@lapxo/bound 0.1.2 → 0.1.4

package/dist/cli/accept.js

@@ -1,3 +1,4 @@
+import { withoutEffects } from "../host/read-only.js";
 import { selectedWireAt } from "../host/selected-topos.js";
 import { timing } from "../host/timing.js";
 import { admittedObjects } from "../host/objects.js";
@@ -22,7 +23,7 @@ import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
 import { widenedWithoutWitness } from "../judge/widening.js";
 import { retractedTogether, withdrawal } from "../land/withdraw.js";
 import { isCeiling } from "../fold/configures.js";
-import { inertIn, rankedIn } from "../land/inert.js";
+import { inertIn } from "../land/inert.js";
 import { landSaid } from "./pass.js";
 import { underTheLock, underTheRegions } from "../land/act.js";
 import { openedBy } from "../fold/opened.js";
@@ -39,6 +40,68 @@ import { ownerOf, epochOf, forksItself, forksJoinedBy, renderInto, sideOf, signe
 import { claimLinesIn, entryOf, namedPlaces, placesOfFile, positionalsOf, valueOf } from "./args.js";
 import { FLAGS } from "./names.js";
 import { judgeDemand, landTake } from "./takes.js";
+/** Admission reads an existing evidence snapshot; acquiring observations belongs to fold. */
+function admissionEvidence(root, signed, standing) {
+    return withoutEffects(() => {
+        const store = storeOf(root);
+        const reads = !signed.some(isReaderLock) && signed.some(isCeiling);
+        const fold = reads ? coneOf(root, entryOf(root), signed.filter(isCeiling)) : { standing, observed: [], own: {}, kept: true };
+        const inert = inertIn(signed, { standing: fold.standing, ceiling: isCeiling, signsReader: !reads, observed: fold.observed, own: fold.own, epoch: epochOf([...lockLines(store), ...signed]) });
+        if (inert.length)
+            throw Error('REFUSE·inert no existing reading meets these ceilings; fold the declared inputs first');
+        const coordinates = coordinatesWithdrawn(root, store, signed, [...signed, ...standing]);
+        if (coordinates.refused.length)
+            throw Error(`REFUSE·withdraw a file is still read: ${coordinates.refused.map(one => `${one.path} by ${one.by}`).join(' · ')}`);
+        const view = `${wordOf(standing, 'families', 'view')}/`;
+        const judged = signed.filter(one => isConfig(one) && fieldOf(one, 'role') === 'demands' && fieldOf(one, 'value') !== 'withdraw' && !fieldOf(one, 'scope').startsWith(view)).map(one => judgeDemand(root, one));
+        const refused = judged.filter(one => one.kind === 'refused' || (one.kind === 'judged' && one.verdict.kind === 'refuse'));
+        if (refused.length)
+            throw Error(`REFUSE·takes ${refused.map(one => `${one.scope}: ${one.kind === 'judged' ? one.verdict.why : one.kind === 'refused' ? one.why : ''}`).join(' · ')}`);
+        return { coordinates, judged, fold };
+    });
+}
+/** One witness rule for prospective admission and the locked act. */
+function refusesWidening(signed, standing) {
+    const widened = widenedWithoutWitness(signed, standing, isCeiling, wordOf(standing, 'at-classes', 'witness'));
+    if (widened.length) {
+        for (const line of widened)
+            process.stderr.write(`WIDER    ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·widening nothing landed · a ceiling that admits more than it did gives back freedom the lock had spent: sign it under a witness that names what made the old ceiling wrong\n`);
+        return true;
+    }
+    return false;
+}
+/** Admission-only checks; observation and mutation belong to the later act. */
+function refusesAdmission(root, signed, standing) {
+    if (refusesWidening(signed, standing))
+        return true;
+    const store = storeOf(root);
+    const outside = outsideTheirCapsule(root, standing, signed);
+    for (const line of outside)
+        process.stderr.write(`OUTSIDE  ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
+    if (outside.length) {
+        process.stderr.write(`${selfName()}: REFUSE·outside nothing landed · a reader or a capsule lands in the capsule of its world, never in the wire or the instrument\n`);
+        return true;
+    }
+    const forks = forksJoinedBy(store, signed).filter(fork => forksItself(fork.lines) || fork.lines.filter(line => signed.includes(line)).length > 1);
+    if (forks.length) {
+        for (const fork of forks) {
+            process.stderr.write(`FORK     ${fork.key}\n`);
+            for (const line of fork.lines)
+                process.stderr.write(`  ${signed.includes(line) ? 'new ' : 'held'}  by=${fieldOf(line, 'by')} ${sideOf(line, lockLines(store))}\n`);
+        }
+        process.stderr.write(`${selfName()}: REFUSE·fork nothing landed · one signer never forks itself, and one act never forks itself: withdraw the held side in this batch, or sign the other reading under its own scope\n`);
+        return true;
+    }
+    const held = aliasPinned(root, signed);
+    if (held.length) {
+        for (const one of held)
+            process.stderr.write(`ALIAS    ${one.scope} · ${one.digest} · ${one.by.join(' ')}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·alias nothing landed · an alias is withdrawn only when no pin names its digest\n`);
+        return true;
+    }
+    return false;
+}
 /** A batch signed as accept signs it: at the next epoch, by the key it names, each line read by the wire it would land under. */
 export async function signedBatch(root, args, files) {
     const byFile = files.map((file) => [placesOfFile(file), claimLinesIn(file)]);
@@ -57,10 +120,16 @@ export async function signedBatch(root, args, files) {
     }
     const store = storeOf(root);
     const destinations = [...new Set([...namedPlaces(args), ...byFile.flatMap(([heads]) => heads)])];
+    const rooted = lockStanding(store);
+    const stray = destinations.filter(one => !placesIn(root).includes(one) && !foundableIn(root, rooted, wordOf(rooted, 'families', 'region'), one));
+    if (stray.length) {
+        process.stderr.write(`${selfName()}: REFUSE·place nothing landed · ${stray.join(', ')} is no place of the tree, and no line of the root founds it: --place names the own lock a line lands in\n`);
+        return { kind: 'exit', code: 2 };
+    }
     const epoch = epochOf([...lockLines(store), ...destinations.flatMap((place) => appliedIn(root, place))]) + 1;
     const stale = proposed.filter((line) => fieldOf(line, 'sig')).flatMap((line) => ((by, key) => (key === undefined || !verifiesOwnerLine(line, key, signaturesOf(store).admitted)
         ? [`${fieldOf(line, 'scope')} · the signature does not hold for ${by || '∅'}`]
-        : isConfig(line) && Number(fieldOf(line, 'epoch')) !== epoch ? [`${fieldOf(line, 'scope')} · signed by ${by} at epoch ${fieldOf(line, 'epoch')}, and this act lands at ${epoch}: sign it again`] : []))(fieldOf(line, 'by'), publicKeyOf(root, fieldOf(line, 'by'))));
+        : []))(fieldOf(line, 'by'), publicKeyOf(root, fieldOf(line, 'by'))));
     if (stale.length) {
         for (const one of stale)
             process.stderr.write(`SIGNED   ${one}\n`);
@@ -85,6 +154,13 @@ export async function signedBatch(root, args, files) {
         }
         return { kind: 'once', proposed };
     }
+    const outdated = proposed.filter(line => fieldOf(line, 'sig') && isConfig(line) && Number(fieldOf(line, 'epoch')) !== epoch);
+    if (outdated.length) {
+        for (const line of outdated)
+            process.stderr.write(`SIGNED   ${fieldOf(line, 'scope')} · signed by ${fieldOf(line, 'by')} at epoch ${fieldOf(line, 'epoch')}, and this act lands at ${epoch}: sign it again\n`);
+        process.stderr.write(`${selfName()}: REFUSE·signed nothing landed · ${outdated.length} lines a lane signed stand at no epoch this act\n`);
+        return { kind: 'exit', code: 1 };
+    }
     const keyFile = valueOf(args, FLAGS.keyFile);
     const keyId = valueOf(args, FLAGS.key) ?? ownerOf(store);
     const publicKey = drafted.length ? publicKeyOf(root, keyId) : undefined;
@@ -121,6 +197,15 @@ export async function signedBatch(root, args, files) {
             return { kind: 'exit', code: 1 };
         }
     }
+    const taken = retractedTogether(signed);
+    if (taken.length) {
+        for (const pair of taken) {
+            process.stderr.write(`WITHDRAW ${sayingOf(pair.withdraw)}\n`);
+            process.stderr.write(`NEW      ${sayingOf(pair.line)}\n`);
+        }
+        process.stderr.write(`${selfName()}: REFUSE·withdraw nothing landed · a withdraw matches a new line in this batch, so it takes that line too\n`);
+        return { kind: 'exit', code: 1 };
+    }
     const authority = authorityFor([...lockLines(store), ...signed], rootSigner(root), signaturesOf(store).admitted);
     const ownership = ownedOf(root, signed, line => authority.of(line).kind === 'admitted', by => authority.admitted.find(one => one.id === by)?.coverage ?? [], named, line => { const heads = byFile.flatMap(([heads, lines]) => lines.some(draft => sayingOf(draft) === sayingOf(line)) ? heads : []); return heads.length ? heads : undefined; });
     if (ownership.nowhere.length) {
@@ -128,6 +213,14 @@ export async function signedBatch(root, args, files) {
             process.stderr.write(`${selfName()}: REFUSE·signer ${keyId} uncovered ${fieldOf(line, 'scope')} · nothing signed for delivery\n`);
         return { kind: 'exit', code: 1 };
     }
+    if (ownership.forked.length) {
+        for (const one of ownership.forked)
+            process.stderr.write(`FORKED   ${one.place}/${LOCK} · ${one.key} · the lot would leave two standing claims where the lock had one\n`);
+        process.stderr.write(`${selfName()}: REFUSE·forked nothing landed · ${ownership.forked.length} claims an own lot would fork: a lot for many places lands the same lines at each, and lines meant for one place go in a lot of their own\n`);
+        return { kind: 'exit', code: 1 };
+    }
+    if (refusesAdmission(root, ownership.ledger, lockStanding(store)))
+        return { kind: 'exit', code: 1 };
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed], text => process.stdout.write(text + '\n'));
@@ -137,6 +230,13 @@ export async function signedBatch(root, args, files) {
             return { kind: 'exit', code: 1 };
         }
     }
+    try {
+        admissionEvidence(root, ownership.ledger, lockStanding(store));
+    }
+    catch (error) {
+        process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)} · nothing landed\n`);
+        return { kind: 'exit', code: 1 };
+    }
     return { kind: 'signed', signed, epoch, ...(drafted.length ? { keyId } : {}) };
 }
 /**
@@ -151,26 +251,11 @@ export async function accept(root, args) {
     const started = Date.now();
     const named = namedPlaces(args);
     const placed = positionalsOf(args).reduce((all, file) => ((places) => (places.length ? claimLinesIn(file).reduce((got, line) => got.set(sayingOf(line), [...new Set([...(got.get(sayingOf(line)) ?? []), ...places])]), all) : all))(placesOfFile(file)), new Map());
-    const rooted = lockStanding(storeOf(root));
-    const stray = [...new Set([...named, ...[...placed.values()].flat()])].filter((one) => !placesIn(root).includes(one) && !foundableIn(root, rooted, wordOf(rooted, 'families', 'region'), one));
-    if (stray.length) {
-        process.stderr.write(`${selfName()}: REFUSE·place nothing landed · ${stray.join(', ')} is no place of the tree, and no line of the root founds it: --place names the own lock a line lands in\n`);
-        return 2;
-    }
     const batch = await signedBatch(root, args, positionalsOf(args));
     if (batch.kind === 'exit')
         return batch.code;
     if (batch.kind === 'once')
         return underTheLock(storeOf(root), 'land', () => repaid(root, batch.proposed, started));
-    const taken = retractedTogether(batch.signed);
-    if (taken.length) {
-        for (const pair of taken) {
-            process.stderr.write(`WITHDRAW ${sayingOf(pair.withdraw)}\n`);
-            process.stderr.write(`NEW      ${sayingOf(pair.line)}\n`);
-        }
-        process.stderr.write(`${selfName()}: REFUSE·withdraw nothing landed · a withdraw matches a new line in this batch, so it takes that line too\n`);
-        return 1;
-    }
     const store = storeOf(root);
     const authority = authorityFor([...lockLines(store), ...batch.signed], rootSigner(root), signaturesOf(store).admitted);
     const owned = ownedOf(root, batch.signed, (line) => authority.of(line).kind === 'admitted', (by) => authority.admitted.find((one) => one.id === by)?.coverage ?? [], named, (line) => placed.get(sayingOf(line)));
@@ -180,12 +265,6 @@ export async function accept(root, args) {
         process.stderr.write(`${selfName()}: REFUSE·nowhere nothing landed · ${owned.nowhere.length} lines neither the ledger nor an own lock admits: a line is landed signed where it stands, never written in bare\n`);
         return 1;
     }
-    if (owned.forked.length) {
-        for (const one of owned.forked)
-            process.stderr.write(`FORKED   ${one.place}/${LOCK} · ${one.key} · the lot would leave two standing claims where the lock had one\n`);
-        process.stderr.write(`${selfName()}: REFUSE·forked nothing landed · ${owned.forked.length} claims an own lot would fork: a lot for many places lands the same lines at each, and lines meant for one place go in a lot of their own\n`);
-        return 1;
-    }
     const places = placesIn(root);
     const pinned = [...new Set([...owned.own.keys(), ...named])];
     const touched = pinned.length === 0 && owned.ledger.length ? touchedBy(root, places, owned.ledger, lockStanding(store)) : [];
@@ -213,42 +292,18 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
             return 1;
         }
     }
-    const reads = !signed.some(isReaderLock) && signed.some(isCeiling);
-    const fold = reads ? took('cone', () => coneOf(root, entryOf(root), signed.filter(isCeiling), descent)) : { ...took('lines', () => standingOf(root)), observed: [], own: {}, kept: true };
-    const inert = inertIn(signed, { standing: fold.standing, ceiling: isCeiling, signsReader: !reads, observed: fold.observed, own: fold.own, epoch });
-    const widened = widenedWithoutWitness(signed, fold.standing, isCeiling, wordOf(fold.standing, 'at-classes', 'witness'));
-    if (widened.length) {
-        for (const line of widened)
-            process.stderr.write(`WIDER    ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
-        process.stderr.write(`${selfName()}: REFUSE·widening nothing landed · a ceiling that admits more than it did gives back freedom the lock had spent: sign it under a witness that names what made the old ceiling wrong\n`);
-        return 1;
-    }
-    if (inert.length) {
-        for (const line of inert)
-            process.stderr.write(`INERT    ${fieldOf(line, 'scope')} measure=${fieldOf(line, 'measure')}\n`);
-        process.stderr.write(`${selfName()}: REFUSE·inert nothing landed · no reading meets these ceilings: sign the reader that meets them in this batch, or leave them out\n`);
+    const snapshot = took('lines', () => standingOf(root));
+    if (refusesAdmission(root, signed, snapshot.standing))
         return 1;
+    let evidence;
+    try {
+        evidence = took('evidence', () => admissionEvidence(root, signed, snapshot.standing));
     }
-    const outside = outsideTheirCapsule(root, fold.standing, signed);
-    for (const line of outside)
-        process.stderr.write(`OUTSIDE  ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
-    if (outside.length) {
-        process.stderr.write(`${selfName()}: REFUSE·outside nothing landed · a reader or a capsule lands in the capsule of its world, never in the wire or the instrument\n`);
+    catch (error) {
+        process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)} · nothing landed\n`);
         return 1;
     }
-    const forks = took('fork', () => forksJoinedBy(store, signed).filter((fork) => forksItself(fork.lines) || fork.lines.filter((line) => signed.includes(line)).length > 1));
-    if (forks.length) {
-        for (const fork of forks) {
-            process.stderr.write(`FORK     ${fork.key}\n`);
-            for (const line of fork.lines)
-                process.stderr.write(`  ${signed.includes(line) ? 'new ' : 'held'}  by=${fieldOf(line, 'by')} ${sideOf(line, lockLines(store))}\n`);
-        }
-        process.stderr.write(`${selfName()}: REFUSE·fork nothing landed · one signer never forks itself, and one act never forks itself: withdraw the held side in this batch, or sign the other reading under its own scope\n`);
-        return 1;
-    }
-    if (reads)
-        for (const line of rankedIn(signed.filter(isCeiling), fold))
-            process.stdout.write(`${line}\n`);
+    const fold = evidence.fold;
     const authority = took('authority', () => authorityFor([...lockLines(store), ...signed], rootSigner(root), signaturesOf(store).admitted));
     for (const line of signed) {
         const verdict = authority.of(line);
@@ -257,14 +312,8 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
             return 1;
         }
     }
-    const coordinates = coordinatesWithdrawn(root, store, signed, [...signed, ...fold.standing]);
-    if (coordinates.refused.length) {
-        for (const one of coordinates.refused)
-            process.stderr.write(`RUN      ${one.path} · still read by ${one.by}\n`);
-        process.stderr.write(`${selfName()}: REFUSE·withdraw nothing landed · a file a block still reads cannot leave: withdraw what reads it first, or keep it\n`);
-        return 1;
-    }
     const withdraws = signed.filter((line) => fieldOf(line, 'value') === 'withdraw');
+    const coordinates = evidence.coordinates;
     const withdrawn = withdraws.length ? withdrawal(withdraws, lockLines(store)) : null;
     const view = `${wordOf(fold.standing, 'families', 'view')}/`;
     const lot = fullDigest(store, signed);
@@ -272,8 +321,7 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
         ? fullDigest(store, [...vouchedCoordinates(store)].sort(([a], [b]) => a.localeCompare(b)).map(([coordinate, digest]) => `${coordinate} ${digest}`))
         : 'key' in fold && typeof fold.key === 'string' ? fold.key : fullDigest(store, fold.standing);
     const cached = keptTakes(keptVerdict(store, tree, lot));
-    const judged = cached ?? took('takes', () => signed.filter((one) => fieldOf(one, 'role') === 'demands' && fieldOf(one, 'value') !== 'withdraw' && !fieldOf(one, 'scope').startsWith(view))
-        .map((line) => judgeDemand(root, line)));
+    const judged = cached ?? evidence.judged;
     if (!cached)
         keepVerdict(store, tree, lot, judged.map(packTake));
     const refused = judged.filter((one) => one.kind === 'refused' || (one.kind === 'judged' && one.verdict.kind === 'refuse'));
@@ -283,13 +331,6 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
         process.stderr.write(`${selfName()}: REFUSE·takes nothing landed · ${refused.length} takes refused: a batch lands whole or not at all\n`);
         return 1;
     }
-    const held = aliasPinned(root, signed);
-    if (held.length) {
-        for (const one of held)
-            process.stderr.write(`ALIAS    ${one.scope} · ${one.digest} · ${one.by.join(' ')}\n`);
-        process.stderr.write(`${selfName()}: REFUSE·alias nothing landed · an alias is withdrawn only when no pin names its digest\n`);
-        return 1;
-    }
     const told = took('told', () => standingOf(root, undefined, signed));
     for (const name of openedBy(descent, told.standing, signed))
         process.stderr.write(`OPEN     ${name}\n`);

package/dist/cli/owner.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { keyFor, lockLines, releaseOf, signedLockLines } from "../fold/keys.js";
 import { existsSync, renameSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -83,6 +84,8 @@ export function renderedLock(root, store, told = []) {
         return readRelease(released);
     const owned = [...lockLines(store), ...told];
     const render = () => renderTarget(owned, undefined, authorityFor(owned, rootSigner(root), signaturesOf(store, told).admitted).of, forkReceipts(store, owned));
+    if (readOnly())
+        return render();
     if (told.length) {
         const byLock = rendered.get(lockLines(store)) ?? rendered.set(lockLines(store), new Map()).get(lockLines(store));
         return byLock.get(told) ?? byLock.set(told, render()).get(told);

package/dist/cli/verb.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
-import { resolveSources } from "../host/source-content.js";
+import { withContentStore } from "../host/content-store.js";
+import { withoutEffects } from "../host/read-only.js";
+import { resolveSources, resolveRequested } from "../host/source-content.js";
 import { cellsWithReceipts } from "../host/cell-receipts.js";
+import { renderCells } from '@lapxo/topos/cells-view';
 import { releasePolicyLines } from "../fold/release-policy.js";
 import { admittedObjects } from "../host/objects.js";
 import { objectFold } from "../fold/object.js";
@@ -15,7 +18,7 @@ import { eraOf, signaturesOf } from "../fold/digests.js";
 import { fullDigest as bootstrapDigest } from "../host/digest.js";
 import { canonical } from '@lapxo/topos/wire';
 import { EXTENSION, LOCK, fieldOf, foldClaims, isWire, selfName } from "../fold/claims.js";
-import { observedClaims } from "../fold/observed.js";
+import { observedClaims, readerRefusals } from "../fold/observed.js";
 import { rolesOf } from "../fold/roles.js";
 import { authorityFor, releaseSigner, rootSigner, writerFor } from "../fold/signers.js";
 import { land, ledgerLines, storeOf } from "../land/ledger.js";
@@ -189,10 +192,31 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
     const rest = told.filter((line) => !ledger.includes(line));
     if (place && rest.length)
         tellOwn(place, rest);
+    if (name === NAMED_VIEWS.lines && (told.length || depth === undefined)) {
+        const text = standingOf(root, under, ledger).standing.filter(isWire).join('\n');
+        process.stdout.write(text ? `${text}\n` : '');
+        return EXIT.closed;
+    }
+    if (told.length) {
+        const selected = viewsOf(standingOf(root, under, ledger).standing).get(name);
+        if (selected && !selected.shape && selected.regions.some(region => region.name === 'cells')) {
+            const history = [...signedOwnerLines(storeOf(root)), ...ledger];
+            const held = await admittedObjects(root, history);
+            process.stdout.write(`TOLD     ${told.length} lines folded as if landed · nothing written\n`);
+            for (const line of renderCells(objectFold(held.records, held.context)))
+                process.stdout.write(line + '\n');
+            return EXIT.closed;
+        }
+    }
     const own = place ? rest.filter((line) => admittedIn(root, place, line)) : [];
     const fold = told.length
-        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }) })
-        : foldPlace(root, entryOf(root), under, false);
+        ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }), free: true })
+        : foldPlace(root, entryOf(root), under, true);
+    if (!told.length && readerRefusals().length) {
+        for (const why of readerRefusals())
+            process.stderr.write(`${selfName()}: ${why}\n`);
+        return EXIT.refuse;
+    }
     if (coord)
         askWhy(fold, coord);
     if (name === NAMED_VIEWS.lines) {
@@ -200,6 +224,9 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
             beat(root, fold, Date.now() - at);
         const text = fold.standing.filter(isWire).join('\n');
         process.stdout.write(text ? `${text}\n` : '');
+        if (depth === '1')
+            for (const line of readingsIn([...fold.standing.filter(isCeiling), ...ownCeilings(under)], fold))
+                process.stdout.write(`${line}\n`);
         return EXIT.closed;
     }
     const views = viewsOf(fold.standing);
@@ -371,7 +398,7 @@ function foldFile(at) {
     process.stdout.write(`FACT     ${folded.standing.length} standing · ${folded.forks.length} forks · ${basename(at)}\n`);
     return EXIT.closed;
 }
-function foldVerb(_root, rest) {
+function foldVerb(root, rest) {
     const files = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory() && one.endsWith(EXTENSION));
     const places = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (files.length === 1 && !places.length && valueOf(rest, FLAGS.as) === undefined) {
@@ -381,16 +408,27 @@ function foldVerb(_root, rest) {
         return foldAt(dirname(at), undefined, rest);
     }
     const under = places[0];
-    const tree = files.length === 1 ? dirname(resolve(files[0])) : resolve('.');
+    // A prospective lot is data, not the place whose authority admits it.
+    const tree = files.length ? root : resolve('.');
     const place = under ? relative(tree, resolve(under)).split(sep).join('/') : '';
     return foldAt(tree, place ? `${place}/` : undefined, rest);
 }
 async function foldAt(root, under, argv) {
+    return withContentStore(storeOf(root), () => foldRequested(root, under, argv), () => standingOf(root, under).standing);
+}
+async function foldRequested(root, under, argv) {
+    const as = valueOf(argv, FLAGS.as);
+    const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    if (as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+        return foldResolved(root, under, argv);
+    return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
+}
+async function foldResolved(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
+    const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
     // Public content is authenticated by its digest, independently of owner history.
     // A named view does not request mounting every release of the instrument.
-    if (as !== NAMED_VIEWS.help && lockLines(storeOf(root)).length)
-        await resolveSources(standingOf(root, under).standing, as === undefined);
+    const receiptCheck = as === undefined && argv.includes(FLAGS.check);
     if (as === OBJECT_VIEW) {
         const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
         if (inputs.length > 1)
@@ -406,6 +444,8 @@ async function foldAt(root, under, argv) {
     const key = valueOf(argv, FLAGS.key);
     if (as === undefined) {
         const exit = await pass(root, entryOf(root), under, argv.includes(FLAGS.check));
+        if (receiptCheck)
+            return exit;
         if (exit !== 0)
             return exit;
         const history = signedOwnerLines(storeOf(root));
@@ -421,7 +461,7 @@ async function foldAt(root, under, argv) {
         }
         return exit;
     }
-    const named = positionalsOf(argv).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
+    const named = inputs;
     const coord = positionalsOf(argv).find((one) => one !== under?.replace(/\/$/, '') && !one.startsWith('-') && !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
     if ((as === 'why' || as === NAMED_VIEWS.because || as.split('@')[0] === 'why') && coord !== undefined)
         return view(root, under, as === NAMED_VIEWS.because ? 'why' : as, [], coord, key);
@@ -432,7 +472,7 @@ async function foldAt(root, under, argv) {
         return batch.code;
     if (batch.kind === 'once')
         process.stdout.write(`ONCE     ${batch.proposed.length} lines · every one already landed: the view folds the tree as it stands\n`);
-    return view(root, under, as, batch.kind === 'signed' ? batch.signed : [], undefined, key);
+    return withoutEffects(() => view(root, under, as, batch.kind === 'signed' ? batch.signed : batch.proposed, undefined, key));
 }
 const VERBS = {
     fold: (root, rest) => foldVerb(root, rest),
@@ -459,8 +499,10 @@ function main(argv) {
     const verb = argv[0] ?? '';
     const run = verb in VERBS ? VERBS[verb] : undefined;
     const places = positionalsOf(run === undefined ? argv : argv.slice(1)).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
-    if (run !== undefined)
-        return run(resolve(places[0] ?? '.'), argv.slice(1), argv);
+    if (run !== undefined) {
+        const root = resolve(places[0] ?? '.');
+        return withContentStore(storeOf(root), () => run(root, argv.slice(1), argv));
+    }
     const under = argv[0] ?? '';
     if (under && !under.startsWith('-') && places.includes(under)) {
         const root = resolve('.');

package/dist/fold/configures.js

@@ -4,6 +4,8 @@ import { isReaderLock } from "./observed.js";
 import { isRoleLock } from "./roles.js";
 import { isSignerLock } from "./signers.js";
 import { isReleaseBinding } from "../host/release.js";
+import { isRegionDeclaration } from "./region-declarations.js";
+import { ownLock } from "../observe/runner.js";
 function isEffectLock(line) {
     const got = parse(line);
     return got.kind === 'fact' && got.value.fields['measure'] === 'effect';
@@ -11,7 +13,7 @@ function isEffectLock(line) {
 /** A lock line the instrument itself consumes — an effect it runs, a reader it loads, a role it walks by, a signer it admits, the wire it reads by. */
 function configures(line) {
     const got = parse(line);
-    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields));
+    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields)) || isRegionDeclaration(line, ownLock());
 }
 /** Every reads line that configures nothing is a ceiling: a bound some reading has to meet. */
 export function isCeiling(line) {

package/dist/fold/digests.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { appendFileSync, dirname, join, mkdirSync, readdirSync, relative, resolve } from "../host/io.js";
 import { bytesDigest as bytesWith, fullDigest as fullWith } from "../host/digest.js";
 import { coordinatesUnder, observeFile, observeText, stampOf } from "../observe/files.js";
@@ -116,6 +117,8 @@ export function coordinateDigest(store, at) {
         return held;
     const digest = bytesDigest(store, observeFile(at) ?? new Uint8Array());
     memo.set(key, digest);
+    if (readOnly())
+        return digest;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${digest}\n`);
     return digest;
@@ -127,6 +130,8 @@ export function memoized(store, key, compute) {
         return held;
     const value = compute();
     memo.set(key, value);
+    if (readOnly())
+        return value;
     mkdirSync(join(store, 'cas'), { recursive: true });
     appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${value}\n`);
     return value;
@@ -141,7 +146,8 @@ const importsOf = (store, at, digest) => {
     const found = [...new TextDecoder().decode(observeFile(at) ?? new Uint8Array()).matchAll(/(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s*)['"]([^'"]*)['"]/g)].map((m) => m[1] ?? '');
     imported.set(digest, found);
     memo.set(key, found.join('|'));
-    appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
+    if (!readOnly())
+        appendFileSync(join(store, 'cas', `stamps${EXTENSION}`), `${key}\t${found.join('|')}\n`);
     return found;
 };
 /**

package/dist/fold/kept.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
@@ -129,8 +130,11 @@ export function keptPlace(store, under) {
     };
 }
 export const keptRender = (store, key, name) => observeText(memoAt(store, `render/${key}/${name}`));
-export const keepRender = (store, _signer, key, name, _epoch, text_) => { landMemo(store, `render/${key}/${name}`, text(text_)); };
+export const keepRender = (store, _signer, key, name, _epoch, text_) => { if (!readOnly())
+    landMemo(store, `render/${key}/${name}`, text(text_)); };
 export function keepFold(store, key, fold, points, instrument = '') {
+    if (readOnly())
+        return;
     const packed = {
         ...fold,
         standing: joined(fold.standing),

package/dist/fold/observed.d.ts

@@ -15,6 +15,7 @@ export declare const readersBehind: () => readonly {
     readonly module: string;
     readonly places: number;
 }[];
+export declare const readerRefusals: () => readonly string[];
 export declare function readerLines(store: string): readonly string[];
 /**
  * A reader never blocks a fold that did not ask to wait: what it read before is served at once, and a reader whose

package/dist/fold/observed.js

@@ -1,3 +1,5 @@
+import { readerLifetime, readerAllowsEmpty, assertReaderInputs, parse as parseLifetime } from '@lapxo/topos/wire';
+import { readOnly } from "../host/read-only.js";
 import { basename, dirname, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
 import { bundleOf, processOf } from "../observe/runner.js";
 import { canonical, parse, PROTOCOL } from '@lapxo/topos/wire';
@@ -15,7 +17,7 @@ import { capsuleReadersOf, handedAt, lookOf, offersOf } from "./readers.js";
 import { runReader, runs } from "../observe/run.js";
 import { LEVEL, OBSERVED, keepObservation, keyOf, legacyOf, observation, observed as observedAt, opened, pointer, readerOf, regionIn, setAside, sha, trimmed } from "./shards.js";
 import { saidDigest } from "./kept.js";
-import { carriedIn } from "./resolved.js";
+import { carriedIn, carriedFrom } from "./resolved.js";
 export const cased = (question) => /^(?:vector|sample)\//.test(question);
 export function isReaderLock(line) {
     const got = parse(line);
@@ -87,6 +89,8 @@ function takeReadings(observed) {
 }
 const behind = [];
 export const readersBehind = () => behind;
+const refused = [];
+export const readerRefusals = () => refused;
 const alive = (pid) => { try {
     return process.kill(pid, 0);
 }
@@ -170,6 +174,14 @@ export function readerReaches(reach, where) {
     return where.some((one) => reached(trimmed(one)));
 }
 export function observedClaims(root, store, options = {}) {
+    refused.length = 0;
+    if (readOnly()) {
+        const carried = (observeText(resolve(root, 'receipts.bound')) ?? '').split('\n').filter(isWire);
+        const evidence = carriedFrom(store, carried);
+        if (evidence === undefined)
+            throw Error('REFUSE·preview native receipt bytes unavailable; fold the declared inputs first');
+        return evidence;
+    }
     const wait = options.wait ?? true;
     const standing = lockStanding(store);
     const lines = readersOf(store);
@@ -253,14 +265,15 @@ export function observedClaims(root, store, options = {}) {
     }
     function observeOne(reader, started) {
         const module = resolve(root, reader.module);
-        const asked = reader.capsule === undefined ? undefined : capsuleAt(reader.capsule.digest, reader.capsule.entry);
+        const asked = reader.capsule === undefined ? undefined : reader.capsule.selected ?? capsuleAt(reader.capsule.digest, reader.capsule.entry);
         const source = reader.capsule === undefined ? observeFile(module) : asked === undefined ? undefined : new Uint8Array();
-        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? 'unbundled' : 'none';
+        const bundle = source && reader.capsule === undefined ? bundleOf(module) ?? bytesDigest(store, source) : 'none';
         const offered = offersOf(root, store, reader, roleOf, look, (where) => reached(trimmed(where)));
+        assertReaderInputs(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module, offered.length);
         const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
         const kept = whole && legacy === undefined && answered === undefined && source ? sha([
             speaker, reader.module, reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
-            reader.capsule === undefined ? '' : `${reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
+            reader.capsule === undefined ? '' : `${reader.capsule.selected?.selection ?? reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
             ...offered.map((offer) => `${offer.place} ${offer.digest?.() ?? bytesDigest(store, offer.bytes())}`),
         ].join('\n')) : undefined;
         const stored = kept === undefined ? undefined : observeText(memoAt(store, `observed/${kept}`));
@@ -275,8 +288,8 @@ export function observedClaims(root, store, options = {}) {
         const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}`);
         const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value'));
         const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
-        const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.digest}\n${reader.capsule.region}`).slice(0, 12) : 'none', lines: [] }
-            : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
+        const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}`).slice(0, 12) : 'none', lines: [] }
+            : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime: readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
                 : { by: 'none', lines: [] };
         const by = measured.by;
         const level = [...measured.lines];
@@ -351,8 +364,10 @@ export function observedClaims(root, store, options = {}) {
             }
             return [];
         };
-        if (due.length && !source)
+        if (due.length && !source) {
+            refused.push(`REFUSE·reader ${reader.module} unavailable · ${due.length} readings remain due`);
             return false;
+        }
         if (due.length && !wait) {
             for (const plan of plans) {
                 if (plan.said !== undefined) {
@@ -394,14 +409,18 @@ export function observedClaims(root, store, options = {}) {
                             throw new Error(`REFUSE·reader ${reader.module} · ${answer?.why ?? 'no capsule answer'}`);
                         return (answer.claims ?? []);
                     })
-                    : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })));
+                    : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })), readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module));
             }
             catch (error) {
-                process.stderr.write(`REFUSE reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}\n`);
+                const why = `REFUSE·reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
-            if (rows.every((mine) => !mine.length)) {
-                process.stderr.write(`REFUSE   reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due\n`);
+            if (rows.every((mine) => !mine.length) && !readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module)) {
+                const why = `REFUSE·reader ${reader.module} · answered none of ${due.length} places · nothing landed, they stay due`;
+                refused.push(why);
+                process.stderr.write(`${why}\n`);
                 return false;
             }
             ran += due.length;