@dtmd/temper 0.0.18 → 0.0.19

package/dist/src/declarations.js

@@ -69,13 +69,24 @@ function clauseRow(clause, kind) {
         count: predicate.key === "count"
             ? { min: predicate.args?.min ?? 0, max: predicate.args?.max ?? Number.MAX_SAFE_INTEGER }
             : undefined,
-        target: predicate.key === "membership" ? predicate.target : undefined,
+        // The requirement-name column `membership`'s allowed-value target and
+        // `reached-from`'s closure roots share — one naming scheme for "the requirement
+        // whose satisfiers this clause reads" (`src/contract.rs` `predicate_from_row`).
+        target: predicate.key === "membership" || predicate.key === "reached-from"
+            ? predicate.target
+            : undefined,
         degree: predicate.key === "degree"
             ? {
                 incoming: edgeBoundArgs(predicate.args, "incoming"),
                 outgoing: edgeBoundArgs(predicate.args, "outgoing"),
             }
             : undefined,
+        // The by-incidence field set rides its own shared column, not the direction-only
+        // `degree` bound — the slot `reached-from`'s via set joins it. Copied into a
+        // fresh array: the predicate's set is read-only, the row's column is not.
+        fields: (predicate.key === "degree" || predicate.key === "reached-from") && predicate.fields
+            ? [...predicate.fields]
+            : undefined,
         gate: predicate.key === "mention-reachable" ? predicate.gate : undefined,
         value_type: predicate.key === "type" && predicate.value_type ? [...predicate.value_type] : undefined,
         shape: predicate.key === "shape" ? predicate.shape : undefined,
@@ -106,17 +117,18 @@ function clauseRow(clause, kind) {
     };
 }
 /**
- * The `field` column for one predicate: the field it names, or — for the two
- * predicates that name a *section* rather than a field — an identity synthesized
- * from the arguments the row already carries.
+ * The `field` column for one predicate: the field it names, or — for the four
+ * predicates that name a *section*, a field *set*, or a *requirement* rather than a
+ * field — an identity synthesized from the arguments the row already carries.
  *
- * `section_contains` and `require_sections` set no `field`, and the column is what
- * emit stamps a clause's label from (`stamp_clause_label`, `src/drift.rs`), so
- * reading `Predicate.field` folds every clause of either predicate on one kind
- * into one label — two rows wearing one label, which admissibility refuses as a
- * malformed lock. Synthesizing here keeps the whole fix at the lowering: the Rust
- * reader reconstructs both predicates from the `section`/`sections` columns and
- * never from this one, so nothing round-trips through the synthesized text.
+ * `section_contains`, `require_sections`, `degree` and `reached-from` set no `field`,
+ * and the column is what emit stamps a clause's label from (`stamp_clause_label`,
+ * `src/drift.rs`), so reading `Predicate.field` folds every clause of one of those
+ * predicates on one kind into one label — two rows wearing one label, which
+ * admissibility refuses as a malformed lock. Synthesizing here keeps the whole fix at
+ * the lowering: the Rust reader reconstructs all four predicates from the
+ * `section`/`sections`/`fields`/`target` columns and never from this one, so nothing
+ * round-trips through the synthesized text.
  */
 function clauseField(predicate) {
     if (predicate.key === "section_contains") {
@@ -128,6 +140,31 @@ function clauseField(predicate) {
         // set it is and two different heading lists cannot fold to one label.
         return predicate.sections?.join("+");
     }
+    if (predicate.key === "degree") {
+        // A `degree` clause names no field of its own: its by-incidence filter is what
+        // distinguishes two bounds on one kind, so the filter is the segment — sorted and
+        // `+`-joined by the rule directly above, so two field lists spelling one set land
+        // one address and two different sets never fold to one. An unfiltered bound adds
+        // no segment: it ranges over every edge at the member, so two of them on one kind
+        // are a redundancy the author collapses, never a distinction an address must hold.
+        return predicate.fields === undefined ? undefined : [...predicate.fields].sort().join("+");
+    }
+    if (predicate.key === "reached-from") {
+        // A `reached-from` clause names no field either: its identity is the pair it walks.
+        // The roots requirement leads, and a declared via set follows after a `.` — the
+        // two-argument `section_contains` precedent — sorted and `+`-joined by `degree`'s
+        // rule directly above. So two closures rooted at one requirement over different
+        // arcs land two addresses instead of folding into one, and two spellings of one via
+        // set land one. An unfiltered closure adds no second segment: the roots are its
+        // whole identity, and two of them on one kind are a redundancy the author
+        // collapses.
+        const { target } = predicate;
+        if (target === undefined)
+            return undefined;
+        return predicate.fields === undefined
+            ? target
+            : `${target}.${[...predicate.fields].sort().join("+")}`;
+    }
     return predicate.field;
 }
 /** `min_len`/`max_len`/`extent`'s scalar bound off their shared `min`/`max`
@@ -267,6 +304,16 @@ function collectionAddressRow(facts) {
         entry_shape: facts.collectionAddress.entryShape,
     };
 }
+/**
+ * Lower a kind's exhaustive leaf-set witness into the row's `leaves` column: the
+ * witness's own keys, in the order its author declared them (`kind.ts`'s `LeafSet`,
+ * decision 0053 — the type is the declaration, and TypeScript erases it, so the record is
+ * how the corpus hands the key set over). `undefined` for a kind declaring no witness, so
+ * its row omits the column.
+ */
+function leafSetRow(leaves) {
+    return leaves === undefined ? undefined : Object.keys(leaves);
+}
 /**
  * One kind's fact row — an `at` locus supplies `governs_root`/`governs_glob` and any
  * other locus neither (a nested-file kind's path composes from its host's unit and the
@@ -274,7 +321,8 @@ function collectionAddressRow(facts) {
  * A file locus's `commitment` class rides the same spelling, absent for the committed
  * default. `templates` names the embedded kinds the corpus admits over it, and `content`
  * lowers a declared layout (absent for a `file`-content kind). A registration kind
- * extends the row with its `shape` marker and `collection_address`. Advisory
+ * extends the row with its `shape` marker and `collection_address`. A declared leaf-set
+ * witness lowers to `leaves` ([`leafSetRow`]), absent for a kind declaring none. Advisory
  * `guidance`/`cite` pair rides alongside, locus-optional so an embedded kind's own
  * counsel reaches the lock the same way a nested-file kind's already does (decision
  * 0045) — callable for any locus; [`kindFactKindsInPlay`] decides which embedded kinds
@@ -294,6 +342,7 @@ function kindFactRow(facts, admissions) {
         templates: templatesFor(facts, admissions),
         content: contentRow(facts.content),
         shape: facts.shape,
+        leaves: leafSetRow(facts.leaves),
         collection_address: collectionAddressRow(facts),
         guidance: facts.guidance,
         cite: facts.cite,
@@ -436,13 +485,20 @@ function atLocusKindsInPlay(allKinds) {
 /**
  * The distinct kinds in play that take a kind-fact row: every non-embedded locus
  * unconditionally (a nested-file kind owns a file the engine must place, and places it
- * off its row, though it governs no glob to be discovered at), plus an embedded kind
- * only when it declares `guidance` or `cite` of its own (decision 0045) — an embedded
- * kind with neither has nothing for the row to carry, and its members already reach the
- * corpus through their host's `templates` column alone (`kindsInPlay`), never the row.
+ * off its row, though it governs no glob to be discovered at), plus an embedded kind that
+ * has something of its own for a row to carry: `guidance` or `cite` (decision 0045), or a
+ * declared leaf set (decision 0053). The leaf set is on this list for the reason the
+ * column exists — it teaches what a child carries *before* the surface holds a member of
+ * it, and an embedded kind taking no row never reaches the lock to teach it. An embedded
+ * kind declaring none of the three has nothing for the row to carry, and its members
+ * already reach the corpus through their host's `templates` column alone (`kindsInPlay`),
+ * never the row.
  */
 function kindFactKindsInPlay(allKinds) {
-    return allKinds.filter((facts) => facts.locus.kind !== "embedded" || facts.guidance !== undefined || facts.cite !== undefined);
+    return allKinds.filter((facts) => facts.locus.kind !== "embedded" ||
+        facts.guidance !== undefined ||
+        facts.cite !== undefined ||
+        facts.leaves !== undefined);
 }
 /** The requirement rows — assembly `require` and every member's `requires`, one namespace. */
 function requirementRows(harness) {
@@ -611,6 +667,27 @@ function includeRows(harness) {
     }
     return rows;
 }
+/**
+ * The `input` rows — every member's declared inputs, in member-then-authored order.
+ * Each carries the declaring member's `kind:name` address and the input's path resolved
+ * against the stating module ({@link fileURLToPath} over the input's own `moduleUrl`),
+ * never the workspace — exactly as an include's is; the engine reads and fingerprints
+ * it, and splices nothing.
+ *
+ * Unlike an include, an input pairs with no body slot, so nothing downstream depends on
+ * this order — the authored one is kept anyway, so a re-emit is byte-stable and the
+ * author reads their own declarations back.
+ */
+function inputRows(harness) {
+    const rows = [];
+    for (const member of harness.members) {
+        const address = hostAddress(member.kind, member.name);
+        for (const declared of member.inputs) {
+            rows.push({ member: address, source_path: fileURLToPath(new URL(declared.path, declared.moduleUrl)) });
+        }
+    }
+    return rows;
+}
 /**
  * One composed embedded value's key in an {@link EdgePlacements} table — its host's
  * `kind:name` address plus the value's own kind and key, the same triple the
@@ -891,6 +968,15 @@ export function compileDeclarations(harness, placements, extents) {
             clauses.push(clauseRow(clause, binding.kind.key));
         }
     }
+    // The root member's own clauses — the third source of a clause row, beside `expect`'s
+    // kind-keyed rows and a requirement's nested ones. They lower with **no** `kind`
+    // column: that absence at the top level is the discriminator
+    // `compose::root_contract_from_rows` reads, and `drift::stamp_clause_labels` addresses
+    // them under the `root` owner segment. Declaration order within the array, appended
+    // past the kind-sorted `expect` rows — a fixed position, so double emit is byte-stable.
+    for (const clause of harness.contract) {
+        clauses.push(clauseRow(clause, undefined));
+    }
     return {
         kinds: kindFactKindsInPlay(allKinds).map((facts) => kindFactRow(facts, admissions)),
         clauses,
@@ -899,6 +985,7 @@ export function compileDeclarations(harness, placements, extents) {
         satisfies: satisfiesRows(harness),
         mentions: mentionRows(harness),
         includes: includeRows(harness),
+        inputs: inputRows(harness),
         nested_members: nestedMemberRows(harness, admissions, mentionScope(harness), placements, extents),
         registrations: [...registrationRows(harness), ...tapHookRows(harness)],
         settings: settingsRows(harness),

package/dist/src/generated/ClauseRow.d.ts

@@ -38,10 +38,11 @@ export type ClauseRow = {
      */
     label?: string;
     /**
-     * The kind whose contract carries the clause. `None` when this row is nested
-     * inside a [`RequirementRow`]'s own [`clauses`](RequirementRow::clauses) — a
-     * requirement's set-scope demand names no kind of its own; it ranges over
-     * whatever kind the requirement's own row already carries.
+     * The kind whose contract carries the clause. `None` has two homes, distinguished
+     * by nesting rather than by a second column: inside a [`RequirementRow`]'s own
+     * [`clauses`](RequirementRow::clauses) it is the requirement's set-scope demand,
+     * ranging over whatever kind the requirement's own row already carries; at the top
+     * level it is the **root member's** clause, ranging over the whole governed forest.
      */
     kind?: string;
     /**
@@ -78,14 +79,28 @@ export type ClauseRow = {
      */
     count?: CountBoundRow;
     /**
-     * The `membership` clause's target requirement name, when the predicate is
-     * `membership`.
+     * The **requirement name** whose satisfiers a clause reads its second selection
+     * from — two owners, one naming scheme: `membership`'s allowed-set source and
+     * `reached-from`'s closure roots. Both ask the same question of the same column
+     * ("which requirement's satisfiers?"), so a second column would be the residue
+     * class ([`crate::contract::predicate_from_row`] decodes either from here).
      */
     target?: string;
     /**
      * The `degree` clause's in/out edge-count bound, when the predicate is `degree`.
      */
     degree?: DegreeBoundRow;
+    /**
+     * The **field set** a by-incidence clause filters its selection to — `degree`'s
+     * bound and `reached-from`'s via set (`specs/decisions/0056-…`). Shared rather
+     * than nested inside [`DegreeBoundRow`] because the filter is the *clause's*, not
+     * either direction's, and the two consumers name one concept: a lock spelling it
+     * twice would be the residue class.
+     *
+     * Absent ⇒ unfiltered, so no committed lock row moves when a clause declares no
+     * filter.
+     */
+    fields?: Array<string>;
     /**
      * The `mention-reachable` clause's **target-side gate field**, when the predicate
      * is `mention-reachable`. The one predicate taking two field arguments: its

package/dist/src/generated/Declarations.d.ts

@@ -1,6 +1,7 @@
 import type { AssemblyFactRow } from "./AssemblyFactRow.js";
 import type { ClauseRow } from "./ClauseRow.js";
 import type { IncludeRow } from "./IncludeRow.js";
+import type { InputRow } from "./InputRow.js";
 import type { KindFactRow } from "./KindFactRow.js";
 import type { MentionRow } from "./MentionRow.js";
 import type { NestedMemberRow } from "./NestedMemberRow.js";
@@ -65,6 +66,13 @@ export type Declarations = {
      * declaration table, so a lock round-trip reads it empty).
      */
     includes: Array<IncludeRow>;
+    /**
+     * The members' declared inputs — the files their claims rest on. Seam-inbound
+     * like `includes`: `emit` resolves and fingerprints each as an `input` source
+     * dependency without moving a byte into any projection, so a lock round-trip reads
+     * this family empty.
+     */
+    inputs: Array<InputRow>;
     /**
      * The host members' declared embedded-member facts — captured as declaration
      * rows rather than a second copy the engine reads back off the rendered fence

package/dist/src/generated/InputRow.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One **declared input** the SDK declares — a file the member's claims rest on, and the
+ * member that rests on it. Its own type, not a reuse of [`IncludeRow`]: an include's
+ * path pairs positionally with a body slot, an input's moves nothing, and two concepts
+ * sharing two columns are still two concepts.
+ *
+ * A seam-inbound row only, the same posture an include takes: `emit` resolves it against
+ * disk ([`resolve_source_dependency`]) and lowers it to a fingerprinted `input` source
+ * dependency — this row itself never reaches the lock. Nothing is spliced and no byte
+ * moves, so the target is never decoded and a binary input is legal.
+ */
+export type InputRow = {
+    /**
+     * The declaring member's own `kind:name` address.
+     */
+    member: string;
+    /**
+     * The input's SDK-resolved absolute path.
+     */
+    source_path: string;
+};

package/dist/src/generated/InputRow.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/src/generated/KindFactRow.d.ts

@@ -73,6 +73,18 @@ export type KindFactRow = {
      * take, so a body-bearing kind's row stays byte-identical.
      */
     shape?: string;
+    /**
+     * The kind's **leaf set** — the leaf names a member of it carries, derived at emit
+     * from the member value type the SDK knows, never authored twice (decision 0053).
+     * Empty for a kind whose declaration carries none, the same tolerant round-trip
+     * [`registration`](KindFactRow::registration) takes, so a committed lock written
+     * before the column existed re-reads byte-identically.
+     *
+     * The declaration a read verb renders where the surface holds no member yet: the
+     * type is the declaration, so a present set outranks the union of what members
+     * carry today.
+     */
+    leaves?: Array<string>;
     /**
      * The declared **collection address** — for a registration member surfacing inside a
      * host manifest, which manifest and which key path it keys at. Absent for a

package/dist/src/generated/index.d.ts

@@ -15,6 +15,7 @@ export type { FeatureValue } from "./FeatureValue.js";
 export type { Features } from "./Features.js";
 export type { FencedBlock } from "./FencedBlock.js";
 export type { IncludeRow } from "./IncludeRow.js";
+export type { InputRow } from "./InputRow.js";
 export type { KindFactRow } from "./KindFactRow.js";
 export type { LayoutRegionRow } from "./LayoutRegionRow.js";
 export type { LayoutRow } from "./LayoutRow.js";

package/dist/src/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * temper's authoring face — the six-noun core as a typed module library.
  * A harness author imports plain nouns — `harness()`, the generic `kind`
- * constructor, the clause and requirement constructors, `needs`, and the three
+ * constructor, the clause and requirement constructors, `needs`, and the four
  * prose constructors — and composes members as typed values. `emit` compiles the
  * whole into the declaration rows and the projected members' erased payload —
  * the JSON pipe printed to stdout; the engine is the sole compiler of every
@@ -13,15 +13,16 @@
  * the `./claude-code` subpath, never here.
  */
 export type { Blocks, File, Include, Mention, Mentionable, Prose, Reference, Text } from "./prose.js";
-export { blocks, file, include, mentionOf, renderText, text } from "./prose.js";
+export { blocks, file, include, mentionOf, renderText, span, text } from "./prose.js";
 export type { Capability } from "./needs.js";
 export { bash, capability, permissionUnion } from "./needs.js";
 export type { Charset, Clause, ExtentUnit, Predicate, Requirement, Severity, Verifier } from "./contract.js";
-export { allowedChars, clause, closedKeys, count, degree, deny, enumOf, extent, forbiddenKeys, formatPlacesEdges, globValid, maxLen, membership, mentionReachable, minLen, mustDefine, nameMatchesDir, optional, range, required, requireSections, requirement, script, sectionContains, shape, telemetry, type, unique, uniqueName, when, } from "./contract.js";
-export type { CollectionAddress, EdgeField, EdgeTargetFacts, EmbeddedMemberCollectionEntry, EmbeddedMemberValue, Format, KindDefinition, KindFacts, KindOptions, KindRelocation, Layout, LayoutRegion, Locus, Member, MemberInit, Registration, ResolvedEmbeddedMemberCollectionEntry, ResolvedEmbeddedMemberValue, Shape, Template, UnitShape, } from "./kind.js";
+export { allowedChars, clause, closedKeys, count, degree, deny, enumOf, extent, forbiddenKeys, formatPlacesEdges, fresh, globValid, locusDeclared, maxLen, membership, mentionReachable, minLen, mustDefine, nameMatchesDir, optional, range, reachable, reachedFrom, required, requireSections, requirement, script, sectionContains, shape, telemetry, type, unique, uniqueName, when, } from "./contract.js";
+export type { CollectionAddress, EdgeField, EdgeTargetFacts, EmbeddedMemberCollectionEntry, EmbeddedMemberValue, Format, Input, KindDefinition, KindFacts, KindOptions, KindRelocation, Layout, LayoutRegion, LeafSet, Locus, Member, MemberInit, Registration, Residue, ResolvedEmbeddedMemberCollectionEntry, ResolvedEmbeddedMemberValue, Shape, Template, UnitShape, } from "./kind.js";
 export { embeddedMemberValue, kind, relocate } from "./kind.js";
+export { input } from "./kind.js";
 export type { Admission, EnforcementMode, ExpectBinding, Harness } from "./assembly.js";
-export { harness } from "./assembly.js";
+export { harness, rootDefaultContract } from "./assembly.js";
 export type { EdgeTarget, EmbeddedTarget, EmitResult, RegistrationFact, ResolveOptions, SettingsResidue, } from "./emit.js";
 export { emit } from "./emit.js";
 export type { Dial, DialEntry } from "./dial.js";

package/dist/src/index.js

@@ -1,7 +1,7 @@
 /**
  * temper's authoring face — the six-noun core as a typed module library.
  * A harness author imports plain nouns — `harness()`, the generic `kind`
- * constructor, the clause and requirement constructors, `needs`, and the three
+ * constructor, the clause and requirement constructors, `needs`, and the four
  * prose constructors — and composes members as typed values. `emit` compiles the
  * whole into the declaration rows and the projected members' erased payload —
  * the JSON pipe printed to stdout; the engine is the sole compiler of every
@@ -12,10 +12,14 @@
  * The first-party Claude Code provider face — the built-in kinds — lives at
  * the `./claude-code` subpath, never here.
  */
-export { blocks, file, include, mentionOf, renderText, text } from "./prose.js";
+export { blocks, file, include, mentionOf, renderText, span, text } from "./prose.js";
 export { bash, capability, permissionUnion } from "./needs.js";
-export { allowedChars, clause, closedKeys, count, degree, deny, enumOf, extent, forbiddenKeys, formatPlacesEdges, globValid, maxLen, membership, mentionReachable, minLen, mustDefine, nameMatchesDir, optional, range, required, requireSections, requirement, script, sectionContains, shape, telemetry, type, unique, uniqueName, when, } from "./contract.js";
+export { allowedChars, clause, closedKeys, count, degree, deny, enumOf, extent, forbiddenKeys, formatPlacesEdges, fresh, globValid, locusDeclared, maxLen, membership, mentionReachable, minLen, mustDefine, nameMatchesDir, optional, range, reachable, reachedFrom, required, requireSections, requirement, script, sectionContains, shape, telemetry, type, unique, uniqueName, when, } from "./contract.js";
 export { embeddedMemberValue, kind, relocate } from "./kind.js";
-export { harness } from "./assembly.js";
+// Inputs — the files a member's claims rest on, fingerprinted by the lock and moved
+// nowhere. A member-grain declaration, not a word in a body, so it rides here rather
+// than on the prose line.
+export { input } from "./kind.js";
+export { harness, rootDefaultContract } from "./assembly.js";
 export { emit } from "./emit.js";
 export { dial, dialDefaultContract } from "./dial.js";

package/dist/src/kind.d.ts

@@ -137,6 +137,24 @@ export interface Layout {
  * {@link Layout}.
  */
 export type Shape = "fields";
+/**
+ * A kind's **leaf-set witness** — the leaf names a member of the kind carries, handed
+ * over by the kind's own typed surface `T` (decision 0053). The type is the declaration:
+ * nothing here is a second schema to keep in step with `T`, because the record's keys
+ * *are* `keyof T`. It exists at all because TypeScript erases `T` at the seam, so the
+ * set the compiler knows has to reach emit as a runtime value.
+ *
+ * The record is **exhaustive** — `-?` strips optionality, so omitting one key of `T` is a
+ * compile error and a key that is not `T`'s own is one too. That binding is what keeps
+ * the witness from degrading into the free-hand leaf schema the decision rejected: a
+ * partial set is unwritable rather than merely discouraged.
+ *
+ * Key order is the order the lowered row carries (`declarations.ts`), so a kind's leaves
+ * read in the order its author declared them.
+ */
+export type LeafSet<T extends object> = {
+    readonly [K in keyof T]-?: true;
+};
 /**
  * A registration member's **collection address** — where inside a host manifest its
  * registration surfaces: which `manifest` (`settings.json`, `.mcp.json`) and which
@@ -168,8 +186,15 @@ export interface Template {
     /** Where a file child's unit sits, relative to the parent's unit; absent for an embedded layer. */
     readonly path?: string;
 }
-/** The seven facts of a kind's runtime residue. */
-export type KindFacts = {
+/**
+ * The seven facts of a kind's runtime residue, plus the derived {@link LeafSet} witness
+ * its typed surface hands over. `T` is that surface — the interface the kind's
+ * constructor is generic over. It defaults to an erased `Record<string, unknown>`, so
+ * every signature that only ever *reads* a facts value (`declarations.ts`'s lowering,
+ * {@link Member}, {@link KindDefinition}) names `KindFacts` bare and no call site
+ * re-spells a type argument.
+ */
+export type KindFacts<T extends object = Record<string, unknown>> = {
     /** Fact 1, label — the compiled debug label findings speak; the kind's name. */
     readonly name: string;
     /** The declared provider authority, when the kind qualifies by one. */
@@ -225,6 +250,11 @@ export type KindFacts = {
     /** Fact 7, template — one {@link Template} per inner layer of nested members the kind
      * hosts; absent for a kind that nests nothing. */
     readonly templates?: readonly Template[];
+    /** The kind's **leaf set**, witnessed exhaustively over its own typed surface and
+     * lowered to the row's `leaves` column at emit ({@link LeafSet}, decision 0053) —
+     * what a read verb renders where the surface holds no member of the kind yet.
+     * Absent for a kind whose constructor declares no witness. */
+    readonly leaves?: LeafSet<T>;
     /** Advisory authoring counsel for the kind as a whole — teaching at authoring time via
      * `schema` hover or `explain`, carrying no predicate or severity (decision 0045). */
     readonly guidance?: string;
@@ -283,6 +313,11 @@ export type KindFacts = {
     /** Fact 7, template — one {@link Template} per inner layer of nested members the kind
      * hosts; absent for a kind that nests nothing. */
     readonly templates?: readonly Template[];
+    /** The kind's **leaf set**, witnessed exhaustively over its own typed surface and
+     * lowered to the row's `leaves` column at emit ({@link LeafSet}, decision 0053) —
+     * what a read verb renders where the surface holds no member of the kind yet.
+     * Absent for a kind whose constructor declares no witness. */
+    readonly leaves?: LeafSet<T>;
     /** Advisory authoring counsel for the kind as a whole — teaching at authoring time via
      * `schema` hover or `explain`, carrying no predicate or severity (decision 0045). */
     readonly guidance?: string;
@@ -341,6 +376,11 @@ export type KindFacts = {
     /** Fact 7, template — one {@link Template} per inner layer of nested members the kind
      * hosts; absent for a kind that nests nothing. */
     readonly templates?: readonly Template[];
+    /** The kind's **leaf set**, witnessed exhaustively over its own typed surface and
+     * lowered to the row's `leaves` column at emit ({@link LeafSet}, decision 0053) —
+     * what a read verb renders where the surface holds no member of the kind yet.
+     * Absent for a kind whose constructor declares no witness. */
+    readonly leaves?: LeafSet<T>;
     /** Advisory authoring counsel for the kind as a whole — teaching at authoring time via
      * `schema` hover or `explain`, carrying no predicate or severity (decision 0045). */
     readonly guidance?: string;
@@ -348,6 +388,31 @@ export type KindFacts = {
      * carried as data. */
     readonly cite?: string;
 };
+/**
+ * A **declared input** — a file the member's claims rest on, fingerprinted by the lock
+ * and moved nowhere (`specs/model/authoring.md`, "The SDK"). The path resolves against
+ * the stating module ({@link moduleUrl}), never the workspace — the same anchor
+ * `include()` and a `file()` body take.
+ *
+ * It lives here rather than beside the prose references it rhymes with: an input rides
+ * no text span and pairs with no body slot, so it is a member-grain framework key, not a
+ * word in a body. When the input's bytes move, the member's own freshness finding routes
+ * the author to re-verify the claims *before* re-emitting — temper never judges whether
+ * the claim still holds, only names the place to look.
+ */
+export interface Input {
+    readonly kind: "input";
+    /** Path to the input, resolved against {@link moduleUrl}. */
+    readonly path: string;
+    /** The declaring module's own `import.meta.url` — what {@link path} resolves against. */
+    readonly moduleUrl: string;
+}
+/**
+ * Declare a file a member's claims rest on — the lock fingerprints it and no byte
+ * reaches the projection. The path resolves against the stating module, so the call is
+ * `input(import.meta.url, "./schema.json")`.
+ */
+export declare function input(moduleUrl: string, path: string): Input;
 /**
  * One authored member — a typed value in the library. Kind identity travels by
  * import (`facts`), never by string; the
@@ -373,8 +438,27 @@ export interface Member {
     readonly requires: Readonly<Record<string, Requirement>>;
     /** The capabilities the member's behavior uses — the permission union's source. */
     readonly needs: readonly Capability[];
+    /** The files this member's claims rest on — fingerprinted, never moved. */
+    readonly inputs: readonly Input[];
 }
-/** The init a kind constructor takes — the framework keys plus the kind's typed fields `T`. */
+/**
+ * The bag a surface `T` declares its {@link RESIDUE_KEY} channel as — the keys `T` does
+ * *not* type, and only those. The two halves partition the format's key space, so a key
+ * in both is a mis-spelling rather than an override: open by key, then narrowed against
+ * `keyof T`, which leaves a typed key's slot here holding nothing a value can fill.
+ *
+ * The narrowing is the front door, never the whole gate — a bag the program computed
+ * arrives as a bare `Record<string, unknown>` and types fine, so the constructor refuses
+ * the collision again over the keys it actually holds ({@link orderedFields}).
+ */
+export type Residue<T> = Readonly<Record<string, unknown>> & {
+    readonly [K in keyof T]?: never;
+};
+/**
+ * The init a kind constructor takes — the framework keys plus the kind's typed fields `T`.
+ * {@link RESIDUE_KEY} is a framework key too, deliberately not spelled below: a kind opts
+ * into that channel through its own surface `T`.
+ */
 export type MemberInit<T> = {
     readonly name: string;
     /** The host member this member's unit composes under — a nested-file child's, and only its. */
@@ -383,6 +467,12 @@ export type MemberInit<T> = {
     readonly satisfies?: readonly string[];
     readonly requires?: Readonly<Record<string, Requirement>>;
     readonly needs?: readonly Capability[];
+    /**
+     * The files this member's claims rest on ({@link input}) — fingerprinted by the lock,
+     * with no byte reaching the projection. The surface binds a *member*: an embedded
+     * value takes no `MemberInit`, and its claims are its host's.
+     */
+    readonly inputs?: readonly Input[];
 } & T;
 /**
  * A kind — a callable constructor carrying its seven facts. Calling it builds a
@@ -414,8 +504,13 @@ export interface KindOptions {
  * into emit is the seven facts plus flat field data. `options.render`, when given,
  * rides alongside `facts`/`key` on the returned constructor — never on the member
  * it builds, since it is erased before a member reaches emit.
+ *
+ * The facts are typed over the same `T` the constructor is, which is what binds a
+ * declared {@link LeafSet} witness to `keyof T`: the leaf set is the kind's own surface,
+ * checked here at the keystroke, and its lowering to the row is the one place it is
+ * spelled again (`declarations.ts`).
  */
-export declare function kind<T extends object>(facts: KindFacts, options?: KindOptions): KindDefinition<T>;
+export declare function kind<T extends object>(facts: KindFacts<T>, options?: KindOptions): KindDefinition<T>;
 /**
  * A **relocation delta** — the facts a relocated built-in kind diverges from its base
  * on. Two faces, either or both:
@@ -428,9 +523,9 @@ export declare function kind<T extends object>(facts: KindFacts, options?: KindO
  *   members are found, the one fact the engine's own overlay exists to apply
  *   (`src/compose.rs`'s `overlay_builtin_kind`).
  *
- * Every other fact — format, unit shape, registration, content, templates — rides
- * through unchanged, which is exactly what makes the emitted row still read as a
- * relocation rather than a name collision on the reading side.
+ * Every other fact — format, unit shape, registration, content, templates, the declared
+ * leaf set — rides through unchanged, which is exactly what makes the emitted row still
+ * read as a relocation rather than a name collision on the reading side.
  */
 export interface KindRelocation<T> {
     /** The edge fields this relocation adds, each over a field of the kind's own surface. */