@lapxo/bound 0.1.0

package/dist/fold/release-policy.js

@@ -0,0 +1,103 @@
+import { verdictDemand } from '@lapxo/topos/authority';
+import { matches, parse } from '@lapxo/topos/wire';
+const fields = (line) => {
+    const got = parse(line);
+    return got.kind === 'fact' ? got.value.fields : {};
+};
+const f = (line, name) => fields(line)[name] ?? '';
+const words = (value) => [...new Set(value.split('|').filter(Boolean))];
+const active = (line) => f(line, 'value') !== 'withdraw';
+const declaration = (line) => active(line) && f(line, 'role') === 'writes' && f(line, 'form') === 'alphabet' && f(line, 'measure') === 'id';
+/** Preserve actual fold faults; none gets a release category from its spelling. */
+export function releaseFaults(fold) {
+    return [
+        ...fold.forks.map((one) => ({ kind: 'fork', evidence: [one.key, ...one.lines] })),
+        ...fold.refused.map((line) => ({ kind: 'refused', evidence: [line] })),
+        ...fold.grey.map((line) => ({ kind: 'grey', evidence: [line] })),
+        ...fold.orphans.map((line) => ({ kind: 'orphan', evidence: [line] })),
+        ...(fold.second.verdict === 'forks' ? [{ kind: 'second-fork', evidence: [fold.second.verdict] }] : []),
+    ];
+}
+/** Select declared obligations, never categories inferred from their names or paths. */
+export function releasePolicy(input) {
+    const policy = [...new Set(input.standing.filter((line) => f(line, 'scope') === 'release/blocks' && declaration(line)))];
+    const debt = [...new Set([...input.demands, ...input.ceilings])];
+    const gateLines = input.standing.filter(line => active(line) && f(line, 'role') === 'demands' && f(line, 'form') === 'alphabet' && f(line, 'measure') === 'verdict');
+    const gates = gateLines.map(line => verdictDemand(fields(line), input.verdicts ?? []));
+    const base = { snapshot: input.snapshot, policy, debt, gates };
+    if (!policy.length)
+        return { ...base, status: 'absent', categories: [], unresolved: [] };
+    const values = new Set(policy.map((line) => [...words(f(line, 'value'))].sort().join('|')));
+    const unresolved = [];
+    for (const fault of input.faults ?? []) {
+        if (fault.obligation === undefined || !debt.includes(fault.obligation))
+            unresolved.push(`unclassified ${fault.kind}: ${fault.evidence.join(' | ')}`);
+    }
+    if (values.size !== 1)
+        unresolved.push('release/blocks has conflicting standing values');
+    const labels = words(f(policy[0], 'value'));
+    if (!labels.length)
+        unresolved.push('release/blocks selects no category');
+    const categories = labels.map((name) => {
+        const links = [...new Set(input.standing.filter((line) => f(line, 'scope') === `release/category/${name}` && declaration(line)))];
+        if (!links.length)
+            unresolved.push(`release/category/${name} has no admitted link`);
+        if (new Set(links.map((line) => [...words(f(line, 'value'))].sort().join('|'))).size > 1)
+            unresolved.push(`release/category/${name} has conflicting standing values`);
+        const selected = new Set();
+        for (const selector of words(f(links[0] ?? '', 'value'))) {
+            const met = debt.filter((line) => matches(selector, f(line, 'scope')));
+            if (!met.length)
+                unresolved.push(`release/category/${name} selector ${selector} names no obligation`);
+            met.forEach((line) => selected.add(line));
+        }
+        if (!selected.size)
+            unresolved.push(`release/category/${name} selects no obligation`);
+        const failures = [];
+        for (const line of selected) {
+            for (const fault of input.faults ?? [])
+                if (fault.obligation === line)
+                    failures.push({ line, reason: fault.kind, evidence: [...fault.evidence] });
+            if (input.demands.includes(line)) {
+                const gate = gateLines.includes(line) ? verdictDemand(fields(line), input.verdicts ?? []) : undefined;
+                if (gate) {
+                    if (gate.status !== 'met')
+                        failures.push({ line, reason: gate.status, evidence: gate.evidence.map(e => `${e.coordinate}=${e.value}`) });
+                    continue;
+                }
+                if (!input.paid.includes(line))
+                    failures.push({ line, reason: 'missing', evidence: [] });
+                continue;
+            }
+            const scope = f(line, 'scope');
+            const over = input.readings.over.filter((one) => one.ceiling === scope);
+            if (over.length && input.ceilings.filter((one) => f(one, 'scope') === scope).length !== 1)
+                unresolved.push(`ceiling evidence for ${scope} does not identify one obligation`);
+            if (over.length)
+                failures.push({ line, reason: 'outside', evidence: over.map((one) => `${one.side} ${one.question} ${one.got}`) });
+            if (input.readings.unread.includes(line))
+                failures.push({ line, reason: 'unread', evidence: [] });
+            if (input.readings.vacuous.includes(line))
+                failures.push({ line, reason: 'vacuous', evidence: [] });
+            if (!input.readings.read.includes(line) && !input.readings.unread.includes(line) && !input.readings.vacuous.includes(line)) {
+                unresolved.push(`ceiling ${scope} has no result in this fold`);
+            }
+        }
+        return { name, links, selected: [...selected], failures };
+    });
+    return { ...base, categories, unresolved: [...new Set(unresolved)], status: unresolved.length ? 'incomplete' : categories.some((one) => one.failures.length) ? 'blocked' : 'ready' };
+}
+/** Existing fold output can show the policy without a new view or a release action. */
+export function releasePolicyLines(result) {
+    if (result === undefined)
+        return [];
+    const gates = (result.gates ?? []).map(g => `GATE     ${g.scope} ${g.status} · requires=${g.required.join('|')} · ${g.evidence.map(e => `${e.coordinate}=${e.value}`).join(' | ') || g.reason || 'no evidence'}`);
+    if (result.status === 'absent')
+        return gates;
+    return [
+        ...gates,
+        `RELEASE  policy ${result.status} · fold ${result.snapshot.fold} · instrument ${result.snapshot.instrument}`,
+        ...result.unresolved.map((one) => `UNRESOLVED release · ${one}`),
+        ...result.categories.flatMap((one) => one.failures.map((failure) => `BLOCK    ${one.name} · ${f(failure.line, 'scope')} · ${failure.reason}${failure.evidence.length ? ` · ${failure.evidence.join(' | ')}` : ''}`)),
+    ];
+}

package/dist/fold/resolved.d.ts

@@ -0,0 +1,18 @@
+import type { PlaceFold } from '../cli/place.ts';
+export declare const bytesOnly: (line: string) => string;
+/**
+ * Every receipt of a place, @8: the bytes of what it observed that a reading ran over, those readings, the verdicts its
+ * paid demands were taken with, and at the root the digest of each place's own receipts. The attest is none of them:
+ * it stands in the root lock and the release, naming the root these lines resolve to. The fold keeps the set in the
+ * root's store under the digest of its bytes, which every line that resolves it names, and what a place with no reader
+ * carries is read back from there, never from a file the place ships.
+ */
+export declare function receiptsOf(fold: PlaceFold): readonly string[];
+export declare function keepCarried(store: string, lines: readonly string[], from?: string): string;
+/**
+ * What a copy of a place reads back of its receipts: the lines it shipped when they are the whole set, or, when they
+ * name a root at the digest of its bytes, the set the store keeps there; a root the store does not keep is no set, and
+ * the caller refuses rather than read the lines that only name it.
+ */
+export declare function carriedFrom(store: string, shipped: readonly string[]): readonly string[] | undefined;
+export declare const carriedIn: (store: string) => readonly string[];

package/dist/fold/resolved.js

@@ -0,0 +1,123 @@
+import { createHash, dirname, existsSync, join, linkSync, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
+import { canonical, parse } from '@lapxo/topos/wire';
+import { RECEIPTS, fieldOf, isWire } from "./claims.js";
+import { bytesDigest } from "./digests.js";
+import { carriesOnly } from "./observed.js";
+import { writerFor } from "./signers.js";
+import { viewsOf } from "./views.js";
+import { zoomed } from "./zoom.js";
+import { ledgerLines, storeAt } from "../land/ledger.js";
+import { sourced } from "../land/vouched.js";
+import { entriesIn, observeFile, observeText } from "../observe/files.js";
+export const bytesOnly = (line) => {
+    const got = parse(line);
+    return got.kind === 'fact' && fieldOf(line, 'measure') === 'observed' ? canonical({ ...got.value.fields, value: fieldOf(line, 'at').replace(/^.*:/, '').slice(0, 16) }) : line;
+};
+const held = new WeakMap();
+/**
+ * Every receipt of a place, @8: the bytes of what it observed that a reading ran over, those readings, the verdicts its
+ * paid demands were taken with, and at the root the digest of each place's own receipts. The attest is none of them:
+ * it stands in the root lock and the release, naming the root these lines resolve to. The fold keeps the set in the
+ * root's store under the digest of its bytes, which every line that resolves it names, and what a place with no reader
+ * carries is read back from there, never from a file the place ships.
+ */
+export function receiptsOf(fold) {
+    const kept = held.get(fold);
+    if (kept !== undefined)
+        return kept;
+    if (!fold.observed.length && carriesOnly(fold.root, fold.store))
+        return held.set(fold, [...new Set(carriedIn(fold.store).flatMap((file) => (observeText(file) ?? '').split('\n').filter(isWire)))]).get(fold);
+    const under = fold.under ?? '';
+    const shape = [...viewsOf(fold.standing).values()].flatMap((view) => ('regions' in view && view.regions.some((one) => one.name === 'receipts') ? [view.shape] : []))[0] ?? '';
+    const closed = under || !shape ? [] : entriesIn(fold.root).filter((entry) => entry.dir && observeText(join(fold.root, entry.name, shape)) !== undefined).map((entry) => `${entry.name}/`).sort();
+    const own = (place) => place.startsWith(under) && !closed.some((one) => place.startsWith(one)) && (!shape || !place.endsWith(shape));
+    const mine = new Set(fold.observed.filter((line) => fieldOf(line, 'measure') === 'observed' && own(fieldOf(line, 'scope')))
+        .map((line) => `${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`));
+    const ran = [...new Set(fold.observed.filter((line) => fieldOf(line, 'measure') !== 'observed'
+            && mine.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)))];
+    const ranAt = new Set(ran.map((line) => `${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`));
+    const cones = new Set(fold.observed.filter((line) => fieldOf(line, 'measure') === 'observed' && own(fieldOf(line, 'scope')) && ranAt.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)).map(bytesOnly));
+    const paid = ledgerLines(fold.store, 'judge').filter((line) => fold.paid.some((demand) => fieldOf(demand, 'scope') === fieldOf(line, 'scope')
+        && !(closed.length > 0 && fieldOf(demand, 'needs').split('|').filter(Boolean).length > 0
+            && fieldOf(demand, 'needs').split('|').filter(Boolean).every((need) => closed.some((one) => need.startsWith(one))))));
+    const named = closed.map((place) => {
+        const digest = bytesDigest(fold.store, observeFile(join(fold.root, place, shape)) ?? new Uint8Array());
+        return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
+    });
+    const place = under.replace(/\/$/, '');
+    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid].map((line) => (place ? zoomed(line, place) : line));
+    if (!lines.length) {
+        const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);
+        const carried = carriedFrom(fold.store, shipped);
+        if (carried !== undefined && carried.length)
+            return held.set(fold, carried).get(fold);
+    }
+    held.set(fold, lines);
+    keepCarried(fold.store, lines);
+    return lines;
+}
+export function keepCarried(store, lines, from) {
+    const text = lines.map((line) => `${line}\n`).join('');
+    const digest = createHash('sha256').update(text).digest('hex');
+    const at = storeAt(store, 'cas', 'carried', digest);
+    if (existsSync(at)) {
+        verifiedCarried(at, digest);
+    }
+    else {
+        mkdirSync(dirname(at), { recursive: true });
+        const src = from === undefined ? '' : storeAt(from, 'cas', 'carried', digest);
+        if (src && existsSync(src)) {
+            verifiedCarried(src, digest);
+            try {
+                linkSync(src, at);
+                return `sha256:${digest}`;
+            }
+            catch {
+                // Cross-device stores still keep the authenticated bytes below.
+            }
+        }
+        writeFileSync(`${at}.${process.pid}`, text);
+        renameSync(`${at}.${process.pid}`, at);
+    }
+    return `sha256:${digest}`;
+}
+/**
+ * What a copy of a place reads back of its receipts: the lines it shipped when they are the whole set, or, when they
+ * name a root at the digest of its bytes, the set the store keeps there; a root the store does not keep is no set, and
+ * the caller refuses rather than read the lines that only name it.
+ */
+export function carriedFrom(store, shipped) {
+    const named = shipped.find((line) => fieldOf(line, 'scope') === 'receipts' && fieldOf(line, 'measure') === 'digest');
+    if (named === undefined)
+        return shipped;
+    // Resolution 8 may precede its authenticated summary in the same public file.
+    // It is evidence only if its exact bytes meet the summary's carrier digest.
+    for (let i = 1; i < shipped.length; i += 1) {
+        const header = shipped[i];
+        if (fieldOf(header, 'scope') !== 'receipts' || fieldOf(header, 'measure') !== 'digest')
+            continue;
+        const digest = fieldOf(header, 'at').replace(/^place:sha256:/, '');
+        const body = shipped.slice(0, i);
+        if (/^[0-9a-f]{64}$/.test(digest) && createHash('sha256').update(body.map(line => `${line}\n`).join('')).digest('hex') === digest)
+            return body;
+    }
+    const hex = fieldOf(named, 'at').replace(/^place:(?:sha256:)?/, '');
+    const text = /^[0-9a-f]{64}$/.test(hex) ? verifiedCarried(storeAt(store, 'cas', 'carried', hex), hex) : undefined;
+    return text === undefined ? undefined : text.split('\n').filter(isWire);
+}
+export const carriedIn = (store) => ((dir) => (existsSync(dir)
+    ? readdirSync(dir).filter((name) => /^[0-9a-f]{64}$/.test(name)).sort().map((name) => {
+        const at = join(dir, name);
+        verifiedCarried(at, name);
+        return at;
+    }) : []))(storeAt(store, 'cas', 'carried'));
+/** Authenticate the existing SHA-256 receipt carrier before interpreting any lines. */
+function verifiedCarried(at, expected) {
+    const bytes = observeFile(at);
+    if (bytes === undefined)
+        return undefined;
+    const actual = createHash('sha256').update(bytes).digest('hex');
+    if (actual !== expected)
+        throw Error(`REFUSE·receipt carried bytes mismatch · expected sha256:${expected} · got sha256:${actual}`);
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+}

package/dist/fold/roles.d.ts

@@ -0,0 +1,17 @@
+import type { RoleClaim } from '@lapxo/topos/wire';
+import type { CoordinateRole } from './wire.ts';
+/** A lock line that gives a coordinate its role: every walk of the tree reads it. */
+export declare function isRoleLock(line: string): boolean;
+/** A lock the owner signs by digest and a capsule writes: its lines stand while the bytes are the ones that were signed. */
+export declare function inheritedRoles(store: string): {
+    readonly claims: readonly RoleClaim[];
+    readonly stale: readonly string[];
+};
+/**
+ * What each coordinate of the tree is: the capsule that knows a world writes the roles of that world, the owner signs the
+ * capsule's lock by digest, and this fold reads both. The instrument reads claims and never a name, and a coordinate no
+ * standing claim names is source. The steps a walk must not enter are read the same way: the claims that name a whole
+ * folder foreign or derived, as a set the walk can ask in one step instead of matching every claim at every step.
+ */
+export declare function stepsOutside(store: string): ReadonlySet<string>;
+export declare function rolesOf(store: string): (coordinate: string) => CoordinateRole;

package/dist/fold/roles.js

@@ -0,0 +1,59 @@
+import { createHash, dirname, join } from "../host/io.js";
+import { parse, roleClaimsOf } from '@lapxo/topos/wire';
+import { namesAt, roleAt } from "./wire.js";
+import { lockStanding } from "./keys.js";
+import { placesIn } from "./places.js";
+import { ownLockOf } from "./signed.js";
+import { observeText } from "../observe/files.js";
+import { fieldOf, isWire } from "./claims.js";
+/** A lock line that gives a coordinate its role: every walk of the tree reads it. */
+export function isRoleLock(line) {
+    const got = parse(line);
+    return got.kind === 'fact' && roleClaimsOf([got.value.fields]).length > 0;
+}
+/** A lock the owner signs by digest and a capsule writes: its lines stand while the bytes are the ones that were signed. */
+export function inheritedRoles(store) {
+    const root = dirname(store);
+    const claims = [];
+    const stale = [];
+    for (const line of lockStanding(store)) {
+        if (fieldOf(line, 'measure') !== 'role' || !fieldOf(line, 'scope').startsWith('roles/'))
+            continue;
+        const at = fieldOf(line, 'needs');
+        const held = at ? observeText(join(root, at)) : undefined;
+        const digest = held === undefined ? '' : `sha256:${createHash('sha256').update(held).digest('hex')}`;
+        if (held === undefined || digest !== fieldOf(line, 'restsOn')) {
+            stale.push(fieldOf(line, 'scope'));
+            continue;
+        }
+        for (const one of held.split('\n').filter(isWire).map((row) => parse(row))) {
+            if (one.kind === 'fact')
+                claims.push(one.value.fields);
+        }
+    }
+    return { claims: roleClaimsOf(claims), stale };
+}
+/**
+ * What each coordinate of the tree is: the capsule that knows a world writes the roles of that world, the owner signs the
+ * capsule's lock by digest, and this fold reads both. The instrument reads claims and never a name, and a coordinate no
+ * standing claim names is source. The steps a walk must not enter are read the same way: the claims that name a whole
+ * folder foreign or derived, as a set the walk can ask in one step instead of matching every claim at every step.
+ */
+export function stepsOutside(store) {
+    const own = roleClaimsOf(lockStanding(store)
+        .map((line) => parse(line))
+        .flatMap((got) => (got.kind === 'fact' ? [got.value.fields] : [])));
+    return new Set([...own, ...inheritedRoles(store).claims]
+        .filter((claim) => (claim.role === 'foreign' || claim.role === 'derived') && !claim.name.includes('/') && !claim.name.includes('*'))
+        .map((claim) => claim.name));
+}
+export function rolesOf(store) {
+    const fields = (lines) => lines.map((line) => parse(line)).flatMap((got) => (got.kind === 'fact' ? [got.value.fields] : []));
+    const claims = [...roleClaimsOf(fields(lockStanding(store))), ...inheritedRoles(store).claims];
+    const root = dirname(store);
+    const placed = new Map(placesIn(root).map((place) => [place, roleClaimsOf(fields(ownLockOf(root, place)))]));
+    return (coordinate) => {
+        const own = coordinate.includes('/') ? placed.get(coordinate.slice(0, coordinate.indexOf('/'))) ?? [] : [];
+        return roleAt(coordinate, own.some((claim) => namesAt(coordinate, claim.name)) ? own : claims);
+    };
+}

package/dist/fold/second.d.ts

@@ -0,0 +1,18 @@
+export interface SecondHead {
+    /** What its latest word says of this fold: the same lines stand, other lines stand, it read another ledger, its key is not admitted, or it never spoke. */
+    readonly verdict: 'agrees' | 'forks' | 'stale' | 'grey' | 'none';
+    /**
+     * A head counts as an origin of its own only once it has disagreed: until then it may be this one again (L16); and
+     * the epoch of its latest word, wherever it said it, which a clone reads as history and not as its own.
+     */
+    readonly external: boolean;
+    readonly epoch: number;
+    readonly apart?: readonly string[];
+}
+/**
+ * The second head's word, read against this fold. It attests the digest of the lines it found standing and the digest
+ * of the lines of the ledger it folded, in whatever order a store landed them, so a clone that lands the same lines
+ * agrees; agreement is an encounter, disagreement a fork. A word about another lock is not read as this one's: the head
+ * bound's own lock names is asked now over the ledger as it stands, with no key, and what it says is read, never kept.
+ */
+export declare function secondHead(store: string, standing: readonly string[], admitted: (line: string) => boolean, owned?: readonly string[]): SecondHead;

package/dist/fold/second.js

@@ -0,0 +1,68 @@
+import { snapshotVerdict } from "./evidence.js";
+import { dirname, resolve, spawnSync } from "../host/io.js";
+import { ledgerLines } from "../land/ledger.js";
+import { ownLock } from "../observe/runner.js";
+import { fieldOf } from "./claims.js";
+import { keyOf, lockLines } from "./keys.js";
+import { digestsOf, finerOf, regionsOf } from "./region.js";
+import { said } from "./wire.js";
+import { sha } from "../host/hash.js";
+const asked = new Map();
+function askedNow(store, rests) {
+    const root = dirname(store);
+    const key = `${root} ${rests}`;
+    if (asked.has(key))
+        return asked.get(key);
+    const argv = said(ownLock(), 'head/second');
+    const got = argv.length ? spawnSync(process.execPath, ['--disable-warning=ExperimentalWarning', '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON',
+        resolve(root, argv[0]), ...argv.slice(1), root], { cwd: root, encoding: 'utf8', maxBuffer: 1 << 26 }) : undefined;
+    const line = got === undefined || got.status !== 0 || typeof got.stdout !== 'string' ? undefined : got.stdout.split('\n').find((one) => one.startsWith('VERIFY'));
+    const word = line === undefined ? undefined : line.slice('VERIFY'.length).trim().split(' ')[0];
+    const verdict = word === 'agrees' || word === 'forks' ? word : undefined;
+    asked.set(key, verdict);
+    return verdict;
+}
+/**
+ * The second head's word, read against this fold. It attests the digest of the lines it found standing and the digest
+ * of the lines of the ledger it folded, in whatever order a store landed them, so a clone that lands the same lines
+ * agrees; agreement is an encounter, disagreement a fork. A word about another lock is not read as this one's: the head
+ * bound's own lock names is asked now over the ledger as it stands, with no key, and what it says is read, never kept.
+ */
+export function secondHead(store, standing, admitted, owned = lockLines(store)) {
+    const head = keyOf(store, 'attest');
+    const said = head === undefined ? [] : ledgerLines(store, head).filter((line) => fieldOf(line, 'scope') === `${head}/target`);
+    const last = said.at(-1);
+    const lines = owned.filter((line) => /\bsig=/.test(line));
+    const rests = `sha256:${sha([...new Set(lines)].sort().join('\n'))}`;
+    const epoch = lines.reduce((most, line) => Math.max(most, Number(fieldOf(line, 'epoch')) || 0), 0);
+    const input = {
+        declared: head !== undefined,
+        expected: { set: lines.length ? rests : undefined, standing: `place:sha256:${sha([...new Set(standing)].sort().join('\n'))}`, epoch },
+        ...(last ? { statement: { admitted: admitted(last), set: fieldOf(last, 'restsOn'), standing: fieldOf(last, 'at'), epoch: Number(fieldOf(last, 'epoch')) || 0 } } : {}),
+        priorDisagreement: said.some(line => fieldOf(line, 'value') === 'forks' && admitted(line)),
+    };
+    let result = snapshotVerdict(input);
+    if (result.verdict === 'stale' && last && lines.length) {
+        const now = askedNow(store, rests);
+        if (now !== undefined)
+            result = snapshotVerdict({ ...input, comparison: { admitted: true, set: rests, verdict: now, epoch } });
+    }
+    if (result.verdict !== 'forks' || head === undefined || last === undefined || fieldOf(last, 'restsOn') !== rests)
+        return result;
+    const theirs = new Map(ledgerLines(store, head).filter((line) => fieldOf(line, 'scope').startsWith(`${head}/region/`) && fieldOf(line, 'restsOn') === fieldOf(last, 'restsOn'))
+        .map((line) => [fieldOf(line, 'scope').slice(`${head}/region/`.length).replace(/^\.$/, ''), fieldOf(line, 'value')]));
+    if (!theirs.size)
+        return result;
+    const regions = regionsOf(standing, standing, []);
+    const [ours, finer] = [digestsOf(regions), finerOf(regions)];
+    const apart = [];
+    const descend = (region) => {
+        if (theirs.get(region) === ours.get(region))
+            return;
+        apart.push(region || '.');
+        for (const one of finer.get(region) ?? [])
+            descend(one);
+    };
+    descend('');
+    return { ...result, apart };
+}

package/dist/fold/shards.d.ts

@@ -0,0 +1,29 @@
+export declare const OBSERVED: RegExp;
+export declare const LEVEL: RegExp;
+export declare const readerOf: (line: string) => string | undefined;
+type Latest = {
+    readonly at: string;
+    readonly line: string;
+};
+export declare const trimmed: (where: string) => string;
+export { sha } from '../host/hash.ts';
+/**
+ * What a reader said is kept by region: the region a place lies in is the longest a reader's lock names that holds it,
+ * the stamps and digests it was observed at are lines of that region's shard, and what the reader answered for the
+ * region is one observation, stored under its reader's extension, the region, the digest of the region's places and
+ * the resolution it was read at. A fold opens the shards of the regions it reaches and reads each observation by its
+ * key: nothing is scanned, the same bytes are never read twice, and an observation found under its key is the reading.
+ */
+export declare function regionIn(regions: readonly string[], place: string): string;
+export declare const keyOf: (by: string, region: string, pairs: readonly string[], resolution?: string) => string;
+export declare const observed: (store: string, key: string) => boolean;
+export declare function observation(store: string, key: string): readonly string[] | undefined;
+export declare function keepObservation(store: string, key: string, lines: readonly string[]): void;
+export declare function opened(store: string, speaker: string, region: string, alive: ReadonlySet<string>): {
+    readonly region: string;
+    readonly places: ReadonlyMap<string, Latest>;
+    readonly keys: Map<string, string>;
+};
+export declare const pointer: (speaker: string, by: string, region: string, key: string, pairs: readonly string[]) => string;
+export declare function legacyOf(store: string, speaker: string, regions: readonly string[]): ReadonlyMap<string, readonly string[]> | undefined;
+export declare function setAside(store: string, speaker: string): void;

package/dist/fold/shards.js

@@ -0,0 +1,100 @@
+import { dirname, existsSync, mkdirSync, renameSync, writeFileSync } from "../host/io.js";
+import { canonical } from '@lapxo/topos/wire';
+import { bytesDigest } from "./digests.js";
+import { blobAt, landShard, ledgerLines, shardFile, shardLines, storeAt, writerFile } from "../land/ledger.js";
+import { fieldOf, isWire } from "./claims.js";
+import { observeFile, observeText } from "../observe/files.js";
+export const OBSERVED = / measure=observed /;
+export const LEVEL = /(?:^|\s)scope=(?:cost\/)?reader\//;
+export const readerOf = (line) => /(?:^|\s)by=reader:([0-9a-f]+)/.exec(line)?.[1];
+export const trimmed = (where) => where.replace(/\/+$/, '');
+import { sha } from "../host/hash.js";
+export { sha } from "../host/hash.js";
+/**
+ * What a reader said is kept by region: the region a place lies in is the longest a reader's lock names that holds it,
+ * the stamps and digests it was observed at are lines of that region's shard, and what the reader answered for the
+ * region is one observation, stored under its reader's extension, the region, the digest of the region's places and
+ * the resolution it was read at. A fold opens the shards of the regions it reaches and reads each observation by its
+ * key: nothing is scanned, the same bytes are never read twice, and an observation found under its key is the reading.
+ */
+export function regionIn(regions, place) {
+    let best = '';
+    for (const region of regions)
+        if (region.length > best.length && (place === region || place.startsWith(`${region}/`)))
+            best = region;
+    return best;
+}
+const observationAt = (store, key) => storeAt(store, 'cas', 'observations', key);
+export const keyOf = (by, region, pairs, resolution = '1') => sha(`${by}\n${region}\n${sha([...pairs].sort().join('\n'))}\n${resolution}`);
+export const observed = (store, key) => existsSync(observationAt(store, key));
+export function observation(store, key) {
+    return observeText(observationAt(store, key))?.split('\n').filter(isWire);
+}
+export function keepObservation(store, key, lines) {
+    const at = observationAt(store, key);
+    if (existsSync(at))
+        return;
+    mkdirSync(dirname(at), { recursive: true });
+    writeFileSync(`${at}.${process.pid}`, `${[...new Set(lines)].sort().join('\n')}\n`);
+    renameSync(`${at}.${process.pid}`, at);
+}
+export function opened(store, speaker, region, alive) {
+    const places = new Map();
+    const keys = new Map();
+    const pointers = new Map();
+    const lines = shardLines(store, speaker, region);
+    for (const line of lines) {
+        if (OBSERVED.test(line))
+            places.set(`${readerOf(line) ?? ''} ${fieldOf(line, 'scope')}`, { at: fieldOf(line, 'at'), line });
+        else if (line.includes(' measure=observation ')) {
+            keys.set(readerOf(line) ?? '', fieldOf(line, 'value'));
+            pointers.set(readerOf(line) ?? '', line);
+        }
+    }
+    const live = [...lines.filter((line) => LEVEL.test(line)), ...[...places].filter(([name]) => alive.has(name.slice(0, name.indexOf(' ')))).map(([, one]) => one.line),
+        ...[...pointers].filter(([by]) => alive.has(by)).map(([, line]) => line)];
+    if (lines.length > 2 * live.length + 500) {
+        const at = shardFile(store, speaker, region);
+        writeFileSync(`${at}.${process.pid}`, `${live.join('\n')}\n`);
+        renameSync(`${at}.${process.pid}`, at);
+    }
+    return { region, places, keys };
+}
+export const pointer = (speaker, by, region, key, pairs) => canonical({ scope: region || '.', role: 'writes', form: 'alphabet', measure: 'observation', value: key, by: `${speaker}:${by}`, at: `place:${sha([...pairs].sort().join('\n'))}` });
+export function legacyOf(store, speaker, regions) {
+    if (!existsSync(writerFile(store, speaker)))
+        return undefined;
+    const latest = new Map();
+    const readings = new Map();
+    const level = new Map();
+    for (const line of ledgerLines(store, speaker)) {
+        if (OBSERVED.test(line))
+            latest.set(`${readerOf(line) ?? ''} ${fieldOf(line, 'scope')}`, line);
+        else if (LEVEL.test(line)) {
+            const region = regionIn(regions, fieldOf(line, 'scope').replace(/^(?:cost\/)?reader\//, ''));
+            level.set(region, [...(level.get(region) ?? []), line]);
+        }
+        else {
+            const key = `${readerOf(line) ?? ''} ${fieldOf(line, 'at')}`;
+            readings.set(key, [...(readings.get(key) ?? []), line]);
+        }
+    }
+    const shards = new Map(level);
+    for (const line of latest.values()) {
+        const region = regionIn(regions, fieldOf(line, 'scope'));
+        shards.set(region, [...(shards.get(region) ?? []), line]);
+    }
+    for (const [region, lines] of shards)
+        landShard(store, speaker, region, lines);
+    return readings;
+}
+export function setAside(store, speaker) {
+    const at = writerFile(store, speaker);
+    if (!existsSync(at))
+        return;
+    const bytes = observeFile(at) ?? new Uint8Array();
+    const kept = blobAt(store, bytesDigest(store, bytes));
+    mkdirSync(dirname(kept), { recursive: true });
+    renameSync(at, kept);
+    process.stderr.write(`SHARDED  ${speaker} · one file of ${bytes.length} bytes laid out by region · kept as ${bytesDigest(store, bytes)}\n`);
+}

package/dist/fold/signed.d.ts

@@ -0,0 +1,18 @@
+/** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
+export declare const tellOwn: (place: string, lines: readonly string[]) => void;
+/**
+ * A place's own lock, folded as the tree folds its own: a line that carries a signature stands only when a key the
+ * tree's lock admits signed it, inside the window that key held at the epoch it signed and inside its coverage of the
+ * place, the line's scope read as a region of the place; a line that carries none is the place's target text until the
+ * place signs its lock, and never stands where only signed lines are asked for.
+ */
+export declare function ownLockOf(root: string, place: string, signedOnly?: boolean): readonly string[];
+/**
+ * What a place's own lock holds by signature — a key the tree admits signed the line, inside its window and its coverage
+ * of the place — withdrawal or not: whether one line stands there so, the lines that do, and how many were written into
+ * the lock rather than applied to it.
+ */
+export declare const admittedIn: (root: string, place: string, line: string) => boolean;
+export declare const appliedIn: (root: string, place: string) => readonly string[];
+export declare const forksIn: (root: string, place: string) => readonly string[];
+export declare const writtenIn: (root: string, place: string) => number;

package/dist/fold/signed.js

@@ -0,0 +1,75 @@
+import { join } from "../host/io.js";
+import { region, within } from '@lapxo/obligations/field';
+import { LOCK, parse, windowAt } from '@lapxo/topos/wire';
+import { fieldOf, foldClaims, isWire, sayingOf } from "./claims.js";
+import { signaturesOf } from "./digests.js";
+import { lockLines, lockStanding } from "./keys.js";
+import { wordOf } from "./wire.js";
+import { authorityFor, rootSigner } from "./signers.js";
+import { shardLines, storeOf } from "../land/ledger.js";
+import { verifiesFields } from "../land/sign.js";
+import { observeText } from "../observe/files.js";
+const held = new Map();
+const told = new Map();
+/** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
+export const tellOwn = (place, lines) => void told.set(place, lines);
+function verified(root, place) {
+    const store = storeOf(root);
+    const lock = lockLines(store);
+    const publicText = observeText(join(root, place, LOCK)) ?? '';
+    const hasAuthority = lock.some(line => fieldOf(line, 'sig') !== '');
+    const algorithms = hasAuthority ? signaturesOf(store).admitted : [];
+    const signers = algorithms.length ? authorityFor(lock, rootSigner(root), algorithms).admitted : [];
+    const history = signers.flatMap(signer => shardLines(store, signer.id, `${place}/${LOCK}`));
+    const text = [publicText, ...history, ...(told.get(place) ?? [])].join('\n');
+    const key = `${root} ${place}`;
+    const last = held.get(key);
+    if (last !== undefined && last.text === text && last.lock === lock)
+        return last;
+    const lines = [...new Set(text.split('\n').filter(isWire))];
+    const family = signers.length ? wordOf(lockStanding(store), 'families', 'region') : '';
+    const stands = (line) => {
+        const got = parse(line);
+        if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)
+            return false;
+        const fields = got.value.fields;
+        const signer = signers.find((one) => one.id === fields['by']);
+        const epoch = Number(fields['epoch']) || 0;
+        if (signer === undefined || !verifiesFields(fields, signer.publicKey, algorithms))
+            return false;
+        const window = windowAt(signer, epoch);
+        return epoch >= window.start && (window.close === null || epoch <= window.close)
+            && signer.coverage.some((prefix) => prefix === '*' || within(region(`${family}/${place}/${fields['scope'] ?? ''}`, './'), region(prefix, './')));
+    };
+    const applied = new Set(lines.filter(stands));
+    // A published copy of an authenticated delivery is not another inscription.
+    const projected = new Set([...applied].map(sayingOf));
+    const got = { text, lock, lines, applied, projected, folded: new Map() };
+    held.set(key, got);
+    return got;
+}
+/**
+ * A place's own lock, folded as the tree folds its own: a line that carries a signature stands only when a key the
+ * tree's lock admits signed it, inside the window that key held at the epoch it signed and inside its coverage of the
+ * place, the line's scope read as a region of the place; a line that carries none is the place's target text until the
+ * place signs its lock, and never stands where only signed lines are asked for.
+ */
+export function ownLockOf(root, place, signedOnly = false) {
+    const got = verified(root, place);
+    const kept = got.folded.get(signedOnly);
+    if (kept !== undefined)
+        return kept;
+    const standing = foldClaims(got.lines.filter((line) => got.applied.has(line) || (!signedOnly && !/ sig=/.test(line) && !got.projected.has(sayingOf(line))))).standing
+        .filter((line) => fieldOf(line, 'value') !== 'withdraw');
+    got.folded.set(signedOnly, standing);
+    return standing;
+}
+/**
+ * What a place's own lock holds by signature — a key the tree admits signed the line, inside its window and its coverage
+ * of the place — withdrawal or not: whether one line stands there so, the lines that do, and how many were written into
+ * the lock rather than applied to it.
+ */
+export const admittedIn = (root, place, line) => verified(root, place).applied.has(line);
+export const appliedIn = (root, place) => [...verified(root, place).applied];
+export const forksIn = (root, place) => ((got) => foldClaims(got.lines.filter((line) => got.applied.has(line) || (!/ sig=/.test(line) && !got.projected.has(sayingOf(line))))).forks.map((fork) => fork.key))(verified(root, place));
+export const writtenIn = (root, place) => ((got) => got.lines.filter((line) => !got.applied.has(line)).length)(verified(root, place));