@lapxo/bound 0.1.0

package/dist/judge/take.js

@@ -0,0 +1,75 @@
+import { createHash, existsSync, join } from "../host/io.js";
+import { fullDigest } from "../fold/digests.js";
+import { answers, point, region } from '@lapxo/obligations/field';
+import { parse, PROTOCOL } from '@lapxo/topos/wire';
+import { observeText } from "../observe/files.js";
+import { storeOf } from "../land/ledger.js";
+import { holdsCases } from "../fold/paid.js";
+/** A demanded location is a region: it is there when some place of the tree answers to it, file or directory alike. */
+function located(root, location) {
+    return existsSync(join(root, location.replace(/\/+$/, '')));
+}
+function namedEffects(_root, _changed, _ROOTS) {
+    return [];
+}
+export function judgeTake(input) {
+    const { root, scope, value, locations, before, after } = input;
+    const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
+    const moved = paths.filter((p) => before.get(p) !== after.get(p));
+    const notOwned = moved.filter((coordinate) => {
+        if (before.has(coordinate) || locations.includes(coordinate) || !input.witnessOf || !input.law)
+            return false;
+        const named = input.witnessOf(coordinate);
+        return named !== undefined && !input.law.includes(named);
+    });
+    const changed = moved.filter((coordinate) => !notOwned.includes(coordinate));
+    const absent = value === 'present' ? locations.filter((l) => !located(root, l)) : [];
+    const effects = changed.length && !absent.length ? namedEffects(root, changed, input.template) : [];
+    const envelope = {
+        scope,
+        cone: [...locations],
+        before: Object.fromEntries([...before].sort()),
+        after: Object.fromEntries([...after].filter(([coordinate]) => !notOwned.includes(coordinate)).sort()),
+        effects,
+    };
+    const digest = fullDigest(storeOf(root), JSON.stringify({ ...envelope, effects: effects.map((e) => ({ kind: e.kind, status: e.status, at: e.at })) }));
+    const refuse = (why) => ({ kind: 'refuse', why, envelope, digest, changed, notOwned });
+    const met = (why) => ({ kind: 'fact', why, envelope, digest, changed, notOwned });
+    if (!changed.length)
+        return refuse('nothing in the cone moved against what was vouched');
+    const cone = locations.map((l) => region(l));
+    const outside = changed.filter((coordinate) => !answers([point(coordinate)], cone));
+    if (outside.length)
+        return refuse(`outside the cone: ${outside.join(', ')}`);
+    if (absent.length)
+        return refuse(`demanded locations absent: ${absent.join(', ')}`);
+    if (input.shape === 'lock' || input.shape === 'render') {
+        const lines = locations.map((l) => ({ at: l, text: observeText(join(root, l)) }));
+        const absent = lines.filter((one) => one.text === undefined).map((one) => one.at);
+        if (absent.length)
+            return refuse(`a lock the demand names is not here: ${absent.join(', ')}`);
+        const said = lines.flatMap((one) => (one.text ?? '').split('\n').filter((line) => line.startsWith(PROTOCOL)));
+        const unread = said.filter((line) => parse(line).kind !== 'fact');
+        if (input.shape === 'lock' && (!said.length || unread.length)) {
+            return refuse(`a lock the demand names holds ${said.length ? `${unread.length} lines the wire does not read` : 'no claim'}`);
+        }
+        const rests = input.restsOn ?? '';
+        const digest = rests ? `sha256:${createHash('sha256').update(lines.map((one) => one.text ?? '').join('')).digest('hex')}` : rests;
+        if (rests && digest !== rests)
+            return refuse(`the lock moved: it rests on ${rests} and is ${digest}`);
+        return met(input.shape === 'lock' ? `${said.length} lines of the lock read, at the digest it rests on` : 'the region is here, at the digest it rests on');
+    }
+    const vectors = locations.filter((l) => holdsCases(l) && located(root, l));
+    if (!vectors.length)
+        return refuse('no vector location in the cone exists');
+    const red = effects.filter((e) => e.status === 'red' && e.admitted);
+    if (red.length)
+        return refuse(`effects red: ${red.map((e) => `${e.kind}@${e.at}`).join(', ')}`);
+    return met('demand met in its cone');
+}
+/** A take that met its cone carries the gates its batch passed: their runs join its envelope, and its receipt is sealed with them. */
+export function sealed(root, verdict, gates) {
+    const envelope = { ...verdict.envelope, effects: [...verdict.envelope.effects, ...gates.map(({ kind, status, ms, at, admitted }) => ({ kind, status, ms, at, admitted }))] };
+    const digest = fullDigest(storeOf(root), JSON.stringify({ ...envelope, effects: envelope.effects.map((e) => ({ kind: e.kind, status: e.status, at: e.at })) }));
+    return { ...verdict, envelope, digest };
+}

package/dist/judge/widening.d.ts

@@ -0,0 +1 @@
+export declare function widenedWithoutWitness(proposed: readonly string[], standing: readonly string[], isCeiling: (line: string) => boolean, witness: string): readonly string[];

package/dist/judge/widening.js

@@ -0,0 +1,25 @@
+import { fieldOf } from "../fold/claims.js";
+import { ALPHABETS, idsOf, INTERVALS, spanOf } from '@lapxo/topos/forms';
+/**
+ * A ceiling that admits more than it did is not a revision of the same kind as one that admits less: narrowing costs
+ * the signer nothing anyone else can dispute, while widening gives back freedom the tree had already spent. So a line
+ * that widens what it replaces is refused unless it says what forced it — an `at` of the witness class, which names
+ * the reading or the case that made the old bound wrong. Policy may narrow; only a witness may widen. A list of what is
+ * forbidden narrows as it grows.
+ */
+function widens(now, before) {
+    const [was, held] = [spanOf(fieldOf(before, 'value')), spanOf(fieldOf(now, 'value'))];
+    if (was && held)
+        return INTERVALS.leq(was, held) && !INTERVALS.leq(held, was);
+    const [old, fresh] = [idsOf(fieldOf(before, 'value')), idsOf(fieldOf(now, 'value'))];
+    return old.polarity === fresh.polarity && ALPHABETS.leq(old, fresh) && !ALPHABETS.leq(fresh, old);
+}
+export function widenedWithoutWitness(proposed, standing, isCeiling, witness) {
+    const held = new Map(standing.filter(isCeiling).map((line) => [fieldOf(line, 'scope'), line]));
+    return proposed.filter((line) => {
+        const before = held.get(fieldOf(line, 'scope'));
+        if (!before || !isCeiling(line) || !widens(line, before))
+            return false;
+        return !fieldOf(line, 'at').startsWith(`${witness}:`);
+    });
+}

package/dist/land/act.d.ts

@@ -0,0 +1,4 @@
+export declare function underTheRegions<T>(store: string, regions: readonly string[], what: string, act: () => T | Promise<T>): Promise<T>;
+export declare const holdRoot: (store: string, what: string) => Promise<void>;
+export declare function underTheLock<T>(store: string, what: string, act: () => T | Promise<T>): Promise<T>;
+export declare const holds: (store: string, region: string) => boolean;

package/dist/land/act.js

@@ -0,0 +1,209 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync } from "../host/io.js";
+import { selfName } from "../fold/claims.js";
+import { placesIn } from "../fold/places.js";
+import { coordinatesUnder, observeText } from "../observe/files.js";
+const context = new AsyncLocalStorage();
+const held = new Map();
+const pauseFor = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
+const ROOT = '_root';
+const MINUTE = 60000;
+const holderOf = (at) => {
+    const text = observeText(at);
+    if (text === undefined)
+        return undefined;
+    const [pid, what, since, token] = text.trim().split(' ');
+    return { pid: Number(pid), what: what ?? '', since: since ?? '', token: token ?? '' };
+};
+function overAMinute(at, began, holder) {
+    if (Date.now() - began < MINUTE)
+        return;
+    const who = holder === undefined ? 'a process' : `${holder.pid} · ${holder.what} since ${holder.since}`;
+    process.stderr.write(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
+    throw new Error(`${selfName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
+}
+const alive = (pid) => {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+};
+const regionAt = (store, region) => {
+    const coordinate = region.replace(/\/+$/, '');
+    if ((coordinate && coordinate.split('/').some((step) => step === '..' || step === '.' || step === '')) || coordinate.startsWith('/'))
+        throw new Error(`${selfName()}: REFUSE·lock invalid region coordinate`);
+    return join(store, 'locks', coordinate ? encodeURIComponent(coordinate).replace(/^\./, '%2E').replace(/^_root$/, '%5Froot') : ROOT);
+};
+const coordinateOf = (file) => {
+    if (file === ROOT)
+        return '';
+    try {
+        return decodeURIComponent(file);
+    }
+    catch {
+        return file;
+    }
+};
+const lockFiles = (locks) => coordinatesUnder(locks, locks).filter((file) => {
+    if (file !== '.act')
+        return true;
+    // The legacy marker lists paths, while an actual region named .act has a numeric lock owner.
+    const holder = holderOf(join(locks, file));
+    return holder !== undefined && Number.isSafeInteger(holder.pid) && holder.pid > 0;
+});
+const overlaps = (a, b) => !a || !b || a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+const treeAt = (store) => join(store, 'lock');
+const named = (at) => (basename(at) === 'lock' ? 'the store' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
+const owns = (at) => {
+    for (let frame = context.getStore(); frame !== undefined; frame = frame.parent) {
+        const token = frame.locks.get(at);
+        if (token !== undefined && held.get(at) === token)
+            return true;
+    }
+    return false;
+};
+const ownsRegion = (store) => [...held.keys()].some((at) => at.startsWith(`${join(store, 'locks')}/`) && owns(at));
+/** Reentry belongs to an awaited act's context. Another process or async act has no inherited authority. */
+async function hold(at, what) {
+    if (owns(at))
+        return;
+    const frame = context.getStore();
+    if (frame === undefined)
+        throw new Error(`${selfName()}: REFUSE·lock no act owns this request`);
+    const began = Date.now();
+    const token = randomUUID();
+    let told = false;
+    mkdirSync(dirname(at), { recursive: true });
+    for (;;) {
+        try {
+            writeFileSync(at, `${process.pid} ${what.replace(/\s+/g, '_')} ${new Date().toISOString()} ${token}\n`, { flag: 'wx' });
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT')
+                mkdirSync(dirname(at), { recursive: true });
+            else if (code !== 'EEXIST')
+                throw error;
+        }
+        const holder = holderOf(at);
+        // Removing a dead owner's lock here would race with another process's recovery. Recovery is a separate host act.
+        if (holder !== undefined && !alive(holder.pid)) {
+            throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+        }
+        overAMinute(at, began, holder);
+        if (!told && holder !== undefined) {
+            process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+            told = true;
+        }
+        await pauseFor(250);
+    }
+    if (told)
+        process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
+    held.set(at, token);
+    frame.locks.set(at, token);
+    if (!process.listeners('exit').includes(releaseAll))
+        process.once('exit', releaseAll);
+}
+function release(at, token) {
+    if (held.get(at) !== token)
+        return;
+    held.delete(at);
+    const holder = holderOf(at);
+    if (holder?.pid === process.pid && holder.token === token && existsSync(at))
+        rmSync(at, { force: true });
+}
+function releaseAll() {
+    for (const [at, token] of [...held])
+        release(at, token);
+}
+process.once('SIGTERM', () => {
+    process.stderr.write(`${selfName()}: REFUSE·crash signal\n`);
+    releaseAll();
+    process.exit(1);
+});
+async function framed(takes, act) {
+    const frame = { parent: context.getStore(), locks: new Map() };
+    return context.run(frame, async () => {
+        try {
+            await takes();
+            return await act();
+        }
+        finally {
+            for (const [at, token] of [...frame.locks].reverse())
+                release(at, token);
+            frame.locks.clear();
+        }
+    });
+}
+export function underTheRegions(store, regions, what, act) {
+    return framed(async () => {
+        const tree = treeAt(store);
+        const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
+        if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
+            for (const region of asked)
+                await hold(regionAt(store, region), what);
+            return;
+        }
+        if (ownsRegion(store))
+            throw new Error(`${selfName()}: REFUSE·lock declare every region before entering an act`);
+        const already = owns(tree);
+        // The tree lock is the acquisition gate. A whole-tree act cannot enter between checking it and taking regions.
+        await hold(tree, what);
+        try {
+            const locks = join(store, 'locks');
+            for (;;) {
+                const conflict = lockFiles(locks).find((file) => asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file))) && !owns(join(locks, file)));
+                if (conflict === undefined)
+                    break;
+                const at = join(locks, conflict);
+                const began = Date.now();
+                for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
+                    if (!alive(holder.pid))
+                        throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+                    overAMinute(at, began, holder);
+                    await pauseFor(250);
+                }
+            }
+            for (const region of asked.filter(Boolean).sort())
+                await hold(regionAt(store, region), what);
+            if (asked.includes(''))
+                await hold(regionAt(store, ''), what);
+        }
+        finally {
+            if (!already) {
+                const frame = context.getStore();
+                const token = frame.locks.get(tree);
+                if (token !== undefined) {
+                    release(tree, token);
+                    frame.locks.delete(tree);
+                }
+            }
+        }
+    }, act);
+}
+export const holdRoot = async (store, what) => {
+    if (!owns(treeAt(store)))
+        await hold(regionAt(store, ''), what);
+};
+export function underTheLock(store, what, act) {
+    return framed(async () => {
+        if (!owns(treeAt(store)) && ownsRegion(store))
+            throw new Error(`${selfName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
+        await hold(treeAt(store), what);
+        const locks = join(store, 'locks');
+        const active = lockFiles(locks);
+        for (const file of [...active].sort())
+            await hold(join(locks, file), what);
+        for (const region of [...placesIn(dirname(store))].sort())
+            await hold(regionAt(store, region), what);
+        await hold(regionAt(store, ''), what);
+    }, act);
+}
+export const holds = (store, region) => [treeAt(store), regionAt(store, region)].some(owns);

package/dist/land/alias.d.ts

@@ -0,0 +1,10 @@
+/**
+ * An alias is gone only when no pin will still name its digest. The pins are the root's uses lines and each world's own,
+ * minus the pins this batch itself withdraws, plus the pins it adds. Checked before the trial, so a batch that would
+ * orphan a pin lands nothing.
+ */
+export declare function aliasPinned(root: string, signed: readonly string[]): readonly {
+    readonly scope: string;
+    readonly digest: string;
+    readonly by: readonly string[];
+}[];

package/dist/land/alias.js

@@ -0,0 +1,41 @@
+import { ENVELOPE } from '@lapxo/topos/wire';
+import { fieldOf, fieldsOf } from "../fold/claims.js";
+import { lockStanding } from "../fold/keys.js";
+import { worldsIn } from "../fold/places.js";
+import { ownLockOf } from "../fold/signed.js";
+import { storeOf } from "./ledger.js";
+const retracts = (withdraw, line) => Object.keys(withdraw).filter((key) => !ENVELOPE.has(key) && key !== 'value').every((key) => line[key] === withdraw[key]);
+const pinScope = (scope) => scope === 'uses' || scope.startsWith('uses/') || scope.split('/').slice(1, -1).includes('uses');
+const aliasWithdraw = (line) => fieldOf(line, 'value') === 'withdraw' && fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads';
+/**
+ * An alias is gone only when no pin will still name its digest. The pins are the root's uses lines and each world's own,
+ * minus the pins this batch itself withdraws, plus the pins it adds. Checked before the trial, so a batch that would
+ * orphan a pin lands nothing.
+ */
+export function aliasPinned(root, signed) {
+    const aliases = lockStanding(storeOf(root)).filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads' && fieldOf(line, 'value') !== 'withdraw');
+    const digests = new Map();
+    for (const withdraw of signed.filter(aliasWithdraw)) {
+        const fields = fieldsOf(withdraw);
+        for (const line of aliases) {
+            if (!retracts(fields, fieldsOf(line)))
+                continue;
+            const digest = fieldOf(line, 'value');
+            const kept = signed.some((one) => fieldOf(one, 'scope') === fieldOf(line, 'scope') && fieldOf(one, 'value') === digest);
+            if (!kept)
+                digests.set(`${fieldOf(line, 'scope')}\0${digest}`, { scope: fieldOf(line, 'scope'), digest });
+        }
+    }
+    if (!digests.size)
+        return [];
+    const named = [
+        ...lockStanding(storeOf(root)).filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: fieldOf(line, 'scope'), value: fieldOf(line, 'value'), fields: fieldsOf(line) })),
+        ...worldsIn(root).flatMap((place) => ownLockOf(root, place).filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: `${place}/${fieldOf(line, 'scope')}`, value: fieldOf(line, 'value'), fields: fieldsOf(line) }))),
+    ];
+    const still = named.filter((pin) => !signed.some((line) => fieldOf(line, 'value') === 'withdraw' && retracts(fieldsOf(line), pin.fields)));
+    const added = signed.filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: fieldOf(line, 'scope'), value: fieldOf(line, 'value') }));
+    return [...digests.values()].flatMap((alias) => {
+        const by = [...still.filter((pin) => pin.value === alias.digest).map((pin) => pin.scope), ...added.filter((pin) => pin.value === alias.digest).map((pin) => pin.scope)];
+        return by.length ? [{ scope: alias.scope, digest: alias.digest, by }] : [];
+    });
+}

package/dist/land/held.d.ts

@@ -0,0 +1,7 @@
+export interface Held {
+    readonly scope: string;
+    readonly bytes: number;
+    readonly at: string;
+}
+/** Bytes the store receipts name: a byte lives only while a standing line names it, and the receipts list what is there. */
+export declare const heldBytes: (_root: string, store: string, _standing: readonly string[]) => number;

package/dist/land/held.js

@@ -0,0 +1,23 @@
+import { fieldOf } from "../fold/claims.js";
+import { spanOf } from '@lapxo/topos/forms';
+import { blobAt, ledgerLines, storeAt } from "./ledger.js";
+const STORE = 'store';
+const pathOf = (store, scope) => {
+    const name = scope.split('/').pop() ?? '';
+    if (scope.startsWith('cas/blobs/'))
+        return blobAt(store, name);
+    if (scope.startsWith('cas/laid/'))
+        return storeAt(store, 'cas', 'laid', name);
+    if (scope.startsWith('cas/answers/'))
+        return storeAt(store, 'cas', 'answers', name);
+    return storeAt(store, ...scope.split('/'));
+};
+const sizeOf = (line) => spanOf(fieldOf(line, 'value'))?.hi ?? 0;
+function inventory(store) {
+    return ledgerLines(store, STORE).filter((line) => fieldOf(line, 'value') !== 'withdraw').map((line) => {
+        const scope = fieldOf(line, 'scope');
+        return { scope, bytes: sizeOf(line), at: pathOf(store, scope) };
+    });
+}
+/** Bytes the store receipts name: a byte lives only while a standing line names it, and the receipts list what is there. */
+export const heldBytes = (_root, store, _standing) => inventory(store).reduce((sum, one) => sum + one.bytes, 0);

package/dist/land/inert.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The ceilings of a batch that would stand unread: no reading meets them and no reading of the instrument's own
+ * carries their measure. A batch that also signs a reader goes through whole, since what a reader reads is known only
+ * once it runs, and so does a ceiling a gate of the same act reads, whose reading lands with it or refuses it.
+ */
+export declare function inertIn(batch: readonly string[], input: {
+    readonly standing: readonly string[];
+    readonly ceiling: (line: string) => boolean;
+    readonly signsReader: boolean;
+    readonly observed: readonly string[];
+    readonly own: Readonly<Record<string, number>>;
+    readonly epoch: number;
+}): readonly string[];
+/** What each ceiling of a batch would bite, read off the summaries of the cone before anything lands. */
+export declare function rankedIn(batch: readonly string[], fold: {
+    readonly standing: readonly string[];
+    readonly observed: readonly string[];
+    readonly own: Readonly<Record<string, number>>;
+}): readonly string[];
+/** Every ceiling asked, at resolution one: what the fold reads for it, beside its bound, or unmeasured where no reading answers it. */
+export declare function readingsIn(ceilings: readonly string[], fold: {
+    readonly standing: readonly string[];
+    readonly observed: readonly string[];
+    readonly own: Readonly<Record<string, number>>;
+    readonly epoch: number;
+}): readonly string[];

package/dist/land/inert.js

@@ -0,0 +1,33 @@
+import { foldCeilings } from "../fold/ceilings.js";
+import { fieldOf } from "../fold/claims.js";
+import { isCeiling } from "../fold/configures.js";
+import { placedReadings } from "../fold/observed.js";
+import { boundOf, rankOf, regionsOf } from "../fold/region.js";
+/**
+ * The ceilings of a batch that would stand unread: no reading meets them and no reading of the instrument's own
+ * carries their measure. A batch that also signs a reader goes through whole, since what a reader reads is known only
+ * once it runs, and so does a ceiling a gate of the same act reads, whose reading lands with it or refuses it.
+ */
+export function inertIn(batch, input) {
+    if (input.signsReader)
+        return [];
+    const folded = foldCeilings({ standing: input.standing, ceilings: batch.filter(input.ceiling), observed: input.observed, own: input.own, epoch: input.epoch });
+    return [...folded.unread, ...folded.vacuous];
+}
+/** What each ceiling of a batch would bite, read off the summaries of the cone before anything lands. */
+export function rankedIn(batch, fold) {
+    const regions = regionsOf(fold.standing, [...fold.standing.filter(isCeiling), ...batch], placedReadings(fold.observed));
+    return batch.map((line) => {
+        const bound = boundOf(regions.named, line);
+        const got = rankOf(regions, bound, fold.own);
+        const bite = got.cells ? `bites ${got.cells} cells in ${got.bars} bars, ${got.fresh} no ceiling above bites` : got.sums ? `bites ${got.sums} sums` : `bites nothing of ${got.met} met`;
+        return `RANK     ${fieldOf(line, 'scope')} · ${bite} · region ${bound.region || '.'}`;
+    });
+}
+/** Every ceiling asked, at resolution one: what the fold reads for it, beside its bound, or unmeasured where no reading answers it. */
+export function readingsIn(ceilings, fold) {
+    const got = foldCeilings({ standing: fold.standing, ceilings, observed: fold.observed, own: fold.own, epoch: fold.epoch });
+    const outside = new Map(got.over.map((one) => [one.ceiling, `${one.side} ${one.got}`]));
+    return ceilings.map((line) => ((scope, read) => `RANK@1   ${scope} · ${fieldOf(line, 'measure')} ${fieldOf(line, 'value')} · ${read === undefined ? 'unmeasured'
+        : `read ${read.length > 3 ? `${read.slice(0, 3).join(' · ')} +${read.length - 3}` : read.join(' · ')}`}${outside.has(scope) ? ` · ${outside.get(scope)}` : read === undefined ? '' : ' · met'}`)(fieldOf(line, 'scope'), got.readings.get(fieldOf(line, 'scope'))));
+}

package/dist/land/leaving.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A file goes from the tree through a line, never through a hand: its path withdrawn in the family the lock sources files
+ * by is the only way a file goes, and the fold refuses it while a block still reads the file — what a run depends on is judged by the run's
+ * own memo, which names every file each block read, and not by a search for the file's name in a test. A search misses
+ * a name built in a loop; the memo does not. A test file goes with its own blocks, and is refused while one of them
+ * is the only run of a vector or a sample, which it names.
+ */
+export declare function coordinatesWithdrawn(root: string, store: string, signed: readonly string[], standing: readonly string[]): {
+    readonly taken: readonly string[];
+    readonly refused: readonly {
+        readonly path: string;
+        readonly by: string;
+    }[];
+};

package/dist/land/leaving.js

@@ -0,0 +1,51 @@
+import { fieldOf } from "../fold/claims.js";
+import { sourced } from "./vouched.js";
+import { observedClaims } from "../fold/observed.js";
+/**
+ * A file goes from the tree through a line, never through a hand: its path withdrawn in the family the lock sources files
+ * by is the only way a file goes, and the fold refuses it while a block still reads the file — what a run depends on is judged by the run's
+ * own memo, which names every file each block read, and not by a search for the file's name in a test. A search misses
+ * a name built in a loop; the memo does not. A test file goes with its own blocks, and is refused while one of them
+ * is the only run of a vector or a sample, which it names.
+ */
+export function coordinatesWithdrawn(root, store, signed, standing) {
+    const family = sourced(standing);
+    const asked = signed.filter((line) => fieldOf(line, 'scope').startsWith(`${family}/`) && fieldOf(line, 'value') === 'withdraw')
+        .map((line) => fieldOf(line, 'scope').slice(family.length + 1));
+    if (!asked.length)
+        return { taken: [], refused: [] };
+    /** A run rewrites every block of a test file under one observation, so a block whose title moved still holds a row
+     * from an older one: what reads a file now is what the latest run of each test file wrote, and nothing older. */
+    const memo = observedClaims(root, store, { wait: false }).filter((line) => fieldOf(line, 'measure') === 'memo');
+    const fileOf = (scope) => scope.split('/').slice(0, 2).join('/');
+    const last = new Map();
+    for (const line of memo)
+        last.set(fileOf(fieldOf(line, 'scope')), fieldOf(line, 'at'));
+    const latest = new Map();
+    for (const line of memo) {
+        const scope = fieldOf(line, 'scope');
+        if (fieldOf(line, 'at') === last.get(fileOf(scope)))
+            latest.set(scope, fieldOf(line, 'value'));
+    }
+    const refused = [];
+    const taken = [];
+    const ownOf = (inside) => (/^test\/[^/]+\.test\.ts$/.test(inside) ? `vector-memo/${inside.slice('test/'.length)}/` : undefined);
+    const leaving = asked.map((path) => ownOf(path.slice(path.indexOf('/') + 1))).filter((own) => own !== undefined);
+    const runs = (value) => value.split('|').filter((token) => token.startsWith('read:') && !token.includes('#')).map((token) => token.slice('read:'.length));
+    for (const path of asked) {
+        const inside = path.slice(path.indexOf('/') + 1);
+        const own = ownOf(inside);
+        const reads = (value) => value.split('|').some((token) => token.startsWith(`in:${inside}:`) && /^[0-9a-f]{12}$/.test(token.slice(`in:${inside}:`.length)));
+        const by = [...latest].find(([scope, value]) => (own === undefined || !scope.startsWith(own)) && reads(value))?.[0];
+        const elsewhere = new Set([...latest].filter(([scope]) => !leaving.some((one) => scope.startsWith(one))).flatMap(([, value]) => runs(value)));
+        const only = own === undefined ? undefined : [...latest].filter(([scope]) => scope.startsWith(own))
+            .flatMap(([scope, value]) => runs(value).filter((name) => !elsewhere.has(name)).map((name) => `${scope}, the only run of ${name}`))[0];
+        if (by !== undefined)
+            refused.push({ path, by });
+        else if (only !== undefined)
+            refused.push({ path, by: only });
+        else
+            taken.push(path);
+    }
+    return { taken, refused };
+}

package/dist/land/ledger.d.ts

@@ -0,0 +1,28 @@
+export declare function storeOf(root: string): string;
+/**
+ * The store of a place: every name under it is read here and nowhere else, whoever needs a place asks for it by its
+ * steps, and one append-only file per writer stands beside the bytes kept by digest — one per region for a writer
+ * whose lines are about regions, so a fold opens only the regions it reaches. A file is read once per stamp, and a
+ * ledger only grows: what it held is kept, and only the bytes appended since, from where it last ended a line, are read.
+ */
+export declare function storeAt(store: string, ...steps: readonly string[]): string;
+export declare function writerFile(store: string, writer: string): string;
+export declare function ledgerLines(store: string, writer: string): readonly string[];
+export declare function shardFile(store: string, writer: string, region: string): string;
+export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
+export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
+export declare function signedLines(store: string, writer: string): string[];
+export declare function blobAt(store: string, digest: string): string;
+/** A file replaced whole: the bytes land in a temp beside it and the name moves in one rename, so a killed write keeps the temp, never a torn file under the name a later read parses. */
+export declare function replaceWhole(at: string, bytes: Uint8Array | string): void;
+export declare const landBlob: (store: string, digest: string, bytes: Uint8Array) => string;
+export declare function holdStore(store: string, kind: 'blobs' | 'laid' | 'answers', name: string, bytes: number): void;
+export declare const memoAt: (store: string, key: string) => string;
+export declare function landMemo(store: string, key: string, bytes: Uint8Array): string;
+export declare const landEnvelope: (store: string, digest: string, bytes: string) => string;
+export declare function land(store: string, writer: string, lines: readonly string[]): {
+    readonly at: string;
+    readonly appended: number;
+};
+export declare function keptVerdict(store: string, tree: string, lot: string): unknown[] | undefined;
+export declare function keepVerdict(store: string, tree: string, lot: string, judged: readonly unknown[]): void;