MTK

The rule is one Trident edit. The engineer adds a TaggedOut member and one branch to the cranes module. Each limit is a measure that carries its unit, so 2L/h compares only with another flow rate.

enum CraneStatus { Ready = 1, Watch = 2, TaggedOut = 3 }

const measure watchLeak = 0.5L/h:volumetricFlow
const measure tagOutLeak = 2L/h:volumetricFlow

CraneStatus statusFor(measure leak) {
    if (leak > tagOutLeak) {
        return CraneStatus.TaggedOut
    }
    if (leak > watchLeak) {
        return CraneStatus.Watch
    }
    return CraneStatus.Ready
}

The compiler checks every screen at once. The tablet's badge function still branches on only Ready and Watch, so the build stops at that when and names the missing member. A status no screen handles never reaches a crew.

$ tri --test craneinspect
craneinspect/a/cranes/badge.tri:2:12: refused [S.when] an enum `when` names every live member of its enum, and no arm names `TaggedOut`
  2 |     return when (status) {
    |            ^^^^^^^^^^^^^^^
tri: falseStart: compile
tri: 1 refusal in craneinspect
tri: test: a/cranes/_test/status.tri: refused

Named cases pin the rule. A source test sits in an _test/ folder beside the module it checks, and the comment at its top lists typed cases. tri --test runs main once per case against the same compiled program, and the test never ships.

#{
  u16 schemaVersion = 1
  chest[] cases = [
    {
      text name = "dry crane is ready"
      chest arguments = { measure leak = 0L/h:volumetricFlow, text expected = "Ready" }
    },
    {
      text name = "slow seep is watched"
      chest arguments = { measure leak = 1.2L/h:volumetricFlow, text expected = "Watch" }
    },
    {
      text name = "fast leak is tagged out"
      chest arguments = { measure leak = 2.4L/h:volumetricFlow, text expected = "TaggedOut" }
    }
  ]
}
bool main(measure leak, text expected) {
    cranes.rules.CraneStatus status = cranes.rules.statusFor(leak)
    assert (status.name() == expected, "crane status for leak rate")
    return true
}

The launch checks the program's reach against its grant. The compiler lists every library the program calls. The yard service's grant revokes outbound HTTP and process launch. A later edit that tries to call out stops at launch with a named refusal.

# _grant/grant.draft
# The yard service answers requests and calls out to nothing.
u16 schemaVersion = 1
text[] revoke = ["t.net.http", "t.proc"]

The same source runs on both devices. The crew tablet runs it under tri with a window and shows the color badgeFor returns. The yard service runs it under tri --headless and answers the berth planner through a declared endpoint, whose parameters the runtime checks against their types before the handler runs.

listener({ port = 8080 })

on request({
    method = "GET"
    pattern = "/cranes/{id}/status"
    parameters = [
        { name = "id", source = "path", typeSpelling = "u32" },
        { name = "leak", source = "query", typeSpelling = "measure" }
    ]
}, const p) {
    u32 crane = p.id
    measure leak = p.leak
    cranes.rules.CraneStatus status = cranes.rules.statusFor(leak)
    chest body = { f64 crane = f64(crane), text status = status.name() }
    return t.net.http.serve.json(200, [], body)
}