END creates an immutable grammar value. grammar USING LALR|EARLEY|PACKRAT|DFA|AUTO creates a portable parser recipe, GENERATOR ... makes the strategy independently authorable, and PARSE(text, parser) returns a native parse-result value. Formalisms retain distinct choice semantics; recipes persist without process-local parser tables. graph syntax = GRAPH(parse_tree) publishes a successful tree through the ordinary resident Graph and Predicate reasoning stack with ordered child edges and source-span provenance. The grammar-bound tree substrate is available through its complete declaration surface — PATTERN, THEORY, ALGEBRA, TRANSFORM, TRANSLATE, SOLVER, and THEOREM — including bounded solver search, saturation, and checked theorems as proved equation sources. See grammars.md.

• **Grammar token highlight categories**

  (supported) - TOKEN name [PRIORITY n] HIGHLIGHT <category> = /pattern/ names the semantic-token category editors color that token with in TREE fragments written in the grammar's notation. Categories are the language service's legend (docs/language/vocabulary.json); an unknown category is GRID_GRAMMAR_TOKEN_HIGHLIGHT. The clause is editor metadata: it never changes the grammar value, its identity, parsing or results, and the formatter preserves it verbatim.

• **Grid-native symbolic mathematics**

  (supported) - contextual symbol x declarations create immutable mathematical variables that compose through ordinary Grid operators, references, and admitted functions. The SYMBOLIC.* family provides exact rational construction, canonicalization, simplification, expansion, collection, factorization, rational transforms, typed substitution, exact evaluation, explicit arbitrary-precision approximation, assumptions, four-state decisions, differentiation, and complete admitted univariate solving, including linear and quadratic equations with coefficients in a real quadratic field and exact substitution into those expressions. SYMBOLIC.CALCULATE runs ordered algebra, differentiation and exact polynomial antiderivative and rational-point evaluation steps with shared local assumptions, retained conditions and one work budget. Polynomial primitives use zero integration constant and exact derivative verification. Point evaluation checks affected assumptions and domain conditions before discharging them, including cancelled holes. Results retain conditions, bounded work, completeness, and replayable Tree certificates; there is no held-body syntax, string evaluator, or alternate public AST. See symbolic-mathematics.md.

• **Parser hardening edge cases**

  (supported) - regression coverage for ambiguous token boundaries.

• **Multi-line bracket

  continuation** (supported) - calls (including MATCH), arrays, objects, comprehensions, and bracketed expressions may span lines while delimiters are open, including before or after a binary operator. A nested DO body still separates its bindings by line.

• **Style-guide multi-line

  patterns** (supported) - canonical formatting for MATCH, objects, comprehensions, DO, and CASE.

• **Trailing commas** (**supported**) -

  allowed in function calls, array literals, object literals, and MATCH arms.

Native Graph Algebra

• **Bounded Graph row expressions and predicates** (**supported**) -

  ordinary pure helpers, conditionals and reductions run through the compiled evaluator over lexical row bindings and frozen scalar captures, including ordered captured paths. Language reference.

• **Atomic Graph topology rewrites** (**supported**) -

  mixed property edits, node/edge creation, cascade deletion and identity merges read one original snapshot and publish one validated immutable result. Language reference.

• **Exact ranked graph paths** (**supported**) -

  frame alternatives = paths in ... limit 12 AS hops limit 3 AS paths returns an exact ranked prefix or refuses on resource exhaustion. Language reference.

• **Graph traversal policies and ordered edge properties** (**supported**) -

  walk, trail, and simple AS traversal constrain path identity reuse; captured trip.edges.cost preserves ordered, nullable native property values. Language reference.

• **Bounded ordinary-data hierarchies** (**supported**) -

  TREE.VIEW admits nested records with an explicit child selector or a resident Graph with an exact root and sibling order. TREE.WALK, TREE.FOLD and TREE.MAP_VALUES use bounded structural traversal and ordinary compiled callbacks; TREE.MATERIALIZE reconstructs views with a validated direct-child-field adapter. Views retain native data and carry no grammar or proof authority. See ordinary-data hierarchies.

• **Complete bounded graph matches** (**supported**) -

  require complete returns every matching row within the authored limit or fails before publication; ordinary matches retain prefix semantics. Language reference.

• **Resident graph bindings**

  (supported) - graph roads = GRAPH(...) creates a typed, immutable, revisioned property-graph handle that cannot spill into Workbook cells. Compiler syntax inspection retains the authored order and interface names of named graph producer arguments.

• **Model graph relationships**

  (supported) - symbols and cells are implicit MODEL.GRAPH nodes; relates to adds directed edges and connects to adds bidirectional logical relationships, with typed payloads, list expansion, and stable identity.

• **Unary-predicate compatibility view**

  (supported) - MODEL.TAGS retains the unary-only :<predicate> -> "model symbol" projection for source compatibility.

• **Unified predicate graph view**

  (supported) - MODEL.PREDICATES combines live unary membership with authored binary facts and their temporal/topology/set family, descriptive relation set, and condition metadata without materializing inference closure into graph topology. Structured unary payloads are edge properties, and rule mutations participate in revisioned caching.

• **Generic knowledge-graph reasoning**

  (supported) - KNOWLEDGE GRAPH knowledge VIA edge.relation projects an arbitrary resident GraphHandle into Predicate v10 with exact string, symbol, and integer node identity. WITH PROPERTIES adds joinable graph_node, graph_edge, graph_node_property, and graph_edge_property facts for typed scalar properties. WHY retains the exact graph, revision, node, edge, and property origins used by a proof, while inferred closure remains a separate derived view.

• **Durable graph patch journal**

  (supported) - every accepted resident patch appends a revisioned event; append/replay/read APIs support optimistic graph and journal revision guards so persistence can replay the exact stream beside the same compiled model.

• **Declarative paths**

  (supported) - path route = path in roads from a to b minimize hops states an objective; the planner selects and explains the physical kernel.

• **First-class partitions**

  (supported) - connectivity, core/k-core, and deterministic Leiden/Louvain community contracts share a revision-bound partition value.

• **Closed graph schemas and kinds**

  (supported) - graph schema Name … END types node/edge properties, named node and edge kinds, and endpoint constraints; hydration and atomic patch staging revalidate the same closed contract. Legacy brace bodies remain accepted.

• **Graph views and immutable rewrites**

  (supported) - graph selected = source DO … END comprehensions can fuse into a consumer or materialize a derived handle, while bounded edge-deletion rewrites publish one validated immutable revision. Legacy brace comprehensions remain accepted.

• **Graph projections and

  contraction** (supported) - path and partition handles expose typed scalar/Frame projections, and a revision-matched partition contracts into a deterministic quotient graph.

• **Typed graph-pattern labels** (**supported**) -

  (a:Account)-[e:Transfer]->(b:Account) abbreviates symbol-valued kind equality in bounded matches and rewrites. Labels compose with where, incoming edges and repeated bindings; existing schema checks apply. See graph patterns.

• **Reactive graph predicates** (**supported**) -

  Model inputs settle once before bounded matching. Structural id equality uses native node seeks. See bounded patterns.

• **Reactive graph transformations** (**supported**) -

  View predicates read model inputs; bounded property rewrites read one source revision, coalesce identical edits and reject conflicts before publishing an immutable result.

• **Optional and negative graph groups** (**supported**) -

  Anchored optional groups preserve missing rows with nulls; without excludes a whole matching group and exports no private bindings.

• **Bounded walk capture** (**supported**) -

  Match-local path … from … via … to … limit reuses logical THEN, OR, *, REVERSE and lexical path aliases, exposing ordered nodes, edges and hop counts.

• **Branching graph patterns** (**supported**) -

  Commas restart from earlier bound nodes; comparisons can relate properties across bindings, including later ones. See bounded patterns.

• **Anonymous entities and node selection** (**supported**) -

  (), (:Kind), [] and [:Kind] omit unused graph bindings without imposing identity equality. Bounded node-only patterns include isolated nodes. Explicit names remain required for projections, property filters and deletion targets.

• **Bounded graph patterns**

  (supported) - frame hits = match roads limit 100: ... return ... provides typed node/edge predicates and Frame projections with a mandatory result bound.

• **Bounded graph fixed points**

  (supported) - frame values = fixpoint in roads: ... within 100 iterations exposes sum-product, min-plus, max-min, and boolean-or propagation with explicit direction, seeds, convergence, and work bounds.

• **Graph `EXPLAIN`** (**supported**) - the

  read-only explainGraph(modelId) host method reports semantic contracts, physical plans, declared/effective budgets, transient/retained/peak memory, materialization, lineage, and resident state. See Graph Authoring.

• **Typed graph domain bridges**

  (supported) - the production host projects the current resident graph revision into Geo routing, Network Flow, and Sim validators/kernels without an untyped intermediate representation.

Games And Mechanisms

• **Declarative game blocks** (supported) - game Name { players = P; strategies = S; payoffs = U } validates live normal-form relations through GAME.NORMAL_FORM; the extensive = Tree form validates a perfect-information tree. Both lower to ordinary named call assignments and the canonical compiled call form.
• **Finite strategic verification** (supported) - exhaustive pure Nash, regret, dominance, Pareto, welfare, and evidence-carrying GAME.VERIFY claims fail closed on incomplete domains or exhausted work.
• **Certified equilibria** (supported) - independent zero-sum primal/dual LPs, bounded general bimatrix support enumeration, correlated-equilibrium incentive LPs, and perfect-information backward induction all replay their defining inequalities before publishing a result.
• **Declarative direct mechanisms** (supported) - mechanism Name { direct = Specification } lowers through MECHANISM.DIRECT; exhaustive DSIC/BIC, ex-post/interim IR, no-deficit, and strong-budget-balance checks return concrete counterexamples.
• **Allocation and auction mechanisms** (supported) - exact unit-demand welfare matching with VCG counterfactual payments plus deterministic first/second-price auctions with reserve and tie evidence. See game-theory.md.

Literals And Values

• **Number literals** (**supported**) - integers, decimals, leading-dot decimals, and scientific notation. Whitespace, comments and grouping do not change numeric meaning; integer -0 is 0, while floating-point -0.0 retains its sign bit.
• **Numeric separators** (**supported**) - 1_000_000 and 0.000_001.
• **Hex and binary literals** (supported) - 0xFF, 0b1010.
• **Octal literals** (**supported**) - 0o755.
• **String literals** (**supported**) - double-quoted, triple-quoted, raw, raw-triple, and backtick strings.
• **String escapes** (**supported**) - newline, tab, quote escaping, and doubled quotes where documented.
• **String interpolation** (**supported**)
  • `total={A1}`.
• **Format specifiers in interpolation** (supported) - `total: {A1:"$#,##0.00"}`.
• **Boolean literals** (**supported**) - TRUE and FALSE, case-insensitive.
• **Wildcard and blank literals** (supported) - glob"*.csv", wild"inv-????", and BLANK.
• **Native format literals** (**supported**) - Bounded specialist enhancements add explicit RomanText and Xiangqi resolution, supplied-model DEXPI validation, LandXML point-unit conversion, written music structures and selected native profile extensions; see the profile guide for refusal rules and the explicitly deferred Benesh workstream. Statically declared native parsers accept quoted, triple-quoted and angle-block payloads through an injected compilation service. Literal compilation produces native constants; ordinary PARSE_* calls use the selected edition's parser. Formatting and syntax inspection preserve payloads without executing readers. Closed native graph object literals honor an explicit boolean directed field (default TRUE); nonboolean or live direction expressions are rejected. Native graph constants and live GRAPH(data) bindings share bounded scalar-table admission. Source edits update topology and direction, including derived graphs. The versioned live-data implementation has authored, unrun native acceptance. Standard (Lite)/Pro includes bounded LandXML, OMM JSON/KVN/XML, Open-PSA, UML XMI, SWU, Knitout, Humdrum, legal identifiers, OEM KVN/XML, SPICE text kernels and manual-token SiGML and direct HamNoSys character imports with catalog-driven editor support. OMM/OEM add source-only field, time-system and unit assistance across KVN/XML and OMM GP JSON, with native verification deferred. VS Code recognizes every catalog literal spelling across all three delimiters. Raw payload highlighting uses registered host grammars or domain token rules. KiCad 7 schematic import adds a structural graph, authored wire coordinates, embedded symbol navigation and label/instance flag assistance under circuit. RomanText adds ordered analysis documents, alternate readings, copy references and source-only header/meter/policy/chord assistance. Pitch realization and copy expansion remain outside import; native validation is deferred. Open-PSA includes scoped expressions, CCF/substitution data, event trees, consequences, missions/phases and standalone result fragments; imports retain source identities and do not execute the supplied model or report. Selected semaphore/ICS signals, TEI feature structures, FMEA/bow-tie data, explicit orientations and GeoSciML Lite/Basic/GeologicTime add bounded native profiles. TEI declarations combine local/inherited explicit-value constraints, reject cycles and expose missing bases. Inherited field choices and type navigation are source-only; defaults remain unmaterialized. Typed feature pointers and bow-tie endpoints support local navigation. Quoted/multiline CSV has field help; their new native validation remains deferred. gestureBot timed-pose JSON through laban retains upper-body poses, seconds, stable track indexes and inert cues with joint-specific vocabulary assistance. Legacy LabanotationSuite objects retain named gestures, member order and millisecond keyframes, with array vocabulary assistance. Native validation remains deferred; no interpolation or robot playback. Selected CML XML reactions, schemes and mechanism annotations retain participant counts, typed references and molecule-local atom/bond identities, with source-only endpoint assistance, including explicit map contexts, per-link overrides and partial-set incidence. MRV imports compact/explicit atoms, bonds and curved-flow endpoints, weights and geometry, with document-scoped source assistance. Balancing, kinetics, electron-count inference and rendering remain separate; native verification is deferred. FeynML 0.2.0.1 XML and standalone child/legacy diagrams retain vertices, propagators, legs and incidence tables with diagram-local endpoint assistance. XML identity rename, particle inference and amplitude evaluation remain outside the profile; native validation is deferred. CalChart version-1 JSON shows join choreography: positional performer/formation identities, raw geometry, assigned curves, fermatas and descriptive continuity ASTs, with source-only numeric reference navigation and vocabulary choices. Native validation remains deferred; no movement or media execution. CalChart and DAGitty graph projections use scalar properties and from/to endpoints; DAGitty rich variable/relation tables remain separate. DAGitty descriptive documents now join the causaldag Grid-record profile: local variable assistance, graph/endpoint kinds, grouped edges and bounded cycle checks. The exact contract retains native validation deferral and the causal-analysis boundary. Quiver v0 arrays/base64/share links retain indexed higher cells and incidence graphs, with decoded source-index navigation and completion. Labels/macros stay inert; native validation remains deferred. Ahnentafel imports expose ancestry-slot graphs and numbering hover, preserving missing links and repeated names without inferring person identity. Morse imports retain selected procedure signs, ambiguous meanings and nominal mark/gap timing, with source-only symbol completion and hover; no transmission. UML XMI includes selected structural and interaction tables with local ID completion/navigation/hover; no metamodel certification or behavior execution. TEI exposes temporal alignment tables and scoped local references. rformula / PARSE_RFORMULA preserve descriptive R formula syntax as native graphs without evaluation. Explicit OPTIMIZATION_MODEL, RFORMULA_SPEC and ANNOTATION_TABLES adapters connect admitted profiles to native optimization, fitting and Frame/Graph workflows; see execution adapters. xigt / PARSE_XIGT import ordered interlinear tiers, validate scoped alignment references and resolve Unicode text selections into native values. Editor reference assistance stays within each IGT and declared target tier. brat / PARSE_BRAT preserve standoff annotations, character spans and local reference graphs without opening document files. DDLm ByReference contents and Table indices resolve supplied definition chains and aliases once per validation, with incomplete missing/cyclic targets. Reference-dictionary attributes support Implied types from their enclosing supplied definition, including structure and block-local type references. DDLm validation includes RFC 3986 URI references and RFC 3339 DateTime syntax, with matching editor choices and explicit incomplete leap-second checks. BRAILLE_TRANSLATE also accepts bounded forward typeform spans with authored Unicode scalar offsets and correction-provenance remapping. spicenetlist / PARSE_SPICENETLIST import descriptive electrical SPICE3 components, scoped nets/models/subcircuits and native terminal graph tables, without simulation, includes or macro execution. PARSE_DAF imports binary SPK/PCK/CK descriptors and exact payloads, with SPK 2/3 and PCK 2 Chebyshev coefficient records; function-only byte input. CIF supports explicit scalar/compound DDLm dictionary validation; UEB text and MathML mathematical braille use bounded native transcription. Bounded workflows add RELIABILITY_REPORT, exact RDF_DATASET tables and RDF_VALIDATE, calibrated WAVEFORM_TABLES, and static NET … IMPORT pnml"…" … END lowering into existing NET semantics. See execution profiles for supported/refused semantics and the scoped verification record. Explicit backward-typeforms recovers UEB style spans over decoded Unicode text. See notation contracts.
• **Extension-defined literals** (**supported**) - explicitly imported package tags accept tag"...", tag"""...""", and <tag>...</tag>, including qualified names. Compilation executes a pure, deterministic parser once per distinct cached input and replaces the literal with native constants. Formatting and syntax inspection preserve source without executing packages. See extension literals.
• **Executable Lua tags** (**supported**) - <lua type="number">return 42</lua> needs no import in a Lua-equipped runtime. Explicit template passes checked scalar or homogeneous list Grid holes as eager arguments. number[], string[], and boolean[] results enable inline list kernels; eligible pure scalar MAP tails batch automatically. Exact source survives cold compiled-model loading; private bytecode belongs to the admitted model revision. This is the bounded Lua pilot; TREE DSL producers and Wasm compiler packs remain follow-up work. See executable tags.
• **Typed literals** (**supported**) - date"...", dt"...", duration"...", cron"...", and domain literals such as url"...", mol"...", dna"...", color"...", note"...", music"...", bin"...", b64"...", and markup typed strings html"...", xhtml"...", svg"...", jsx"..."; any typed tag may also wrap the payload as <tag>...</tag>, for example <dna>ATCG</dna>.
• **Reactive typed templates** (**supported**) - <json template>{"total": {{Quantity * UnitPrice}}}</json> compiles static format structure and ordinary Grid expression holes into native expressions. start="[[" end="]]" overrides the format’s delimiter defaults; doubling the opener emits it literally. Extensions may declare a separate template compiler. See templates.
• **Music notation** (**supported**) - music"..." and <music>...</music> hold Grid Music Notation text and desugar to MUSIC_SCORE(text), a music score value. Notes, chords, rests, ties, slurs, tuplets, grace notes, articulations, ornaments, tremolos, dynamics, hairpins, lyrics, chord symbols, repeats, ottava lines, pedal marks, cue notes, swing, drum-kit staves, tablature with tunings and chosen strings, and key/time/clef/tempo changes are supported; errors report their line and column. MUSIC_* functions transpose, excerpt, join, import and export MusicXML, and publish note and MIDI tables. In a Grid View the Score element accepts edit, view, zoom, playback, audio, soundfont, multirests, spacing, page, orientation, staff size, margin and hide empty staves. See Music Notation.
• **Exact numeric literals** (supported) - bigint"123456789012345678901234567890" for arbitrary-precision integers and decimal"0.1" for exact fixed-precision decimals, plus the BIGINT(...) constructor. Exact values keep their precision through arithmetic and number-theory functions such as ISPRIME, MODPOW, GCD, ISQRT, and RANDPRIME; decimal"0.1" + decimal"0.2" equals decimal"0.3" exactly. Mixing an exact value with a non-integer ordinary number is a #VALUE! instead of a silent floating-point rounding.
• **Custom unit literals** (**supported**)
  • duration suffixes (5min), basis points (25bps), percentages (5pct), angles (45deg), data sizes (512MB), and 3-letter units (100USD).
• **Custom unit declarations** (supported) - unit smoot = 1.7018 m and derived scale-only units extend dimensional inference without shadowing built-ins or using affine bases. Declarations and inferred dimensions persist in compiled module metadata.
• **Model-owned FX-rate declarations** (supported) - fx_rate R1C2 = EUR/USD marks an ordinary numeric rate cell as a directional currency conversion. Dimensional checking accepts the declared direction, rejects the reverse use, and retains the declaration in compiled module metadata.
• **Error literals** (**supported**) - #N/A, #DIV/0!, #VALUE!, #REF!, #NAME?, #NULL!, #NUM!, #CALC!, and #SPILL!.
• **Regex literals** (**supported**) - /^INV-\d+$/i.
• **Array literals** (**supported**) - [1, 2, 3], [1; 2; 3], and [1, 2; 3, 4].
• **Spread in arrays** (**supported**) - [0, ...A1:A3, 4] desugars to HSTACK for horizontal concatenation.
• **Object literals** (**supported**) - {name: "Ada", level: 9} and {"first name": "Ada"}.
• **Parenthesized expressions** (supported) - (1 + 2) * 3.

References, Ranges, And Access

• **Cell references** (**supported**) - `A1`, $A$1, AA100, R1C1, and R[1]C[-2]. Qualified references such as [sales]Default!Revenue and grid://node-b/[inventory]Ops!Stock preserve machine/model metadata through source and owning-module compilation.
• **Named address aliases** (supported) - Revenue = A1 gives the existing reactive binding a semantic address; calculated or decorated named assignments remain distinct bindings.
• **Ranges** (**supported**) - `A1:B10` and R1C1:R3C3.
• **Full column and row ranges** (supported) - A:A, A:C, 1:1, and 1:3 in expression positions.
• **Spill references** (**supported**) - A1# refers to the full spilled rectangle anchored at A1.
• **Implicit intersection `@`** (diagnostic) - @A:A was removed (it never reduced a range to a row/column value — UnaryOp::At was pure identity). A prefix @ on a reference now rejects with GRID_IMPLICIT_INTERSECTION_REMOVED; reference the cell directly. Prefix @ remains valid for temporal coordinates (@today), and postfix @ remains valid for temporal references (A1@-1) and structured projection (data@"amount", data@["id", "amount"]).
• **Object dot/bracket access** (supported) - obj.field, obj["field"], and optional chains.
• **Bracket and dot access** (supported) - unified array/object access through INDEX, including addressed fields such as A1.value and R1C1.value.
• **From-end indexing** (**supported**) - data[-1] and data[^1].
• **Slice notation** (**supported**) - data[2:5], data[:3], data[3:], and data[1:10:2].
• **Structured references** (supported) - Sales[Revenue].
• **QUERY function** (**supported**) - QUERY(data, "SELECT * WHERE col1 > 5") for table-like arrays.
• **Model table declarations** (supported) - table Orders = { schema: "orders" } declares durable table state, while table PaidOrders = SELECT ... FROM Orders declares a continuously maintained live table. Connector-backed table declarations retain their authored schema and ingestion contract as model metadata. A columns object declares each column's type and write rules (unique, immutable, softDelete, references: "Table.column" and balance); deploy provisions them additively and the table store enforces them for every writer.
• **Native `SELECT … FROM` expression** (supported) - SELECT id AS order_id, amount * 1.2 AS gross FROM Orders WHERE status IN ("paid", "pending") OR amount BETWEEN 10 AND 30 ORDER BY amount DESC LIMIT 25, plus grouped forms such as SELECT status, SUM(amount) AS total, COUNT(DISTINCT customer) AS customers FROM Orders GROUP BY status, parse and lower to structured relational IR (REL_SELECT(source, projection, predicate, order, limit, group, having)) instead of a SQL string. Header arrays and Tuple/Vector/Deque collections of Record rows execute natively, preserving the source sequence family. Connector- produced Frames also route through native filtering, ordering, limiting, and projection and may feed another query without materializing back to cells. Warehouse-backed queries push supported clauses to BigQuery, Snowflake, Redshift, and Databricks using provider-native parameter binding, with relational residuals executed in DataFusion. WHERE uses a canonical recursive predicate tree with SQL NOT/AND/OR precedence and three-valued blank/NULL behavior. LIKE/ILIKE use SQL % and _ wildcards. Computed projections use a typed scalar tree and require AS; arithmetic, searched and simple CASE, COALESCE, NULLIF, ABS, SQRT, FLOOR, CEIL/CEILING, ROUND, POWER, LOWER, UPPER, LENGTH, CAST, TRY_CAST, IN, and inclusive BETWEEN share the same backend-neutral contract. Cast targets canonicalize to number, string, or boolean; CAST reports an invalid conversion while TRY_CAST returns null. CASE is ordered, first-true, and treats unknown conditions as fallthrough. FETCH FIRST|NEXT n ROW|ROWS ONLY is the SQL-standard spelling of the same bounded result stage as LIMIT n. LIMIT n OFFSET m and OFFSET m [ROW|ROWS] [FETCH FIRST|NEXT n ROW|ROWS ONLY] share one result- window contract across resident values, Frames, Polars, DataFusion, and bounded warehouse pushdown. ORDER BY ... NULLS FIRST|LAST controls blank/ null placement for outer and analytic-window ordering; omitted placement remains null-last in both directions. Outer ORDER BY accepts typed scalar expressions and resolves both simple and computed SELECT aliases across resident collections, Frames, Polars, DataFusion, and warehouse pushdown; sort keys are evaluated once per row. Analytic-window ordering accepts the same scalar expressions; ranking, peers, and RANGE bounds share cached key values across those backends. COUNT(*) plus COUNT, COUNT(DISTINCT ...), SUM, AVG, MIN, and MAX over portable scalar expressions execute for resident values, Frames, Polars, DataFusion, and supported warehouse pushdown. Post-aggregate HAVING uses the same predicate tree. SELECT DISTINCT deduplicates typed projected rows before outer ordering and limiting across resident relations and source-proven Frames. SQL UNION, INTERSECT, and EXCEPT, with optional ALL, compose complete query results positionally. Typed duplicate/null semantics, SQL multiset counts, INTERSECT precedence, left-arm column names, and final-result ordering/limits are shared by resident collections and source-proven Frames. Analytic projections support ROW_NUMBER, RANK, DENSE_RANK, NTILE, PERCENT_RANK, CUME_DIST, LAG, LEAD, FIRST_VALUE, LAST_VALUE, NTH_VALUE, and windowed COUNT/SUM/AVG/MIN/MAX with PARTITION BY and ORDER BY, shared by resident values, Frames, local analytics, and warehouse pushdown. LAG/LEAD accept bounded offsets and scalar defaults; aggregate and value windows accept validated explicit ROWS BETWEEN ... AND ... and RANGE BETWEEN ... AND ... frames. Grouped queries stage WHERE, aggregation, HAVING, windows, outer ordering/result-window, and final projection in SQL logical order. Parenthesized relation subqueries and non-recursive SQL WITH name AS (SELECT ...) SELECT ... CTEs compose resident relation values directly and source-proven chains fuse into one physical Frame region; single-source aliases resolve qualified references without changing the source schema. Equality-correlatable EXISTS, NOT EXISTS, correlated IN, and null-aware correlated NOT IN over explicitly aliased sources lower to composite-key hash semi/anti joins while retaining inner-local and trailing outer filters. Correlated scalar aggregate projections lower to grouped inner relations plus typed lookup joins, with SQL empty-group defaults and no per-outer-row subquery evaluation. Multiple aggregate projections compose for resident relations and source-proven Frames. WITH RECURSIVE executes as a bounded fixpoint group over header arrays and native record sequences, with column lists, multiple bindings, simultaneous mutual recursion, per-binding UNION/UNION ALL, and explicit 1,000-iteration and 2,000,000-aggregate-row limits. Source-proven groups additionally promote to native Frame recursion, including explicit column lists, multiple or mutually recursive bindings, set expressions, and recursive equi-joins against other resident Frames. Explicitly aliased INNER, LEFT, RIGHT, and FULL equi-joins lower to REL_JOIN, execute as bounded typed hash joins for resident values and Frames, and support composite keys.
• **PostgreSQL table queries** (supported) - PG_TABLE("finance", "public", "orders") and related bounded Postgres helpers.
• **Native frames** (supported) - READ_PARQUET("orders.parquet") |> WHERE("amount > 0") creates a frame value for filtering, projections, and columnar analytics.
• **Spatial references** (**supported**) - ABOVE, BELOW, LEFT, RIGHT, and directional offset forms.
• **NEIGHBORS reference** (**supported**) - NEIGHBORS and NEIGHBORS(N).
• **Temporal references** (**supported**)
  • A1@-1, A1@dt"...", and temporal-coordinate shorthands such as A1@today, A1@monday, A1@january, A1@1776, A1@5000BCE, and A1@2026-12-31 read historical values from model history.
• **Iteration context** (**supported**) - ROW_INDEX, COL_INDEX, IS_FIRST, IS_LAST, and CELL_COUNT inside range-target rule actions, resolved for each materialized target cell.
• **Header selection** (**supported**) - data@"amount" for a single header/key.
• **PICK/OMIT/RENAME sugar** (supported) - data@["id", "amount"], data@!["secret"], data PICK id, glob"*amount*", data OMIT secret, data RENAME "old" AS "new".

Operators

• **Binary operators** (**supported**) -

  arithmetic, concatenation, comparison, and equality operators.

• **Unary operators** (**supported**) - unary

  +, unary -, logical !, and NOT.

• **Pipeline operator `|>`**

  (supported) - frame |> WHERE("x > 0") |> COLLECT() desugars to nested function calls, placing the left expression as the first argument. values |> FILTER(value => predicate [, if_empty]) is the elementwise special form and lowers to FILTER(values, MAP(values, value => predicate) [, if_empty]). Ordinary FILTER(values, include_mask [, if_empty]) is unchanged outside a pipe; the legacy FILTER(_, _ > 0) pipe spelling remains accepted but is not canonical. See collections.md.

• **Infix apply `OF`** (**supported**) -

  function-first mirror of pipe: ABS() OF A1 ≡ A1 >> ABS(); ROUND(_, 2) OF ABS() OF A1 is right-associative and ≡ A1 >> ABS() >> ROUND(_, 2). The left operand must be a function call (ABS(), not bare ABS); the right operand must be a value (cell, literal, or expression without _ placeholders). Callable OF callable is rejected. %OF is unrelated (percent-of → PERCENTOF); IS MULTIPLE OF stays on the comparison layer. See infix-operators.md.

• **Percentage operator** (**supported**) -

  50% is 0.5.

• **Right-associative

  exponentiation** (supported) - 2 ^ 3 ^ 2 parses as 2 ^ (3 ^ 2).

• **Exponent `**`** (**supported**) -

  2 ** 3.

• **Integer division** (**supported**) -

  7 // 2 (floor division). Use QUOTIENT(n, d) for truncate-toward-zero division (Excel semantics). Backslash \ is not a division operator.

• **Modulo operator** (**supported**) -

  10 %% 3, 10 MOD 3, or 10 MODULO 3 (all desugar to MOD).

• **Divides operator** (**supported**) -

  10 DIVIDES 5, 10 NOT DIVIDES 3, or 10 /? 5 (desugar to MOD(a, b) = 0). See infix-operators.md.

• **Coprime operator** (**supported**) -

  8 COPRIME 15 (desugar to GCD(a, b) = 1).

• **Bitwise infix operators**

  (supported) - a BITAND b, BITOR, BITXOR, BITLSHIFT/SHL, and BITRSHIFT/SHR.

• **Array append** (**supported**) -

  [1, 2] ++ [3, 4] desugars to VSTACK.

• **Collection operators** (**supported**) -

  [1, 2, 3] HAS 2, [1, 2] SUBSET OF [1, 2, 3], [1, 2, 3] SUPERSET OF [1, 2], and [1, 2] OVERLAPS [2, 3]. Membership and set relations compare direct elements without recursively flattening nested arrays; 2-D arrays expose rows, while subset/superset are unordered and duplicate-insensitive. Equality is type/tag-sensitive, compares errors by code, equates signed zero, never equates NaN, and distinguishes infinity signs.

• **Factorial operators** (**supported**) -

  5! and 7!!.

• **String multiplication**

  (supported) - "ha" * 3 repeats text.

• **Logical operators** (**supported**) -

  AND, OR, XOR, NOT, &&, and ||.

• **Null coalescing** (**supported**) -

  A1 ?? 0; DEFAULT is the canonical spelling.

• **Membership operators** (**supported**)
  • value IN [1, 2, 3] and value NOT IN set.
• **Inequality aliases** (**supported**) -

  both <> and !=.

• **BETWEEN operator** (**supported**) -

  5 BETWEEN 1 AND 10, plus NOT BETWEEN.

• **LIKE operator** (**supported**) -

  "Jon" LIKE "J*n" and NOT LIKE.

• **String and ordered-containment

  operators** (supported) - STARTS WITH, ENDS WITH, ILIKE, and their NOT forms; CONTAINS is case-sensitive contiguous containment for both text and ordered arrays/tuples/vectors/deques, with linear sequence matching.

• **IS predicates** (**supported**) -

  value IS NUMBER, value IS NOT BLANK, value IS EMPTY, value IS ODD, value IS EVEN, value IS PRIME, value IS MULTIPLE OF 5, and domain predicates such as value IS URL.

• **Chained comparisons** (**supported**) -

  0 <= score <= 100.

• **Spaceship operator** (**supported**) -

  A1 <=> B1 returns -1, 0, or 1.

• **Set operators** (**supported**) - `UNION`,

  INTERSECT, EXCEPT.

• **EXCLUDE operator** (**supported**) -

  synonym for EXCEPT.

• **Reduction operators** (**supported**) -

  +/ A1:A10, */ A1:A10, and &/ A1:A10.

• **Broadcast-dot syntax**

  (supported) - SIN.([1, 2, 3]) and ROUND.(values, 2).

• **Domain operators** (**supported**) -

  25 %OF 200 and 100 TO 200.

• **Combinatoric operators**

  (supported) - n CHOOSE k → COMBIN(n, k); n PERMUTE k → PERMUT(n, k); n MULTICHOOSE k → COMBINA(n, k). Bind tighter than *, /, //, and %% (5 * 3 CHOOSE 2 is 5 * COMBIN(3, 2)). Infix CHOOSE is unrelated to the lookup function CHOOSE(index, ...).

• **Finite discrete posterior inference** (**supported**) — named finite-state factor models, explicit observations, exhaustive posterior marginal queries and retained requests through `DISCRETE_POSTERIOR`. Bounded work, impossible-evidence outcomes, reactive input edits and saved-LIR reproduction. See [Finite discrete inference](finite-discrete-inference.md).
• **Uncertainty operator** (**supported**)
  • 100 +/- 5 and 100 +/- measurement_error.

Expressions And Control Flow

• **Function calls** (**supported**) -

  SUM(A1:A3), dotted function names such as Z.TEST(...), and the full generated catalog in functions.md. BIO_OMICS_EMBED_V2(matrix, components, "pca") requires an explicit supported method and positive integer component count; older runtimes refuse this identity. The legacy BIO_OMICS_EMBED retains omitted-method SVD semantics. DNA motif arguments are strings. BOOTSTRAP_ZERO_CURVE.EXACT(...) performs a sequential regular-schedule discount-factor bootstrap; .REPORT(...) adds instrument repricing details. The legacy undotted curve function retains its approximate method.

• **Named arguments** (**supported**) -

  ROUND(3.14159 AS number, 2 AS digits).

• **Conditional expression**

  (supported) - score > 0 THEN "positive" ELSE "non-positive".

• **LET function** (**supported**) -

  LET(x, 2, x + 3).

• **Callable parameters and local

  helpers** (supported) - apply_to(operation, value) = operation(value) accepts statically inferred callable arguments. LET and DO may bind and call local lambdas. Data bindings preserve built-in calls; an already inferred callable binding can shadow a built-in. Unconstrained collisions select the built-in and retain a data-only parameter constraint. Self-application, unknown callable invocation, and escaping callable values are compile errors; callables remain confined to expression scope. See named functions.

• **Bounded early-exit iteration**

  (supported) - ITERATE(seed, bound, step) UNTIL predicate tests the seed and each new state. ITERATE.REPORT adds value, steps, and a :converged/:limit status. The mandatory bound remains at most one million steps; predicates are pure, and Tensor-resident iteration rejects this data-dependent exit. See collections.

• **DO blocks** (**supported**) - multi-line local

  bindings ending in a result expression. Async calls are dependency-aware: independent bindings launch concurrently, AWAIT adds a barrier, DO SYNC serializes async bindings, and the result waits for all active stages.

• **Bounded effect traversal** (**supported**)
  • TRAVERSE applies one effectful named function serially and PAR_TRAVERSE applies it with an explicit concurrency bound. Both preserve source order, enforce collection and concurrency limits before launching work, and fail closed when the function has zero or multiple effect sites.
• **WITH expression** (**supported**) -

  WITH data = HTTP_JSON(url), users = data.results THEN users[1] ELSE BLANK.

• **WHERE clause** (**supported**) -

  total + tax WHERE total = SUM(A1:A10), tax = total * 0.21.

• **USING...AS bindings** (**supported**) -

  total + tax USING total AS SUM(A1:A10), tax AS total * 0.21.

• **UNLESS modifier** (**supported**) -

  amount UNLESS amount = 0.

• **ASSERT guard** (**supported**) -

  value ASSERT value > 0 ELSE #N/A.

• **TRY...THEN...ELSE error

  recovery** (supported) - TRY primary() THEN backup() ELSE "n/a".

• **CASE WHEN expression** (**supported**)
  • CASE WHEN score >= 90 THEN "A" ELSE "F" END.
• **Pattern matching** (**supported**) -

  MATCH(status, "draft" -> :gray, _ -> :red). Error-literal arms match on the subject's error kind without propagating — MATCH(risky, #DIV/0! -> 0, #N/A -> BLANK, _ -> risky).

• **Choice sets** (**supported**) -

  CHOICE status = :green | :amber | :red declares a one-of enum that makes MATCH check exhaustiveness; CHOICES perms = :read | :write | :exec declares a flag set, where perms HAS :read + :write tests membership. Selected syntax inspection retains the authored flag literals and HAS operands even though compilation lowers them to numeric bit operations; those source nodes cannot be rendered as standalone expressions.

• **Algebraic choices** (**supported**) -

  CHOICE Reply = Ok(value: number) | Rejected(reason: string) declares payload-bearing constructors such as Reply.Ok(7). Constructor-pattern MATCH is exhaustive, fields may recursively reference the enclosing type, and nested values are bounded to 64 levels.

• **Generic CHOICE values**

  (supported) - CHOICE Maybe<T> = None | Some(value: T) supports inferred constructors (Maybe.Some(42)), explicit applications (Maybe<number>.None()) and constructor-pattern MATCH through LET, immutable named/cell values, functions and recursive fields. Typed patterns constrain static arguments; runtime values retain schema identity while erasing those arguments. Compiled artifact save/load preserves the contracts. Source-created values now cross typed process inputs, child RUN calls and results, with readable inspection and durable argument recovery. Inspection JSON is data, not a constructor. A compiler resolver can supply installed data-only ops: packages through USE "ops:fixtures/review@1.0.0" AS service or EXPOSING (Draft). Package content pins nominal identity; aliases share it. Owner-only exports admit pattern matching but refuse source construction. Imports require no execution grant and start no owner. Sequential operation exports now have source compilation support and selected internal volatile execution (see team/process declarations); durable recovery, concrete catalogue installation, owner-issued runtime values, remaining refinements and legacy v1 ADT migration remain unfinished. See Algebraic choices.

• **Arrow lambda** (**supported**) -

  x => x * 2, (acc, x) => acc + x.

• **Named trailing blocks** (**supported**)
  • MAP(rows) WITH row DO ... END and REDUCE(0, values) WITH total, value DO ... END lower to the helpers' existing final lambda argument. Also supported by SCAN, ITERATE, BYROW, BYCOL, and MAKEARRAY, with checked parameter arity.
• **LAMBDA function** (**supported**) -

  LAMBDA(x, x + 1). A lambda assigned to a named wire can be called by name, including inside another lambda: F = LAMBDA(x, x + Offset), MAP({1, 2}, LAMBDA(x, F(x))). Calls check arity and use current inputs.

• **Named definitions** (**supported**) -

  DEFINE hypot(a, b) = SQRT(a^2 + b^2) names a reusable, non-recursive helper; the DEFINE keyword is optional (hypot(a, b) = …) and DEF is an accepted synonym. Definitions receive independently inferred principal signatures with fresh per-call polymorphism, open record rows, shared collection protocol constraints, and inferred connector effect rows. Ordinary SUM has a numeric result contract for scalar or array inputs. Parameters shadow imported constants and namespace aliases lexically. Errors retain their normal evaluation behavior. One shared callable body supports direct forward calls and _ partial application in supported callback positions; recursion and storing callable values in cells remain unsupported. See named functions.

• **Named-function reflection**

  (supported) - ARGS(fn), BODY(fn), and FUNCTION(fn) fold at compile time to ordinary Grid values. BODY exposes a normalized, versionable AST shape with exhaustive structural coverage of the expression tree.

• **Named-function calculus**

  (supported) - D(fn, x[, step]) differentiates a named definition using exact autodiff when available and central differences otherwise; INTEGRAL(fn, start, end[, control]) adaptively integrates a one-parameter definition. DERIVATIVE and INTEGRATE are the long-form aliases.

• **Checked state machines** (**supported**) -

  MACHINE generates pure callables with typed events and context, ordered guards, atomic patches, invariants and emitted data. CHECK validates an instance; RESTORE reconstructs or explicitly migrates it. REPLAY and TRACE retain progress and emissions under an explicit rejection policy. Bounded diagnostics identify proven FIRST shadowing, UNIQUE overlaps and coverage gaps. Instances remain explicit values owned by formulas, reducers or rules. See state machines.

• **Pure typed decision tables** (**supported**) -

  DECISION defines an ordinary callable with FIRST, UNIQUE, ANY or ordered COLLECT semantics, immutable captures and lazy selected outputs. Local and imported decisions compose with pure callbacks, structured inputs and machine guards and isolated EVALUATE study cases. A statically bound .REPORT companion explains the same evaluation; comparison and report limits fail explicitly. Row-scoped MATCH subject WITH pattern shares constructor payloads between an optional guard and output, while evaluating the subject once per tested row. Explicit annotations resolve forward and imported CHOICE schemas at admission; bounded diagnostics identify provable coverage gaps, UNIQUE overlaps and unreachable FIRST rows. Unknown coverage retains runtime checks. See decision tables. DMN-to-BPMN routing freezes a scalar decision report into one exclusive native process instance. The explicit DMN importer admits a closed scalar/unary-test profile into the same native callables, with source-row mapping, checked inputs and Option results. DMN 1.5 and 1.6 literal tables can return matching rules in authored or output-priority order and aggregate a single output column. DMN 1.6 literal-expression decisions can share exact Decimal128 results and nullable Booleans through local requirements. One numeric UNIQUE table can select a discount from a preceding decision and pass it into the final amount. A terminal boxed context can return the subtotal, discount and amount due together as a native record. A named DMN decision service can expose the price-to-quote call and encapsulate its intermediate decisions. Linked DMN models can filter and iterate over lists of structured items, invoke knowledge models and resolve named or unnamed imports.

• **Labeled decision and flow reports** (**supported**) -

  LINEAR_PROGRAM.REPORT, MIXED_INTEGER_PROGRAM.REPORT, PORTFOLIO_QP_WEIGHTS.REPORT, and CS_MAX_FLOW.REPORT expose existing solver results and certificates through explicit resident records. See the OR teaching guide.

• **Queue and process simulation definitions** (**supported**) -

  name = SIMULATION(parameters) … END (also SIMULATION name) declares typed entities, recorded/recurring sources, simultaneous patches, finite FIFO/priority queues, patience, atomic multi-pool services, capacity calendars and checked routes. Reusable local/imported FLOW components use explicit ports and resource maps. Reading the definition runs nothing; name.RUN({seed, horizon, …}) is the explicit seeded, bounded run on the native DES engine and name.DEFINITION() is the inert description. Ordinary compiled LIR callbacks keep immutable inputs and independent station/purpose streams. The existing Host experiment owner selects definitions and freezes literal or model-symbol-bound inputs once, expands numeric scenarios/replications and retains original results for verified replay. The Experiments surface exposes named process authoring, replica/cohort statistics and paged original events. Bounded traces expose lossless native entity payload columns through explicit Frame and monitor adapters; incomplete outcomes never become complete replication statistics or absence coverage. See process simulation.

• **Petri nets with atomic selected firing** (**supported**) -

  name = NET(parameters) … END (also NET name) declares count or typed places and atomic transitions. TAKE selects distinct occurrences; READ binds without consumption; dependent COUNT and EACH production retain typed payloads. Subnet PORT/USE mappings explicitly share places. INITIAL, TOKENS, FIRE, bounded paged ENABLED and REPORT are pure. Explicit Host ownership commits revisions and retry receipts through the existing model database. Timed firing and reachability analysis are separate contracts. See Petri nets. The payment settlement owner connects a decision-bound service effect to that wait and confirms compensation of the original effect after timeout. A BPMN receive task can wait for a correlated message or an interrupting timer and recover the winning receipt after restart. The BPMN model editor can rename tasks, move diagram shapes and rebind message flows in supplied models. Embedded BPMN subprocesses transfer tokens across explicit entry and exit transitions. A task can also wait for its designated event consumer to return true. The service-task owner also admits one authorized durable event-channel post with original-receipt recovery, no-effect-only retry and cancellation that retains committed effects. Its query profile binds one task to an authorized read-only PROCESS operation with durable results, explicit retry, cancellation and recovery. The decision-routing profile adds an explicit scalar DMN binding, exclusive split/merge, frozen inputs and source-linked replay. The explicit BPMN importer admits acyclic plain-task/parallel-gateway workflows with source-linked steps, instance cancellation and saved marking/LIR replay.

• **Temporal obligations over correlated events** (**supported**) -

  name = MONITOR ON port AS event … END (also MONITOR name) supports response/absence, counted and distinct goals, PRIOR/UNLESS, sequences, BETWEEN, ORDER and explicit cancellation ties. EVALUATE and REPORT retain pending, satisfied, violated, cancelled or indeterminate outcomes with explicit coverage. Stable envelopes and all-partition progress support an explicitly attached durable Stream continuation; formula reads attach nothing. Finite results expose typed Frames for ordinary queries and COLLECT. See temporal obligations.

• **Dense tensor contractions** (**supported**) -

  EINSUM("ik,kj->ij", lhs, rhs) contracts finite numeric scalars, Lists, arrays and shaped f32/f64 Tensors: permutations, diagonals, reductions, inner/outer products, batching and multi-operand contractions. Exact shaped transport retains arbitrary empty axes. Literal patterns reuse bounded plans; resident CPU handles reuse unchanged input generations and support reverse gradients. Physical units normalize at admission; optional pairwise order validates the full result against explicit tolerances. Cancellation and workspace bounds apply before publication. Named axes never broadcast; ellipsis axes do. EINSUM.REPORT explains the same execution. See tensor contractions.

• **Structural causal models with hard interventions** (**supported**) -

  name = CAUSAL(inputs) … END (also CAUSAL name) declares typed acyclic mechanisms over explicit exogenous inputs. USE preserves component equation identities; qualified INTERVENE targets cut incoming edges without running the replaced equation. BATCH aligns stable-ID rows across scenarios and observation cones. Explicit studies retain actual exogenous draws for replay and Frame publication; reading a definition samples and queues nothing. Pure BATCH results expose typed Frames with stable sample/scenario IDs. GRAPH and REPORT expose the assumed structure and actual evaluation. See causal models.

• **Bounded optimization completion report** (**supported**) -

  BOUNDED_MINIMIZE_N.REPORT(fn, initial, lower, upper[, tolerance, max_iterations]) retains the actual stopping reason, objective at the returned coordinates, evaluation count and a bounded candidate. Read report.parameters to reuse the same solve. Local convergence concerns objective spread, not global optimality or parameter accuracy; ordinary budget-limited calls now fail explicitly. See OR research and teaching.

• **Nonlinear fitting report** (**supported**) -

  CURVE_FIT.REPORT(model, xs, ys, initial[, tolerance, max_iterations]) returns coefficients, residuals, stopping reason, and bounded final-Jacobian rank/conditioning from the existing unweighted solve. Uncertainty is off by default. See the fitting guide.

• **Calendar alignment and aggregate completeness** (**supported**) -

  Economic lags and annual growth use declared calendar periods; missing periods stay missing, invalid/duplicate dates fail explicitly, and resampling discloses completeness or requires complete buckets.

• **Explicit regression inference and term names** (**supported**) -

  REGRESS options select residual-df t, cluster-df t, or normal inference and label coefficients. Results and REGRESS.TABLE disclose covariance corrections, distribution and degrees of freedom.

• **Established binary-response separation** (**supported**) -

  LOGIT.FIT and PROBIT.FIT explain complete separation when a strict linear separating direction is established. Other numerical failures keep their own diagnostics; failure to find a certificate does not establish overlap.

• **Closed parameter bounds for fitting** (**supported**) -

  Explicit lower and upper options select v4 constrained fitting reports. Scalars broadcast; vectors follow parameter order; BLANK omits an endpoint. Equal endpoints fix a parameter. Feasible iterates, exact active limits and projected stationarity are reported, with optional observation weighting. Local covariance intervals explicitly decline for bounds. See the chemistry guide.

• **Seeded parametric fitting uncertainty** (**supported**) -

  Explicit uncertainty:"bootstrap_normal" options request seeded normal-data refits with the authored starts, weights, bounds and solver controls. The v5 report retains every refit, failures, noise scale, percentile limits, spread and bias. Any ineligible refit prevents interval publication; fixed parameters have blank inferred uncertainty. Small, weak and boundary designs can have inaccurate coverage. See the fitting guide and decay example.

• **Weighted fitting and declared observation errors** (**supported**) -

  CURVE_FIT.REPORT accepts weights or standard_deviations in argument seven, with optional matching local_relative or local_known uncertainty. v3 separates raw residuals from the weighted objective and names its error model; v1/v2 remain available. Without explicit bounds parameters remain unconstrained, and local intervals may have poor nonlinear coverage. See the chemistry guide.

• **Derivative method disclosure** (**supported**) -

  DERIVATIVE.REPORT(fn, x, h?) exposes the actual automatic or finite-difference method, value, point, step and fallback reason from one calculation. A finite- difference estimate is not a proof of differentiability. See the applied mathematics guide.

• **Readable ODE report record** (**supported**) -

  ODE_REPORT(fn, initial, start, end, {format: "record", ...}) returns the declared grid.ode.report.v1 schema with the concrete method, completed interval, terminal state, local tolerance controls and numerical work. Omit format or select "row" for the existing numeric row. Publication reuses the same solve and numeric memo payload; reading fields does not integrate again. Units follow the authored model, and local tolerance settings do not establish global accuracy. See the ODE guide.

• **Local nonlinear parameter uncertainty**

  (supported) - An explicit seventh-argument options record {uncertainty: "local_iid", confidence: 0.95} selects local linearized covariance and individual Student-t intervals, estimating a common observation variance from residuals. Rank, degrees of freedom, variance and stationarity eligibility are explicit; unavailable intervals are not replaced by finite defaults. This assumes independent equal-variance normal observation errors and does not establish nonlinear interval coverage for arbitrary models.

• **Named-function sampling**

  (supported) - SAMPLE(fn, coordinates) realizes explicit points; SAMPLE(fn, start, end[, count_or_tolerance]) produces fixed-resolution or adaptive x/y rows whose reactive bounds can be driven by a chart viewport. Multi-parameter families select a varying parameter and bind the others by name; SAMPLE_INFO reports resolution, tolerance, discontinuities, and safety-limit metadata.

• **Partial application** (**supported**) -

  SUM(5, _) produces a lambda when used as a value.

• **Array comprehensions** (**supported**)
  • [x * 2 FOR x IN A1:A10 IF x > 0].
• **Sequence shorthand** (**supported**) -

  1..10, 1..<10, 1..2..10, and date/duration ranges.

• **Exclusive range `..<`** (**supported**) -

  1..<10 excludes the upper bound.

• **Pipe operator** (**supported**) -

  A1 >> ABS() >> ROUND(_, 2). >> and |> share the same insertion and functional-FILTER lowering rules.

• **WITH … DO pipeline** (**supported**) -

  WITH A1 DO FILTER(value => value > 0) THEN SORT(_, -1) >> TAKE(5) — same desugar as >> on _; after DO, steps may be separated by THEN, >>, or |>. Optional ELSE wraps the chain in IFERROR (classic WITH name = … THEN bindings are unchanged).

• **TAP pipeline function**

  (supported) - value >> TAP passes the value through for inspection.

• **Conditional pipeline**

  (supported) - value >> ABS() IF cond desugars to IF(cond, ABS(value), value). Each pipe step may have its own trailing IF; see infix-operators.md.

Function Catalog

The function catalog is the user-callable function reference:

• functions.md lists every built-in function, grouped by category, with signature, return type, aliases, compatibility notes, and external contracts.
• function-compatibility.md lists every canonical name and alias with its compatibility label.

Known task lists retain their bounds through reusable PROCESS parameters and RUN forwarding. See the collection guide.

The Process creation form offers compiler-owned debate and list-review starters. Each opens editable Grid source; saving and starting remain explicit actions.

The API assessment starter selects an installed read and generates an explicit read, SHARE, ASK and structured result. See the mixed-workflow guide.

The private ledger reserve owner now connects admitted compiled-model and native preview checking to atomic reservation/window creation and bounded original-body recovery. Ninety selected behavioral controls pass against its unchanged production compiler libraries, including eight new reserve controls. This adds no grammar, builtin or installed Process capability.

V3 composed submission evidence (2026-10-08)

The local composed Testing selection exercises authored Process source through wallet proposal, imported native intent submission, TLS validators and original-operation recovery. This Testing selection adds no production capability. The fault-path repair returns unavailable room inspection when native resource authority is lost, preserving the original operation outcome. The complete decision/reference composition remains unproven while its production Process installers are missing. Fixture consent and accepted scripted AI output do not establish authenticated human approval or truth.

The native ingress follow-up checks nested issued references against original retained producer bindings. Internal decision/reference declaration builders remain explicitly selected and uninstalled; they add no executable Source imports or new authority.

Selected Host development also derives decision provenance from the original retained Process writer, accepted output and frozen Start, including typed selection inside a closed record/source choice. This binds facts without granting decision membership or replacing human consent; production decision adapters and complete authority admission remain unfinished. A separate native authority component now verifies signed, deployment-pinned decision grants against real Registry certificates, exact policies and explicit source/seat rights. Joining these rights to original accepted Process roles/profiles, guarded keys and complete replicated evidence remains required before production operations can be installed. The selected Host source join now derives source coordinates from the actual retained writer and holds its original deadline together with the native permission. Complete assessment admission and public adapter installation remain unfinished.

Selected native decision ingress now replays original accepted role/profile evidence through the existing native executor and pins the compiled role and full actual responder identity. Staged native ownership replays outside the writer, then rechecks complete original history and fresh permission before attachment. It stops before original operation restoration. A separate native schema/placement join checks admitted exact fact types, canonical bytes and the authenticated native placement mapping against signed seat pins. Current disclosure, decision/input scope, key custody, replicated evidence and public operation installation remain unfinished. A selected quorum-backed scope reader now derives committed decision/input/epoch and seat versions from the actual Raft owner. It adds no public Process operation and does not prove original ASK input delivery or current disclosure permission.

Selected replay now captures the original native argument owner and authenticates retained reference producers outside the Process writer. Fresh attachment checks native capture identity; equal data cannot replace it. Complete decision adapter installation and original AI input delivery remain required before assessment signing and public operation installation.

Selected native replay now joins the exact original DecisionRef to committed scope. The reference must come from the shipped Open producer and assessment ingress; its decision/Open identities match the actual borrowed quorum snapshot and current seat permission. Original AI input delivery, validator disclosure, signing and public adapters remain unfinished. The complete installed positive composition is still unrun.

Selected native decision references now retain their original deployment mapping. The original Open Root/controller freeze network, epochs and immutable input identities in model.db. Replay requires that original association; a replacement deployment cannot silently reinterpret it. A separate committed Open reader also supports human-only decisions and zero AI budgets. Public issuance, original AI input delivery, disclosure/signing and installed composition remain unfinished.

Selected original decision input ownership: selected Open retention now freezes the complete canonical input and original reference mapping atomically in model.db. Native restoration authenticates the original operation and association before creating an immutable material owner. Private scope attachment requires that same owner's physical body in the accepted replay packet and exact committed input/scope equality. Live/replay ContextDelivery installation, public issuance, current validator disclosure, custody, replicated evidence and installed positive composition remain open.

Selected original input projection: private decision assessment now admits the original closed DATA schema, checks the exact existing value codec and retains bounded readable native JSON with exact integer text. The accepted packet must contain both native audit and readable bodies; committed schema/input pins are checked at scope attachment. Live/replay ContextDelivery, public Open issuance, disclosure, signing and complete replicated/installed composition remain unfinished.

Selected original decision Open outcome: native Open scope now supplies its immutable original receipt, published atomically with reference and input. Original journal-authenticated recovery preserves outcome/position and refuses late associations. This adds no public operation installation, finality scheme or live disclosure right. Result issuance and complete live/replicated composition remain unfinished.

Selected Open publication now requires a native retention reservation. The actual pending Root/controller reserves an original slot before dispatch; publication checks both native token and durable row. Slots and legacy references share the bounded quota; timeout, Stop and Drop preserve uncertain originals. This does not install public Open, reserve physical disk, issue results or close live/replicated composition.

Selected Open publication now also requires prepared native issuer capacity for its exact shipped reference, receipt and result types. An owned native token keeps the existing issuer budget through adapter dispatch/inspection without changing value bytes or evaluator semantics. Public issuance, guarded writer ordering and the complete installed workflow remain unfinished.

A selected native issuer writer fence now holds the actual original pending Root writer through durable operation result append, ordering it against Stop. Ordinary journals keep their direct path. Public Open installation, borrowed current Decision permission and full workflow composition remain unfinished.

A private original Open result path now joins actual fenced registry ownership, original outcome and current native source/controller before issuing dependency-ordered references. Receipt identity pins the original outcome/deployment. Public installation and proof of the actual joined invocation remain unfinished.

Native V3 Open recovery now preserves the complete committed command and original signed deployment atomically with its outcome; native issuance requires the same actual deployment. Public producer/adapter installation and complete recovery remain unfinished.

Selected V3 native input production preserves the exact completed Process result and original durable provenance. Public reference issuance and service permission remain separate unfinished work.

Selected V3 native policy/input room-resource production now has a separate pre-Start fence, exact original recovery and whole-plan Open result capacity. Public installation and committed workflow proof remain unfinished.

Selected V3 native Open preparation now freezes the original typed arguments, command, time and deployment before dispatch. Exact recovery preserves that original; Stop or timeout cannot renew authority. Preparation is data, while proof-bearing validator admission and public installation remain unfinished.

Selected native V3 Open source evidence now uses purpose-specific guarded custody and original Process ownership, with immutable original-signature recovery. Validator admission, public operation installation and composed workflow proof remain unfinished.

Selected V3 decision Open replication now verifies complete native source evidence under an independently pinned signed deployment. Original wire bytes are durable before dispatch and retained with the authoritative outcome. Bare commands and unsupported mutations refuse. Local native producer/quorum/issuer composition uses fixture transport and adapter; public installation, Process source acceptance, other mutation proofs and finality remain unfinished.

The selected internal V3 native Open operation installation joins original pre-dispatch evidence, actual application/quorum ownership and the existing Process result acceptance journals. Fresh-only admission refuses recovery instead of reconstructing authority. Public/remote routing, original-only recovery, other mutations and full service evidence remain unfinished.

The internal native decision Open owner also supports original settled Process inspection with no live key, permission renewal, clock read or quorum dependency. Exact original input/result issuance and accepted-source membership are required; pending or Unknown roots still refuse settled replay. Pending/stopped/partial recovery and configured public routing remain unfinished.

The internal native Open owner now admits explicit Resume of already received or accepted original results, restoring original issued identities under the existing successor Root writer claim. Original acceptance deadlines and budgets still apply; unresolved sends and partial issuance remain fenced. Rejected received results also pass native store-reopen Resume/deadline and expired-authority replay controls, preserving the original receipt/result pair and four issued values without signing, network observation or live-clock reads in historical replay. This is internal owner coverage, not public routing.

The internal Open owner also installs explicit stopped original-command lookup through the existing Process operation API. Complete original issued results can be restored after a lost reply. A complete original native outcome also permits finishing a valid partial result prefix under the original issuer budget, current permission, stopped generation and durable lookup attempt. It never signs, resubmits or restarts Source. Missing quorum or native outcome ownership remains Unknown; conflicting prefixes and expired authority refuse. Public routing and full configured-service delivery remains unfinished. Original rejected results can restore their exact receipt/result pair or finish a valid zero/one-value prefix only when the original native rejection publication matches the quorum outcome. Altered or partial publication cannot be reconstructed. Wholly absent publication requires the native original-source/input/reservation completion described below.

The internal native decision Open owner also completes interrupted original local publication after quorum commit, under original input/source/reservation ownership, current permission and stopped-generation/reconciliation-attempt fences. Applied publication is atomic; Rejected retains the original receipt/result identity. Missing, partial or contradictory ownership remains fenced. This introduces no source syntax or public service activation. Full configured-service delivery remains unfinished.

Native known-result Pending recovery now uses the existing Process Resume/Check owner, original authority and issuer budget; stopped reconciliation also retains the original command generation after a successor claim. No language syntax or public activation changes.

Native controller decision preparation now has a quorum-backed state scope and separately selected controller-source replay profile. Authenticated state preconditions survive into durable application; stale candidates retain their original rejection and retries return original receipts. Exact native verifier type/allocation joins preparation to its installed owner. The internal native Open installer now selects this profile and retains its immutable original interpretation through publication, rejection, cold recovery and issued DecisionRef lineage. Controller mutation and compiled-model producers, remaining proof kinds, human consent, other Process installers and configured routing remain required.

The native controller input owner now authenticates original Cancel arguments through the actual pending Root, fenced issuer, issued DecisionRef and applied Open mapping. It attaches only to the native quorum scope and a separate exact Cancel grant. Assessment replay remains assessment-only. The native second-wait fixture refuses Cancel effects; purpose custody, immutable command/source retention, output/recovery installation and configured routing remain required. This is input ownership implementation, not an active author-facing Cancel workflow or full-service completion.

Internal distributed-decision development includes original native Cancel preparation with separate controller-purpose custody and durably frozen command/source/envelope identity. Its preparation-only fixture deliberately refuses dispatch; the selected native installer below connects production application and typed results. Shipped grammar and nominal schemas are unchanged.

Internal distributed-decision development now includes native Cancel application/outcome ownership. The selected native embedding provider below now connects Cancel Start to exact typed results and cold recovery; configured binary deployment remains unfinished. Shipped grammar and nominal schemas are unchanged.

The selected native controller provider now routes Open and Cancel, reserves exact typed Cancel outputs before send, and connects original outcomes to Process result acceptance and cold completion. A public native embedding installer consumes actual admitted application/authority/custody owners and accepted Process input. Configured binary startup, Seal/Decide/workflow receipts and the full-service evidence remain unfinished.

The separately selected workflow-source-v2 profile connects native pure accepted-result Assess, original-assessment Vote, Seal and Decide, with purpose-bound custody and workflow receipts. A dedicated configured host role connects closed startup pins, real TLS/Raft storage, existing encrypted vault custody and native Process HTTP routing. The v1 profile still refuses seat grants/mutations. See the scoped service contract and evidence for exact observed coverage, usage and remaining broader obligations.

The optional native participant-source-v3 profile now accepts replay-verified AgentResponder output with original role/profile provenance. An authored proposal drives the decision vote, and receipt inspection includes the original assessment. Selected schema-2 service startup supports separate authenticated human Process questions/replies and original recovery. Schema-4 selected startup also supports a sole native HumanVote seat with exact authenticated ballot consent, signed approval/ballot evidence and original approval receipts. The authored native consent example uses a retained mock proposal and Open → Authorize → Cast → Seal → Decide. Fresh Root resource admission begins at first binding, rather than installation; recovery preserves original identities and makes no new inference call. Schema-5 mixed-source-v5 adds one Agent and one Human seat: native Agent assessment/vote, authenticated Human ballot consent, then a distinct approval of the exact sealed outcome/effects before Decide. The authored mixed example uses the existing package and Process grammar. Wider rosters and live inference remain separate.

Native reference workflow development cut

The explicitly selected V3 native-reference profile includes scalar/array schema pinning, authenticated exact-consumer disclosure, guarded publication/confirmation signing and root-owned operations through the existing ProcessService. ops:grid/references@1.0.0 retains its opaque snapshot contract. Separately versioned ops:grid/references@1.1.0 returns typed scalar/flat-array DATA for pure REFERENCES getters and installs Manual/Latest/AnyRetained/Pinned bind, refresh and unbind for declared native inputs. Formula evaluation performs no service I/O.

Configured local HTTP routing requires startup-pinned owners, Registry trust, existing vault purposes and authenticated activation before Process service selection. Original inspection, explicit Resume and replay retain original receipts without recapture or renewed authority. See the authored input workflow and implementation contract and proof boundary. Remote transport, rich carriers, Every, Read/Await/Inspect adapters and governed source/bootstrap epoch migration remain separate work. This is a development profile, not a claim that the complete V3 service set is installed.

Configured native decision input now uses the pinned Process and compiled-model result type and the existing exact native DATA admission, rather than a fixed String contract. Selected numbers, booleans, exact integers and closed records preserve original input and recovery ownership. Signed policy/schema pins remain mandatory; pure input cannot claim model-origin rights.

Internal V3 development now includes an explicit configured escrow-service role for the finite no-report T1–T8 application. Source-bound QA drives three actual product processes through authenticated outcome/spending approvals, settlement, finality and accounting, then kills all owners and recovers identical original receipts with zero new AI calls. Inference is mocked. Current shared compiler reconciliation, general composition and the broader operational matrix remain open.

Statistical model and study notation

• **Reusable SOLVE/FIT definitions** (**supported**) — parenthesized headers, local DO scope, ordinary calls, named arguments, partial application, imports and re-exports; immutable captures and strict selected argument checks. See [SOLVE](assignments.md#reusable-solve-definitions) and [FIT](studies.md#reusable-fit-definitions).
• **Named statistical model formulas** (**supported**) — shared column/Table/Frame inputs, numeric transformations, learned category contrasts and explicit interactions, linear/logistic/probit fitting, reactive covariance/confidence and nonlinear fit settings, shared numeric helpers and lexical LET with closed portable prediction, named coefficients and portable nonlinear prediction through imported values, functions, records and dynamic selections. See [Studies](studies.md).
• **Experiment and parameter sweep definitions** (**supported**) — pure EVALUATE also admits random and Latin hypercube bounded local axes (fresh retained acceptance pending); inert Cartesian or zip value/range sweeps, expression-valued settings, named observation formulas, scenario overrides, native simulation controls and seeded replications with quantile Frames, executed explicitly by the existing Host experiment operation. See [Studies](studies.md).
• **Model calibration definitions** (**supported**) — bounded named adjustments, custom scalar objectives, and trajectory squared-error loss with per-target observation errors, expression-valued controls and retained named observations, executed explicitly by the retained Host calibration operation. See [Studies](studies.md).

Nonlinear FIT adds local named parameters, optional bounds, pure prediction formulas, known observation errors and native local/bootstrap uncertainty. Trajectory CALIBRATION ON observations aligns multiple observed series to compiled simulation outputs with exact or linear alignment and retained residuals. See study notation for limits and portable nonlinear prediction.

• **Bounded SOLVE/PLAN diagnosis** (**supported**) —

  explicit investigation budgets, source-mapped constraints/bounds or search events, and separate proof/completion statuses. See assignments.

• **PLAN objective priorities** (**supported**) —

  ordered subsets of omission cost, tardiness cost and makespan, compared as tuples through the existing native search. See assignments.

• **Configured PLAN instances** (**supported**) —

  inert callable definitions with fixed topology and reactive numeric data; explicit model-local solve/publication. See assignments.

• **Keyed SOLVE inputs** (**supported**) — `PARAMETER ... = rows BY key VALUE column` admits complete one- or two-axis numeric data from column records, header matrices, row records, Tables and materialized local Frames. `KEYED.VALUES` exposes the same typed alignment, including shared multiple-column reads. See [keyed parameter inputs](assignments.md#keyed-parameter-inputs).

FOLD literals and PARSE_FOLD support explicit multi-frame parent inheritance, checked per-frame native tables, local editor navigation and parent completion. Fields replace whole values; no folding simulation or inferred geometry. The frame contract documents bounds.

Native variational Poisson problems (supported)

Canonical femRegions JSON admits scalar P1 trial/test integral records, region coefficients and marked boundaries through the existing Poisson FEM owner. Resolve, durable boundary edits and saved-LIR reopen retain native field/residual semantics. The first profile is two-dimensional and dimensionless; general integrands and mixed spaces remain separate work. See the authoring contract.

SBML native kinetic workflows (supported)

The explicit native SBML import tool admits a bounded Level 3 Version 2 Core constant-compartment kinetics profile and emits ordinary REACTIONS source. Amount/concentration binding, fixed species, scoped parameters and kinetic MathML are checked before source generation. Existing native trajectory and fit operations, retained-study definitions, parameter edits and source/LIR reopen compose with that generated definition. Unsupported events, rules, packages and unit conversions refuse. See SBML kinetics.

Native molecular query and transformation workflows (supported)

MOL_MATCH and MOL_TRANSFORM admit bounded explicit-bond SMARTS/SMIRKS patterns through the native molecular owner. Reports retain source/target identity and atom maps; typed products feed existing molecular functions. Input and pattern edits reproduce after source/LIR reopen. Unsupported stereo, recursive and aromatic-transform semantics refuse. See molecular patterns.

Native discrete control composition and response (supported)

CS_LTI and CS_TRANSFER define bounded discrete SISO models. CS_SERIES, CS_PARALLEL and CS_FEEDBACK compose compatible clocks; CS_RESPONSE retains coefficients, explicit initial state, inputs, response and numerical stability across edits and source/LIR reopen. Existing post-update CS_STATE_SPACE_SIM semantics remain intact. See discrete controls.