Add a control port that replaces a running program with a new version of its source

.github/scripts/shared-state/check_shared_state.py

@@ -86,6 +86,7 @@
     ("src/interpreter/mod.rs", "shared cell of `C`"),
     ("src/interpreter/tile_operators/cycle_slot.rs", "shared cell of `Option<Box<T>>`"),
     ("src/interpreter/tile_operators/fanout.rs", "cell of `bool`"),
+    ("src/interpreter/tile_operators/fanout.rs", "shared cell of `usize`"),
     ("src/interpreter/tile_operators/fanout.rs", "shared cell of `Box<dyn TileOperator>`"),
     ("src/interpreter/tile_operators/fanout.rs", "shared cell of `Box<dyn TileOperator>`"),
     ("src/interpreter/tile_operators/mod.rs", "ambient mutable state"),

README.md

@@ -88,6 +88,24 @@ cargo run -- --inspect tests/programs/inner_join/program.cambra
 
 The inspector defaults to port 8080 (`--inspect=9090` to change it). After the program finishes, the process stays alive so you can browse `http://localhost:<port>`; Ctrl+C to exit.
 
+### Control port
+
+Pass `--control` to let a running program be diffed against, and replaced by, a new version of its source. Both endpoints take the new source as the query string or the request body:
+
+```bash
+cargo run -- --control tests/programs/http_greeter/program.cambra
+
+# in another terminal, with the edited program in v2.cambra:
+curl --data-binary @v2.cambra localhost:8081/diff
+curl --data-binary @v2.cambra localhost:8081/update
+```
+
+`/diff` reports how the two versions differ and changes nothing. `/update` replaces the program in place: sockets stay open, every binding whose computation is unchanged keeps running, and a variable whose logic you did edit resumes from the value it was holding. Add `phase=<name>&` before the source to diff somewhere other than the default (`lowered`, `inferred`, `inlined`, `channelized`, `lambda-elim`, `planned`).
+
+An update may change the program's logic freely, add endpoints, and stop serving ones it no longer wants (their addresses then answer 404). A variable may even move to another loop or into a transaction: it keeps its value and starts counting positions in whatever it now iterates. The one thing an update may not do is break continuity of state: a variable the running program is holding a value for must be one the new version declares, at the same type, or the update is refused and the running program is left serving. See [live-update.md](src/ccl/design/live-update.md).
+
+The control port defaults to 8081 (`--control=9090` to change it).
+
 ## License
 
 Apache 2.0 — see [LICENSE](LICENSE).

docs/design.md

@@ -203,6 +203,7 @@ The connections between the layers above and the capabilities Cambra claims:
 - **Incremental views by construction.** Monotone tilings mean live aggregates are maintained, not recomputed. The materializable time-pinned view is the decided form of this — the history substrate is implemented, the transaction-handle read it needs is not yet (the ledger's `txn_kv` pins it).
 - **Verification [Sketched].** A small referentially-transparent core plus a refinement-typed checker means a semantic predicate established at one point composes across the whole program. The machinery exists today; whole-application contracts on top of it are the driving direction.
 - **Validation and program branching [Open].** Referential transparency makes program versions *syntactically comparable with well-defined semantics*, and temporal functional mutation makes state a value over time domains — *branchable and pinnable by construction*. Together they are the substrate for branching a running application — logic and state — exercising the branch under a realistic workload, and diffing behaviour.
+- **Live update [Partial].** A running program can be replaced by a new version of its source over the control port (`--control`): `/diff` reports how the two versions differ, at a pipeline phase the caller picks, and `/update` swaps the program. The new version inherits the running one's sources and sinks, may add to them, and retires a route it stops serving, and inherits the operator behind every `Let` binding whose computation is unchanged; a variable whose logic the edit did touch resumes from the value it held. A variable that moves to another loop, or into or out of a transaction, keeps its value and counts positions in whatever it now iterates. The one refused update is one that cannot take over the state — a variable the new version no longer declares, or declares at a different type. See [live-update.md](/src/ccl/design/live-update.md). Running two versions at once is not implemented.
 - **Observability.** The compilation pipeline preserves a legible chain from source to running state; the web inspector (`--inspect`) serves the CHL AST, the lowered CCL, the operator graph, and live per-producer runtime state for any running program.
 
 ## Feature status at a glance
@@ -221,6 +222,7 @@ The connections between the layers above and the capabilities Cambra claims:
 | `rec` fixpoint bindings | **[Decided]** |
 | Collections-as-functions model | Organizing idea decided; encodings **[Sketched]** |
 | `match` / `case` | Tag dispatch implemented; deeper patterns **[Tentative]** |
+| Live update of a running program (`--control`) | Implemented for logic, endpoint changes, and state resume; running two versions at once is **[Open]** |
 | `while`, floats, imports, classes, exceptions | Absent (see the spec) |
 
 The [spec](chl-spec.md) carries the authoritative per-construct markers; [demo-programs.md](demo-programs.md) maps them to runnable programs and their blockers.

src/ccl/ccl_utils.rs

@@ -1178,6 +1178,55 @@ pub fn free_names_in_value(expr: &Expr) -> HashSet<Name> {
     out
 }
 
+/// Every name free in `expr`, in its term structure **and** inside the
+/// refinement predicates riding its type slots — the set counterpart of
+/// [`is_free`], as [`free_names_in_value`] is of [`is_free_in_value`].
+///
+/// Answers "which bindings does this term read?" for a caller that must decide
+/// something for all of them at once and would otherwise walk the term once per
+/// candidate name. Predicates count because a term can depend on a binding
+/// through one: a refinement is a term in a type position, and a domain
+/// restriction built from it reaches the operator graph.
+///
+/// Self-referential predicates terminate on the same `visited` discipline as
+/// [`count_free`], and the refinement element binder is excluded in type
+/// position for the reason given on [`count_free_in_type_with_visited`].
+pub fn free_names(expr: &Expr) -> HashSet<Name> {
+    fn go(
+        e: &Expr,
+        bound: &mut Vec<Name>,
+        visited: &mut HashSet<PredicateId>,
+        out: &mut HashSet<Name>,
+    ) {
+        e.walk_type_slots(|ty| {
+            walk_refined_predicates(ty, visited, &mut |pred, vis| {
+                // A binder's declared type sits in the enclosing scope, so the
+                // predicate is walked under the binders in force *here*.
+                let mut inner = HashSet::new();
+                go(pred, bound, vis, &mut inner);
+                out.extend(inner.into_iter().filter(|n| !n.is_elem()));
+            });
+        });
+        for_each_scoped_item(e, &mut |item| match item {
+            ScopedItem::VarRef(n) => {
+                if !bound.contains(n) {
+                    out.insert(n.clone());
+                }
+            }
+            ScopedItem::KeyRef(_) => {}
+            ScopedItem::Child { expr, binders } => {
+                let depth = bound.len();
+                bound.extend(binders.iter().map(|b| b.name.clone()));
+                go(expr, bound, visited, out);
+                bound.truncate(depth);
+            }
+        });
+    }
+    let mut out = HashSet::new();
+    go(expr, &mut Vec::new(), &mut HashSet::new(), &mut out);
+    out
+}
+
 /// Value-only worker for [`is_free_in_value`]: the same fold over
 /// [`crate::ccl::scope::for_each_scoped_item`] as [`count_free`], minus the type
 /// slots (so a refinement on a `Lambda` param — which lives in the type — is