@lapxo/bound 0.1.1 → 0.1.3

package/dist/cli/verb.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-import { resolveSources } from "../host/source-content.js";
+import { withoutEffects } from "../host/read-only.js";
+import { resolveSources, resolveRequested } from "../host/source-content.js";
 import { cellsWithReceipts } from "../host/cell-receipts.js";
+import { renderCells } from '@lapxo/topos/cells-view';
 import { releasePolicyLines } from "../fold/release-policy.js";
 import { admittedObjects } from "../host/objects.js";
 import { objectFold } from "../fold/object.js";
@@ -15,7 +17,7 @@ import { eraOf, signaturesOf } from "../fold/digests.js";
 import { fullDigest as bootstrapDigest } from "../host/digest.js";
 import { canonical } from '@lapxo/topos/wire';
 import { EXTENSION, LOCK, fieldOf, foldClaims, isWire, selfName } from "../fold/claims.js";
-import { observedClaims } from "../fold/observed.js";
+import { observedClaims, readerRefusals } from "../fold/observed.js";
 import { rolesOf } from "../fold/roles.js";
 import { authorityFor, releaseSigner, rootSigner, writerFor } from "../fold/signers.js";
 import { land, ledgerLines, storeOf } from "../land/ledger.js";
@@ -189,10 +191,31 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
     const rest = told.filter((line) => !ledger.includes(line));
     if (place && rest.length)
         tellOwn(place, rest);
+    if (name === NAMED_VIEWS.lines && (told.length || depth === undefined)) {
+        const text = standingOf(root, under, ledger).standing.filter(isWire).join('\n');
+        process.stdout.write(text ? `${text}\n` : '');
+        return EXIT.closed;
+    }
+    if (told.length) {
+        const selected = viewsOf(standingOf(root, under, ledger).standing).get(name);
+        if (selected && !selected.shape && selected.regions.some(region => region.name === 'cells')) {
+            const history = [...signedOwnerLines(storeOf(root)), ...ledger];
+            const held = await admittedObjects(root, history);
+            process.stdout.write(`TOLD     ${told.length} lines folded as if landed · nothing written\n`);
+            for (const line of renderCells(objectFold(held.records, held.context)))
+                process.stdout.write(line + '\n');
+            return EXIT.closed;
+        }
+    }
     const own = place ? rest.filter((line) => admittedIn(root, place, line)) : [];
     const fold = told.length
-        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }) })
-        : foldPlace(root, entryOf(root), under, false);
+        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }), free: true })
+        : foldPlace(root, entryOf(root), under, true);
+    if (!told.length && readerRefusals().length) {
+        for (const why of readerRefusals())
+            process.stderr.write(`${selfName()}: ${why}\n`);
+        return EXIT.refuse;
+    }
     if (coord)
         askWhy(fold, coord);
     if (name === NAMED_VIEWS.lines) {
@@ -200,6 +223,9 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
             beat(root, fold, Date.now() - at);
         const text = fold.standing.filter(isWire).join('\n');
         process.stdout.write(text ? `${text}\n` : '');
+        if (depth === '1')
+            for (const line of readingsIn([...fold.standing.filter(isCeiling), ...ownCeilings(under)], fold))
+                process.stdout.write(`${line}\n`);
         return EXIT.closed;
     }
     const views = viewsOf(fold.standing);
@@ -371,7 +397,7 @@ function foldFile(at) {
     process.stdout.write(`FACT     ${folded.standing.length} standing · ${folded.forks.length} forks · ${basename(at)}\n`);
     return EXIT.closed;
 }
-function foldVerb(_root, rest) {
+function foldVerb(root, rest) {
     const files = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory() && one.endsWith(EXTENSION));
     const places = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (files.length === 1 && !places.length && valueOf(rest, FLAGS.as) === undefined) {
@@ -381,14 +407,24 @@ function foldVerb(_root, rest) {
         return foldAt(dirname(at), undefined, rest);
     }
     const under = places[0];
-    const tree = files.length === 1 ? dirname(resolve(files[0])) : resolve('.');
+    // A prospective lot is data, not the place whose authority admits it.
+    const tree = files.length ? root : resolve('.');
     const place = under ? relative(tree, resolve(under)).split(sep).join('/') : '';
     return foldAt(tree, place ? `${place}/` : undefined, rest);
 }
 async function foldAt(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
-    if (as !== NAMED_VIEWS.help && signedOwnerLines(storeOf(root)).length)
-        await resolveSources(standingOf(root, under).standing);
+    const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    if (as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+        return foldResolved(root, under, argv);
+    return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
+}
+async function foldResolved(root, under, argv) {
+    const as = valueOf(argv, FLAGS.as);
+    const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    // Public content is authenticated by its digest, independently of owner history.
+    // A named view does not request mounting every release of the instrument.
+    const receiptCheck = as === undefined && argv.includes(FLAGS.check);
     if (as === OBJECT_VIEW) {
         const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
         if (inputs.length > 1)
@@ -404,6 +440,8 @@ async function foldAt(root, under, argv) {
     const key = valueOf(argv, FLAGS.key);
     if (as === undefined) {
         const exit = await pass(root, entryOf(root), under, argv.includes(FLAGS.check));
+        if (receiptCheck)
+            return exit;
         if (exit !== 0)
             return exit;
         const history = signedOwnerLines(storeOf(root));
@@ -419,7 +457,7 @@ async function foldAt(root, under, argv) {
         }
         return exit;
     }
-    const named = positionalsOf(argv).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    const named = inputs;
     const coord = positionalsOf(argv).find((one) => one !== under?.replace(/\/$/, '') && !one.startsWith('-') && !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
     if ((as === 'why' || as === NAMED_VIEWS.because || as.split('@')[0] === 'why') && coord !== undefined)
         return view(root, under, as === NAMED_VIEWS.because ? 'why' : as, [], coord, key);
@@ -430,7 +468,7 @@ async function foldAt(root, under, argv) {
         return batch.code;
     if (batch.kind === 'once')
         process.stdout.write(`ONCE     ${batch.proposed.length} lines · every one already landed: the view folds the tree as it stands\n`);
-    return view(root, under, as, batch.kind === 'signed' ? batch.signed : [], undefined, key);
+    return withoutEffects(() => view(root, under, as, batch.kind === 'signed' ? batch.signed : batch.proposed, undefined, key));
 }
 const VERBS = {
     fold: (root, rest) => foldVerb(root, rest),

package/dist/fold/configures.js

@@ -3,6 +3,9 @@ import { fieldOf, isConfig } from "./claims.js";
 import { isReaderLock } from "./observed.js";
 import { isRoleLock } from "./roles.js";
 import { isSignerLock } from "./signers.js";
+import { isReleaseBinding } from "../host/release.js";
+import { isRegionDeclaration } from "./region-declarations.js";
+import { ownLock } from "../observe/runner.js";
 function isEffectLock(line) {
     const got = parse(line);
     return got.kind === 'fact' && got.value.fields['measure'] === 'effect';
@@ -10,7 +13,7 @@ function isEffectLock(line) {
 /** A lock line the instrument itself consumes — an effect it runs, a reader it loads, a role it walks by, a signer it admits, the wire it reads by. */
 function configures(line) {
     const got = parse(line);
-    return isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields));
+    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields)) || isRegionDeclaration(line, ownLock());
 }
 /** Every reads line that configures nothing is a ceiling: a bound some reading has to meet. */
 export function isCeiling(line) {

package/dist/fold/digests.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { appendFileSync, dirname, join, mkdirSync, readdirSync, relative, resolve } from "../host/io.js";
 import { bytesDigest as bytesWith, fullDigest as fullWith } from "../host/digest.js";
 import { coordinatesUnder, observeFile, observeText, stampOf } from "../observe/files.js";
@@ -116,6 +117,8 @@ export function coordinateDigest(store, at) {
         return held;
     const digest = bytesDigest(store, observeFile(at) ?? new Uint8Array());
     memo.set(key, digest);
+    if (readOnly())
+        return digest;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${digest}\n`);
     return digest;
@@ -127,6 +130,8 @@ export function memoized(store, key, compute) {
         return held;
     const value = compute();
     memo.set(key, value);
+    if (readOnly())
+        return value;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${value}\n`);
     return value;
@@ -141,7 +146,8 @@ const importsOf = (store, at, digest) => {
     const found = [...new TextDecoder().decode(observeFile(at) ?? new Uint8Array()).matchAll(/(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s*)['"]([^'"]*)['"]/g)].map((m) => m[1] ?? '');
     imported.set(digest, found);
     memo.set(key, found.join('|'));
-    appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
+    if (!readOnly())
+        appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
     return found;
 };
 /**

package/dist/fold/kept.js

@@ -1,10 +1,11 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
-import { landMemo, ledgerLines, memoAt } from "../land/ledger.js";
-import { observeText } from "../observe/files.js";
+import { landMemo, ledgerLines, memoAt, shardFile, writerFile } from "../land/ledger.js";
+import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { EXTENSION, fieldOf } from "./claims.js";
-import { keyFor, lockSigners } from "./keys.js";
+import { keyFor, keyOf, lockSigners } from "./keys.js";
 import { sourceOf, vouching } from "../land/vouched.js";
 import { wordsOf } from "./wire.js";
 import { ownLock } from "../observe/runner.js";
@@ -45,6 +46,7 @@ export function foldPoints(store, standing, under, keeper, instrument = '', obse
     return [
         `place ${under ?? '.'}`,
         `instrument ${instrument}`,
+        `reading context ${readingContext(store)}`,
         ...written,
         ...lined,
         ...[...new Set(coordinates)].sort(),
@@ -93,6 +95,14 @@ export const foldsElsewhere = () => elsewhere.folds;
 const joined = (lines) => lines.join('\n');
 const split = (text) => (text === '' ? [] : text.split('\n'));
 const linesOf = (value) => value === undefined ? [] : typeof value === 'string' ? split(value) : value;
+/** Operational reader history guards file-fold reuse, never cell-region identity. */
+function readingContext(store) {
+    const speaker = keyOf(store, 'read');
+    const files = speaker === undefined ? [] : [writerFile(store, speaker), ...coordinatesUnder(dirname(shardFile(store, speaker, '')), store)
+            .filter(file => file.endsWith(EXTENSION)).map(file => join(store, file))];
+    return bytesDigest(store, text(files.filter(file => existsSync(file)).sort()
+        .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())).join('\n')));
+}
 export function keptPlace(store, under) {
     const key = observeText(memoAt(store, lastOf([`place ${under ?? '.'}`])))?.trim();
     if (key === undefined || key === '')
@@ -101,6 +111,8 @@ export function keptPlace(store, under) {
     if (held === undefined)
         return undefined;
     const blob = JSON.parse(held);
+    if (blob.readingContext !== readingContext(store))
+        return undefined;
     const fold = blob.fold;
     return {
         ...fold,
@@ -118,8 +130,11 @@ export function keptPlace(store, under) {
     };
 }
 export const keptRender = (store, key, name) => observeText(memoAt(store, `render/${key}/${name}`));
-export const keepRender = (store, _signer, key, name, _epoch, text_) => { landMemo(store, `render/${key}/${name}`, text(text_)); };
+export const keepRender = (store, _signer, key, name, _epoch, text_) => { if (!readOnly())
+    landMemo(store, `render/${key}/${name}`, text(text_)); };
 export function keepFold(store, key, fold, points, instrument = '') {
+    if (readOnly())
+        return;
     const packed = {
         ...fold,
         standing: joined(fold.standing),
@@ -134,7 +149,7 @@ export function keepFold(store, key, fold, points, instrument = '') {
         signed: [...fold.signed],
         kept: false,
     };
-    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument })));
+    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store) })));
     const at = memoAt(store, lastOf(points));
     mkdirSync(dirname(at), { recursive: true });
     writeFileSync(`${at}.${process.pid}.part`, `${key}\n`);

package/dist/fold/observed.d.ts

@@ -15,6 +15,7 @@ export declare const readersBehind: () => readonly {
     readonly module: string;
     readonly places: number;
 }[];
+export declare const readerRefusals: () => readonly string[];
 export declare function readerLines(store: string): readonly string[];
 /**
  * A reader never blocks a fold that did not ask to wait: what it read before is served at once, and a reader whose

package/dist/fold/observed.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { basename, dirname, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
 import { bundleOf, processOf } from "../observe/runner.js";
 import { canonical, parse, PROTOCOL } from '@lapxo/topos/wire';
@@ -15,7 +16,7 @@ import { capsuleReadersOf, handedAt, lookOf, offersOf } from "./readers.js";
 import { runReader, runs } from "../observe/run.js";
 import { LEVEL, OBSERVED, keepObservation, keyOf, legacyOf, observation, observed as observedAt, opened, pointer, readerOf, regionIn, setAside, sha, trimmed } from "./shards.js";
 import { saidDigest } from "./kept.js";
-import { carriedIn } from "./resolved.js";
+import { carriedIn, carriedFrom } from "./resolved.js";
 export const cased = (question) => /^(?:vector|sample)\//.test(question);
 export function isReaderLock(line) {
     const got = parse(line);
@@ -87,6 +88,8 @@ function takeReadings(observed) {
 }
 const behind = [];
 export const readersBehind = () => behind;
+const refused = [];
+export const readerRefusals = () => refused;
 const alive = (pid) => { try {
     return process.kill(pid, 0);
 }
@@ -170,6 +173,14 @@ export function readerReaches(reach, where) {
     return where.some((one) => reached(trimmed(one)));
 }
 export function observedClaims(root, store, options = {}) {
+    refused.length = 0;
+    if (readOnly()) {
+        const carried = (observeText(resolve(root, 'receipts.bound')) ?? '').split('\n').filter(isWire);
+        const evidence = carriedFrom(store, carried);
+        if (evidence === undefined)
+            throw Error('REFUSE·preview native receipt bytes unavailable; fold the declared inputs first');
+        return evidence;
+    }
     const wait = options.wait ?? true;
     const standing = lockStanding(store);
     const lines = readersOf(store);
@@ -255,7 +266,7 @@ export function observedClaims(root, store, options = {}) {
         const module = resolve(root, reader.module);
         const asked = reader.capsule === undefined ? undefined : capsuleAt(reader.capsule.digest, reader.capsule.entry);
         const source = reader.capsule === undefined ? observeFile(module) : asked === undefined ? undefined : new Uint8Array();
-        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? 'unbundled' : 'none';
+        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? bytesDigest(store, source) : 'none';
         const offered = offersOf(root, store, reader, roleOf, look, (where) => reached(trimmed(where)));
         const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
         const kept = whole && legacy === undefined && answered === undefined && source ? sha([
@@ -351,8 +362,10 @@ export function observedClaims(root, store, options = {}) {
             }
             return [];
         };
-        if (due.length && !source)
+        if (due.length && !source) {
+            refused.push(`REFUSE·reader ${reader.module} unavailable · ${due.length} readings remain due`);
             return false;
+        }
         if (due.length && !wait) {
             for (const plan of plans) {
                 if (plan.said !== undefined) {
@@ -397,11 +410,15 @@ export function observedClaims(root, store, options = {}) {
                     : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })));
             }
             catch (error) {
-                process.stderr.write(`REFUSE reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}\n`);
+                const why = `REFUSE·reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
             if (rows.every((mine) => !mine.length)) {
-                process.stderr.write(`REFUSE   reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due\n`);
+                const why = `REFUSE·reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
             ran += due.length;

package/dist/fold/reach.d.ts

@@ -7,6 +7,11 @@ export declare const selectionLines: (fold: {
     readonly standing: readonly string[];
     readonly under?: string;
 }) => readonly string[];
+export declare const projectionLines: (fold: {
+    readonly root: string;
+    readonly standing: readonly string[];
+    readonly under?: string;
+}) => readonly string[];
 export declare function capsulesFor(standing: readonly string[], place: string, root?: string): readonly {
     readonly capsule: Capsule;
     readonly offer: string;

package/dist/fold/reach.js

@@ -1,6 +1,6 @@
 import { selectedCapsules } from "../host/selected-capsules.js";
 import { basename } from "../host/io.js";
-import { matches } from '@lapxo/topos/wire';
+import { canonical, matches, parse } from '@lapxo/topos/wire';
 import { fieldOf } from "./claims.js";
 import { spoken, worldsIn } from "./places.js";
 import { wordOf, wordsOf } from "./wire.js";
@@ -57,9 +57,27 @@ export const selectionLines = (fold) => {
     const qualified = fold.standing.filter((line) => fieldOf(line, 'scope').startsWith(`${fold.under ?? ''}uses/`));
     return [...new Set([...local, ...qualified])].filter((line) => fieldOf(line, 'value') !== 'withdraw');
 };
+/** Host bindings belong to the selected place, never to another sibling's lock. */
+const relativeProjections = (standing, prefix) => standing.filter(line => fieldOf(line, 'scope').startsWith(`${prefix}dep/`)).map(line => {
+    const got = parse(line, { preserveKeys: true });
+    if (got.kind !== 'fact')
+        throw Error(`REFUSE·wire ${got.why}`);
+    // An unsigned host projection of admitted fields, never a newly signed claim.
+    const { sig, by, epoch, expires, repo, ...fields } = got.value.fields;
+    return canonical({ ...fields, scope: fields.scope.slice(prefix.length) }, got.value.version);
+});
+export const projectionLines = (fold) => {
+    const place = fold.under?.replace(/\/$/, '') ?? '';
+    const prefix = place ? `${place}/` : '';
+    const local = ownLockOf(fold.root, place).filter(line => fieldOf(line, 'scope').startsWith('dep/'));
+    const qualified = relativeProjections(fold.standing, prefix);
+    return [...new Set([...ownLock(), ...local, ...qualified])];
+};
 export function capsulesFor(standing, place, root) {
     const prefix = place ? `${place}/` : '';
     const pins = root === undefined ? standing.filter(line => fieldOf(line, 'scope').startsWith(`${prefix}uses/`) && fieldOf(line, 'value') !== 'withdraw')
         : selectionLines({ root, standing, ...(prefix ? { under: prefix } : {}) });
-    return selectedCapsules(pins);
+    const host = root === undefined ? [...ownLock(), ...relativeProjections(standing, prefix)]
+        : projectionLines({ root, standing, ...(prefix ? { under: prefix } : {}) });
+    return selectedCapsules(pins, undefined, undefined, host);
 }

package/dist/fold/region-declarations.d.ts

@@ -0,0 +1,2 @@
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export declare function isRegionDeclaration(line: string, wire: readonly string[]): boolean;

package/dist/fold/region-declarations.js

@@ -0,0 +1,13 @@
+import { fieldOf, isConfig } from "./claims.js";
+import { wordsOf } from "./wire.js";
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export function isRegionDeclaration(line, wire) {
+    if (!isConfig(line) || !fieldOf(line, 'scope').startsWith('region/') || fieldOf(line, 'value') === 'withdraw')
+        return false;
+    const named = ['region-coordinate', 'region-leaf'].flatMap(name => {
+        const words = wordsOf(wire, name);
+        return words.length === 1 ? words : [];
+    });
+    const measures = ['lines', 'receipts', 'reads', ...named];
+    return measures.includes(fieldOf(line, 'measure'));
+}

package/dist/fold/resolved.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, linkSync, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { canonical, parse } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, isWire } from "./claims.js";
@@ -11,6 +12,10 @@ import { sourced } from "../land/vouched.js";
 import { entriesIn, observeFile, observeText } from "../observe/files.js";
 export const bytesOnly = (line) => {
     const got = parse(line);
+    // Authenticated evidence is delivered verbatim. A shortened observation is
+    // a different signed message, even when it describes the same input.
+    if (got.kind === 'fact' && got.value.fields.sig)
+        return line;
     return got.kind === 'fact' && fieldOf(line, 'measure') === 'observed' ? canonical({ ...got.value.fields, value: fieldOf(line, 'at').replace(/^.*:/, '').slice(0, 16) }) : line;
 };
 const held = new WeakMap();
@@ -45,7 +50,8 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid].map((line) => (place ? zoomed(line, place) : line));
+    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+        .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);
         const carried = carriedFrom(fold.store, shipped);
@@ -64,6 +70,8 @@ export function keepCarried(store, lines, from) {
         verifiedCarried(at, digest);
     }
     else {
+        if (readOnly())
+            return `sha256:${digest}`;
         mkdirSync(dirname(at), { recursive: true });
         const src = from === undefined ? '' : storeAt(from, 'cas', 'carried', digest);
         if (src && existsSync(src)) {

package/dist/fold/second.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { snapshotVerdict } from "./evidence.js";
 import { dirname, resolve, spawnSync } from "../host/io.js";
 import { ledgerLines } from "../land/ledger.js";
@@ -9,6 +10,8 @@ import { said } from "./wire.js";
 import { sha } from "../host/hash.js";
 const asked = new Map();
 function askedNow(store, rests) {
+    if (readOnly())
+        return undefined;
     const root = dirname(store);
     const key = `${root} ${rests}`;
     if (asked.has(key))

package/dist/host/capsule.js

@@ -1,3 +1,5 @@
+import { ContentNeeded } from "./content-needed.js";
+import { readOnly } from "./read-only.js";
 import { sha } from "./hash.js";
 import { wireLinesOf as linesOf } from "../fold/claims.js";
 import { createHash } from 'node:crypto';
@@ -47,8 +49,10 @@ export function capsuleAt(digest, entry, store) {
     if (held !== undefined)
         return held;
     const bytes = observeFile(blobAt(store ?? ownStore(), digest));
-    if (bytes === undefined || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
-        return undefined;
+    if (bytes === undefined)
+        throw new ContentNeeded(digest, `REFUSE·pin ${digest} offered capsule unavailable · not laid`);
+    if (`sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
+        throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
     const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
     declared.set(digest, known);
     const names = Object.keys(known.declaration.regions);
@@ -108,6 +112,8 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         }
     });
     const missing = requests.filter((_, i) => held[i] === undefined);
+    if (missing.length && readOnly())
+        throw Error(`REFUSE·preview capsule ${digest} has no verified answer for the proposed inputs; fold the declared inputs first`);
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.

package/dist/host/content-needed.d.ts

@@ -0,0 +1,5 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export declare class ContentNeeded extends Error {
+    readonly digest: string;
+    constructor(digest: string, why?: string);
+}

package/dist/host/content-needed.js

@@ -0,0 +1,8 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export class ContentNeeded extends Error {
+    constructor(digest, why = `REFUSE·pin ${digest} content unavailable · not laid`) {
+        super(why);
+        this.digest = digest;
+        this.name = 'ContentNeeded';
+    }
+}

package/dist/host/read-only.d.ts

@@ -0,0 +1,3 @@
+export declare const readOnly: () => boolean;
+export declare const withoutEffects: <T>(evaluate: () => T) => T;
+export declare function requireEffects(operation: string): void;

package/dist/host/read-only.js

@@ -0,0 +1,9 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+/** Prospective evaluation may read existing evidence and calculate values, but cannot acquire evidence or persist caches. */
+const mode = new AsyncLocalStorage();
+export const readOnly = () => mode.getStore() === true;
+export const withoutEffects = (evaluate) => mode.run(true, evaluate);
+export function requireEffects(operation) {
+    if (readOnly())
+        throw Error(`REFUSE·preview ${operation} requires an act; fold the declared inputs first`);
+}

package/dist/host/release.d.ts

@@ -1,4 +1,6 @@
 export declare const laidAt: (store: string, digest: string) => string;
+/** A host artifact binding, not a measured ceiling or an object act. */
+export declare const isReleaseBinding: (line: string) => boolean;
 export declare const releasesOf: (lock: readonly string[]) => readonly string[];
 /**
  * What the host does before anything runs: each release the instrument's own lock names by digest is a snapshot of

package/dist/host/release.js

@@ -1,13 +1,19 @@
+import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, sep } from 'node:path';
 import { canonical } from '@lapxo/topos/wire';
-import { fieldOf, isWire } from "../fold/claims.js";
+import { fieldOf, isWire, isConfig } from "../fold/claims.js";
 import { archiveCoordinate, archiveDestination, members } from "./archive.js";
 import { blobAt, holdStore, landBlob, replaceWhole, storeAt } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 export const laidAt = (store, digest) => storeAt(store, 'cas', 'laid', digest.replace(/^[^:]*:/, ''));
-export const releasesOf = (lock) => lock.filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads' && fieldOf(line, 'value') !== 'withdraw');
+/** A host artifact binding, not a measured ceiling or an object act. */
+export const isReleaseBinding = (line) => isConfig(line)
+    && fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads'
+    && fieldOf(line, 'value') !== 'withdraw'
+    && (fieldOf(line, 'measure') === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(fieldOf(line, 'value')));
+export const releasesOf = (lock) => lock.filter(isReleaseBinding);
 const laidMark = '.laid';
 const digestOf = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
 const hashed = (digest, bytes) => createHash(digest.includes(':') ? digest.slice(0, digest.indexOf(':')) : 'sha256').update(bytes).digest('hex') === digest.replace(/^[^:]*:/, '');
@@ -119,6 +125,11 @@ function keepSnapshot(store, digest, bytes) {
 export function layReleases(store, own, lock, contentStore = own) {
     let laid = 0;
     for (const line of releasesOf(lock)) {
+        // A release catalog entry without a mount is materialized only when requested.
+        // Its absence must not block an unrelated place's fold.
+        const needs = fieldOf(line, 'needs');
+        if (!needs)
+            continue;
         const digest = fieldOf(line, 'value');
         const at = laidAt(store, digest);
         const dir = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() ?? false;
@@ -133,10 +144,7 @@ export function layReleases(store, own, lock, contentStore = own) {
         if (bytes !== undefined && current !== undefined && !dir && !sameSnapshot(snapshotOf(current), members(bytes).map((one) => [one.name, digestOf(one.bytes)])))
             throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
         if (bytes === undefined && !dir && current === undefined)
-            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
-        const needs = fieldOf(line, 'needs');
-        if (!needs)
-            continue;
+            throw new ContentNeeded(digest, `REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
         const root = fieldOf(line, 'shape');
         const place = join(own, archiveCoordinate(needs));
         const link = lstatSync(place, { throwIfNoEntry: false });

package/dist/host/selected-capsules.d.ts

@@ -2,7 +2,7 @@ import { capsuleAt } from './capsule.ts';
 import type { Capsule } from './capsule.ts';
 import type { ToposResolver } from './selected-topos.ts';
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export declare function selectedCapsules(pins: readonly string[], resolve?: typeof capsuleAt, select?: ToposResolver): readonly {
+export declare function selectedCapsules(pins: readonly string[], resolve?: typeof capsuleAt, select?: ToposResolver, host?: readonly string[]): readonly {
     readonly capsule: Capsule;
     readonly offer: string;
 }[];

package/dist/host/selected-capsules.js

@@ -4,13 +4,17 @@ import { selectedTopoi, toposAt } from "./selected-topos.js";
 import { canonical } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
 import { ownLock } from "../observe/runner.js";
+import { archiveCoordinate } from "./archive.js";
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt) {
+export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
     return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const projections = ownLock().filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads' && fieldOf(line, 'value') === offer.value);
-        if (projections.length !== 1 || !fieldOf(projections[0], 'shape'))
+        const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
+        if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
             throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-        const projected = { ...offer, shape: fieldOf(projections[0], 'shape') };
+        const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
+        if (entries.length !== 1)
+            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
+        const projected = { ...offer, shape: entries[0] };
         const capsule = resolve(offer.value, projected.shape);
         if (capsule === undefined)
             throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);

package/dist/host/selected-topos.d.ts

@@ -10,7 +10,7 @@ export declare function toposAt(digest: string): StandingTopos;
 export declare function contentAt(digest: string): Uint8Array;
 /** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
 export declare function contextModuleAt(digest: string): string;
-/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
 /** Read a declared wire list without copying a world's claims or executing its offers.
  * Independent declarations must agree; selection order cannot choose a contract.