@dtmd/temper 0.0.18 → 0.0.20

package/dist/src/assembly.d.ts

@@ -49,6 +49,22 @@ export interface Harness {
     readonly require: Readonly<Record<string, Requirement>>;
     /** The residual harness-level settings with no member home (a shrinking list). */
     readonly settings: Readonly<Record<string, unknown>>;
+    /**
+     * The **root member's own contract** — the clauses that bind to the whole governed
+     * forest rather than to one kind's population. Lowered to top-level clause rows
+     * carrying no `kind` column, the absence the engine reads as "the root's"
+     * (`specs/model/representation.md`, "The root member": the contract attaches to the
+     * harness the way it attaches to any member).
+     *
+     * Every clause here is judged at the selection grain, so the vocabulary is the
+     * selection predicates plus {@link reachable}; a member-grain clause names a field in
+     * a schema the root has no single kind to supply, and the gate refuses it at
+     * admissibility rather than leaving it unjudged.
+     *
+     * Absent, {@link rootDefaultContract} applies — the shipped floor, composed by
+     * {@link harness}.
+     */
+    readonly contract: readonly Clause[];
     /**
       * The root member's declared enforcement mode — harness-wide, overridable
     * per member. Defaults to `warn`: temper fabricates no enforcement the
@@ -69,4 +85,28 @@ export declare function harness(init: {
     require?: Readonly<Record<string, Requirement>>;
     settings?: Readonly<Record<string, unknown>>;
     mode?: EnforcementMode;
+    contract?: readonly Clause[];
 }): Harness;
+/**
+ * The **shipped root default contract** — what the root member owes absent an authored
+ * one, and what the embedded built-in lock therefore carries for the stranger gate (a
+ * harness with no lock of its own gets the same root contract an emitted one does).
+ *
+ * Homed beside the root member's other fields, the precedent `dialDefaultContract` sets
+ * in `dial.ts`: a default contract lives with the surface it governs.
+ *
+ * Three clauses, all predicates only the root can bind: their selection is the whole
+ * forest and their judges read the reference graph, the committed lock and the discovery
+ * walk, none of which any one kind's population carries. `reachable` is the one check
+ * that catches authored configuration the harness never loads at all; `fresh` is the one
+ * that catches a projection or a fingerprinted source dependency that has moved out from
+ * under its lock row; `locus-declared` is the one that catches a document sitting at a
+ * governed locus that the program never declared.
+ *
+ * All advisory — today's posture for each, so no adopter turns red on the upgrade. A
+ * dead registration is often deliberate work-in-progress, a drifted projection is usually
+ * a re-emit away, and an undeclared document is often a surface mid-adoption; whether any
+ * of them gates is the adopting author's call, dialed or re-declared rather than
+ * tool-decided.
+ */
+export declare const rootDefaultContract: readonly Clause[];

package/dist/src/assembly.js

@@ -6,6 +6,7 @@
  * `temper.toml`, no roster/bindings dialect (the Decision rejects both);
  * composing partial harnesses is ordinary code.
  */
+import { clause, fresh, locusDeclared, reachable } from "./contract.js";
 /**
  * Compose the harness from its six fields — ordinary code, Turing-completeness
  * quarantined at authoring time. Absent
@@ -20,5 +21,47 @@ export function harness(init) {
         require: init.require ?? {},
         settings: init.settings ?? {},
         mode: init.mode ?? "warn",
+        // The one place "a shipped root default applies when the author declares none" is
+        // spelled. Composing the array is the whole override surface: an authored
+        // `contract` replaces the default wholesale, never merges with it — the same
+        // rows-or-default rule a kind's `expect` binding takes over its floor.
+        contract: init.contract ?? rootDefaultContract,
     };
 }
+/**
+ * The **shipped root default contract** — what the root member owes absent an authored
+ * one, and what the embedded built-in lock therefore carries for the stranger gate (a
+ * harness with no lock of its own gets the same root contract an emitted one does).
+ *
+ * Homed beside the root member's other fields, the precedent `dialDefaultContract` sets
+ * in `dial.ts`: a default contract lives with the surface it governs.
+ *
+ * Three clauses, all predicates only the root can bind: their selection is the whole
+ * forest and their judges read the reference graph, the committed lock and the discovery
+ * walk, none of which any one kind's population carries. `reachable` is the one check
+ * that catches authored configuration the harness never loads at all; `fresh` is the one
+ * that catches a projection or a fingerprinted source dependency that has moved out from
+ * under its lock row; `locus-declared` is the one that catches a document sitting at a
+ * governed locus that the program never declared.
+ *
+ * All advisory — today's posture for each, so no adopter turns red on the upgrade. A
+ * dead registration is often deliberate work-in-progress, a drifted projection is usually
+ * a re-emit away, and an undeclared document is often a surface mid-adoption; whether any
+ * of them gates is the adopting author's call, dialed or re-declared rather than
+ * tool-decided.
+ */
+export const rootDefaultContract = [
+    clause(reachable(), {
+        severity: "advisory",
+        guidance: "This member is authored but unreachable: every registration channel its kind declares is provably dead, and no member that is reachable imports it. Claude never loads it, so it is context you maintain and never pay for — and a reader of the tree cannot tell it from live configuration. Three remedies: open a channel (give the `paths` globs a file they match, give the `description` trigger words), import it from a member that is reachable, or delete it. Advisory because a dead edge is a legitimate work-in-progress state; dial it or re-declare the clause `required` once your tree should hold the line.",
+        cite: "https://code.claude.com/docs/en/memory#path-specific-rules (retrieved 2026-07-15); https://code.claude.com/docs/en/skills (retrieved 2026-07-16)",
+    }),
+    clause(fresh(), {
+        severity: "advisory",
+        guidance: "A lock row this member owns no longer matches disk: either its committed projection was hand-edited, or a fingerprinted source dependency it imports or includes has moved. Nothing reverse-parses a projection back into the program, so the two sides stay apart until you reconcile them: edit the owning source and re-emit, and for a moved dependency re-verify the member's claims against the new bytes first. Advisory because a drifted checkout is usually one `emit` away and blocking every such run would be temper's escalation, not yours; dial this label to `required` — or re-declare the clause — once a drifted projection should fail CI.",
+    }),
+    clause(locusDeclared(), {
+        severity: "advisory",
+        guidance: "A document sits at a governed locus that your program declares no member for. Claude Code loads it, but temper maintains nothing about it: `emit` never writes or reaps it, `guard` never bound it, and every address under it resolves to nothing — so it reads as governed configuration while being governed by no one. Declare the member in the program and re-emit; for a directory whose documents are authored in place rather than projected, declare its kind `local` so `check` derives the rows at read time instead. Advisory because a tree mid-adoption legitimately carries documents the program has not reached yet; dial this label to `required` — or re-declare the clause — once every document at a governed locus should be one you declared.",
+    }),
+];

package/dist/src/builtins.d.ts

@@ -9,7 +9,7 @@
  * `@dtmd/temper/claude-code` subpath
  * — never from the root.
  */
-import type { KindDefinition } from "./kind.js";
+import type { KindDefinition, Residue } from "./kind.js";
 import type { Prose } from "./prose.js";
 import type { Clause } from "./contract.js";
 /** A Claude Code skill — a directory whose entry file is `SKILL.md` with YAML frontmatter. */
@@ -766,6 +766,15 @@ export interface SettingsLocal {
     readonly autoMemoryEnabled?: boolean;
     /** Absolute or `~/`-prefixed path for auto-memory storage, honored at any settings scope (code.claude.com/docs/en/memory, retrieved 2026-07-26). */
     readonly autoMemoryDirectory?: string;
+    /**
+     * The opaque residue — every documented-but-untyped top-level key this overlay carries,
+     * projected flat and key-sorted after the typed fields above. The settings schema is
+     * large and version-evolving, so 0036 settles the unschematized remainder opaque and
+     * *named*: this bag is the name. The two halves partition the file's key space, which
+     * the bag's type holds: a key typed above belongs above and is unspellable here
+     * (code.claude.com/docs/en/settings, retrieved 2026-07-16).
+     */
+    readonly residue?: Residue<SettingsLocal>;
 }
 /**
  * `settings-local` — `.claude/settings.local.json`, a whole-file JSON document at the
@@ -773,9 +782,10 @@ export interface SettingsLocal {
  * target, its rows derived at read time and no row of it ever landing in the lock. Its
  * top-level keys are its fields; identity is the fixed singleton stem `settings.local` (the
  * `file` unit shape — every machine's overlay is the one file at this path, so no declared
- * key names it). Channel-less: machine configuration read by the harness, never surfaced to
- * the model (code.claude.com/docs/en/settings, retrieved 2026-07-16; decisions
- * 0032/0034/0036).
+ * key names it). The keys it does not type ride {@link SettingsLocal.residue}, the opaque
+ * channel 0036's partial governance names. Channel-less: machine configuration read by the
+ * harness, never surfaced to the model (code.claude.com/docs/en/settings, retrieved
+ * 2026-07-16; decisions 0032/0034/0036).
  */
 export declare const settingsLocal: KindDefinition<SettingsLocal>;
 /**
@@ -793,6 +803,102 @@ export declare const settingsLocal: KindDefinition<SettingsLocal>;
  * never a gate clause.
  */
 export declare const settingsLocalDefaultContract: readonly Clause[];
+/**
+ * Claude Code's committed project settings — `.claude/settings.json`, the file a team
+ * checks in so everyone who clones the repository gets the same permissions, hooks,
+ * plugins and environment (code.claude.com/docs/en/settings, "Settings files and who they
+ * affect", retrieved 2026-09-22).
+ *
+ * Only the documented top-level keys a committed team file carries are typed here; the
+ * settings schema is large and version-evolving, and every key not named below survives as
+ * opaque residue named as such — the partial-governance posture `settings-local` already
+ * holds. What is deliberately absent is not residue but *ownership*: `hooks`,
+ * `enabledPlugins` and `extraKnownMarketplaces` are the collection addresses of the
+ * {@link hook}, {@link installedPlugin} and {@link knownMarketplace} kinds, so a member
+ * registers there and this container never types the key. Declaring one here would author
+ * the same segment twice.
+ */
+export interface Settings {
+    /** JSON Schema URL for editor autocomplete; Claude Code ignores it at load time. */
+    readonly $schema?: string;
+    /** Tool-permission rules: `{ allow, ask, deny }`, each an array of rule strings, plus `defaultMode`. */
+    readonly permissions?: Readonly<Record<string, unknown>>;
+    /** Environment variables applied to every session and its subprocesses, a map of string to string. */
+    readonly env?: Readonly<Record<string, string>>;
+    /** The model this project runs as. */
+    readonly model?: string;
+    /** Attribution Claude Code adds to commits and pull requests: `{ commit, pr, sessionUrl }`. */
+    readonly attribution?: Readonly<Record<string, unknown>>;
+    /**
+     * Whether to add a Claude co-author trailer to git commits.
+     *
+     * @deprecated Claude Code documents `attribution` as this key's replacement
+     * (code.claude.com/docs/en/settings-reference#attribution, retrieved 2026-09-22).
+     */
+    readonly includeCoAuthoredBy?: boolean;
+    /** Whether project MCP servers from `.mcp.json` are auto-approved. */
+    readonly enableAllProjectMcpServers?: boolean;
+    /** MCP servers from `.mcp.json` to approve. */
+    readonly enabledMcpjsonServers?: readonly string[];
+    /** MCP servers from `.mcp.json` to reject. */
+    readonly disabledMcpjsonServers?: readonly string[];
+    /** The output rendering style. */
+    readonly outputStyle?: string;
+    /** Whether to enable auto-memory for this project. */
+    readonly autoMemoryEnabled?: boolean;
+    /** Absolute or `~/`-prefixed path for auto-memory storage, honored at any settings scope. */
+    readonly autoMemoryDirectory?: string;
+    /**
+     * The opaque residue — every documented-but-untyped top-level key the committed file
+     * carries, projected flat and key-sorted after the typed fields above. The settings
+     * reference documents several hundred keys and gains more, so the remainder is opaque
+     * and *named* rather than indicted; this bag is the name. The two halves partition the
+     * file's key space, which the bag's type holds: a key typed above belongs above and is
+     * unspellable here. Nor is it an escape hatch for the three collection addresses:
+     * `hooks`, `enabledPlugins` and `extraKnownMarketplaces` are their kinds' to author, so
+     * a key of those names does not belong here either
+     * (code.claude.com/docs/en/settings-reference, retrieved 2026-09-22).
+     */
+    readonly residue?: Residue<Settings>;
+}
+/**
+ * `settings` — `.claude/settings.json`, a whole-file JSON document at the **committed**
+ * commitment class: the program authors every key, `emit` renders the file whole, and the
+ * member's byte fingerprint makes a hand edit to any part of it drift under the root
+ * `fresh` clause (decision 0050). Its top-level keys are its fields; identity is the fixed singleton stem
+ * `settings` (the `file` unit shape — a project's committed settings are the one file at
+ * this documented path, so no declared key names it). Channel-less: configuration the
+ * harness reads, never surfaced to the model.
+ *
+ * It is the **container** of three registration collection addresses — `hooks`,
+ * `enabledPlugins`, `extraKnownMarketplaces` — which keep their own kinds
+ * ({@link hook}, {@link installedPlugin}, {@link knownMarketplace}). Those segments and
+ * this member's opaque residue are one file: emit renders the declared segments in
+ * address order, then the residue — which the member itself authors through
+ * {@link Settings.residue}, flat and key-sorted behind its typed fields
+ * (code.claude.com/docs/en/settings, retrieved 2026-09-22).
+ */
+export declare const settings: KindDefinition<Settings>;
+/**
+ * The default contract for `settings` — the structural container keys typed, everything
+ * else opaque. The settings reference documents several hundred keys, most of them scalar
+ * preferences and many of them managed-scope-only, so a `closedKeys()` allow-list would
+ * strand a valid committed file the moment upstream adds a key: the residue is opaque, not
+ * indicted. What stays decidable is the shape of the documented object-valued keys a
+ * committed team file carries — `permissions`, `env` and `attribution` are each a JSON
+ * *object*, and a value that is not one cannot be applied — so each is gated as a `map`.
+ *
+ * `hooks` is **not** gated here, and its absence is ownership rather than an opaque
+ * residue key: the committed file's `hooks` object is the {@link hook} kind's collection
+ * address, so its shape is that kind's contract to hold, member by member. This is the one
+ * place `settingsLocalDefaultContract`'s guidance does not transfer — a hook in the local
+ * overlay is opaque residue precisely because no kind reads it there.
+ *
+ * Deliberately absent as undecidable: whether a permission rule reads correctly, whether
+ * an env var is one this project needs, whether the chosen `model` exists — semantic
+ * judgment, never a gate clause.
+ */
+export declare const settingsDefaultContract: readonly Clause[];
 /**
  * The default contract for `skill` — Anthropic's documented skill contract: the Agent
  * Skills open standard (agentskills.io), Anthropic's platform upload

package/dist/src/builtins.js

@@ -620,9 +620,10 @@ export const marketplaceDefaultContract = [
  * target, its rows derived at read time and no row of it ever landing in the lock. Its
  * top-level keys are its fields; identity is the fixed singleton stem `settings.local` (the
  * `file` unit shape — every machine's overlay is the one file at this path, so no declared
- * key names it). Channel-less: machine configuration read by the harness, never surfaced to
- * the model (code.claude.com/docs/en/settings, retrieved 2026-07-16; decisions
- * 0032/0034/0036).
+ * key names it). The keys it does not type ride {@link SettingsLocal.residue}, the opaque
+ * channel 0036's partial governance names. Channel-less: machine configuration read by the
+ * harness, never surfaced to the model (code.claude.com/docs/en/settings, retrieved
+ * 2026-07-16; decisions 0032/0034/0036).
  */
 export const settingsLocal = kind({
     name: "settings-local",
@@ -662,6 +663,66 @@ export const settingsLocalDefaultContract = [
         cite: "https://code.claude.com/docs/en/settings#available-settings (retrieved 2026-07-16)",
     }),
 ];
+/**
+ * `settings` — `.claude/settings.json`, a whole-file JSON document at the **committed**
+ * commitment class: the program authors every key, `emit` renders the file whole, and the
+ * member's byte fingerprint makes a hand edit to any part of it drift under the root
+ * `fresh` clause (decision 0050). Its top-level keys are its fields; identity is the fixed singleton stem
+ * `settings` (the `file` unit shape — a project's committed settings are the one file at
+ * this documented path, so no declared key names it). Channel-less: configuration the
+ * harness reads, never surfaced to the model.
+ *
+ * It is the **container** of three registration collection addresses — `hooks`,
+ * `enabledPlugins`, `extraKnownMarketplaces` — which keep their own kinds
+ * ({@link hook}, {@link installedPlugin}, {@link knownMarketplace}). Those segments and
+ * this member's opaque residue are one file: emit renders the declared segments in
+ * address order, then the residue — which the member itself authors through
+ * {@link Settings.residue}, flat and key-sorted behind its typed fields
+ * (code.claude.com/docs/en/settings, retrieved 2026-09-22).
+ */
+export const settings = kind({
+    name: "settings",
+    locus: { kind: "at", root: ".claude", glob: "settings.json" },
+    format: "json-document",
+    unitShape: "file",
+    registration: [],
+});
+/**
+ * The default contract for `settings` — the structural container keys typed, everything
+ * else opaque. The settings reference documents several hundred keys, most of them scalar
+ * preferences and many of them managed-scope-only, so a `closedKeys()` allow-list would
+ * strand a valid committed file the moment upstream adds a key: the residue is opaque, not
+ * indicted. What stays decidable is the shape of the documented object-valued keys a
+ * committed team file carries — `permissions`, `env` and `attribution` are each a JSON
+ * *object*, and a value that is not one cannot be applied — so each is gated as a `map`.
+ *
+ * `hooks` is **not** gated here, and its absence is ownership rather than an opaque
+ * residue key: the committed file's `hooks` object is the {@link hook} kind's collection
+ * address, so its shape is that kind's contract to hold, member by member. This is the one
+ * place `settingsLocalDefaultContract`'s guidance does not transfer — a hook in the local
+ * overlay is opaque residue precisely because no kind reads it there.
+ *
+ * Deliberately absent as undecidable: whether a permission rule reads correctly, whether
+ * an env var is one this project needs, whether the chosen `model` exists — semantic
+ * judgment, never a gate clause.
+ */
+export const settingsDefaultContract = [
+    clause(type("permissions", ["map"]), {
+        severity: "required",
+        guidance: "`permissions` is the tool-permission object — `allow`, `ask` and `deny` rule arrays plus `defaultMode`. A value that is not an object carries no rules Claude Code can read, so the rules a whole team relies on silently apply nothing.",
+        cite: "https://code.claude.com/docs/en/settings-reference#permissions (retrieved 2026-09-22)",
+    }),
+    clause(type("env", ["map"]), {
+        severity: "required",
+        guidance: "`env` is a map of environment variables — string keys to string values — applied to every session and its subprocesses. A non-object value is not a shorter spelling of one variable; it is a shape the loader cannot expand, so none of the variables take effect.",
+        cite: "https://code.claude.com/docs/en/settings-reference#env (retrieved 2026-09-22)",
+    }),
+    clause(type("attribution", ["map"]), {
+        severity: "required",
+        guidance: "`attribution` is the commit/PR attribution object — `commit`, `pr` and `sessionUrl`. A non-object value configures none of them, so Claude Code falls back to its default trailer with no error, which is exactly the outcome a project setting this key was avoiding.",
+        cite: "https://code.claude.com/docs/en/settings-reference#attribution (retrieved 2026-09-22)",
+    }),
+];
 /**
  * The default contract for `skill` — Anthropic's documented skill contract: the Agent
  * Skills open standard (agentskills.io), Anthropic's platform upload

package/dist/src/claude-code.d.ts

@@ -7,7 +7,7 @@
  * specifier like any other. The built-in default contracts join the kinds here
  * too: adoption is `import { skill, skillDefaultContract } from "@dtmd/temper/claude-code"`.
  */
-export type { Agent, Hook, InstalledPlugin, KnownMarketplace, Marketplace, MarketplacePlugin, MarketplaceSource, McpServer, Memory, PluginManifest, Rule, SettingsLocal, Skill, SupportingDoc, } from "./builtins.js";
-export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
+export type { Agent, Hook, InstalledPlugin, KnownMarketplace, Marketplace, MarketplacePlugin, MarketplaceSource, McpServer, Memory, PluginManifest, Rule, Settings, SettingsLocal, Skill, SupportingDoc, } from "./builtins.js";
+export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settings, settingsDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
 export type { Blocks, File, Prose, Text } from "./prose.js";
 export { blocks, file, text } from "./prose.js";

package/dist/src/claude-code.js

@@ -7,5 +7,5 @@
  * specifier like any other. The built-in default contracts join the kinds here
  * too: adoption is `import { skill, skillDefaultContract } from "@dtmd/temper/claude-code"`.
  */
-export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
+export { agent, agentDefaultContract, command, commandDefaultContract, hook, hookDefaultContract, installedPlugin, installedPluginDefaultContract, knownMarketplace, knownMarketplaceDefaultContract, marketplace, marketplaceDefaultContract, mcpServer, mcpServerDefaultContract, memory, memoryAnthropicDefaultContract, pluginManifest, pluginManifestDefaultContract, rule, ruleDefaultContract, settings, settingsDefaultContract, settingsLocal, settingsLocalDefaultContract, skill, skillDefaultContract, supportingDoc, supportingDocDefaultContract, } from "./builtins.js";
 export { blocks, file, text } from "./prose.js";

package/dist/src/contract.d.ts

@@ -40,8 +40,10 @@ export interface Predicate {
      * `incoming_min`/`incoming_max`/`outgoing_min`/`outgoing_max`). */
     readonly args?: Readonly<Record<string, number>>;
     /**
-     * `membership`'s target requirement name — a separate slot from `field` (the
-     * checked field) since `membership` names both.
+     * The **requirement name** a clause reads its source set from — `membership`'s
+     * allowed-value target and `reached-from`'s closure roots, one naming scheme for
+     * both. A separate slot from `field` since `membership` names a checked field too,
+     * and `reached-from` names no field at all.
      */
     readonly target?: string;
     /**
@@ -79,6 +81,13 @@ export interface Predicate {
     };
     /** `require_sections`'s required heading list. */
     readonly sections?: readonly string[];
+    /**
+     * A by-incidence clause's **field set** — the fields whose edges the selection is
+     * filtered to. `degree`'s bound filter and `reached-from`'s via set both ride it:
+     * one concept, one slot, mirroring the lock's own shared `fields` column rather than
+     * a `degree`-private key. Absent ⇒ unfiltered, every edge at the member.
+     */
+    readonly fields?: readonly string[];
     /** `extent`'s declared unit — the render-side size proxy the bound is measured in. */
     readonly unit?: ExtentUnit;
 }
@@ -185,6 +194,56 @@ export declare const globValid: (field: string) => Predicate;
  * wrong must not block.
  */
 export declare const mentionReachable: (scopeField: string, gateField: string) => Predicate;
+/**
+ * Every selected member is reachable from the world — its own inbound registration edge
+ * is live, or a reachable member imports it. A member whose every declared registration
+ * channel is provably dead (a `paths` glob set matching no file, a blank
+ * description-trigger field) and that no live importer reaches is authored configuration
+ * the harness never loads.
+ *
+ * Names **no field**: the grain is each-grain over the *root* selection — the whole
+ * governed forest — and the verdict is read off the reference graph's reachability
+ * closure, never off any member's own fields. So it composes into a root `contract`,
+ * where a member-grain clause is refused: there is no one kind whose schema a root
+ * clause could name a field in.
+ */
+export declare const reachable: () => Predicate;
+/**
+ * Every lock row a selected member owns still matches disk — its projection's byte
+ * fingerprint, and each fingerprinted source dependency a layout import or a
+ * composed-prose include recorded. A drifted row means the authored source changed and
+ * `emit` has not run, or the emitted bytes were hand-edited.
+ *
+ * Drift is one comparison in one vocabulary, so one predicate carries all of it: a
+ * hand-edited projection, a moved import target and a moved include target are the same
+ * freshness fact over the same rows, and hardening freshness hardens it once.
+ *
+ * Names **no field**, like {@link reachable}: the argument is the committed lock read
+ * against disk, never any member's own fields. So it composes into a root `contract`,
+ * whose selection is the whole governed forest — a per-kind binding beside the root's
+ * would double-report one row, and a user-declared kind carries no default contract to
+ * bind it in.
+ */
+export declare const fresh: () => Predicate;
+/**
+ * Every document discovery finds at a **governed locus** is one the lock declares a
+ * member for — a file-content kind's committed document joined against the provenance
+ * rows, a layout host's document against the `layout_source` record `emit` writes when
+ * it reads one. A stranger at a governed locus is loaded by Claude Code and maintained
+ * by nobody: `emit` never reaps it, `guard` never bound it, and every address under it
+ * resolves to nothing.
+ *
+ * Kept apart from {@link fresh} rather than folded into it: a stale pin and an
+ * undeclared document are different facts with different remedies — re-emit versus
+ * declare the member — and a read-only ground kind draws the second routinely while
+ * its pins stay fresh, so hardening one must not harden the other.
+ *
+ * Names **no field**, like {@link fresh}: the subject is the discovery walk read
+ * against the lock's declarations, never any member's own fields. So it composes into a
+ * root `contract` — what is governed is a locus, not a population, and a per-kind
+ * binding would have no member to hang off.
+ */
+export declare const locusDeclared: () => Predicate;
 /**
  * Every edge the member's kind declares is placed by the format that renders the member
  * — a format that omits one renders a contract the prose does not represent. Names no
@@ -202,7 +261,16 @@ export declare const count: (bounds: {
 export declare const unique: (field: string) => Predicate;
 /** Every selected member's `field` value is drawn from a feature over the selection `target` declares. */
 export declare const membership: (field: string, target: string) => Predicate;
-/** The in/out edge-count bound every selected member must land in. At least one direction must be given. */
+/**
+ * The in/out edge-count bound every selected member must land in. At least one
+ * direction must be given.
+ *
+ * `fields` filters the by-incidence selection both bounds range over — the clause's
+ * own filter, not either direction's. Omit it and the bound ranges over every edge at
+ * the member; name a set and it ranges over the union of those fields' edges, so two
+ * fields to one target count two. Containment (`contains:<kind>`) counts only where a
+ * filter names it.
+ */
 export declare const degree: (bounds: {
     incoming?: {
         min?: number;
@@ -212,7 +280,32 @@ export declare const degree: (bounds: {
         min?: number;
         max?: number;
     };
+    fields?: readonly string[];
 }) => Predicate;
+/**
+ * Every selected member lies in the forward closure of `roots` over the `via` field
+ * set — `degree`'s global counterpart. `degree` asks the local question (how many arcs
+ * sit at this member), so the first orphan of a dead chain fires and none behind it;
+ * this asks the global one, so every member the roots cannot reach is equally a
+ * finding.
+ *
+ * `roots` names a **requirement**, spelled exactly as `membership` names its target
+ * set: rootness is a role, and a role is opt-in, so the roots are declared once and
+ * never re-derived from a kind. A root holds trivially, and the walk visits each node
+ * once, so a cycle inside the closure terminates and moves no verdict.
+ *
+ * `via` is the same by-incidence field set `degree`'s filter rides. Omit it and the
+ * closure follows every edge at a member but containment; name a set and it follows
+ * the union of those fields' arcs, so a mention or an import counts only where the set
+ * names its field.
+ *
+ * Each-grain over the **selection** the clause binds to, and judged by the reference
+ * graph rather than any member's own fields. It belongs in **no default contract**: a
+ * clause demanding every member be reached is the declaration-density demand
+ * `specs/intent.md`'s invariant 1 forbids unless the author declares it
+ * (`specs/decisions/0056-reached-from-joins-the-vocabulary.md`).
+ */
+export declare const reachedFrom: (roots: string, via?: readonly string[]) => Predicate;
 /**
  * A guarded clause — a predicate (restricted to `type` or `enum`) that acts as a
  * guard, with a body of ordinary clauses that fire only where the guard holds.

package/dist/src/contract.js

@@ -130,6 +130,56 @@ export const mentionReachable = (scopeField, gateField) => ({
     field: scopeField,
     gate: gateField,
 });
+/**
+ * Every selected member is reachable from the world — its own inbound registration edge
+ * is live, or a reachable member imports it. A member whose every declared registration
+ * channel is provably dead (a `paths` glob set matching no file, a blank
+ * description-trigger field) and that no live importer reaches is authored configuration
+ * the harness never loads.
+ *
+ * Names **no field**: the grain is each-grain over the *root* selection — the whole
+ * governed forest — and the verdict is read off the reference graph's reachability
+ * closure, never off any member's own fields. So it composes into a root `contract`,
+ * where a member-grain clause is refused: there is no one kind whose schema a root
+ * clause could name a field in.
+ */
+export const reachable = () => ({ key: "reachable" });
+/**
+ * Every lock row a selected member owns still matches disk — its projection's byte
+ * fingerprint, and each fingerprinted source dependency a layout import or a
+ * composed-prose include recorded. A drifted row means the authored source changed and
+ * `emit` has not run, or the emitted bytes were hand-edited.
+ *
+ * Drift is one comparison in one vocabulary, so one predicate carries all of it: a
+ * hand-edited projection, a moved import target and a moved include target are the same
+ * freshness fact over the same rows, and hardening freshness hardens it once.
+ *
+ * Names **no field**, like {@link reachable}: the argument is the committed lock read
+ * against disk, never any member's own fields. So it composes into a root `contract`,
+ * whose selection is the whole governed forest — a per-kind binding beside the root's
+ * would double-report one row, and a user-declared kind carries no default contract to
+ * bind it in.
+ */
+export const fresh = () => ({ key: "fresh" });
+/**
+ * Every document discovery finds at a **governed locus** is one the lock declares a
+ * member for — a file-content kind's committed document joined against the provenance
+ * rows, a layout host's document against the `layout_source` record `emit` writes when
+ * it reads one. A stranger at a governed locus is loaded by Claude Code and maintained
+ * by nobody: `emit` never reaps it, `guard` never bound it, and every address under it
+ * resolves to nothing.
+ *
+ * Kept apart from {@link fresh} rather than folded into it: a stale pin and an
+ * undeclared document are different facts with different remedies — re-emit versus
+ * declare the member — and a read-only ground kind draws the second routinely while
+ * its pins stay fresh, so hardening one must not harden the other.
+ *
+ * Names **no field**, like {@link fresh}: the subject is the discovery walk read
+ * against the lock's declarations, never any member's own fields. So it composes into a
+ * root `contract` — what is governed is a locus, not a population, and a per-kind
+ * binding would have no member to hang off.
+ */
+export const locusDeclared = () => ({ key: "locus-declared" });
 /**
  * Every edge the member's kind declares is placed by the format that renders the member
  * — a format that omits one renders a contract the prose does not represent. Names no
@@ -161,7 +211,16 @@ export const membership = (field, target) => ({
     field,
     target,
 });
-/** The in/out edge-count bound every selected member must land in. At least one direction must be given. */
+/**
+ * The in/out edge-count bound every selected member must land in. At least one
+ * direction must be given.
+ *
+ * `fields` filters the by-incidence selection both bounds range over — the clause's
+ * own filter, not either direction's. Omit it and the bound ranges over every edge at
+ * the member; name a set and it ranges over the union of those fields' edges, so two
+ * fields to one target count two. Containment (`contains:<kind>`) counts only where a
+ * filter names it.
+ */
 export const degree = (bounds) => {
     const args = {};
     if (bounds.incoming?.min !== undefined)
@@ -172,8 +231,36 @@ export const degree = (bounds) => {
         args.outgoing_min = bounds.outgoing.min;
     if (bounds.outgoing?.max !== undefined)
         args.outgoing_max = bounds.outgoing.max;
-    return { key: "degree", args };
+    return bounds.fields === undefined
+        ? { key: "degree", args }
+        : { key: "degree", args, fields: bounds.fields };
 };
+/**
+ * Every selected member lies in the forward closure of `roots` over the `via` field
+ * set — `degree`'s global counterpart. `degree` asks the local question (how many arcs
+ * sit at this member), so the first orphan of a dead chain fires and none behind it;
+ * this asks the global one, so every member the roots cannot reach is equally a
+ * finding.
+ *
+ * `roots` names a **requirement**, spelled exactly as `membership` names its target
+ * set: rootness is a role, and a role is opt-in, so the roots are declared once and
+ * never re-derived from a kind. A root holds trivially, and the walk visits each node
+ * once, so a cycle inside the closure terminates and moves no verdict.
+ *
+ * `via` is the same by-incidence field set `degree`'s filter rides. Omit it and the
+ * closure follows every edge at a member but containment; name a set and it follows
+ * the union of those fields' arcs, so a mention or an import counts only where the set
+ * names its field.
+ *
+ * Each-grain over the **selection** the clause binds to, and judged by the reference
+ * graph rather than any member's own fields. It belongs in **no default contract**: a
+ * clause demanding every member be reached is the declaration-density demand
+ * `specs/intent.md`'s invariant 1 forbids unless the author declares it
+ * (`specs/decisions/0056-reached-from-joins-the-vocabulary.md`).
+ */
+export const reachedFrom = (roots, via) => via === undefined
+    ? { key: "reached-from", target: roots }
+    : { key: "reached-from", target: roots, fields: via };
 /**
  * A guarded clause — a predicate (restricted to `type` or `enum`) that acts as a
  * guard, with a body of ordinary clauses that fire only where the guard holds.