@lapxo/bound 0.1.3 → 0.1.5

package/dist/observe/identity.js

@@ -19,7 +19,7 @@ export function resetsOnEqualEmits(lines) {
     }
     return [...named.values()].filter((ats) => ats.size > 1).length;
 }
-function emitted(store, root, module, kind, cases) {
+function emitted(store, root, module, kind, cases, lifetime) {
     const laid = kind === 'process' ? mkdtempSync(join(tmpdir(), `${selfName()}-vectors-`)) : root;
     try {
         for (const one of kind === 'process' ? cases : []) {
@@ -28,7 +28,7 @@ function emitted(store, root, module, kind, cases) {
                 writeFileSync(join(laid, one.place, name), text);
             }
         }
-        const rows = runReader(resolve(root, module), laid, cases.map((one) => ({ place: one.place, ...(kind === 'js' ? { text: one.text ?? '' } : {}) })));
+        const rows = runReader(resolve(root, module), laid, cases.map((one) => ({ place: one.place, ...(kind === 'js' ? { text: one.text ?? '' } : {}) })), lifetime);
         if (cases.length && rows.every((mine) => !mine.length))
             return undefined;
         const said = rows.map((mine) => mine.filter((row) => !/^(cost|derived|vector-memo)\//.test(row.scope)).map((row) => JSON.stringify(row)).sort());
@@ -50,7 +50,7 @@ export function identityOf(input) {
     const known = mine.find((line) => fieldOf(line, 'measure') === 'extension' && fieldOf(line, 'at') === `place:${key}`);
     if (known !== undefined && fieldOf(known, 'value') === input.code)
         return { by: input.code, lines: [] };
-    const emits = emitted(input.store, input.root, input.module, input.kind, JSON.parse(text).cases ?? []);
+    const emits = emitted(input.store, input.root, input.module, input.kind, JSON.parse(text).cases ?? [], input.lifetime);
     if (emits === undefined)
         return { by: input.code, lines: [] };
     const by = input.code;

package/dist/observe/regions.js

@@ -5,13 +5,11 @@ import { createHash } from 'node:crypto';
 import { basename, dirname, join, relative } from 'node:path';
 import { CAPSULE, LOCK, canonical, matches, PROTOCOL } from '@lapxo/topos/wire';
 import { handed, readsOf } from '@lapxo/topos/capsule';
-import { STATES } from '@lapxo/obligations';
 import { foldCeilings } from "../fold/ceilings.js";
 import { fieldOf, wireLinesOf as linesOf } from "../fold/claims.js";
 import { isCeiling } from "../fold/configures.js";
 import { keyFor } from "../fold/keys.js";
 import { casesHeld, placedReadings } from "../fold/observed.js";
-import { verdictsFor } from "../fold/paid.js";
 import { capsuleAt as isWorld, placesIn, spoken } from "../fold/places.js";
 import { rolesOf } from "../fold/roles.js";
 import { ownLockOf } from "../fold/signed.js";
@@ -71,9 +69,8 @@ function askedOf(fold) {
     return fold.under ? [...new Set(capsuleOf(fold).filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'role') === 'render').map((line) => fieldOf(line, 'scope').slice('region/'.length)))]
         .map((name) => ((n) => fact(`asked/${name}`, `${n}..${n}`, 'interval', 'count'))(pinnersOf(fold).map(at).filter((names) => names.has(name)).length)) : [];
 }
-/** The place's verdict line as counts: what the fold lands, forks and refuses, each of the object's four states, and the ceilings it meets. */
+/** File-fold readings and their ceilings; this path computes no object encounters. */
 function verdictOf(fold) {
-    const states = Object.values(verdictsFor(fold));
     const named = (line) => ((cut) => [line.slice(0, cut < 0 ? line.length : cut).trim(), line.slice(cut < 0 ? line.length : cut + 3).trim() || line])(line.indexOf(' · '));
     const here = (fold.under ?? '').replace(/\/$/, '');
     const others = new Set(here ? placesIn(fold.root).filter((place) => place !== here) : []);
@@ -86,7 +83,8 @@ function verdictOf(fold) {
         return !others.has(head);
     };
     return [['claims', fold.claims], ['forks', fold.forks.length + (fold.second.verdict === 'forks' ? 1 : 0)], ['refused', fold.refused.length], ['vacuous', fold.vacuous], ['history', fold.history.length],
-        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length], ...STATES.map((one) => [one, states.filter((state) => state === one).length])].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length]].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        .concat([fact('verdict/computation', 'readings'), fact('verdict/encounters', 'uncomputed')])
         .concat(fold.ceilings.short.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`unpaid/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.over.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`outside/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.unread.filter(mine).map((scope) => fact(`unpaid/${scope}`, 'unread')))

package/dist/observe/run.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
 export type Kind = 'js' | 'process';
 /** The kinds this host starts. A reader of any other kind is signed and stays potential: nothing here runs it. */
 export declare const runs: (kind: string) => kind is Kind;
@@ -26,5 +27,5 @@ export declare const hostOf: () => string;
  * the file it is handed or alone when it reads the place by running it, as the region it was matched for when its
  * capsule reads with several, and answers one list of claims per place.
  */
-export declare function runReader(module: string, root: string, inputs: readonly Input[]): readonly (readonly Row[])[];
+export declare function runReader(module: string, root: string, inputs: readonly Input[], limits?: ReaderLifetime): readonly (readonly Row[])[];
 export {};

package/dist/observe/run.js

@@ -1,3 +1,4 @@
+import { boundedProcess } from "../host/process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { PROTOCOL } from '@lapxo/topos/wire';
@@ -13,7 +14,7 @@ export const hostOf = () => processOf('host');
  * the file it is handed or alone when it reads the place by running it, as the region it was matched for when its
  * capsule reads with several, and answers one list of claims per place.
  */
-export function runReader(module, root, inputs) {
+export function runReader(module, root, inputs, limits) {
     if (!inputs.length)
         return [];
     const requests = inputs.map((input) => ({
@@ -23,8 +24,9 @@ export function runReader(module, root, inputs) {
     const reader = readerOf(module);
     if (!existsSync(reader.path))
         throw new Error(`REFUSE·reader ${module} unavailable; its declared capability needs an admitted provider`);
-    const ran = spawnSync(process.execPath, [...reader.flags, hostOf(), reader.path, module], { cwd: root, input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 28 });
-    if (ran.error)
+    const args = [...reader.flags, hostOf(), reader.path, module];
+    const ran = limits === undefined ? spawnSync(process.execPath, args, { cwd: root, input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 28 }) : boundedProcess(process.execPath, args, JSON.stringify(requests), limits, root);
+    if ('error' in ran && ran.error)
         throw Object.assign(new Error(`${module}: reader process failed: ${ran.error.message}`), { cause: ran.error });
     if (ran.status !== 0)
         throw new Error(`${module}: reader exited ${ran.status ?? `with signal ${ran.signal}`}\n${ran.stderr ?? ''}${ran.stdout ?? ''}`);

package/dist/render/field.d.ts

@@ -1,9 +1,3 @@
 import type { PlaceFold } from '../cli/place.ts';
-/**
- * The field of a place at resolution N: every bound placed at the place or at none, in the state its poles give, and
- * every coordinate cut to its first N steps in the worst state it holds. Interval poles with no value in common
- * conflict, as two signers on one key do; an alphabet that permits none is a ceiling like any other. A value read
- * outside the poles is forbidden; a bound nothing read, a reader that refused and a demand unpaid are required; the
- * rest is free. It is read off the region summaries and the landed readings, and no reader runs.
- */
+/** Host file-region readings, grouped by coordinate prefix. These statuses do not compute object encounters. */
 export declare function field(fold: PlaceFold, at: number): readonly string[];

package/dist/render/field.js

@@ -3,15 +3,9 @@ import { placesIn } from "../fold/places.js";
 import { placedAt } from "../fold/reach.js";
 import { polesOf, rankOf, unpackRegions } from "../fold/region.js";
 import { INTERVALS } from '@lapxo/topos/forms';
-const WORST = ['CONFLICT', 'FORBIDDEN', 'REQUIRED', 'FREE'];
+const WORST = ['disagreement', 'outside', 'unanswered', 'met'];
 const empty = (ceiling) => ceiling !== undefined && 'lo' in ceiling && !INTERVALS.inhabited(ceiling);
-/**
- * The field of a place at resolution N: every bound placed at the place or at none, in the state its poles give, and
- * every coordinate cut to its first N steps in the worst state it holds. Interval poles with no value in common
- * conflict, as two signers on one key do; an alphabet that permits none is a ceiling like any other. A value read
- * outside the poles is forbidden; a bound nothing read, a reader that refused and a demand unpaid are required; the
- * rest is free. It is read off the region summaries and the landed readings, and no reader runs.
- */
+/** Host file-region readings, grouped by coordinate prefix. These statuses do not compute object encounters. */
 export function field(fold, at) {
     if (fold.regions === undefined)
         return ['GREY     field · this fold carries no region summaries; it is read again at the next fold'];
@@ -25,10 +19,10 @@ export function field(fold, at) {
         ...regions.bounds.filter((bound) => here(bound.line)).map((bound) => {
             const ceiling = (poles.get(bound.region) ?? poles.set(bound.region, polesOf(regions, bound.region)).get(bound.region)).get(`${bound.question} ${bound.measure}`)?.ceiling;
             const got = rankOf(regions, bound, own);
-            return [fieldOf(bound.line, 'scope'), empty(ceiling) ? 'CONFLICT' : got.bars || got.sums ? 'FORBIDDEN' : got.met ? 'FREE' : 'REQUIRED'];
+            return [fieldOf(bound.line, 'scope'), empty(ceiling) ? 'disagreement' : got.bars || got.sums ? 'outside' : got.met ? 'met' : 'unanswered'];
         }),
-        ...fold.missing.filter(here).map((line) => [fieldOf(line, 'scope'), 'REQUIRED']),
-        ...fold.forks.flatMap((fork) => fork.lines.slice(0, 1)).filter(here).map((line) => [fieldOf(line, 'scope'), 'CONFLICT']),
+        ...fold.missing.filter(here).map((line) => [fieldOf(line, 'scope'), 'unanswered']),
+        ...fold.forks.flatMap((fork) => fork.lines.slice(0, 1)).filter(here).map((line) => [fieldOf(line, 'scope'), 'disagreement']),
     ];
     const cells = new Map();
     for (const [scope, state] of states) {
@@ -39,7 +33,7 @@ export function field(fold, at) {
     const ordered = [...cells].sort((a, b) => WORST.indexOf(a[1].state) - WORST.indexOf(b[1].state) || a[0].localeCompare(b[0]));
     return [
         '## field', '', '```',
-        `FIELD    @${at} · ${cells.size} cells · ${states.length} bounds · ${WORST.map((state) => `${state} ${ordered.filter(([, one]) => one.state === state).length}`).join(' · ')}`,
+        `FIELD    @${at} · ${cells.size} groups · ${states.length} bounds · readings · no encounters computed · ${WORST.map((state) => `${state} ${ordered.filter(([, one]) => one.state === state).length}`).join(' · ')}`,
         ...ordered.map(([cell, one]) => `FIELD    ${cell} · ${one.state} · ${one.bounds} bounds`),
         '```',
     ];

package/dist/render/names.d.ts

@@ -1,3 +1,3 @@
 /** The regions bound renders itself, by name: a view that asks any other is answered by a capsule that declares it, or refused whole. */
-export declare const REGION_NAMES: readonly ["receipts", "help", "lines", "red", "forks", "programs", "why", "sign", "take", "history", "field"];
+export declare const REGION_NAMES: readonly ["receipts", "help", "lines", "red", "forks", "programs", "why", "sign", "take", "history", "field", "evidence"];
 export type RegionName = (typeof REGION_NAMES)[number];

package/dist/render/names.js

@@ -1,4 +1,4 @@
 /** The regions bound renders itself, by name: a view that asks any other is answered by a capsule that declares it, or refused whole. */
 export const REGION_NAMES = [
-    'receipts', 'help', 'lines', 'red', 'forks', 'programs', 'why', 'sign', 'take', 'history', 'field',
+    'receipts', 'help', 'lines', 'red', 'forks', 'programs', 'why', 'sign', 'take', 'history', 'field', 'evidence',
 ];

package/dist/render/receipts.js

@@ -23,7 +23,8 @@ export function receiptRegion(fold, at) {
     const contract = wireLine(ownLock(), 'receipt-instrument');
     const coordinate = contract === undefined ? undefined : fieldOf(contract, 'value');
     const implementation = coordinate === undefined ? undefined : instrumentDigest(fold.store, sourceOf(), [], ownRoot(), ownLock());
-    const observed = [...receiptsOf(fold), ...(coordinate && implementation ? [canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'digest', value: implementation, at: `place:${implementation}`, by: 'bound' })] : [])];
+    // The current implementation seal is metadata, not an observation carried from a previous fold.
+    const observed = [...receiptsOf(fold).filter(line => !coordinate || fieldOf(line, 'scope') !== coordinate), ...(coordinate && implementation ? [canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'digest', value: implementation, at: `place:${implementation}`, by: 'bound' })] : [])];
     const hash = (bytes) => bytesDigest(fold.store, new TextEncoder().encode(bytes));
     const head = keyOf(fold.store, 'attest');
     const projection = receiptProjection(observed, fields, hash, head ? [head] : []);

package/dist/render/view.js

@@ -7,26 +7,29 @@ import { capsuleAnswers, capsuleRegions, capsuleViews } from "./capsule.js";
 import { declaredBy } from "../observe/regions.js";
 import { readersBehind } from "../fold/observed.js";
 import { LOCK, canonical, matches } from '@lapxo/topos/wire';
-import { STATES } from '@lapxo/obligations';
 import { fieldOf, foldClaims, selfName } from "../fold/claims.js";
 import { keepRender, keptRender } from "../fold/kept.js";
-import { bytesDigest } from "../fold/digests.js";
-import { writerFor } from "../fold/signers.js";
+import { bytesDigest, signaturesOf } from "../fold/digests.js";
+import { authorityFor, rootSigner, writerFor } from "../fold/signers.js";
 import { lockLines } from "../fold/keys.js";
+import { appliedIn } from "../fold/signed.js";
+import { ledgerLines } from "../land/ledger.js";
 import { horizonOf, moved, shapeLines } from "./shape.js";
 import { rankLines } from "../fold/rank.js";
 import { differing, regionsOf } from "../fold/region.js";
-import { verdictsFor } from "../fold/paid.js";
 import { field } from "./field.js";
 import { helpLines } from "../cli/names.js";
+/** Authenticated delivery history is evidence, not the place's normative standing. */
+const evidence = (fold) => {
+    const authority = authorityFor(lockLines(fold.store), rootSigner(fold.root), signaturesOf(fold.store).admitted);
+    const place = (fold.under ?? '').replace(/\/$/, '');
+    const deliveries = place ? appliedIn(fold.root, place)
+        : [...new Set(authority.admitted.flatMap(key => ledgerLines(fold.store, key.id)))];
+    return deliveries
+        .filter(line => authority.of(line).kind === 'admitted');
+};
 const block = (name, lines) => (lines.length ? [`## ${name}`, '', '```', ...lines, '```'] : []);
 const seconds = (ms) => `${(ms / 1000).toFixed(1)} s`;
-const statesOf = (fold) => {
-    const held = new Map();
-    for (const one of Object.values(verdictsFor(fold)))
-        held.set(one, (held.get(one) ?? 0) + 1);
-    return STATES.flatMap((one) => (held.get(one) ? [`${one} ${held.get(one)}`] : []));
-};
 const programs = (fold) => {
     const median = fold.costs.length ? [...fold.costs].sort((a, b) => a - b)[Math.floor(fold.costs.length / 2)] ?? 0 : 0;
     const turned = moved(fold);
@@ -34,12 +37,13 @@ const programs = (fold) => {
     const refusedByReader = fold.observed.filter((line) => fieldOf(line, 'scope') === 'refuse/reader').length;
     const c = fold.ceilings;
     return block('programs', [
-        `PROGRAMS${fold.under ? ` ${fold.under}` : ''} ${[`${fold.claims} claims`, ...statesOf(fold), `${fold.history.length} history`].join(' · ')}`
+        `PROGRAMS${fold.under ? ` ${fold.under}` : ''} ${[`${fold.claims} claims`, `${fold.history.length} history`].join(' · ')}`
             + ` · ${fold.forks.length + (fold.second.verdict === 'forks' ? 1 : 0)} forks · ${fold.grey.length} grey · ${fold.refused.length} refused · ${fold.vacuous} vacuous`
             + ` · ${secondName()} ${fold.second.verdict}${fold.second.verdict === 'agrees' && !fold.second.external ? ', never disagreed' : ''}`
             + ` · store ${fold.observed.length} observed${refusedByReader ? ` · ${refusedByReader} refuse·reader` : ''}`
             + (fold.under ? ` · ceilings ${c.read} met here · ${c.short.length} short · ${c.over.length} over`
                 : ` · ceilings ${c.read}/${c.total} read · ${c.short.length} short · ${c.over.length} over · ${c.unread.length} unread${c.vacuous.length ? ` · ${c.vacuous.length} vacuous unread` : ''}`)
+            + ' · readings · no encounters computed'
             + ` · ${fold.effects} · take ${fold.costs.length ? seconds(fold.costs[fold.costs.length - 1] ?? 0) : 'none'} last`
             + (fold.costs.length > 1 ? ` · ${seconds(median)} median of ${fold.costs.length}` : ''),
         ...shapeLines(fold),
@@ -134,6 +138,7 @@ const REGIONS = {
     receipts: (fold) => receiptRegion(fold, 1),
     help: () => helpLines(),
     lines: (fold) => fold.standing,
+    evidence,
     red, forks, programs, why, sign, take, history,
     field: (fold) => field(fold, 3),
 };

package/docs/contracts/archive.md

@@ -0,0 +1,11 @@
+# Exact release artifact
+
+Packing is a host operation. An archive digest names those archive bytes; it is not the identity of a Topos standing. The release pipeline makes one archive and transfers that same file to its destinations. Repeating a pack operation is not a proof of identical bytes.
+
+The archive conformance vector declares the host package command, digest algorithm, execution deadline, response bound and its sample packages. It packs each sample once, hashes the resulting bytes, verifies both destination copies, installs offline without package scripts and compares every listed installed member with the input bytes. It executes the installed entry and checks its declared output. Changed archive bytes refuse by digest before they can be treated as the named artifact. The negative control fails when that verification is removed.
+
+The samples use independent packages with different contents. Their outputs and member digests are captured by the executable vector; their file presence alone is not evidence. The selected publication reader measures this quartet through the existing process contract, and native receipts supply its member status to the plan.
+
+This is conformance of the packaging recipe. Acceptance of a particular Bound candidate additionally requires the exact archive audit, clean installation and product CLI captures for that archive. A previous archive's captures cannot certify changed implementation bytes. The final candidate must be rebuilt after admitted metadata changes, with every changed member accounted for. The product witness uses the installed reader directly, without a checkout ledger or source conditions.
+
+Rendering and installation are different boundaries. README, the manifest and the standard MIT text remain native renders. Publication to a registry or forge is a later owner action; this vector does not publish, authenticate to an account, create a tag or infer an external release from a local file.

package/docs/contracts/cli.md

@@ -0,0 +1,11 @@
+# fold
+
+`bound fold` reads the admitted place. Configuration output names readings and says no encounters computed; its counts are not independent-origin states. A declared cells view projects admitted typed history into Obligations. A selected world defines other views; its contract decides when empty output is valid. A refusal or nonzero status wins over any parseable diagnostic stdout. `--check` verifies receipts without inventing a missing reading. The published evidence vector folds fresh places, preserves admitted key attribution, reads a native receipt and checks exact withdrawals. The typed-object quartet covers object states separately.
+
+# land
+
+`bound land <lot>` admits authenticated lines through the same boundary used by signing and previews. Authority, coverage, historical wire and typed context remain distinct checks. Unknown wire and tampered signatures refuse. Exact redelivery returns ONCE; it does not append another origin or grant new authority. Withdrawals remain exact under their declared contract. A refusal does not append a partial act. The published evidence vector lands fresh places, refuses unauthorized writes and tampering, redelivers signed bytes and exercises exact withdrawals. The signing-port vector additionally checks interrupted or invalid command responses do not land a partial lot.
+
+# sign
+
+`bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.

package/docs/contracts/documents.md

@@ -0,0 +1,35 @@
+# Explanation — historical profile
+
+The declared view selects idea, what-holds and refuses from the byte-pinned historical document provider. The place owns its language and prose. Idea renders its own heading and body. The other two regions require their declared law readings or captured refusals; absent evidence supplies no invented result. The executable sample uses two unrelated places, checks the complete explanation file, repeats the product fold without a file difference and asks the named view directly. It also refuses a well-formed view asking an unoffered region. This quartet proves own-prose projection and absence under this profile; it does not certify law readings, a rejection corpus, typed-object states or the pending general document contract. Bound does not parse this prose.
+
+# README — historical profile
+
+The declared view selects hero@3, commands@3 and idea@3 from the byte-pinned historical document provider. The place supplies its name, tagline, language, sentence rule and idea. Commands and measured badges are absent in the sample: no command, number or success is invented to fill them. Two unrelated places check the generated README, a second unchanged product fold and the named view; a declared unoffered region refuses by name. The implementation member is verified against the admitted historical artifact. This quartet proves the selected prose profile, not command execution, badges with measured values or a general document grammar. The eight text@3 demands remain unpaid.
+
+# Citation file — historical profile
+
+The declared view asks the pinned document provider for cff at resolution 3. It projects the place name, version and optional citation metadata into CFF text. The sample uses the exact implementation member from the admitted historical artifact, names its hash and license, and exercises two unrelated places through the compiled CLI. It checks complete citation bytes and two equal readings; title and version follow each place. An unoffered region refuses by view name. Missing optional metadata is omitted; missing name can produce an empty answer under this historical profile. Rendering is not verification of a scientific claim or an external DOI. This pinned profile does not implement the pending general document contract.
+
+# Guide — historical profile
+
+The declared view asks seq from the pinned historical document provider. The place owns page/seq lines and their heading. Canonical input order supplies the steps; the provider numbers that order and writes the requested shape. The executable sample uses two unrelated procedures, checks their complete Markdown and reads each view twice without differences. A declared view with an unoffered region refuses by name. An empty step set may have an empty answer; it is not invented evidence. A rendered instruction does not prove that instruction was executed. The implementation bytes remain the existing pinned profile, not a document grammar inside Bound.
+
+# Reference — historical profile
+
+The declared view combines term, set and ref from the pinned historical document provider. The profile projects the place term and meaning, its selected world names and links to its declared Markdown shapes. The executable sample runs two unrelated places, checks their own term and meaning, the actual selected world and relative guide link, and captures two identical CLI readings. A view asking an unoffered region refuses by name. Missing terms or links can yield empty component answers; these are not measurements or a claim that obligations were paid. These historical regions and selectors belong to the selected Topos; Bound supplies verified inputs and dispatch only. The general document contract remains unpaid.
+
+# Manifest render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. The place assigns its complete manifest text to its output shape; Bound verifies and dispatches the selected offer and writes that shape. The provider does not infer a package schema, dependency graph or fields from the filename. The sample renders two places with distinct JSON bodies twice and checks exact file bytes. Two distinct prose bodies assigned to the same shape refuse; earlier outputs remain unchanged. This proves rendering, not that arbitrary JSON is an installable package.
+
+# Workflow render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. The place owns the workflow text and its shape; Bound does not infer a forge or manufacture pipeline steps. The sample writes distinct YAML bodies in two places, reads the rendered files twice and compares exact bytes. Conflicting bodies for one shape refuse without replacing prior outputs. This is a render contract, not evidence that a forge executed, staged or published a release. The release pipeline has its separate artifact gate.
+
+# Usage render profile
+
+This declared view uses the selected verbatim-prose provider at text@3. A prose line with measure=text and the requested shape supplies its own body. The sample renders distinct Markdown bodies in two places twice and compares exact bytes. Multiple identical bodies are one text; differing bodies for one shape refuse. It invents no sections or documentation schema. This existing profile does not pay the eight general-document demands or validate commands that prose happens to mention; executable commands require their own captured vectors.
+
+# Build configuration — historical profile
+
+The declared tsconfig view asks the admitted package provider for its build region. It projects the place's build/* lines whose shape matches the requested file: true and false become JSON booleans, other option values remain strings, and include separates its declared alternatives. The byte-fixed fixture names the implementation member and its artifact independently; Bound does not interpret compiler options. Two unrelated places exercise the compiled CLI, check the complete generated configuration and two byte-identical readings. A declared view asking an unoffered region refuses by name. This profile renders configuration; it does not validate compiler options or claim a successful build. An empty option set renders an empty compilerOptions object. It is a pinned historical profile, not the pending general document contract.

package/docs/contracts/evidence-view.md

@@ -0,0 +1,6 @@
+# Authenticated evidence view
+
+The declared evidence@8 view projects authenticated delivery history of this place. It preserves signatures and key attribution, including admitted receipts from an attest-class key. Evidence is not normative configuration, proof of truth, or an independent observation origin. Authority and coverage are checked by the existing Topos contract; no consumer or device type changes that boundary.
+
+
+The no sample specifies an uncovered write and tampered signed bytes. Both must refuse by name. Exact withdrawals remove only covered normative lines; authenticated evidence remains inspectable. The vectors assert status, signature verification and observable CLI output. No private key bytes are printed or shipped.

package/docs/contracts/publication.md

@@ -0,0 +1,17 @@
+# Published contracts
+
+Every public surface names its contract, accepted sample, captured executable vector and rejected sample. Missing members, differing artifact digests and failed vectors remain unpaid. Publication conformance is distinct from installed-artifact acceptance.
+
+The selected Topos projects each quartet as a reading through the existing wire. Execution proofs are dependency readings; identical vector bytes share one proof. Each reading names its exact handed inputs and dependent receipt digests. Bound verifies those closures and keeps native count/bytes receipts by digest. A closed reading costs no new execution. The publication aggregate reads the quartet receipts; it never starts an inventory batch.
+
+Execution slots, per-execution timeout and response bytes are declared resource lines in the selected Topos. Bounds remain unchanged. A failed reading is not cached as a successful proof. Earlier completed readings stay verified, so a later refusal does not force them to execute again. Changed, missing or corrupt bytes cannot reuse their receipts. Output and execution history retain their exact coordinates.
+
+## Act cost
+
+Each declared reading and each host invocation is measured separately. The total duration of a pass is a diagnostic; it is not the cost of one indivisible act. The cost/act ceiling reads the largest measured act or the remaining unpartitioned host work. Nested invocations are not charged twice. A slow or refused act retains its cost. Native reading receipts retain measured seconds separately from semantic identity; reusing a receipt performs no new reader execution. Missing historical durations are not invented as zero.
+
+## Public verification
+
+Full-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.
+
+File-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.

package/docs/contracts/typed-object.md

@@ -0,0 +1,27 @@
+## Typed cell, claim and mark records
+
+The object profile is selected by admitted `wire/object/*` claims in a historical wire snapshot. The epoch of `wire/object/types` is its activation E; a typed record must have epoch >= E. An older record keeps the older grammar. Merely adding object words to `wire/fields` does not admit a typed profile.
+
+`fromLine` selects grammar before validating required fields: a record without `type` remains configuration, retaining its required `at`, `role`, `form`, `measure` and `value`; a typed record selects its exact required/allowed row. Configuration cannot carry object-only fields. An incomplete typed record receives no configuration defaults. The parse result distinguishes configuration from cell/claim/mark. `sign=+1|-1` is an object act, `sig` its signature envelope, and a host sign operation produces that envelope.
+
+The common object envelope is `type`, `scope`, `id`, `epoch`, `by`, `sig`. Object records reject `at`: epoch orders acts, and `widens` names a local join witness. The following is the declared reference profile. The admitted row alphabets, not this table or a host decoder, are the source of required/allowed field permission.
+
+| Row | Fields in addition to the common envelope | Meaning |
+| --- | --- | --- |
+| cell | form, measure, params, restsOn, topos | Define a cell and its selected form/context. |
+| claim/positive | sign, origin, value | Observe an encoded span, sign=+1. |
+| claim/negative | sign, takes | Withdraw an exact claim ID, sign=-1. |
+| mark/travelling | sign, pole, reach, value | Ceiling sign: sign=+1, pole=ceiling, reach=travels. |
+| mark/local | sign, pole, reach, value, widens | Local join: sign=+1, pole=ceiling, reach=local; another mark, retaining the travelling sign. |
+| mark/floor-travelling | sign, pole, reach, value | Travelling require: sign=+1, pole=floor, reach=travels; no widens. |
+| mark/negative | sign, takes | Withdraw an exact mark ID, sign=-1; no pole/reach/widens. |
+
+Each row has both `wire/object/required/<row>` and `wire/object/allowed/<row>`. Unknown keys, missing required keys, floor/local, floor+widens, and travelling widening refuse without coercion. A configuration demand is unrelated to a floor mark. `by` authenticates a signing key; it is not an independent observation origin.
+
+For a cell, `restsOn=none` represents no parents; otherwise it is a canonical byte-ordered alphabet of coordinates. Several parents are permitted. Only declared cell-coordinate edges form object rest; a directory prefix, a configuration artifact digest, and a host source location do not. Context validation rejects reachable cycles before algebraic parts are requested.
+
+The cell's `topos` names folded standing, and its `params` identifies declared parameter bytes. A selected provider decodes values and supplies origin/witness authorization from admitted evidence. A host does not infer interval endpoints, map a key to an origin, or accept widens as its own witness. Missing pin, artifact, decoder, origin or witness refuses by cause. Cell definitions and pins are immutable in this profile; migration is not inferred.
+
+`objectHistory` preserves typed history separately from configuration; `validateObjectContext` checks IDs, cell ownership, exact takes, witness order and declared rest under the selected context. Exact redelivery is idempotent; one ID with different canonical content refuses. Signature-envelope differences never bypass verification.
+
+After admission, the instrument projects the acts into Obligations. Sign and require travel along declared rest; a witnessed join is local. Descendants inherit travelling marks without local widening. Live exact-ID withdrawals remain confined to their authenticated history. Keys, snapshots, signing devices and repeated receipts do not create independent origins. Compatible meets are not forks. Object states and their precedence come from Obligations; configuration folds do not compute object encounters.

package/docs/contracts/view-walk.md

@@ -0,0 +1,7 @@
+# Walk
+
+`bound fold --as walk@<resolution>` compares the admitted place with an authenticated peer inventory. Resolution is interpreted by the declared Topos selection and projection contract; it is not restricted to three fixed numbers. The wire declares region membership, context, origin and cuts. The output names touched regions, open regions and payload bytes; protocol and imported bytes carry their own units.
+
+Foreign history retains its signed origin epoch. Sender keys authenticate that history and never grant coverage or independent origins in the receiver. Whole-region prefixes are verified before ingress. Import and the receiver-signed local receipt commit atomically; only that receipt advances the receiver's local epoch. Foreign withdrawals are confined to the same authenticated origin and exact identifier. A repeated valid delivery adds no lines and retains its existing import receipt. A rejected or interrupted ingress adds neither evidence nor a receipt.
+
+The published sample uses the same compiled public reader on measurement and artifact places. It compares equal summaries, opens a differing region, exchanges at intermediate declared resolutions, converges by union, retains disagreement and verifies replay after a later local act. It rejects tampered payloads, missing records, unauthorized signatures, non-prefix epochs and undeclared context changes. It interrupts a real receiver signer and verifies unchanged ingress and local history. Dead-owner recovery is a separate host action; this view does not silently recover it. The typed object's origin-local claims and withdrawals are a separate conformance vector, not inferred from configuration counts.

package/docs/contracts/views.md

@@ -0,0 +1,29 @@
+# Help view
+
+A declared help view projects the instrument verb and flag table. It is generated from that table, not copied prose or a claim that another world is supported. Asking it does not authorize a line or call a selected external reader. The sample declares view/help value=help, checks the printed three verbs and refuses a declared view whose region has no provider.
+
+# Lines view
+
+A declared lines view projects canonical normative standing as wire lines. It is a configuration reading; it does not compute encounters or turn evidence into authority. Live exact withdrawals disappear from normative standing while authenticated evidence remains inspectable through its own view. The sample verifies signatures and attribution, redelivery ONCE, exact withdrawals, tampering and uncovered writes. A declared missing provider refuses rather than returning an invented reading.
+
+# Receipts view
+
+The native receipt view projects the fold through the admitted Topos receipt contract. The sample uses the published place profile receipts@8|receipts@0|receipts@1: observations, summary and current region bytes. These are that profile’s declared projections, not a universal enumeration of resolutions. A receipt identifies the actual observed set; it is not an origin or a valuation. The sample obtains a native receipt, verifies its signed delivery from an attest-class key through evidence, and checks idempotent delivery. The refused sample names an uncovered write, tampered signature and declared view without a provider. No harness-written JSON is used as a receipt.
+
+## Public verification
+
+Full-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.
+
+File-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.
+
+# Why a coordinate
+
+`bound fold <coordinate> --as why` explains the live declarations whose exact `needs` member or `shape` names that coordinate. It prints the selector, witness and value. It does not compute an object encounter or infer authority from a path. The published sample bootstraps two independent places, explains each declared source coordinate and prints `OPEN` for a coordinate no declaration names. That absence is not zero, green or a state. A declared view with no provider refuses by name with a nonzero status. Calling why without a coordinate is not this sample’s acceptance vector; its empty historical capture pays nothing.
+
+# Declared programs
+
+The programs view asks the selected Topos demand-status projection at resolution 8. Selection, minimum, evidence, elapsed reading and time ceiling coordinates belong to that Topos contract; Bound only hands admitted declarations and region receipts. Program status is derived from that evidence and the declared dependency graph. A demand with no evidence remains unread, its dependant remains blocked, and a missing elapsed reading keeps deadline unread. No cell encounter, origin count or information quantity is computed by this view. The sample uses the published SDK implementation on two unrelated demand chains, captures equal readings twice, names the next unblocked coordinate, and refuses dependency cycles. It does not provide stage conformance evidence or claim either program closed.
+
+# Demand card
+
+The declared card view asks the selected Topos demand-card projection at resolution 8. It reads the selected demand coordinates, their explicit dependencies and the handed evidence region under selectors declared by that Topos. It does not infer progress from files or convert a declaration into proof. A requirement without evidence is unread; an unpaid predecessor blocks its dependant. The next coordinate is an unblocked unpaid demand. Deadline is unread when no elapsed receipt is handed; absence is not zero. These labels describe program evidence, not Obligations cell states. The sample pins the implementation member from the published Topos SDK, folds two unrelated places twice with equal stdout and refuses a declared dependency cycle. This sample intentionally has no evidence to close either program; it certifies the projection of absence and order, not stage acceptance.

package/docs/usage.md

@@ -51,3 +51,9 @@ The accepted TARGET is independent of a contributor's scan. Commit native receip
 A contribution is a proposed lot with the leaf changes rendered from it. Send that lot for admission by the team's coverage. Do not submit hand-edited lock output as already accepted. Check secrets, extra bound files, foreign vendoring and uncaptured page claims before review.
 
 A review includes the product fold, meaningful suites and verification of the rendered bytes. Preserve their actual output and exit status.
+
+## Declaring a demand
+
+A new demand records what remains to be proved. Admission does not create conformance evidence or pay it. An OWED line after land says the declaration was admitted and remains unpaid. Signing authority and conformance evidence are separate inputs.
+
+The selected program projection reads declared requirements and handed evidence. Missing evidence stays unread; a missing elapsed-time reading is not zero. A dependency cannot close before its requirements and predecessors. Declaring a plan never certifies a release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -13,7 +13,7 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "test": "node --import ./test/setup.ts --test test/*.test.ts",
+    "test": "node --import ./test/setup.ts --test --test-concurrency=2 test/*.test.ts",
     "clean": "rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo",
     "build": "node tools/build.mjs",
     "prepack": "npm run build"
@@ -26,13 +26,15 @@
     "TARGET.bound",
     "receipts.bound",
     "docs/usage.md",
-    "docs/readme-assets/atlas.svg"
+    "docs/readme-assets/atlas.svg",
+    "docs/contracts/*.md"
   ],
   "author": "Lapxo",
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "0.1.8"
+    "@lapxo/topos": "^0.1.11",
+    "acorn": "8.19.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",