@lapxo/bound 0.1.2 → 0.1.3

package/dist/cli/verb.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-import { resolveSources } from "../host/source-content.js";
+import { withoutEffects } from "../host/read-only.js";
+import { resolveSources, resolveRequested } from "../host/source-content.js";
 import { cellsWithReceipts } from "../host/cell-receipts.js";
+import { renderCells } from '@lapxo/topos/cells-view';
 import { releasePolicyLines } from "../fold/release-policy.js";
 import { admittedObjects } from "../host/objects.js";
 import { objectFold } from "../fold/object.js";
@@ -15,7 +17,7 @@ import { eraOf, signaturesOf } from "../fold/digests.js";
 import { fullDigest as bootstrapDigest } from "../host/digest.js";
 import { canonical } from '@lapxo/topos/wire';
 import { EXTENSION, LOCK, fieldOf, foldClaims, isWire, selfName } from "../fold/claims.js";
-import { observedClaims } from "../fold/observed.js";
+import { observedClaims, readerRefusals } from "../fold/observed.js";
 import { rolesOf } from "../fold/roles.js";
 import { authorityFor, releaseSigner, rootSigner, writerFor } from "../fold/signers.js";
 import { land, ledgerLines, storeOf } from "../land/ledger.js";
@@ -189,10 +191,31 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
     const rest = told.filter((line) => !ledger.includes(line));
     if (place && rest.length)
         tellOwn(place, rest);
+    if (name === NAMED_VIEWS.lines && (told.length || depth === undefined)) {
+        const text = standingOf(root, under, ledger).standing.filter(isWire).join('\n');
+        process.stdout.write(text ? `${text}\n` : '');
+        return EXIT.closed;
+    }
+    if (told.length) {
+        const selected = viewsOf(standingOf(root, under, ledger).standing).get(name);
+        if (selected && !selected.shape && selected.regions.some(region => region.name === 'cells')) {
+            const history = [...signedOwnerLines(storeOf(root)), ...ledger];
+            const held = await admittedObjects(root, history);
+            process.stdout.write(`TOLD     ${told.length} lines folded as if landed · nothing written\n`);
+            for (const line of renderCells(objectFold(held.records, held.context)))
+                process.stdout.write(line + '\n');
+            return EXIT.closed;
+        }
+    }
     const own = place ? rest.filter((line) => admittedIn(root, place, line)) : [];
     const fold = told.length
-        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }) })
-        : foldPlace(root, entryOf(root), under, false);
+        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }), free: true })
+        : foldPlace(root, entryOf(root), under, true);
+    if (!told.length && readerRefusals().length) {
+        for (const why of readerRefusals())
+            process.stderr.write(`${selfName()}: ${why}\n`);
+        return EXIT.refuse;
+    }
     if (coord)
         askWhy(fold, coord);
     if (name === NAMED_VIEWS.lines) {
@@ -200,6 +223,9 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
             beat(root, fold, Date.now() - at);
         const text = fold.standing.filter(isWire).join('\n');
         process.stdout.write(text ? `${text}\n` : '');
+        if (depth === '1')
+            for (const line of readingsIn([...fold.standing.filter(isCeiling), ...ownCeilings(under)], fold))
+                process.stdout.write(`${line}\n`);
         return EXIT.closed;
     }
     const views = viewsOf(fold.standing);
@@ -371,7 +397,7 @@ function foldFile(at) {
     process.stdout.write(`FACT     ${folded.standing.length} standing · ${folded.forks.length} forks · ${basename(at)}\n`);
     return EXIT.closed;
 }
-function foldVerb(_root, rest) {
+function foldVerb(root, rest) {
     const files = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory() && one.endsWith(EXTENSION));
     const places = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (files.length === 1 && !places.length && valueOf(rest, FLAGS.as) === undefined) {
@@ -381,16 +407,24 @@ function foldVerb(_root, rest) {
         return foldAt(dirname(at), undefined, rest);
     }
     const under = places[0];
-    const tree = files.length === 1 ? dirname(resolve(files[0])) : resolve('.');
+    // A prospective lot is data, not the place whose authority admits it.
+    const tree = files.length ? root : resolve('.');
     const place = under ? relative(tree, resolve(under)).split(sep).join('/') : '';
     return foldAt(tree, place ? `${place}/` : undefined, rest);
 }
 async function foldAt(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
+    const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    if (as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+        return foldResolved(root, under, argv);
+    return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
+}
+async function foldResolved(root, under, argv) {
+    const as = valueOf(argv, FLAGS.as);
+    const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
     // Public content is authenticated by its digest, independently of owner history.
     // A named view does not request mounting every release of the instrument.
-    if (as !== NAMED_VIEWS.help && lockLines(storeOf(root)).length)
-        await resolveSources(standingOf(root, under).standing, as === undefined);
+    const receiptCheck = as === undefined && argv.includes(FLAGS.check);
     if (as === OBJECT_VIEW) {
         const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
         if (inputs.length > 1)
@@ -406,6 +440,8 @@ async function foldAt(root, under, argv) {
     const key = valueOf(argv, FLAGS.key);
     if (as === undefined) {
         const exit = await pass(root, entryOf(root), under, argv.includes(FLAGS.check));
+        if (receiptCheck)
+            return exit;
         if (exit !== 0)
             return exit;
         const history = signedOwnerLines(storeOf(root));
@@ -421,7 +457,7 @@ async function foldAt(root, under, argv) {
         }
         return exit;
     }
-    const named = positionalsOf(argv).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    const named = inputs;
     const coord = positionalsOf(argv).find((one) => one !== under?.replace(/\/$/, '') && !one.startsWith('-') && !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
     if ((as === 'why' || as === NAMED_VIEWS.because || as.split('@')[0] === 'why') && coord !== undefined)
         return view(root, under, as === NAMED_VIEWS.because ? 'why' : as, [], coord, key);
@@ -432,7 +468,7 @@ async function foldAt(root, under, argv) {
         return batch.code;
     if (batch.kind === 'once')
         process.stdout.write(`ONCE     ${batch.proposed.length} lines · every one already landed: the view folds the tree as it stands\n`);
-    return view(root, under, as, batch.kind === 'signed' ? batch.signed : [], undefined, key);
+    return withoutEffects(() => view(root, under, as, batch.kind === 'signed' ? batch.signed : batch.proposed, undefined, key));
 }
 const VERBS = {
     fold: (root, rest) => foldVerb(root, rest),

package/dist/fold/configures.js

@@ -4,6 +4,8 @@ import { isReaderLock } from "./observed.js";
 import { isRoleLock } from "./roles.js";
 import { isSignerLock } from "./signers.js";
 import { isReleaseBinding } from "../host/release.js";
+import { isRegionDeclaration } from "./region-declarations.js";
+import { ownLock } from "../observe/runner.js";
 function isEffectLock(line) {
     const got = parse(line);
     return got.kind === 'fact' && got.value.fields['measure'] === 'effect';
@@ -11,7 +13,7 @@ function isEffectLock(line) {
 /** A lock line the instrument itself consumes — an effect it runs, a reader it loads, a role it walks by, a signer it admits, the wire it reads by. */
 function configures(line) {
     const got = parse(line);
-    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields));
+    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields)) || isRegionDeclaration(line, ownLock());
 }
 /** Every reads line that configures nothing is a ceiling: a bound some reading has to meet. */
 export function isCeiling(line) {

package/dist/fold/digests.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { appendFileSync, dirname, join, mkdirSync, readdirSync, relative, resolve } from "../host/io.js";
 import { bytesDigest as bytesWith, fullDigest as fullWith } from "../host/digest.js";
 import { coordinatesUnder, observeFile, observeText, stampOf } from "../observe/files.js";
@@ -116,6 +117,8 @@ export function coordinateDigest(store, at) {
         return held;
     const digest = bytesDigest(store, observeFile(at) ?? new Uint8Array());
     memo.set(key, digest);
+    if (readOnly())
+        return digest;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${digest}\n`);
     return digest;
@@ -127,6 +130,8 @@ export function memoized(store, key, compute) {
         return held;
     const value = compute();
     memo.set(key, value);
+    if (readOnly())
+        return value;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${value}\n`);
     return value;
@@ -141,7 +146,8 @@ const importsOf = (store, at, digest) => {
     const found = [...new TextDecoder().decode(observeFile(at) ?? new Uint8Array()).matchAll(/(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s*)['"]([^'"]*)['"]/g)].map((m) => m[1] ?? '');
     imported.set(digest, found);
     memo.set(key, found.join('|'));
-    appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
+    if (!readOnly())
+        appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
     return found;
 };
 /**

package/dist/fold/kept.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
@@ -129,8 +130,11 @@ export function keptPlace(store, under) {
     };
 }
 export const keptRender = (store, key, name) => observeText(memoAt(store, `render/${key}/${name}`));
-export const keepRender = (store, _signer, key, name, _epoch, text_) => { landMemo(store, `render/${key}/${name}`, text(text_)); };
+export const keepRender = (store, _signer, key, name, _epoch, text_) => { if (!readOnly())
+    landMemo(store, `render/${key}/${name}`, text(text_)); };
 export function keepFold(store, key, fold, points, instrument = '') {
+    if (readOnly())
+        return;
     const packed = {
         ...fold,
         standing: joined(fold.standing),

package/dist/fold/observed.d.ts

@@ -15,6 +15,7 @@ export declare const readersBehind: () => readonly {
     readonly module: string;
     readonly places: number;
 }[];
+export declare const readerRefusals: () => readonly string[];
 export declare function readerLines(store: string): readonly string[];
 /**
  * A reader never blocks a fold that did not ask to wait: what it read before is served at once, and a reader whose

package/dist/fold/observed.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { basename, dirname, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
 import { bundleOf, processOf } from "../observe/runner.js";
 import { canonical, parse, PROTOCOL } from '@lapxo/topos/wire';
@@ -15,7 +16,7 @@ import { capsuleReadersOf, handedAt, lookOf, offersOf } from "./readers.js";
 import { runReader, runs } from "../observe/run.js";
 import { LEVEL, OBSERVED, keepObservation, keyOf, legacyOf, observation, observed as observedAt, opened, pointer, readerOf, regionIn, setAside, sha, trimmed } from "./shards.js";
 import { saidDigest } from "./kept.js";
-import { carriedIn } from "./resolved.js";
+import { carriedIn, carriedFrom } from "./resolved.js";
 export const cased = (question) => /^(?:vector|sample)\//.test(question);
 export function isReaderLock(line) {
     const got = parse(line);
@@ -87,6 +88,8 @@ function takeReadings(observed) {
 }
 const behind = [];
 export const readersBehind = () => behind;
+const refused = [];
+export const readerRefusals = () => refused;
 const alive = (pid) => { try {
     return process.kill(pid, 0);
 }
@@ -170,6 +173,14 @@ export function readerReaches(reach, where) {
     return where.some((one) => reached(trimmed(one)));
 }
 export function observedClaims(root, store, options = {}) {
+    refused.length = 0;
+    if (readOnly()) {
+        const carried = (observeText(resolve(root, 'receipts.bound')) ?? '').split('\n').filter(isWire);
+        const evidence = carriedFrom(store, carried);
+        if (evidence === undefined)
+            throw Error('REFUSE·preview native receipt bytes unavailable; fold the declared inputs first');
+        return evidence;
+    }
     const wait = options.wait ?? true;
     const standing = lockStanding(store);
     const lines = readersOf(store);
@@ -255,7 +266,7 @@ export function observedClaims(root, store, options = {}) {
         const module = resolve(root, reader.module);
         const asked = reader.capsule === undefined ? undefined : capsuleAt(reader.capsule.digest, reader.capsule.entry);
         const source = reader.capsule === undefined ? observeFile(module) : asked === undefined ? undefined : new Uint8Array();
-        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? 'unbundled' : 'none';
+        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? bytesDigest(store, source) : 'none';
         const offered = offersOf(root, store, reader, roleOf, look, (where) => reached(trimmed(where)));
         const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
         const kept = whole && legacy === undefined && answered === undefined && source ? sha([
@@ -351,8 +362,10 @@ export function observedClaims(root, store, options = {}) {
             }
             return [];
         };
-        if (due.length && !source)
+        if (due.length && !source) {
+            refused.push(`REFUSE·reader ${reader.module} unavailable · ${due.length} readings remain due`);
             return false;
+        }
         if (due.length && !wait) {
             for (const plan of plans) {
                 if (plan.said !== undefined) {
@@ -397,11 +410,15 @@ export function observedClaims(root, store, options = {}) {
                     : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })));
             }
             catch (error) {
-                process.stderr.write(`REFUSE reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}\n`);
+                const why = `REFUSE·reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
             if (rows.every((mine) => !mine.length)) {
-                process.stderr.write(`REFUSE   reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due\n`);
+                const why = `REFUSE·reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
             ran += due.length;

package/dist/fold/region-declarations.d.ts

@@ -0,0 +1,2 @@
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export declare function isRegionDeclaration(line: string, wire: readonly string[]): boolean;

package/dist/fold/region-declarations.js

@@ -0,0 +1,13 @@
+import { fieldOf, isConfig } from "./claims.js";
+import { wordsOf } from "./wire.js";
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export function isRegionDeclaration(line, wire) {
+    if (!isConfig(line) || !fieldOf(line, 'scope').startsWith('region/') || fieldOf(line, 'value') === 'withdraw')
+        return false;
+    const named = ['region-coordinate', 'region-leaf'].flatMap(name => {
+        const words = wordsOf(wire, name);
+        return words.length === 1 ? words : [];
+    });
+    const measures = ['lines', 'receipts', 'reads', ...named];
+    return measures.includes(fieldOf(line, 'measure'));
+}

package/dist/fold/resolved.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, linkSync, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { canonical, parse } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, isWire } from "./claims.js";
@@ -11,6 +12,10 @@ import { sourced } from "../land/vouched.js";
 import { entriesIn, observeFile, observeText } from "../observe/files.js";
 export const bytesOnly = (line) => {
     const got = parse(line);
+    // Authenticated evidence is delivered verbatim. A shortened observation is
+    // a different signed message, even when it describes the same input.
+    if (got.kind === 'fact' && got.value.fields.sig)
+        return line;
     return got.kind === 'fact' && fieldOf(line, 'measure') === 'observed' ? canonical({ ...got.value.fields, value: fieldOf(line, 'at').replace(/^.*:/, '').slice(0, 16) }) : line;
 };
 const held = new WeakMap();
@@ -45,7 +50,8 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid].map((line) => (place ? zoomed(line, place) : line));
+    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+        .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);
         const carried = carriedFrom(fold.store, shipped);
@@ -64,6 +70,8 @@ export function keepCarried(store, lines, from) {
         verifiedCarried(at, digest);
     }
     else {
+        if (readOnly())
+            return `sha256:${digest}`;
         mkdirSync(dirname(at), { recursive: true });
         const src = from === undefined ? '' : storeAt(from, 'cas', 'carried', digest);
         if (src && existsSync(src)) {

package/dist/fold/second.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { snapshotVerdict } from "./evidence.js";
 import { dirname, resolve, spawnSync } from "../host/io.js";
 import { ledgerLines } from "../land/ledger.js";
@@ -9,6 +10,8 @@ import { said } from "./wire.js";
 import { sha } from "../host/hash.js";
 const asked = new Map();
 function askedNow(store, rests) {
+    if (readOnly())
+        return undefined;
     const root = dirname(store);
     const key = `${root} ${rests}`;
     if (asked.has(key))

package/dist/host/capsule.js

@@ -1,3 +1,5 @@
+import { ContentNeeded } from "./content-needed.js";
+import { readOnly } from "./read-only.js";
 import { sha } from "./hash.js";
 import { wireLinesOf as linesOf } from "../fold/claims.js";
 import { createHash } from 'node:crypto';
@@ -47,8 +49,10 @@ export function capsuleAt(digest, entry, store) {
     if (held !== undefined)
         return held;
     const bytes = observeFile(blobAt(store ?? ownStore(), digest));
-    if (bytes === undefined || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
-        return undefined;
+    if (bytes === undefined)
+        throw new ContentNeeded(digest, `REFUSE·pin ${digest} offered capsule unavailable · not laid`);
+    if (`sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
+        throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
     const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
     declared.set(digest, known);
     const names = Object.keys(known.declaration.regions);
@@ -108,6 +112,8 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         }
     });
     const missing = requests.filter((_, i) => held[i] === undefined);
+    if (missing.length && readOnly())
+        throw Error(`REFUSE·preview capsule ${digest} has no verified answer for the proposed inputs; fold the declared inputs first`);
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.

package/dist/host/content-needed.d.ts

@@ -0,0 +1,5 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export declare class ContentNeeded extends Error {
+    readonly digest: string;
+    constructor(digest: string, why?: string);
+}

package/dist/host/content-needed.js

@@ -0,0 +1,8 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export class ContentNeeded extends Error {
+    constructor(digest, why = `REFUSE·pin ${digest} content unavailable · not laid`) {
+        super(why);
+        this.digest = digest;
+        this.name = 'ContentNeeded';
+    }
+}

package/dist/host/read-only.d.ts

@@ -0,0 +1,3 @@
+export declare const readOnly: () => boolean;
+export declare const withoutEffects: <T>(evaluate: () => T) => T;
+export declare function requireEffects(operation: string): void;

package/dist/host/read-only.js

@@ -0,0 +1,9 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+/** Prospective evaluation may read existing evidence and calculate values, but cannot acquire evidence or persist caches. */
+const mode = new AsyncLocalStorage();
+export const readOnly = () => mode.getStore() === true;
+export const withoutEffects = (evaluate) => mode.run(true, evaluate);
+export function requireEffects(operation) {
+    if (readOnly())
+        throw Error(`REFUSE·preview ${operation} requires an act; fold the declared inputs first`);
+}

package/dist/host/release.js

@@ -1,3 +1,4 @@
+import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, sep } from 'node:path';
@@ -143,7 +144,7 @@ export function layReleases(store, own, lock, contentStore = own) {
         if (bytes !== undefined && current !== undefined && !dir && !sameSnapshot(snapshotOf(current), members(bytes).map((one) => [one.name, digestOf(one.bytes)])))
             throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
         if (bytes === undefined && !dir && current === undefined)
-            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
+            throw new ContentNeeded(digest, `REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
         const root = fieldOf(line, 'shape');
         const place = join(own, archiveCoordinate(needs));
         const link = lstatSync(place, { throwIfNoEntry: false });

package/dist/host/selected-topos.d.ts

@@ -10,7 +10,7 @@ export declare function toposAt(digest: string): StandingTopos;
 export declare function contentAt(digest: string): Uint8Array;
 /** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
 export declare function contextModuleAt(digest: string): string;
-/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
 /** Read a declared wire list without copying a world's claims or executing its offers.
  * Independent declarations must agree; selection order cannot choose a contract.

package/dist/host/selected-topos.js

@@ -1,3 +1,4 @@
+import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
 import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt } from '@lapxo/topos/wire';
@@ -5,13 +6,9 @@ import { fieldOf } from "../fold/claims.js";
 import { blobAt } from "../land/ledger.js";
 import { observeFile } from "../observe/files.js";
 import { ownStore, ownLock } from "../observe/runner.js";
-import { replaceWhole } from "../land/ledger.js";
-import { join } from 'node:path';
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
 export function toposAt(digest) {
     const topos = readStanding(Buffer.from(contentAt(digest)).toString('utf8'));
-    for (const dependency of topos.dependencies)
-        contentAt(dependency);
     return topos;
 }
 export function contentAt(digest) {
@@ -27,7 +24,7 @@ export function contentAt(digest) {
             throw Error(`REFUSE·pin ${name} digest is not admitted`);
         const bytes = observeFile(blobAt(ownStore(), name));
         if (bytes === undefined)
-            throw Error(`REFUSE·pin ${name} content unavailable · not laid`);
+            throw new ContentNeeded(name);
         if (createHash(algorithm).update(bytes).digest('hex') !== hex)
             throw Error(`REFUSE·pin ${name} content hash mismatch · not laid`);
         return bytes;
@@ -36,12 +33,10 @@ export function contentAt(digest) {
 }
 /** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
 export function contextModuleAt(digest) {
-    const bytes = contentAt(digest);
-    const at = join(ownStore(), 'cas', 'runtime', digest.replace(':', '_') + '.mjs');
-    replaceWhole(at, bytes);
-    return at;
+    contentAt(digest);
+    return blobAt(ownStore(), digest);
 }
-/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export function selectedTopoi(pins, resolve = toposAt) {
     return [...new Set(pins.map(pin => fieldOf(pin, 'value')))].map(digest => ({ digest, topos: resolve(digest) }));
 }

package/dist/host/source-content.d.ts

@@ -5,6 +5,8 @@ export interface ContentPort {
     readonly fetch: (url: string) => Promise<Uint8Array>;
 }
 /** Transport uses declared locations; only the requested digest admits bytes into the cache. */
-export declare function resolveSelectedContent(lines: readonly string[], port: ContentPort): Promise<readonly string[]>;
+export declare function resolveSelectedContent(lines: readonly string[], port: ContentPort, requested: readonly string[]): Promise<readonly string[]>;
 /** Exact resource URLs; no repository checkout or inferred release. */
-export declare function resolveSources(standing: readonly string[], materializeInstrument?: boolean): Promise<void>;
+export declare function resolveSources(standing: readonly string[], requested: readonly string[]): Promise<void>;
+/** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
+export declare function resolveRequested<T>(resolve: (digest: string) => Promise<void>, fold: () => Promise<T>): Promise<T>;

package/dist/host/source-content.js

@@ -1,11 +1,11 @@
+import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
-import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt } from '@lapxo/topos/wire';
 import { blobAt, landBlob } from "../land/ledger.js";
 import { observeFile } from "../observe/files.js";
 import { ownLock, ownStore } from "../observe/runner.js";
 /** Transport uses declared locations; only the requested digest admits bytes into the cache. */
-export async function resolveSelectedContent(lines, port) {
+export async function resolveSelectedContent(lines, port, requested) {
     const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
     const selectionIndex = (scope) => { const match = /(^|\/)uses\//.exec(scope); return match === null ? -1 : match.index + match[1].length; };
     // A dependency constraint is not a content binding. Historical artifact records
@@ -21,7 +21,6 @@ export async function resolveSelectedContent(lines, port) {
         if (urls.length)
             locations.set(binding.value ?? '', [...new Set([...(locations.get(binding.value ?? '') ?? []), ...urls])]);
     }
-    const roots = [...new Set(bindings.filter(f => selectionIndex(f.scope ?? '') >= 0).map(f => f.value ?? ''))];
     const received = [];
     const validate = (digest) => {
         const split = digest.indexOf(':');
@@ -30,9 +29,6 @@ export async function resolveSelectedContent(lines, port) {
             throw Error(`REFUSE·pin ${digest} digest is not admitted`);
         return { algorithm, hex };
     };
-    // Refuse malformed declared selections before materializing any dependency.
-    for (const binding of bindings)
-        validate(binding.value ?? '');
     const ensure = async (digest) => {
         const { algorithm, hex } = validate(digest);
         const verify = (bytes) => {
@@ -66,17 +62,12 @@ export async function resolveSelectedContent(lines, port) {
         }
         throw Error(`REFUSE·source ${digest} ${last instanceof Error ? last.message : 'declared sources unavailable'}`);
     };
-    for (const digest of new Set(bindings.filter(f => f.scope?.startsWith('dep/') && f.role === 'reads').map(f => f.value ?? '')))
+    for (const digest of new Set(requested))
         await ensure(digest);
-    for (const digest of roots) {
-        const topos = readStanding(Buffer.from(await ensure(digest)).toString('utf8'));
-        for (const dependency of topos.dependencies)
-            await ensure(dependency);
-    }
     return received;
 }
 /** Exact resource URLs; no repository checkout or inferred release. */
-export async function resolveSources(standing, materializeInstrument = false) {
+export async function resolveSources(standing, requested) {
     const instrument = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
     const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
     if (wire === null)
@@ -86,7 +77,7 @@ export async function resolveSources(standing, materializeInstrument = false) {
         if (p.kind !== 'fact')
             return false;
         const fields = p.value.fields;
-        return fields.scope?.startsWith('sources/') || (fields.scope?.startsWith('dep/') && (fields.role !== 'reads' || (materializeInstrument && !!fields.needs)));
+        return fields.scope?.startsWith('sources/') || fields.scope?.startsWith('dep/');
     });
     const received = await resolveSelectedContent([...standing, ...bindings], {
         algorithms: wire.digests,
@@ -98,7 +89,22 @@ export async function resolveSources(standing, materializeInstrument = false) {
                 throw Error(`HTTP ${response.status}`);
             return new Uint8Array(await response.arrayBuffer());
         },
-    });
+    }, requested);
     for (const digest of received)
         process.stdout.write(`FETCHED  ${digest} · verified\n`);
 }
+/** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
+export async function resolveRequested(resolve, fold) {
+    const attempted = new Set();
+    for (;;) {
+        try {
+            return await fold();
+        }
+        catch (error) {
+            if (!(error instanceof ContentNeeded) || attempted.has(error.digest))
+                throw error;
+            attempted.add(error.digest);
+            await resolve(error.digest);
+        }
+    }
+}

package/dist/land/leaving.js

@@ -1,3 +1,5 @@
+import { readOnly } from "../host/read-only.js";
+import { meets } from "../fold/closed.js";
 import { fieldOf } from "../fold/claims.js";
 import { sourced } from "./vouched.js";
 import { observedClaims } from "../fold/observed.js";
@@ -14,6 +16,8 @@ export function coordinatesWithdrawn(root, store, signed, standing) {
         .map((line) => fieldOf(line, 'scope').slice(family.length + 1));
     if (!asked.length)
         return { taken: [], refused: [] };
+    if (readOnly() && !meets(root, store, ''))
+        throw Error('REFUSE·withdraw current native receipts are required to judge file removal; fold the declared inputs first');
     /** A run rewrites every block of a test file under one observation, so a block whose title moved still holds a row
      * from an older one: what reads a file now is what the latest run of each test file wrote, and nothing older. */
     const memo = observedClaims(root, store, { wait: false }).filter((line) => fieldOf(line, 'measure') === 'memo');

package/dist/land/ledger.js

@@ -1,3 +1,4 @@
+import { requireEffects } from "../host/read-only.js";
 import { appendFileSync, closeSync, dirname, existsSync, join, linkSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "../host/io.js";
 import { storeRoot } from "../host/ports/store.js";
 import { canonical, EXTENSION, PROTOCOL } from '@lapxo/topos/wire';
@@ -81,6 +82,7 @@ function landWhole(at, bytes) {
 }
 /** A file replaced whole: the bytes land in a temp beside it and the name moves in one rename, so a killed write keeps the temp, never a torn file under the name a later read parses. */
 export function replaceWhole(at, bytes) {
+    requireEffects('persistent replacement');
     mkdirSync(dirname(at), { recursive: true });
     const part = `${at}.${process.pid}.part`;
     writeFileSync(part, bytes);
@@ -124,6 +126,7 @@ export function landMemo(store, key, bytes) {
 }
 export const landEnvelope = (store, digest, bytes) => landWhole(storeAt(store, 'cas', 'envelopes', `${digest.slice(digest.indexOf(':') + 1)}.json`), bytes);
 export function land(store, writer, lines) {
+    requireEffects('ledger admission');
     const at = writerFile(store, writer);
     return { at, appended: appendNew(at, lines) };
 }

package/dist/observe/regions.js

@@ -23,11 +23,11 @@ import { coordinatesUnder, observeText } from "./files.js";
 import { ownLock } from "./runner.js";
 import { nameOf } from "../render/page.js";
 import { placeLines, takenFor } from "../fold/place-inputs.js";
+import { isRegionDeclaration } from "../fold/region-declarations.js";
 const fact = (scope, value, form = 'alphabet', measure = 'fact') => canonical({ scope, role: 'writes', form, measure, value, by: 'fold', at: 'place:fold' });
 const described = (local = []) => {
     const lock = ownLock();
-    const measures = ['lines', 'receipts', 'reads', wordOn(lock, 'region-coordinate', lock), wordOn(lock, 'region-leaf', lock)];
-    const eligible = (line) => fieldOf(line, 'scope').startsWith('region/') && measures.includes(fieldOf(line, 'measure')) && fieldOf(line, 'value') !== 'withdraw';
+    const eligible = (line) => isRegionDeclaration(line, lock);
     const key = (line) => `${fieldOf(line, 'scope')} ${fieldOf(line, 'measure')}`;
     const supplied = local.filter(eligible);
     const overridden = new Set(supplied.map(key));