@lapxo/bound 0.1.4 → 0.1.5

package/TARGET.bound

@@ -1,6 +1,14 @@
-bound-lock/1 about="# @lapxo/bound\n\nDeclare what must hold. Read what does. Keep the evidence.\n\nBound reads a project's admitted statements, checks observations against its requirements, and produces the views its selected topos declares. It keeps conflicting evidence and its origins instead of choosing a convenient answer.\n\n`fold` reads. `sign` signs a proposed lot. `land` admits that lot under the place's authority. These acts work across domains: a selected topos supplies forms, units, readers and views.\n\n## Start in an admitted project\n\n```sh\nnpx @lapxo/bound@0.1.4 fold --as help\nnpx @lapxo/bound@0.1.4 fold\n```\n\nThe help view prints:\n\n```text\nverbs fold land sign\nflags --as --check --key --key-file --signer --place\n```\n\nThe default fold runs the project's declared views. Its authority and selected topos determine what can be admitted, read and shown.\n\nStart with the team's accepted TARGET, admitted authority and selected readers. [Full usage guide](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).\n\n## A meeting everyone can understand\n\nAna is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.\n\nWith an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.\n\nThe same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.\n\n## See how information holds together\n\n![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)\n\nA travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.\n\n| State | Meaning |\n| --- | --- |\n| REQUIRED | Compatible bounds, fewer than two independent origins. |\n| FREE | Independent origins meet and their encounter fits the bounds. |\n| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |\n| FORBIDDEN | An inhabited encounter does not fit the bounds. |\n\nBounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.\n\n## Change a project without erasing evidence\n\nWork in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.\n\n```sh\nexport BOUND_KEY_ID='your-admitted-key-id'\nexport BOUND_KEY_FILE=\"$HOME/Private/keys/your-device.pem\"\nlot_dir=\"$(mktemp -d)\"\n```\n\nHave the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.\n\n```sh\nnpx @lapxo/bound@0.1.4 sign \"$lot_dir/proposal.bound\" \\\n  --key \"$BOUND_KEY_ID\" --key-file \"$BOUND_KEY_FILE\" \\\n  > \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.4 land \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.4 fold\n```\n\n`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.\n\nFor typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.\n\n[Authority, withdrawals, receipts and PR review](docs/usage.md).\n\n## Read a declared view and reuse its evidence\n\nWhen the project has admitted a cells view:\n\n```sh\nnpx @lapxo/bound@0.1.4 fold --as cells\n```\n\nThe installed interval scene printed this on an unchanged second reading:\n\n```text\nRECEIPTS 4 read · 0 opened · idle · provider 0\n```\n\nNative receipts identify the live semantic inputs, declared rest, selected topos, codecs and selected rendering implementation. They exclude delivery count, display paths and Bound's error wrapper. A local join changes its own cell's receipt. A travelling sign changes dependent cells. Missing or corrupt carried bytes cannot prove reuse.\n\nFor judgement:\n\n```sh\nnpx @lapxo/bound@0.1.4 fold --check\n```\n\nKeep stdout, stderr and the exit status. `--check` is not an install-and-build replacement. A source test passing does not pay an unread ceiling, prove a cold clone, or accept a release.\n\n## Select a topos by what it declares\n\n`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.\n\n`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.\n\n| Responsibility | Owner |\n| --- | --- |\n| Meet, state, live acts and rest | Obligations |\n| Wire, forms, classes, views and offer contracts | Topos |\n| Admission, folding and evidence | Bound |\n| Domain measurement and representation | Selected topos |\n| Storage, transport and execution | Host |\n\nCell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.\n\n## Repository rules\n\nCommit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.\n\nThe lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.\n\nA PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).\n\n## An atlas you can question\n\nInformation can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.\n\nThis makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.\n\nA pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.\n\nUse Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.\n\n[Contribute a counterexample or a proposed lot](CONTRIBUTING.md).\n" at=witness:bound/014-candidate by=target form=alphabet measure=text role=writes scope=prose/en/files/public-0 shape=README.md value=lock
+bound-lock/1 about="# @lapxo/bound\n\n## Use Bound in a project\n\nFrom a project with an admitted lock and selected views, inspect its standing, ask for its evidence, then verify the committed outputs:\n\n```sh\nnpx @lapxo/bound@0.1.5 fold --as lines\nnpx @lapxo/bound@0.1.5 fold --as receipts@1\nnpx @lapxo/bound@0.1.5 fold --check\n```\n\nUse this flow to review a project change or check a dependency's declared contract. `--check` verifies existing evidence; it does not execute a missing reading. A file fold names readings and explicitly says that it computed no encounters.\n\nIndependent observations are judged through the declared typed cells view. The selected topos supplies the form, origin evidence and bounds. Bound keeps attribution and exact-ID withdrawals through the fold.\n\nA selected form can instead describe a set of artifacts, a delivery interval or another domain's values. The project declares the form, origin evidence and views; Bound does not infer them from filenames or units.\n\n\nDeclare what must hold. Read what does. Keep the evidence.\n\nBound reads a project's admitted statements, checks observations against its requirements, and produces the views its selected topos declares. It keeps conflicting evidence and its origins instead of choosing a convenient answer.\n\n`fold` reads. `sign` signs a proposed lot. `land` admits that lot under the place's authority. These acts work across domains: a selected topos supplies forms, units, readers and views.\n\n## Start in an admitted project\n\n```sh\nnpx @lapxo/bound@0.1.5 fold --as help\nnpx @lapxo/bound@0.1.5 fold\n```\n\nThe help view prints:\n\n```text\nverbs fold land sign\nflags --as --check --key --key-file --signer --place\n```\n\nThe default fold runs the project's declared views. Its authority and selected topos determine what can be admitted, read and shown.\n\nStart with the team's accepted TARGET, admitted authority and selected readers. [Full usage guide](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).\n\n## A meeting everyone can understand\n\nAna is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.\n\nWith an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.\n\nThe same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.\n\n## See how information holds together\n\n![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)\n\nA travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.\n\n| State | Meaning |\n| --- | --- |\n| REQUIRED | Compatible bounds, fewer than two independent origins. |\n| FREE | Independent origins meet and their encounter fits the bounds. |\n| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |\n| FORBIDDEN | An inhabited encounter does not fit the bounds. |\n\nBounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.\n\n## Change a project without erasing evidence\n\nWork in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.\n\n```sh\nexport BOUND_KEY_ID='your-admitted-key-id'\nexport BOUND_KEY_FILE=\"$HOME/Private/keys/your-device.pem\"\nlot_dir=\"$(mktemp -d)\"\n```\n\nHave the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.\n\n```sh\nnpx @lapxo/bound@0.1.5 sign \"$lot_dir/proposal.bound\" \\\n  --key \"$BOUND_KEY_ID\" --key-file \"$BOUND_KEY_FILE\" \\\n  > \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.5 land \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.5 fold\n```\n\n`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.\n\nFor typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.\n\n[Authority, withdrawals, receipts and PR review](docs/usage.md).\n\n## Read a declared view and reuse its evidence\n\nWhen the project has admitted a cells view:\n\n```sh\nnpx @lapxo/bound@0.1.5 fold --as cells\n```\n\nThe installed interval scene printed this on an unchanged second reading:\n\n```text\nRECEIPTS 4 read · 0 opened · idle · provider 0\n```\n\nNative receipts identify the live semantic inputs, declared rest, selected topos, codecs and selected rendering implementation. They exclude delivery count, display paths and Bound's error wrapper. A local join changes its own cell's receipt. A travelling sign changes dependent cells. Missing or corrupt carried bytes cannot prove reuse.\n\nFor judgement:\n\n```sh\nnpx @lapxo/bound@0.1.5 fold --check\n```\n\nKeep stdout, stderr and the exit status. `--check` is not an install-and-build replacement. A source test passing does not pay an unread ceiling, prove a cold clone, or accept a release.\n\n## Select a topos by what it declares\n\n`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.\n\n`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.\n\n| Responsibility | Owner |\n| --- | --- |\n| Meet, state, live acts and rest | Obligations |\n| Wire, forms, classes, views and offer contracts | Topos |\n| Admission, folding and evidence | Bound |\n| Domain measurement and representation | Selected topos |\n| Storage, transport and execution | Host |\n\nCell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.\n\n## Repository rules\n\nCommit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.\n\nThe lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.\n\nA PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).\n\n## An atlas you can question\n\nInformation can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.\n\nThis makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.\n\nA pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.\n\nUse Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.\n\n[Contribute a counterexample or a proposed lot](CONTRIBUTING.md).\n\n\n## Foundations and related libraries\n\nThe two-sided constraint object is described in Nahum Ochoa's [Two-Sided Constraints on a Valued Lattice](https://doi.org/10.5281/zenodo.21858428), DOI `10.5281/zenodo.21858428`. Bound uses the object through [Obligations](https://github.com/Lapxo/obligations); [Topos](https://github.com/Lapxo/topos) supplies the wire and contracts for forms, views and selected worlds. Bound admits, folds and retains evidence across those declared boundaries. A digest identifies bytes; it does not certify that an observation is true.\n" at=witness:minimal-public-surface-015 by=target form=alphabet measure=text role=writes scope=prose/en/files/public-0 shape=README.md value=lock
+bound-lock/1 about="# Authenticated evidence view\n\nThe declared evidence@8 view projects authenticated delivery history of this place. It preserves signatures and key attribution, including admitted receipts from an attest-class key. Evidence is not normative configuration, proof of truth, or an independent observation origin. Authority and coverage are checked by the existing Topos contract; no consumer or device type changes that boundary.\n\n\nThe no sample specifies an uncovered write and tampered signed bytes. Both must refuse by name. Exact withdrawals remove only covered normative lines; authenticated evidence remains inspectable. The vectors assert status, signature verification and observable CLI output. No private key bytes are printed or shipped.\n" at=witness:minimal-public-surface-015 by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-evidence-view shape=docs/contracts/evidence-view.md value=lock
 bound-lock/1 about="# Contributing to Bound\n\nBring a counterexample, an observation or a proposed lot. Include the inputs and the output that led you to it. A signature establishes who was authorized to speak; it does not make their result true.\n\n## Set up a working copy\n\nClone the repository and use the Node version supported by package.json. If package-lock.json is present, run npm ci; otherwise use npm install --ignore-scripts --no-package-lock. Then run:\n\n```sh\nnpm run build\nnpm test\n```\n\nThese are development checks, not project acceptance. For a place with admitted trust context and native receipts, run the product judgement as well:\n\n```sh\nnpx @lapxo/bound@0.1.0 fold --check\n```\n\nPreserve a refusal and its exit status in your report. Do not borrow a neighbouring checkout's ledger or substitute local bytes for a named pin.\n\n## Make the smallest useful change\n\nBound owns admission, folding and evidence. Topos owns grammar, forms, classes, views and their contracts. A selected topos owns domain measurement. Obligations owns the algebra. Keep each change in its layer; do not put a domain decoder, path-based inference or a fallback for a missing pin into Bound.\n\nAn algebra change needs an independent oracle and a counterexample. A host change needs evidence for authentic bytes, failure propagation or reuse. A view change needs its declared region and implementation identity. A test should fail for a plausible incorrect implementation, not assert a source string or repeat the same expression on both sides.\n\nKeep regressions for changed signatures, unauthorized coverage, exact-id withdrawal, conflicting evidence, local versus travelling acts, corrupt content and duplicate delivery. Consolidate repeated setup and duplicate scenarios without removing distinct falsifiers.\n\n## Propose and admit\n\nKeep proposal and signed-lot files outside the repository. Use the current admitted wire, by=target, and no preassigned epoch or signature. The team's admitted key signs the lot; Bound admits it under scope coverage. The [usage guide](docs/usage.md) explains the transaction and external key-file requirements.\n\nSend the proposed lines with the leaf changes they render. A hand-edited render is evidence of the intended change, not an admitted contribution. Do not edit the accepted TARGET to make a test or ceiling pass. If a render disagrees with the lock, fix the proposed lines and re-render it.\n\nCommit only the project's TARGET.bound and native receipts.bound as bound files. The first .gitignore line excludes .bound/. Do not commit keys, stores, ledgers, caches, capsules, archives or vendored dependencies.\n\n## Submit a pull request\n\nExplain the concrete behavior before and after the change, the affected layer, and the checks you ran. Include stdout, stderr and exit status for a CLI case. State which reader and input bytes produced the evidence; a source harness is not an installed-package proof.\n\nPolicy changes receive explicit team review separately from measurements of the proposed source. Keep incompatible readings and their origins visible. Never remove a failing test or weaken a ceiling to obtain acceptance. Withdraw statements through their admitted history; do not rewrite prior signatures, tags or releases.\n\nDocumentation and workflows follow the same review: propose their lines and include the rendered changes.\n" at=policy:public-prose by=target form=alphabet measure=text role=writes scope=prose/en/files/public-1 shape=CONTRIBUTING.md value=lock
-bound-lock/1 about="# Using Bound\n\nThis guide covers the current CLI in a place whose wire and authority are already admitted. A fresh unsigned TARGET is a proposal, not a trusted project. The prepared repository is not yet a certified empty-clone bootstrap.\n\n## Before the first fold\n\nYou need the team's accepted TARGET and trust context, authentic bytes for each selected digest, and the readers/views that TARGET names. Do not borrow a neighbouring repository's ledger or copy node_modules to make a missing pin look available.\n\nThe published repository carries exactly TARGET.bound and receipts.bound as bound files. Local admission history lives in the ignored .bound/ store. Published standing excludes the signature envelope; owner public keys retain their signatures.\n\nStart by asking for help and folding the project. If a selected view is unavailable, use the named refusal and its fix; do not invent an output with a similar name.\n\n## Keys and coverage\n\nUse a named key already admitted by the project. The authority contract declares its public key, class and scope coverage. Signing uses a declared port. The lock names `keys/<who> measure=signer value=<name>`; `signer/timeout` and `signer/response-bytes` bound each invocation. The built-in `file` port reads a matching PKCS8 PEM outside the repository through `--key-file`. For a command port, the host supplies a `BOUND_SIGNERS` registry mapping that admitted name to `{ \"kind\": \"command\", \"executable\": \"...\", \"args\": [] }`. A repository declaration cannot authorize a program. `--signer <name>` must match the admitted selection.\n\nA new device must have its public key and coverage admitted by an authority that already covers the intended scope. The CLI does not currently certify silent key creation or tap-to-sign. This guide does not substitute a self-authorized fixture key for the team's authority.\n\nFor automation through the file port, supply the private key through the runner's secret storage to a temporary external file with restricted permissions. A command signer receives the lot once as canonical signed bytes, one line per record in order. It returns one canonical wire response per record, containing `by` and `sig`, in that same order. Bound verifies the entire reply against the admitted public key before any admission. Timeout, nonzero exit, missing or invalid replies refuse the whole lot; raw signer output is not logged. Hosts can keep private keys outside Bound through this port. Key generation, storage and rotation belong to the host. Do not print, commit or upload it. A source-control token and a Bound authority key have different purposes. Key rotation and revocation are changes to the admitted authority contract, not edits that erase prior signatures.\n\n## Proposal → signature → admission → reading\n\nPrepare the proposed lines outside the repository. Each line must use the current wire's fields, forms and required set. Configuration retains its legacy required fields, including `at`. Typed cells, claims and marks use their exact row grammar; `role=reads` or `at` cannot repair an incomplete typed record.\n\nA proposal names `by=target` and omits epoch/signature. The CLI assigns epoch from admitted history when signing. Never copy an epoch from an example or change a signed line's body.\n\nUse the signing and admission transaction in the README. Shell `&&` prevents a failed sign from being followed by land. Successful signing alone does not mean admission. Successful admission alone does not mean every requirement is paid. Fold after land and inspect its states, receipts and exit status.\n\nCLI sign authenticates wire inscriptions. It is different from the object's travelling ceiling sign. The selected Topos decodes spans and supplies origin/witness context; Bound must not guess those from by, widens or a path.\n\n## Reading and withdrawing\n\nAsk only for a view admitted by the project, such as cells. A local join widens that cell with a witness; it leaves the travelling ceiling live. A travelling require supplies a floor. Claims carry distinct origins; their signatures do not by themselves establish independent origins.\n\nFor typed histories, a negative record names the exact id in takes. Withdrawing a claim removes that live observation; withdrawing a join removes that local widening, not the sign. A fresh claim with the same content is a new identity, not resurrection of a withdrawn id. Re-delivery of the same signed bytes is idempotent.\n\nFor configuration, the negative line preserves the exact non-envelope selectors and changes value to withdraw. Do not withdraw and replace identical selectors in the same batch. Use a new epoch when superseding an alphabet declaration. Never withdraw evidence merely to obtain a green verdict.\n\n## Receipts and refusals\n\nreceipts.bound is native fold output. Do not write it by hand, use JSON from a test as a receipt, or copy receipts from another tree. Unchanged inputs can reuse verified region receipts; missing bytes require recomputation or a refusal. A duplicate receipt does not create another origin.\n\nREFUSE·wire means the current grammar does not admit the record. REFUSE·pin/release means named authentic content or its closure is unavailable or does not match. REFUSE·view means the requested view cannot be rendered under its contract. Authority refusal means the signer is not covered. Keep the line and the failed exit status; follow an explicit fix without changing the named digest or dropping a conflicting statement.\n\nrelease/blocks is policy read by the fold. Its admitted category links select existing obligations. The fold prints each missing reading or crossed ceiling as BLOCK; a blocked or incomplete policy is not READY. Read the captured verdict for the exact candidate instead of inferring acceptance from a successful render.\n\n## Repository and PR review\n\nThe accepted TARGET is independent of a contributor's scan. Commit native receipts and admitted renders, not local .bound/ state. A page disagreeing with TARGET must be re-rendered; a ceiling is not lowered to fit the page.\n\nA contribution is a proposed lot with the leaf changes rendered from it. Send that lot for admission by the team's coverage. Do not submit hand-edited lock output as already accepted. Check secrets, extra bound files, foreign vendoring and uncaptured page claims before review.\n\nA review includes the product fold, meaningful suites and verification of the rendered bytes. Preserve their actual output and exit status.\n" at=policy:bound/011-signing-docs by=target form=alphabet measure=text role=writes scope=prose/en/files/public-2 shape=docs/usage.md value=lock
+bound-lock/1 about="# Exact release artifact\n\nPacking is a host operation. An archive digest names those archive bytes; it is not the identity of a Topos standing. The release pipeline makes one archive and transfers that same file to its destinations. Repeating a pack operation is not a proof of identical bytes.\n\nThe archive conformance vector declares the host package command, digest algorithm, execution deadline, response bound and its sample packages. It packs each sample once, hashes the resulting bytes, verifies both destination copies, installs offline without package scripts and compares every listed installed member with the input bytes. It executes the installed entry and checks its declared output. Changed archive bytes refuse by digest before they can be treated as the named artifact. The negative control fails when that verification is removed.\n\nThe samples use independent packages with different contents. Their outputs and member digests are captured by the executable vector; their file presence alone is not evidence. The selected publication reader measures this quartet through the existing process contract, and native receipts supply its member status to the plan.\n\nThis is conformance of the packaging recipe. Acceptance of a particular Bound candidate additionally requires the exact archive audit, clean installation and product CLI captures for that archive. A previous archive's captures cannot certify changed implementation bytes. The final candidate must be rebuilt after admitted metadata changes, with every changed member accounted for. The product witness uses the installed reader directly, without a checkout ledger or source conditions.\n\nRendering and installation are different boundaries. README, the manifest and the standard MIT text remain native renders. Publication to a registry or forge is a later owner action; this vector does not publish, authenticate to an account, create a tag or infer an external release from a local file.\n" at=witness:public-contracts-by-operation by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-archive shape=docs/contracts/archive.md value=lock
+bound-lock/1 about="# Explanation — historical profile\n\nThe declared view selects idea, what-holds and refuses from the byte-pinned historical document provider. The place owns its language and prose. Idea renders its own heading and body. The other two regions require their declared law readings or captured refusals; absent evidence supplies no invented result. The executable sample uses two unrelated places, checks the complete explanation file, repeats the product fold without a file difference and asks the named view directly. It also refuses a well-formed view asking an unoffered region. This quartet proves own-prose projection and absence under this profile; it does not certify law readings, a rejection corpus, typed-object states or the pending general document contract. Bound does not parse this prose.\n\n# README — historical profile\n\nThe declared view selects hero@3, commands@3 and idea@3 from the byte-pinned historical document provider. The place supplies its name, tagline, language, sentence rule and idea. Commands and measured badges are absent in the sample: no command, number or success is invented to fill them. Two unrelated places check the generated README, a second unchanged product fold and the named view; a declared unoffered region refuses by name. The implementation member is verified against the admitted historical artifact. This quartet proves the selected prose profile, not command execution, badges with measured values or a general document grammar. The eight text@3 demands remain unpaid.\n\n# Citation file — historical profile\n\nThe declared view asks the pinned document provider for cff at resolution 3. It projects the place name, version and optional citation metadata into CFF text. The sample uses the exact implementation member from the admitted historical artifact, names its hash and license, and exercises two unrelated places through the compiled CLI. It checks complete citation bytes and two equal readings; title and version follow each place. An unoffered region refuses by view name. Missing optional metadata is omitted; missing name can produce an empty answer under this historical profile. Rendering is not verification of a scientific claim or an external DOI. This pinned profile does not implement the pending general document contract.\n\n# Guide — historical profile\n\nThe declared view asks seq from the pinned historical document provider. The place owns page/seq lines and their heading. Canonical input order supplies the steps; the provider numbers that order and writes the requested shape. The executable sample uses two unrelated procedures, checks their complete Markdown and reads each view twice without differences. A declared view with an unoffered region refuses by name. An empty step set may have an empty answer; it is not invented evidence. A rendered instruction does not prove that instruction was executed. The implementation bytes remain the existing pinned profile, not a document grammar inside Bound.\n\n# Reference — historical profile\n\nThe declared view combines term, set and ref from the pinned historical document provider. The profile projects the place term and meaning, its selected world names and links to its declared Markdown shapes. The executable sample runs two unrelated places, checks their own term and meaning, the actual selected world and relative guide link, and captures two identical CLI readings. A view asking an unoffered region refuses by name. Missing terms or links can yield empty component answers; these are not measurements or a claim that obligations were paid. These historical regions and selectors belong to the selected Topos; Bound supplies verified inputs and dispatch only. The general document contract remains unpaid.\n\n# Manifest render profile\n\nThis declared view uses the selected verbatim-prose provider at text@3. The place assigns its complete manifest text to its output shape; Bound verifies and dispatches the selected offer and writes that shape. The provider does not infer a package schema, dependency graph or fields from the filename. The sample renders two places with distinct JSON bodies twice and checks exact file bytes. Two distinct prose bodies assigned to the same shape refuse; earlier outputs remain unchanged. This proves rendering, not that arbitrary JSON is an installable package.\n\n# Workflow render profile\n\nThis declared view uses the selected verbatim-prose provider at text@3. The place owns the workflow text and its shape; Bound does not infer a forge or manufacture pipeline steps. The sample writes distinct YAML bodies in two places, reads the rendered files twice and compares exact bytes. Conflicting bodies for one shape refuse without replacing prior outputs. This is a render contract, not evidence that a forge executed, staged or published a release. The release pipeline has its separate artifact gate.\n\n# Usage render profile\n\nThis declared view uses the selected verbatim-prose provider at text@3. A prose line with measure=text and the requested shape supplies its own body. The sample renders distinct Markdown bodies in two places twice and compares exact bytes. Multiple identical bodies are one text; differing bodies for one shape refuse. It invents no sections or documentation schema. This existing profile does not pay the eight general-document demands or validate commands that prose happens to mention; executable commands require their own captured vectors.\n\n# Build configuration — historical profile\n\nThe declared tsconfig view asks the admitted package provider for its build region. It projects the place's build/* lines whose shape matches the requested file: true and false become JSON booleans, other option values remain strings, and include separates its declared alternatives. The byte-fixed fixture names the implementation member and its artifact independently; Bound does not interpret compiler options. Two unrelated places exercise the compiled CLI, check the complete generated configuration and two byte-identical readings. A declared view asking an unoffered region refuses by name. This profile renders configuration; it does not validate compiler options or claim a successful build. An empty option set renders an empty compilerOptions object. It is a pinned historical profile, not the pending general document contract.\n" at=witness:public-contracts-by-operation by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-documents shape=docs/contracts/documents.md value=lock
+bound-lock/1 about="# Help view\n\nA declared help view projects the instrument verb and flag table. It is generated from that table, not copied prose or a claim that another world is supported. Asking it does not authorize a line or call a selected external reader. The sample declares view/help value=help, checks the printed three verbs and refuses a declared view whose region has no provider.\n\n# Lines view\n\nA declared lines view projects canonical normative standing as wire lines. It is a configuration reading; it does not compute encounters or turn evidence into authority. Live exact withdrawals disappear from normative standing while authenticated evidence remains inspectable through its own view. The sample verifies signatures and attribution, redelivery ONCE, exact withdrawals, tampering and uncovered writes. A declared missing provider refuses rather than returning an invented reading.\n\n# Receipts view\n\nThe native receipt view projects the fold through the admitted Topos receipt contract. The sample uses the published place profile receipts@8|receipts@0|receipts@1: observations, summary and current region bytes. These are that profile’s declared projections, not a universal enumeration of resolutions. A receipt identifies the actual observed set; it is not an origin or a valuation. The sample obtains a native receipt, verifies its signed delivery from an attest-class key through evidence, and checks idempotent delivery. The refused sample names an uncovered write, tampered signature and declared view without a provider. No harness-written JSON is used as a receipt.\n\n## Public verification\n\nFull-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.\n\nFile-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.\n\n# Why a coordinate\n\n`bound fold <coordinate> --as why` explains the live declarations whose exact `needs` member or `shape` names that coordinate. It prints the selector, witness and value. It does not compute an object encounter or infer authority from a path. The published sample bootstraps two independent places, explains each declared source coordinate and prints `OPEN` for a coordinate no declaration names. That absence is not zero, green or a state. A declared view with no provider refuses by name with a nonzero status. Calling why without a coordinate is not this sample’s acceptance vector; its empty historical capture pays nothing.\n\n# Declared programs\n\nThe programs view asks the selected Topos demand-status projection at resolution 8. Selection, minimum, evidence, elapsed reading and time ceiling coordinates belong to that Topos contract; Bound only hands admitted declarations and region receipts. Program status is derived from that evidence and the declared dependency graph. A demand with no evidence remains unread, its dependant remains blocked, and a missing elapsed reading keeps deadline unread. No cell encounter, origin count or information quantity is computed by this view. The sample uses the published SDK implementation on two unrelated demand chains, captures equal readings twice, names the next unblocked coordinate, and refuses dependency cycles. It does not provide stage conformance evidence or claim either program closed.\n\n# Demand card\n\nThe declared card view asks the selected Topos demand-card projection at resolution 8. It reads the selected demand coordinates, their explicit dependencies and the handed evidence region under selectors declared by that Topos. It does not infer progress from files or convert a declaration into proof. A requirement without evidence is unread; an unpaid predecessor blocks its dependant. The next coordinate is an unblocked unpaid demand. Deadline is unread when no elapsed receipt is handed; absence is not zero. These labels describe program evidence, not Obligations cell states. The sample pins the implementation member from the published Topos SDK, folds two unrelated places twice with equal stdout and refuses a declared dependency cycle. This sample intentionally has no evidence to close either program; it certifies the projection of absence and order, not stage acceptance.\n" at=witness:public-contracts-by-operation by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-views shape=docs/contracts/views.md value=lock
+bound-lock/1 about="# Published contracts\n\nEvery public surface names its contract, accepted sample, captured executable vector and rejected sample. Missing members, differing artifact digests and failed vectors remain unpaid. Publication conformance is distinct from installed-artifact acceptance.\n\nThe selected Topos projects each quartet as a reading through the existing wire. Execution proofs are dependency readings; identical vector bytes share one proof. Each reading names its exact handed inputs and dependent receipt digests. Bound verifies those closures and keeps native count/bytes receipts by digest. A closed reading costs no new execution. The publication aggregate reads the quartet receipts; it never starts an inventory batch.\n\nExecution slots, per-execution timeout and response bytes are declared resource lines in the selected Topos. Bounds remain unchanged. A failed reading is not cached as a successful proof. Earlier completed readings stay verified, so a later refusal does not force them to execute again. Changed, missing or corrupt bytes cannot reuse their receipts. Output and execution history retain their exact coordinates.\n\n## Act cost\n\nEach declared reading and each host invocation is measured separately. The total duration of a pass is a diagnostic; it is not the cost of one indivisible act. The cost/act ceiling reads the largest measured act or the remaining unpartitioned host work. Nested invocations are not charged twice. A slow or refused act retains its cost. Native reading receipts retain measured seconds separately from semantic identity; reusing a receipt performs no new reader execution. Missing historical durations are not invented as zero.\n\n## Public verification\n\nFull-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.\n\nFile-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.\n" at=witness:public-receipts-verify-without-private-store by=target form=alphabet measure=text role=writes scope=prose/en/files/publication-contract shape=docs/contracts/publication.md value=lock
+bound-lock/1 about="# Using Bound\n\nThis guide covers the current CLI in a place whose wire and authority are already admitted. A fresh unsigned TARGET is a proposal, not a trusted project. The prepared repository is not yet a certified empty-clone bootstrap.\n\n## Before the first fold\n\nYou need the team's accepted TARGET and trust context, authentic bytes for each selected digest, and the readers/views that TARGET names. Do not borrow a neighbouring repository's ledger or copy node_modules to make a missing pin look available.\n\nThe published repository carries exactly TARGET.bound and receipts.bound as bound files. Local admission history lives in the ignored .bound/ store. Published standing excludes the signature envelope; owner public keys retain their signatures.\n\nStart by asking for help and folding the project. If a selected view is unavailable, use the named refusal and its fix; do not invent an output with a similar name.\n\n## Keys and coverage\n\nUse a named key already admitted by the project. The authority contract declares its public key, class and scope coverage. Signing uses a declared port. The lock names `keys/<who> measure=signer value=<name>`; `signer/timeout` and `signer/response-bytes` bound each invocation. The built-in `file` port reads a matching PKCS8 PEM outside the repository through `--key-file`. For a command port, the host supplies a `BOUND_SIGNERS` registry mapping that admitted name to `{ \"kind\": \"command\", \"executable\": \"...\", \"args\": [] }`. A repository declaration cannot authorize a program. `--signer <name>` must match the admitted selection.\n\nA new device must have its public key and coverage admitted by an authority that already covers the intended scope. The CLI does not currently certify silent key creation or tap-to-sign. This guide does not substitute a self-authorized fixture key for the team's authority.\n\nFor automation through the file port, supply the private key through the runner's secret storage to a temporary external file with restricted permissions. A command signer receives the lot once as canonical signed bytes, one line per record in order. It returns one canonical wire response per record, containing `by` and `sig`, in that same order. Bound verifies the entire reply against the admitted public key before any admission. Timeout, nonzero exit, missing or invalid replies refuse the whole lot; raw signer output is not logged. Hosts can keep private keys outside Bound through this port. Key generation, storage and rotation belong to the host. Do not print, commit or upload it. A source-control token and a Bound authority key have different purposes. Key rotation and revocation are changes to the admitted authority contract, not edits that erase prior signatures.\n\n## Proposal → signature → admission → reading\n\nPrepare the proposed lines outside the repository. Each line must use the current wire's fields, forms and required set. Configuration retains its legacy required fields, including `at`. Typed cells, claims and marks use their exact row grammar; `role=reads` or `at` cannot repair an incomplete typed record.\n\nA proposal names `by=target` and omits epoch/signature. The CLI assigns epoch from admitted history when signing. Never copy an epoch from an example or change a signed line's body.\n\nUse the signing and admission transaction in the README. Shell `&&` prevents a failed sign from being followed by land. Successful signing alone does not mean admission. Successful admission alone does not mean every requirement is paid. Fold after land and inspect its states, receipts and exit status.\n\nCLI sign authenticates wire inscriptions. It is different from the object's travelling ceiling sign. The selected Topos decodes spans and supplies origin/witness context; Bound must not guess those from by, widens or a path.\n\n## Reading and withdrawing\n\nAsk only for a view admitted by the project, such as cells. A local join widens that cell with a witness; it leaves the travelling ceiling live. A travelling require supplies a floor. Claims carry distinct origins; their signatures do not by themselves establish independent origins.\n\nFor typed histories, a negative record names the exact id in takes. Withdrawing a claim removes that live observation; withdrawing a join removes that local widening, not the sign. A fresh claim with the same content is a new identity, not resurrection of a withdrawn id. Re-delivery of the same signed bytes is idempotent.\n\nFor configuration, the negative line preserves the exact non-envelope selectors and changes value to withdraw. Do not withdraw and replace identical selectors in the same batch. Use a new epoch when superseding an alphabet declaration. Never withdraw evidence merely to obtain a green verdict.\n\n## Receipts and refusals\n\nreceipts.bound is native fold output. Do not write it by hand, use JSON from a test as a receipt, or copy receipts from another tree. Unchanged inputs can reuse verified region receipts; missing bytes require recomputation or a refusal. A duplicate receipt does not create another origin.\n\nREFUSE·wire means the current grammar does not admit the record. REFUSE·pin/release means named authentic content or its closure is unavailable or does not match. REFUSE·view means the requested view cannot be rendered under its contract. Authority refusal means the signer is not covered. Keep the line and the failed exit status; follow an explicit fix without changing the named digest or dropping a conflicting statement.\n\nrelease/blocks is policy read by the fold. Its admitted category links select existing obligations. The fold prints each missing reading or crossed ceiling as BLOCK; a blocked or incomplete policy is not READY. Read the captured verdict for the exact candidate instead of inferring acceptance from a successful render.\n\n## Repository and PR review\n\nThe accepted TARGET is independent of a contributor's scan. Commit native receipts and admitted renders, not local .bound/ state. A page disagreeing with TARGET must be re-rendered; a ceiling is not lowered to fit the page.\n\nA contribution is a proposed lot with the leaf changes rendered from it. Send that lot for admission by the team's coverage. Do not submit hand-edited lock output as already accepted. Check secrets, extra bound files, foreign vendoring and uncaptured page claims before review.\n\nA review includes the product fold, meaningful suites and verification of the rendered bytes. Preserve their actual output and exit status.\n\n## Declaring a demand\n\nA new demand records what remains to be proved. Admission does not create conformance evidence or pay it. An OWED line after land says the declaration was admitted and remains unpaid. Signing authority and conformance evidence are separate inputs.\n\nThe selected program projection reads declared requirements and handed evidence. Missing evidence stays unread; a missing elapsed-time reading is not zero. A dependency cannot close before its requirements and predecessors. Declaring a plan never certifies a release.\n" at=witness:declared-demand-close by=target form=alphabet measure=text role=writes scope=prose/en/files/public-2 shape=docs/usage.md value=lock
+bound-lock/1 about="# Walk\n\n`bound fold --as walk@<resolution>` compares the admitted place with an authenticated peer inventory. Resolution is interpreted by the declared Topos selection and projection contract; it is not restricted to three fixed numbers. The wire declares region membership, context, origin and cuts. The output names touched regions, open regions and payload bytes; protocol and imported bytes carry their own units.\n\nForeign history retains its signed origin epoch. Sender keys authenticate that history and never grant coverage or independent origins in the receiver. Whole-region prefixes are verified before ingress. Import and the receiver-signed local receipt commit atomically; only that receipt advances the receiver's local epoch. Foreign withdrawals are confined to the same authenticated origin and exact identifier. A repeated valid delivery adds no lines and retains its existing import receipt. A rejected or interrupted ingress adds neither evidence nor a receipt.\n\nThe published sample uses the same compiled public reader on measurement and artifact places. It compares equal summaries, opens a differing region, exchanges at intermediate declared resolutions, converges by union, retains disagreement and verifies replay after a later local act. It rejects tampered payloads, missing records, unauthorized signatures, non-prefix epochs and undeclared context changes. It interrupts a real receiver signer and verifies unchanged ingress and local history. Dead-owner recovery is a separate host action; this view does not silently recover it. The typed object's origin-local claims and withdrawals are a separate conformance vector, not inferred from configuration counts.\n" at=witness:publish-native-walk-contract by=target form=alphabet measure=text role=writes scope=prose/en/files/view-walk shape=docs/contracts/view-walk.md value=lock
+bound-lock/1 about="# fold\n\n`bound fold` reads the admitted place. Configuration output names readings and says no encounters computed; its counts are not independent-origin states. A declared cells view projects admitted typed history into Obligations. A selected world defines other views; its contract decides when empty output is valid. A refusal or nonzero status wins over any parseable diagnostic stdout. `--check` verifies receipts without inventing a missing reading. The published evidence vector folds fresh places, preserves admitted key attribution, reads a native receipt and checks exact withdrawals. The typed-object quartet covers object states separately.\n\n# land\n\n`bound land <lot>` admits authenticated lines through the same boundary used by signing and previews. Authority, coverage, historical wire and typed context remain distinct checks. Unknown wire and tampered signatures refuse. Exact redelivery returns ONCE; it does not append another origin or grant new authority. Withdrawals remain exact under their declared contract. A refusal does not append a partial act. The published evidence vector lands fresh places, refuses unauthorized writes and tampering, redelivers signed bytes and exercises exact withdrawals. The signing-port vector additionally checks interrupted or invalid command responses do not land a partial lot.\n\n# sign\n\n`bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.\n" at=witness:public-contracts-by-operation by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-cli shape=docs/contracts/cli.md value=lock
+bound-lock/1 about="## Typed cell, claim and mark records\n\nThe object profile is selected by admitted `wire/object/*` claims in a historical wire snapshot. The epoch of `wire/object/types` is its activation E; a typed record must have epoch >= E. An older record keeps the older grammar. Merely adding object words to `wire/fields` does not admit a typed profile.\n\n`fromLine` selects grammar before validating required fields: a record without `type` remains configuration, retaining its required `at`, `role`, `form`, `measure` and `value`; a typed record selects its exact required/allowed row. Configuration cannot carry object-only fields. An incomplete typed record receives no configuration defaults. The parse result distinguishes configuration from cell/claim/mark. `sign=+1|-1` is an object act, `sig` its signature envelope, and a host sign operation produces that envelope.\n\nThe common object envelope is `type`, `scope`, `id`, `epoch`, `by`, `sig`. Object records reject `at`: epoch orders acts, and `widens` names a local join witness. The following is the declared reference profile. The admitted row alphabets, not this table or a host decoder, are the source of required/allowed field permission.\n\n| Row | Fields in addition to the common envelope | Meaning |\n| --- | --- | --- |\n| cell | form, measure, params, restsOn, topos | Define a cell and its selected form/context. |\n| claim/positive | sign, origin, value | Observe an encoded span, sign=+1. |\n| claim/negative | sign, takes | Withdraw an exact claim ID, sign=-1. |\n| mark/travelling | sign, pole, reach, value | Ceiling sign: sign=+1, pole=ceiling, reach=travels. |\n| mark/local | sign, pole, reach, value, widens | Local join: sign=+1, pole=ceiling, reach=local; another mark, retaining the travelling sign. |\n| mark/floor-travelling | sign, pole, reach, value | Travelling require: sign=+1, pole=floor, reach=travels; no widens. |\n| mark/negative | sign, takes | Withdraw an exact mark ID, sign=-1; no pole/reach/widens. |\n\nEach row has both `wire/object/required/<row>` and `wire/object/allowed/<row>`. Unknown keys, missing required keys, floor/local, floor+widens, and travelling widening refuse without coercion. A configuration demand is unrelated to a floor mark. `by` authenticates a signing key; it is not an independent observation origin.\n\nFor a cell, `restsOn=none` represents no parents; otherwise it is a canonical byte-ordered alphabet of coordinates. Several parents are permitted. Only declared cell-coordinate edges form object rest; a directory prefix, a configuration artifact digest, and a host source location do not. Context validation rejects reachable cycles before algebraic parts are requested.\n\nThe cell's `topos` names folded standing, and its `params` identifies declared parameter bytes. A selected provider decodes values and supplies origin/witness authorization from admitted evidence. A host does not infer interval endpoints, map a key to an origin, or accept widens as its own witness. Missing pin, artifact, decoder, origin or witness refuses by cause. Cell definitions and pins are immutable in this profile; migration is not inferred.\n\n`objectHistory` preserves typed history separately from configuration; `validateObjectContext` checks IDs, cell ownership, exact takes, witness order and declared rest under the selected context. Exact redelivery is idempotent; one ID with different canonical content refuses. Signature-envelope differences never bypass verification.\n\nAfter admission, the instrument projects the acts into Obligations. Sign and require travel along declared rest; a witnessed join is local. Descendants inherit travelling marks without local widening. Live exact-ID withdrawals remain confined to their authenticated history. Keys, snapshots, signing devices and repeated receipts do not create independent origins. Compatible meets are not forks. Object states and their precedence come from Obligations; configuration folds do not compute object encounters.\n" at=witness:minimal-contract-015 by=target form=alphabet measure=text role=writes scope=prose/en/files/contract-typed-object shape=docs/contracts/typed-object.md value=lock
 bound-lock/1 about=", & " at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/cite/and value=lock
 bound-lock/1 about="<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"1200\" height=\"760\" viewBox=\"0 0 1200 760\" role=\"img\" aria-labelledby=\"title desc\">\n<title id=\"title\">One history, several views</title><desc id=\"desc\">Illustrative spatial view of B, C, G and independent D. C rests on B and G rests on C. B's travelling ceiling is 0 to 50 and travelling floor 40 to 100. Its local join widens only B to 0 to 100. Region receipts retain selected topos and implementation identity. Background points are decorative, not additional measured cells.</desc>\n<defs>\n<radialGradient id=\"bg\"><stop stop-color=\"#163445\"/><stop offset=\"1\" stop-color=\"#080f1c\"/></radialGradient>\n<radialGradient id=\"dot\"><stop stop-color=\"#fff\"/><stop offset=\".4\" stop-color=\"#b4f8ed\"/><stop offset=\"1\" stop-color=\"#2c8c9a\"/></radialGradient>\n<linearGradient id=\"edge\"><stop stop-color=\"#62d9c4\"/><stop offset=\"1\" stop-color=\"#8da4ef\"/></linearGradient>\n<filter id=\"glow\" x=\"-100%\" y=\"-100%\" width=\"300%\" height=\"300%\"><feGaussianBlur stdDeviation=\"12\"/></filter>\n<marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"8\" refY=\"5\" markerWidth=\"5\" markerHeight=\"5\" orient=\"auto-start-reverse\"><path d=\"M0 0 10 5 0 10\" fill=\"#7ce4d1\"/></marker>\n</defs>\n<style>text{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif;fill:#eef5fa}.muted{fill:#aac0ce;font-size:16px}.small{fill:#aac0ce;font-size:14px}.label{font-size:19px;font-weight:600}.mono{font-family:Menlo,Consolas,monospace;font-size:15px;fill:#8fe7d7}</style>\n<rect width=\"1200\" height=\"760\" rx=\"24\" fill=\"url(#bg)\"/>\n<text x=\"64\" y=\"68\" class=\"small\" letter-spacing=\"3\">THE ALGEBRA IN 60 SECONDS</text>\n<text x=\"64\" y=\"118\" font-size=\"38\" font-weight=\"600\">One history. Several views.</text>\n<text x=\"64\" y=\"152\" class=\"muted\">A cell keeps its readings. A connection carries only what travels.</text>\n\n<path d=\"M687.2 493.6 Q622.5 471.6 557.7 519.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M687.2 493.6 Q611.8 400.4 536.4 377.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"687.2\" cy=\"493.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M557.7 519.6 Q599.3 438.0 640.9 426.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M557.7 519.6 Q694.0 469.6 830.3 489.7\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"557.7\" cy=\"519.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M640.9 426.5 Q679.9 444.8 718.9 533.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M640.9 426.5 Q532.8 423.4 424.6 490.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"640.9\" cy=\"426.5\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M718.9 533.1 Q593.9 462.3 468.9 461.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M718.9 533.1 Q723.2 406.5 727.6 349.8\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"718.9\" cy=\"533.1\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M468.9 461.5 Q624.8 408.6 780.7 425.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M468.9 461.5 Q584.9 469.0 701.0 546.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"468.9\" cy=\"461.5\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M780.7 425.6 Q680.5 453.3 580.3 550.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M780.7 425.6 Q600.0 368.0 419.3 380.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"780.7\" cy=\"425.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M580.3 550.9 Q558.3 429.0 536.4 377.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M580.3 550.9 Q726.7 444.2 873.2 407.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"580.3\" cy=\"550.9\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M536.4 377.1 Q683.3 398.4 830.3 489.7\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M536.4 377.1 Q510.2 415.4 484.0 523.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"536.4\" cy=\"377.1\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M830.3 489.7 Q627.4 455.0 424.6 490.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M830.3 489.7 Q713.5 362.0 596.8 304.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"830.3\" cy=\"489.7\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M424.6 490.3 Q576.1 385.1 727.6 349.8\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M424.6 490.3 Q627.3 458.2 829.9 496.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"424.6\" cy=\"490.3\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M727.6 349.8 Q714.3 413.1 701.0 546.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M727.6 349.8 Q546.7 349.1 365.9 418.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"727.6\" cy=\"349.8\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M701.0 546.4 Q560.2 428.4 419.3 380.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M701.0 546.4 Q760.0 399.0 818.9 321.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"701.0\" cy=\"546.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M419.3 380.4 Q646.3 358.9 873.2 407.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M419.3 380.4 Q518.5 419.1 617.6 527.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"419.3\" cy=\"380.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M873.2 407.4 Q678.6 430.5 484.0 523.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M873.2 407.4 Q665.3 320.4 457.4 303.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"873.2\" cy=\"407.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M484.0 523.6 Q540.4 378.9 596.8 304.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M484.0 523.6 Q690.8 432.3 897.5 411.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"484.0\" cy=\"523.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M596.8 304.3 Q713.4 365.1 829.9 496.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M596.8 304.3 Q502.6 347.7 408.4 461.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"596.8\" cy=\"304.3\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M829.9 496.0 Q597.9 422.2 365.9 418.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M829.9 496.0 Q759.5 344.6 689.1 263.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"829.9\" cy=\"496.0\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M365.9 418.3 Q592.4 334.9 818.9 321.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M365.9 418.3 Q564.7 418.1 763.4 487.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"365.9\" cy=\"418.3\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M818.9 321.5 Q718.3 389.7 617.6 527.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M818.9 321.5 Q597.5 294.7 376.0 338.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"818.9\" cy=\"321.5\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M617.6 527.9 Q537.5 380.6 457.4 303.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M617.6 527.9 Q743.8 388.6 869.9 319.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"617.6\" cy=\"527.9\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M457.4 303.3 Q677.5 322.2 897.5 411.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M457.4 303.3 Q493.2 355.5 529.1 477.7\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"457.4\" cy=\"303.3\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M897.5 411.0 Q653.0 401.0 408.4 461.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M897.5 411.0 Q720.1 295.0 542.7 248.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"897.5\" cy=\"411.0\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M408.4 461.0 Q548.8 327.1 689.1 263.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M408.4 461.0 Q631.6 401.1 854.7 411.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"408.4\" cy=\"461.0\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M689.1 263.2 Q726.2 340.6 763.4 487.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M689.1 263.2 Q539.2 287.2 389.2 381.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"689.1\" cy=\"263.2\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M763.4 487.9 Q569.7 377.9 376.0 338.0\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M763.4 487.9 Q762.5 335.1 761.7 252.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"763.4\" cy=\"487.9\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M376.0 338.0 Q623.0 293.7 869.9 319.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M376.0 338.0 Q523.1 359.3 670.2 450.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"376.0\" cy=\"338.0\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M869.9 319.4 Q699.5 363.5 529.1 477.7\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M869.9 319.4 Q659.0 260.9 448.0 272.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"869.9\" cy=\"319.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M529.1 477.7 Q535.9 328.3 542.7 248.9\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M529.1 477.7 Q690.3 366.0 851.4 324.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"529.1\" cy=\"477.7\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M542.7 248.9 Q698.7 295.1 854.7 411.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M542.7 248.9 Q514.0 289.8 485.2 400.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"542.7\" cy=\"248.9\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M854.7 411.2 Q621.9 361.2 389.2 381.2\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M854.7 411.2 Q742.8 285.3 631.0 229.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"854.7\" cy=\"411.2\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M389.2 381.2 Q575.4 281.7 761.7 252.3\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M389.2 381.2 Q574.0 347.8 758.8 384.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"389.2\" cy=\"381.2\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M761.7 252.3 Q716.0 316.4 670.2 450.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M761.7 252.3 Q606.9 244.3 452.2 306.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"761.7\" cy=\"252.3\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M670.2 450.6 Q559.1 326.5 448.0 272.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M670.2 450.6 Q715.3 322.0 760.3 263.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"670.2\" cy=\"450.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M448.0 272.4 Q649.7 263.4 851.4 324.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M448.0 272.4 Q525.9 286.7 603.9 371.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"448.0\" cy=\"272.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M851.4 324.4 Q668.3 327.5 485.2 400.6\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M851.4 324.4 Q707.4 252.6 563.4 250.8\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"851.4\" cy=\"324.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M485.2 400.6 Q558.1 280.0 631.0 229.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M485.2 400.6 Q604.9 318.9 724.5 307.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"485.2\" cy=\"400.6\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M631.0 229.4 Q694.9 271.9 758.8 384.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<path d=\"M631.0 229.4 Q605.0 231.0 579.1 302.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"631.0\" cy=\"229.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M758.8 384.4 Q605.5 310.4 452.2 306.4\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"758.8\" cy=\"384.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M452.2 306.4 Q606.2 249.9 760.3 263.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"452.2\" cy=\"306.4\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M760.3 263.5 Q682.1 282.3 603.9 371.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"760.3\" cy=\"263.5\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M603.9 371.1 Q583.6 276.0 563.4 250.8\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"603.9\" cy=\"371.1\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M563.4 250.8 Q644.0 244.0 724.5 307.1\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"563.4\" cy=\"250.8\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<path d=\"M724.5 307.1 Q651.8 269.8 579.1 302.5\" stroke=\"#588d9e\" stroke-width=\".6\" opacity=\".13\" fill=\"none\"/>\n<circle cx=\"724.5\" cy=\"307.1\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<circle cx=\"579.1\" cy=\"302.5\" r=\"1.6\" fill=\"#8cafbc\" opacity=\".4\"/>\n<ellipse cx=\"557\" cy=\"422\" rx=\"240\" ry=\"132\" transform=\"rotate(-16 557 422)\" stroke=\"#547c96\" stroke-dasharray=\"3 9\" fill=\"#71b9bd\" fill-opacity=\".025\"/>\n<path d=\"M391 402 Q469 255 583 351\" stroke=\"url(#edge)\" stroke-width=\"2.6\" fill=\"none\" marker-end=\"url(#arrow)\"/>\n<path d=\"M603 367 Q681 397 689 457\" stroke=\"url(#edge)\" stroke-width=\"2.6\" fill=\"none\" marker-end=\"url(#arrow)\"/>\n<ellipse cx=\"379\" cy=\"420\" rx=\"57\" ry=\"24\" transform=\"rotate(-20 379 420)\" stroke=\"#bba4f8\" stroke-width=\"2\" fill=\"#bba4f8\" fill-opacity=\".06\"/>\n<path d=\"M356 439 Q334 464 317 481\" stroke=\"#bba4f8\" opacity=\".7\" fill=\"none\"/>\n<text x=\"65\" y=\"283\" class=\"label\">Travelling bounds</text>\n<text x=\"65\" y=\"313\" class=\"mono\">ceiling 0..50</text><text x=\"65\" y=\"340\" class=\"mono\">floor 40..100</text>\n<text x=\"65\" y=\"369\" class=\"small\">B → C → G</text>\n<path d=\"M243 319 289 319 336 398\" stroke=\"#608797\" fill=\"none\"/>\n<text x=\"65\" y=\"498\" class=\"label\">Local join</text>\n<text x=\"65\" y=\"528\" font-size=\"16\" fill=\"#c3b2fa\">B widens to 0..100</text>\n<text x=\"65\" y=\"555\" class=\"small\">The travelling sign stays live.</text>\n<path d=\"M240 511 284 511 317 481\" stroke=\"#847fa1\" fill=\"none\"/>\n\n<circle cx=\"379\" cy=\"420\" r=\"22\" fill=\"#78d7c8\" opacity=\".4\" filter=\"url(#glow)\"/><circle cx=\"379\" cy=\"420\" r=\"8\" fill=\"url(#dot)\"/><text x=\"397\" y=\"411\" class=\"label\">B</text>\n<circle cx=\"590\" cy=\"354\" r=\"22\" fill=\"#78d7c8\" opacity=\".4\" filter=\"url(#glow)\"/><circle cx=\"590\" cy=\"354\" r=\"8\" fill=\"url(#dot)\"/><text x=\"608\" y=\"345\" class=\"label\">C</text>\n<circle cx=\"690\" cy=\"468\" r=\"22\" fill=\"#78d7c8\" opacity=\".4\" filter=\"url(#glow)\"/><circle cx=\"690\" cy=\"468\" r=\"8\" fill=\"url(#dot)\"/><text x=\"708\" y=\"459\" class=\"label\">G</text>\n<circle cx=\"927\" cy=\"302\" r=\"22\" fill=\"#78d7c8\" opacity=\".4\" filter=\"url(#glow)\"/><circle cx=\"927\" cy=\"302\" r=\"8\" fill=\"url(#dot)\"/><text x=\"945\" y=\"293\" class=\"label\">D</text>\n<text x=\"621\" y=\"331\" class=\"small\">ceiling 0..50</text>\n<text x=\"718\" y=\"496\" class=\"small\">ceiling 0..50</text>\n<text x=\"868\" y=\"251\" class=\"label\">Independent cell</text>\n<text x=\"868\" y=\"278\" class=\"small\">D declares no rest on B.</text>\n<text x=\"449\" y=\"573\" class=\"small\">Region: the cells selected by a view</text>\n<path d=\"M64 624H1136\" stroke=\"#304658\"/>\n<text x=\"64\" y=\"664\" class=\"label\">Selected topos</text>\n<text x=\"64\" y=\"693\" class=\"small\">Forms and views · pinned folded standing</text>\n<text x=\"655\" y=\"664\" class=\"label\">Receipts at resolution 1</text>\n<text x=\"655\" y=\"693\" class=\"small\">Semantic inputs + selected implementation</text>\n<text x=\"64\" y=\"733\" font-size=\"12\" fill=\"#8ea6b7\">Illustrative layout · connections denote declared rest · position and size do not measure importance</text>\n</svg>" at=policy:public-prose by=target form=alphabet measure=text role=writes scope=prose/en/files/public-3 shape=docs/readme-assets/atlas.svg value=lock
 bound-lock/1 about="A REFUSE prints its line and stops. Nothing after it is a fact." at=witness:project-coordinates-are-relative by=target form=alphabet kind=axiom measure=status needs=samples/yes/a-refuse-plants.json|samples/no/a-refuse-plants.json role=demands scope=law/a-refuse-plants value=present
@@ -10,24 +18,48 @@ bound-lock/1 about="A fold" at=policy:bound/readme by=target form=alphabet measu
 bound-lock/1 about="A fold, live" at=policy:bound/door by=target form=alphabet measure=text role=writes scope=prose/en/seq/heading value=lock
 bound-lock/1 about="A line" at=policy:bound/readme by=target form=alphabet measure=text role=writes scope=prose/en/figure/line/heading value=present
 bound-lock/1 about="A lock is the set of lines a place is bound by. A receipt is what a reader saw. The fold is their meet. Each line carries scope, role, form, measure, value, needs, at, by, epoch, sig." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/the-object value=present
+bound-lock/1 about="A new snapshot has a new evidence identity, not automatically a new independent origin. Preserve the admitted attribution and the chosen Topos's independence contract. Repeated readings, time periods, signing devices and receipt copies must not manufacture freedom." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/01 value=lock
+bound-lock/1 about="A port's digest identifies executable bytes, not permission to execute them. Coverage, request authority, bounds, framing and resource dependencies are checked separately. `port/**` coverage is a proposed namespace policy to admit, not an existing universal authority rule." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/05 value=lock
 bound-lock/1 about="A second independent reader must agree. The fold rebuilds from the files alone, offline." at=witness:project-coordinates-are-relative by=target form=alphabet kind=axiom measure=status needs=samples/yes/verify-agrees.json|samples/no/verify-agrees.json role=demands scope=law/verify-agrees value=present
+bound-lock/1 about="A sequence of declared readings is not an indivisible act. Preserve total pass time as a diagnostic; measure each reading and host invocation, account for unpartitioned work, keep refusals and the 60-second ceiling unchanged." at=witness:declared-act-cost by=target form=alphabet measure=text role=writes scope=rationale/015/cost-boundary value=present
+bound-lock/1 about="Algebraic vacuity, absence of observations and lack of recent activity are separate facts. A view may expose inactivity over an admitted window, but cannot rename it algebraic vacuity or read missing history as zero." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/02 value=lock
 bound-lock/1 about="Bind a package release with the pipeline views. Bind a page to its receipts with view/readme. Refuse a dependency drift with dep pins. Ask a second head that must agree." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/learn value=present
 bound-lock/1 about="Bound is the application of that algebra: signed bounds, folded by one meet, refused when they fork." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/paper value=present
-bound-lock/1 about="Bound reads a project's admitted statements and observations through its selected Topos, then renders the declared views and records their inputs in receipts. The example below explains the object; a file-fold alone does not calculate its intervals.\n\n## A meeting everyone can understand\n\nAna is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.\n\nWith an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.\n\nThe same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.\n\n## See how information holds together\n\n![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)\n\nA travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.\n\n| State | Meaning |\n| --- | --- |\n| REQUIRED | Compatible bounds, fewer than two independent origins. |\n| FREE | Independent origins meet and their encounter fits the bounds. |\n| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |\n| FORBIDDEN | An inhabited encounter does not fit the bounds. |\n\nBounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.\n\n## Change a project without erasing evidence\n\nWork in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.\n\n```sh\nexport BOUND_KEY_ID='your-admitted-key-id'\nexport BOUND_KEY_FILE=\"$HOME/Private/keys/your-device.pem\"\nlot_dir=\"$(mktemp -d)\"\n```\n\nHave the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.\n\n```sh\nnpx @lapxo/bound@0.1.4 sign \"$lot_dir/proposal.bound\" \\\n  --key \"$BOUND_KEY_ID\" --key-file \"$BOUND_KEY_FILE\" \\\n  > \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.4 land \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.4 fold\n```\n\n`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.\n\nFor typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.\n\n[Authority, withdrawals, receipts and PR review](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).\n\n## Select a topos by what it declares\n\n`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.\n\n`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.\n\n| Responsibility | Owner |\n| --- | --- |\n| Meet, state, live acts and rest | Obligations |\n| Wire, forms, classes, views and offer contracts | Topos |\n| Admission, folding and evidence | Bound |\n| Domain measurement and representation | Selected topos |\n| Storage, transport and execution | Host |\n\nCell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.\n\n## Repository rules\n\nCommit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.\n\nThe lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.\n\nA PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).\n\n## An atlas you can question\n\nInformation can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.\n\nThis makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.\n\nA pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.\n\nUse Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.\n\n[Contribute a counterexample or a proposed lot](CONTRIBUTING.md)." at=witness:bound/014-candidate by=target form=alphabet measure=text role=writes scope=prose/en/idea value=present
+bound-lock/1 about="Bound reads a project's admitted statements and observations through its selected Topos, then renders the declared views and records their inputs in receipts. The example below explains the object; a file-fold alone does not calculate its intervals.\n\n## Use Bound in a project\n\nFrom a project with an admitted lock and selected views, inspect its standing, ask for its evidence, then verify the committed outputs:\n\n```sh\nnpx @lapxo/bound@0.1.5 fold --as lines\nnpx @lapxo/bound@0.1.5 fold --as receipts@1\nnpx @lapxo/bound@0.1.5 fold --check\n```\n\nUse this flow to review a project change or check a dependency's declared contract. `--check` verifies existing evidence; it does not execute a missing reading. A file fold names readings and explicitly says that it computed no encounters.\n\nIndependent observations are judged through the declared typed cells view. The selected topos supplies the form, origin evidence and bounds. Bound keeps attribution and exact-ID withdrawals through the fold.\n\nA selected form can instead describe a set of artifacts, a delivery interval or another domain's values. The project declares the form, origin evidence and views; Bound does not infer them from filenames or units.\n\n\n## A meeting everyone can understand\n\nAna is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.\n\nWith an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.\n\nThe same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.\n\n## See how information holds together\n\n![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)\n\nA travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.\n\n| State | Meaning |\n| --- | --- |\n| REQUIRED | Compatible bounds, fewer than two independent origins. |\n| FREE | Independent origins meet and their encounter fits the bounds. |\n| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |\n| FORBIDDEN | An inhabited encounter does not fit the bounds. |\n\nBounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.\n\n## Change a project without erasing evidence\n\nWork in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.\n\n```sh\nexport BOUND_KEY_ID='your-admitted-key-id'\nexport BOUND_KEY_FILE=\"$HOME/Private/keys/your-device.pem\"\nlot_dir=\"$(mktemp -d)\"\n```\n\nHave the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.\n\n```sh\nnpx @lapxo/bound@0.1.5 sign \"$lot_dir/proposal.bound\" \\\n  --key \"$BOUND_KEY_ID\" --key-file \"$BOUND_KEY_FILE\" \\\n  > \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.5 land \"$lot_dir/signed.bound\" &&\nnpx @lapxo/bound@0.1.5 fold\n```\n\n`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.\n\nFor typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.\n\n[Authority, withdrawals, receipts and PR review](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).\n\n## Select a topos by what it declares\n\n`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.\n\n`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.\n\n| Responsibility | Owner |\n| --- | --- |\n| Meet, state, live acts and rest | Obligations |\n| Wire, forms, classes, views and offer contracts | Topos |\n| Admission, folding and evidence | Bound |\n| Domain measurement and representation | Selected topos |\n| Storage, transport and execution | Host |\n\nCell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.\n\n## Repository rules\n\nCommit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.\n\nThe lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.\n\nA PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).\n\n## An atlas you can question\n\nInformation can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.\n\nThis makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.\n\nA pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.\n\nUse Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.\n\n[Contribute a counterexample or a proposed lot](CONTRIBUTING.md).\n\n## Foundations and related libraries\n\nThe two-sided constraint object is described in Nahum Ochoa's [Two-Sided Constraints on a Valued Lattice](https://doi.org/10.5281/zenodo.21858428), DOI `10.5281/zenodo.21858428`. Bound uses the object through [Obligations](https://github.com/Lapxo/obligations); [Topos](https://github.com/Lapxo/topos) supplies the wire and contracts for forms, views and selected worlds. Bound admits, folds and retains evidence across those declared boundaries. A digest identifies bytes; it does not certify that an observation is true.\n" at=witness:minimal-readme-015 by=target form=alphabet measure=text role=writes scope=prose/en/idea value=present
 bound-lock/1 about="Cite it as {name}." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/cff/name value=lock
 bound-lock/1 about="Cite it by the paper it rests on, Two-Sided Constraints on a Valued Lattice." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/cff/paper value=lock
+bound-lock/1 about="Conflicting live wire declarations refuse by scope; no vacuous alphabet." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/wire/unique-live-alphabet.md|samples/yes/wire/unique-live-alphabet.json|vectors/wire/unique-live-alphabet.json|samples/no/wire/unique-live-alphabet.json role=demands scope=wire/unique-live-alphabet value=present
 bound-lock/1 about="Declare what must hold. Read what does. Keep the evidence." at=policy:bound/historical-prose by=target form=alphabet measure=text role=writes scope=docs/tagline value=present
 bound-lock/1 about="Declared runtime processes participate in the instrument implementation identity." at=policy:bound/receipts by=target form=alphabet kind=process measure=id needs=dist/cli/host.js|dist/cli/observe.js|dist/host/located.js|dist/host/provide.js role=writes scope=process/runtime value=present
+bound-lock/1 about="Deterministic repair means a reproducible proposed lot, not automatic human approval. A red can lack measurements, authority, a witness or a unique repair. Such a case returns an explicit unmet requirement; it never invents a paying line." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/06 value=lock
+bound-lock/1 about="Elapsed days from 2026-10-07; deadline 2026-10-21. An unread clock is not payment." at=policy:bound/015-plan by=target form=interval measure=days role=demands scope=plan/0.1.5/time value=0..14
+bound-lock/1 about="Every selected public coordinate has its exact contract/yes/vector/no quartet and executable conformance; availability is not proof." at=witness:publication-is-measured by=target form=interval measure=count needs=docs/contracts/publication.md|docs/contracts/publication.inventory.json role=reads scope=contract/published value=0..0
+bound-lock/1 about="Exact npm archive integrity for acorn 8.19.0. Library metadata, not Topos standing or a release mount; npm verifies the matching package-lock integrity." at=policy:host-module-identity by=target form=alphabet measure=id role=writes scope=dep/acorn value=sha512:a09940dd78919bb0b293aa850f6267f1a93d07b8d2cb4ab2d340033b7fbc7694f42d28c58a1418bf80b4d8b142498255dd0dfbc58c30472e66f88a48894cea5b
+bound-lock/1 about="Exchange cost requires units: transferred regions, payload bytes, protocol overhead and verification work. Reused regions transfer zero semantic payload. Variable-size regions cannot obey a byte ceiling stated merely as a count of open regions." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/03 value=lock
 bound-lock/1 about="First session" at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=page/seq/heading value=present
 bound-lock/1 about="First use" at=policy:bound/readme by=target form=alphabet measure=text role=writes scope=prose/en/commands/heading value=lock
+bound-lock/1 about="Historical file-fold illustration using cellOfLines; not the typed object. No admitted native observation vector certifies it in this release. Re-entry requires its contract, two unrelated native CLI places, a rejection sample and the exact installed vector. No current view is advertised; withdrawal is not payment." at=witness:withdraw-unpublished-legacy-views by=target form=alphabet measure=status needs=docs/contracts/view-figure-fold.md|samples/yes/view-figure-fold.json|vectors/view-figure-fold.json|samples/no/view-figure-fold.json role=demands scope=plan/0.1.6/view-figure-fold value=present
+bound-lock/1 about="Historical illustration depends on genuine captured refusals; no complete shipped conformance vector currently certifies it. Re-entry requires its contract, two unrelated native CLI places, a rejection sample and the exact installed vector. No current view is advertised; withdrawal is not payment." at=witness:withdraw-unpublished-legacy-views by=target form=alphabet measure=status needs=docs/contracts/view-figure-refuses.md|samples/yes/view-figure-refuses.json|vectors/view-figure-refuses.json|samples/no/view-figure-refuses.json role=demands scope=plan/0.1.6/view-figure-refuses value=present
+bound-lock/1 about="Historical line illustration depends on native said/lines receipts; no complete shipped conformance vector currently certifies it. Re-entry requires its contract, two unrelated native CLI places, a rejection sample and the exact installed vector. No current view is advertised; withdrawal is not payment." at=witness:withdraw-unpublished-legacy-views by=target form=alphabet measure=status needs=docs/contracts/view-figure-line.md|samples/yes/view-figure-line.json|vectors/view-figure-line.json|samples/no/view-figure-line.json role=demands scope=plan/0.1.6/view-figure-line value=present
+bound-lock/1 about="Historical line region reads sources/<name>; the native CLI returned empty and does not compute the promised standing pin. URLs are not pins. Re-entry requires its contract, two unrelated native CLI places, a rejection sample and the exact installed vector. No current view is advertised; withdrawal is not payment." at=witness:withdraw-unpublished-legacy-views by=target form=alphabet measure=status needs=docs/contracts/view-release.md|samples/yes/view-release.json|vectors/view-release.json|samples/no/view-release.json role=demands scope=plan/0.1.6/view-release value=present
 bound-lock/1 about="How Bound reads a project" at=policy:bound/historical-prose by=target form=alphabet measure=text role=writes scope=prose/en/idea/heading value=lock
 bound-lock/1 about="How to add or change a lock" at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=page/exchange/heading value=present
 bound-lock/1 about="In an empty folder, write a three-line TARGET.bound, run bound ., and see the stranger four lines printed. Then land, then bound . --as card --key <you>. A fact is a printed line." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/first-use/lead value=lock
+bound-lock/1 about="Inventory actual installed public surface; missing artifacts remain unpaid." at=witness:public-contracts-by-operation by=target form=alphabet measure=status needs=docs/contracts/archive.md|docs/contracts/cli.md|docs/contracts/documents.md|docs/contracts/evidence-view.md|docs/contracts/typed-object.md|docs/contracts/view-walk.md|docs/contracts/views.md|samples/no/archive-conformance.json|samples/no/historical-document-views.json|samples/no/native-views.json|samples/no/program-views.json|samples/no/query-views.json|samples/no/signing-port.json|samples/no/typed-object.json|samples/no/walk.json|samples/yes/archive-conformance.json|samples/yes/historical-document-views.json|samples/yes/native-views.json|samples/yes/program-views.json|samples/yes/query-views.json|samples/yes/signing-port.json|samples/yes/typed-object.json|samples/yes/walk.json|vectors/archive-conformance.json|vectors/historical-document-views.json|vectors/native-views.json|vectors/program-views.json|vectors/query-views.json|vectors/signing-port.json|vectors/typed-object.json|vectors/walk-publication.json role=demands scope=plan/0.1.5/0 value=present
 bound-lock/1 about="Joining two files is putting their lines together: order does not matter, and a line twice is still one. A disagreement does not break the merge; it shows as CONFLICT. A file travels alone. Bound never guesses: one origin is REQUIRED, not FREE. Each of these is a test in bound/test/laws.test.ts." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/what-holds/lead value=lock
 bound-lock/1 about="Land the batch with the key that covers it." at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=page/seq/key value=present
+bound-lock/1 about="MIT License\n\nCopyright (c) 2026 Lapxo\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." at=witness:bound/015-standard-mit by=target form=alphabet measure=text role=writes scope=prose/en/files/license shape=LICENSE value=lock
 bound-lock/1 about="No fourth verb. A batch lands whole or not at all. A bound nobody has a reading for is refused. A changed byte of a signed line does not verify. Bound does not know whether a claim is true in the world: it knows who signed what, and whether the ranges meet." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/refuses/lead value=lock
+bound-lock/1 about="Not every existing export needs removal because its docs are incomplete. Inventory supported package exports, CLI verbs/views, record families and provider-facing protocols. Distinguish documented public surface from internal implementation files; review accidental published subpaths. Withdraw public support through an explicit compatibility decision, not by erasing history or inventing new verbs." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/07 value=lock
 bound-lock/1 about="One lot lands one place. A lot for many places lands the same lines at each." at=witness:project-coordinates-are-relative by=target form=alphabet kind=axiom measure=status needs=samples/yes/one-lot-one-place.json|samples/no/one-lot-one-place.json role=demands scope=law/one-lot-one-place value=present
 bound-lock/1 about="Only the declared license is requested by this historical page." at=policy:bound/historical-prose by=target form=alphabet measure=id role=writes scope=docs/badges value=license
+bound-lock/1 about="Optional Stage 3: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-3.md|samples/yes/015-stage-3.json|vectors/015-stage-3.json|samples/no/015-stage-3.json role=demands scope=plan/0.1.6/3 value=present
+bound-lock/1 about="Optional Stage 4: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-4.md|samples/yes/015-stage-4.json|vectors/015-stage-4.json|samples/no/015-stage-4.json role=demands scope=plan/0.1.6/4 value=present
+bound-lock/1 about="Optional Stage 6: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-6.md|samples/yes/015-stage-6.json|vectors/015-stage-6.json|samples/no/015-stage-6.json role=demands scope=plan/0.1.6/6 value=present
+bound-lock/1 about="Optional Stage 7: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-7.md|samples/yes/015-stage-7.json|vectors/015-stage-7.json|samples/no/015-stage-7.json role=demands scope=plan/0.1.6/7 value=present
+bound-lock/1 about="Optional Stage 8: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-8.md|samples/yes/015-stage-8.json|vectors/015-stage-8.json|samples/no/015-stage-8.json role=demands scope=plan/0.1.6/8 value=present
+bound-lock/1 about="Optional Stage 9: carry only if unpaid at the red time ceiling; no payment inferred." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/015-stage-9.md|samples/yes/015-stage-9.json|vectors/015-stage-9.json|samples/no/015-stage-9.json role=demands scope=plan/0.1.6/9 value=present
+bound-lock/1 about="Output names the computation and distinguishes valid empty output from refusal." at=witness:public-contracts-by-operation by=target form=alphabet measure=status needs=docs/contracts/cli.md|docs/contracts/typed-object.md|samples/no/native-views.json|samples/no/typed-object.json|samples/yes/native-views.json|samples/yes/typed-object.json|vectors/native-views.json|vectors/typed-object.json restsOn=plan/0.1.5/1 role=demands scope=plan/0.1.5/2 value=present
 bound-lock/1 about="Pending general document projection at .github/workflows/release.yml; no automatic output is claimed by this capability demand." at=policy:own-prose by=target form=alphabet measure=id role=demands scope=view/files/workflow/release value=text@3
 bound-lock/1 about="Pending general document projection at .github/workflows/tag.yml; no automatic output is claimed by this capability demand." at=policy:own-prose by=target form=alphabet measure=id role=demands scope=view/files/workflow/tag value=text@3
 bound-lock/1 about="Pending general document projection at .github/workflows/test.yml; no automatic output is claimed by this capability demand." at=policy:own-prose by=target form=alphabet measure=id role=demands scope=view/files/workflow/test value=text@3
@@ -37,6 +69,8 @@ bound-lock/1 about="Pending general document projection at docs/readme-assets/at
 bound-lock/1 about="Pending general document projection at docs/usage.md; no automatic output is claimed by this capability demand." at=policy:own-prose by=target form=alphabet measure=id role=demands scope=view/files/public-2 value=text@3
 bound-lock/1 about="Pending general document projection at package.json; no automatic output is claimed by this capability demand." at=policy:own-prose by=target form=alphabet measure=id role=demands scope=view/files/manifest value=text@3
 bound-lock/1 about="Preview with fold --as before it lands." at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=page/seq/look value=present
+bound-lock/1 about="Publish contracts and typed-object samples; attest evidence is visible through a declared view." at=witness:published-plan-evidence by=target form=alphabet measure=status needs=docs/contracts/evidence-view.md|docs/contracts/typed-object.md|samples/no/native-views.json|samples/no/typed-object.json|samples/yes/native-views.json|samples/yes/typed-object.json|vectors/native-views.json|vectors/typed-object.json restsOn=plan/0.1.5/0 role=demands scope=plan/0.1.5/1 value=present
+bound-lock/1 about="Reading regions compose all adopted world answers with origins and disagreements retained; shaped files keep one writer." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/readings/compose-origins.md|samples/yes/readings/compose-origins.json|vectors/readings/compose-origins.json|samples/no/readings/compose-origins.json role=demands scope=readings/compose-origins value=present
 bound-lock/1 about="Rejected: a source URL does not define authenticated release lineage or order. A bump proposal requires an explicit release contract; downloaded bytes cannot replace an immutable standing pin." at=policy:bound/014-review by=target form=alphabet measure=text role=writes scope=policy/rejected/newest-by-url value=lock
 bound-lock/1 about="Rejected: empty output is not universally a failure. Missing required inputs remain unpaid; a completed empty result is valid only where its declared Topos contract permits it." at=policy:bound/014-review by=target form=alphabet measure=text role=writes scope=policy/rejected/empty-is-failure value=lock
 bound-lock/1 about="Rejected: key-name depth does not determine authority. Key identifier grammar and ambiguity belong to Topos; coverage and admitted public keys govern authorization." at=policy:bound/014-review by=target form=alphabet measure=text role=writes scope=policy/rejected/nested-key-authority value=lock
@@ -45,13 +79,22 @@ bound-lock/1 about="Release selection of existing obligations; their fold eviden
 bound-lock/1 about="Release selection of existing obligations; their fold evidence determines the verdict." at=policy:bound/release by=target form=alphabet measure=id role=writes scope=release/category/cli value=cli/**|fold/idle|cost/act
 bound-lock/1 about="Release selection of existing obligations; their fold evidence determines the verdict." at=policy:bound/release by=target form=alphabet measure=id role=writes scope=release/category/integrity value=literal/host|literal/key|literal/org|literal/path|duplicate/src|door/unreceipted
 bound-lock/1 about="Release selection of existing obligations; their fold evidence determines the verdict." at=policy:bound/release by=target form=alphabet measure=id role=writes scope=release/category/pins value=resolve-by-url|offline|the-stranger
+bound-lock/1 about="Render documentation and standard MIT license; verify one exact staged artifact." at=witness:public-contracts-by-operation by=target form=alphabet measure=status needs=docs/contracts/archive.md|samples/no/archive-conformance.json|samples/yes/archive-conformance.json|vectors/archive-conformance.json restsOn=plan/0.1.5/5 role=demands scope=plan/0.1.5/10 value=present
+bound-lock/1 about="Render only this place admitted MIT text through the selected generic prose provider." at=witness:bound/015-standard-mit by=target form=alphabet measure=id needs=LICENSE role=demands scope=view/license-native shape=LICENSE value=text@3
 bound-lock/1 about="Render this place admitted manifest prose through the existing explicitly selected text provider; general document capability demands remain unchanged." at=policy:bound/presentation by=target form=alphabet measure=id needs=package.json role=demands scope=view/manifest-render shape=package.json value=text@3
+bound-lock/1 about="Replace the built-in module parser with a declared bounded command under a published host closure contract, then remove Acorn from Bound. Prove identical implementation identities and refusal of an unclosed runtime graph on unrelated programs; no regex fallback and no universal source grammar in the kernel." at=witness:host-command-requires-its-publication-quartet by=target form=alphabet measure=status needs=docs/contracts/host-module-command.md|samples/no/host-module-command.json|samples/yes/host-module-command.json|vectors/host-module-command.json role=demands scope=plan/0.1.6/host-module-command value=present
+bound-lock/1 about="Reported unpaid by the Head clean-install matrix: authority-class evidence is exposed but attest receipts appear in no view. Confirm against exact archive; preserve admitted attribution." at=witness:head/014-clean-install by=target form=alphabet measure=status needs=docs/contracts/evidence-view.md|samples/yes/attest-evidence.json|vectors/attest-evidence.json|samples/no/attest-evidence.json role=demands scope=contract/published/attest-evidence-view value=present
+bound-lock/1 about="Reported unpaid by the Head clean-install matrix: the typed-object sample is absent from the package. Confirm against exact archive; no receipt is fabricated." at=witness:head/014-clean-install by=target form=alphabet measure=status needs=docs/contracts/typed-object.md|samples/yes/typed-object.json|vectors/typed-object.json|samples/no/typed-object.json role=demands scope=contract/published/typed-object-sample value=present
 bound-lock/1 about="Rewriting hero, idea and the other section regions as compositions of atoms is 0.1.1, not done quietly here." at=policy:bound/010 by=target form=alphabet kind=conjecture measure=status role=demands scope=open/section-regions-as-atoms value=present
+bound-lock/1 about="Source origin is distinct from local coordinates; requested verified bytes are handed to every declared eligible reader." at=policy:bound/015-plan by=target form=alphabet measure=status needs=docs/contracts/region/origin-input.md|samples/yes/region/origin-input.json|vectors/region/origin-input.json|samples/no/region/origin-input.json role=demands scope=region/origin-input value=present
 bound-lock/1 about="The coordinate of the observed host implementation digest in the native receipt set." at=policy:bound/receipts by=target form=alphabet measure=id role=writes scope=audit/wire/receipt-instrument value=instrument/implementation
 bound-lock/1 about="The explicitly selected historical document profile over this place own prose; general text@3 demands remain unpaid." at=policy:readme-without-debt-section by=target form=alphabet measure=id needs=README.md role=demands scope=view/readme-historical shape=README.md value=hero@3|commands@3|idea@3
+bound-lock/1 about="The host adapter parses literal JavaScript imports when identifying the implementation behind receipts. It executes no module and does not inventory domain exports, duplicates or literals. It does not enforce arbitrary dynamic-import closure or claim a capsule sandbox." at=policy:host-module-identity by=target form=alphabet measure=text role=writes scope=rationale/host/module-parser value=present
 bound-lock/1 about="The native public receipt carries its actual observed set at resolution 8 before the authenticated summary at resolution 0 and current region bytes at resolution 1." at=witness:a-public-receipt-carries-its-observations by=target form=alphabet measure=id role=demands scope=view/receipts shape=receipts.bound value=receipts@8|receipts@0|receipts@1
 bound-lock/1 about="The object" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/the-object/heading value=lock
 bound-lock/1 about="The paper" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/the-paper/heading value=lock
+bound-lock/1 about="The previously declared cell card remains available under its explicit object coordinate; it is not silently treated as a demand scheduler." at=witness:preserved-cell-card by=target form=alphabet measure=id role=demands scope=view/object-card value=cells
+bound-lock/1 about="The proposed laws are not already paid merely because this text names them. Inventory actual standing lines and current evidence first. New laws, category links and grammar require named admission acts. Obligations remains unchanged." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/08 value=lock
 bound-lock/1 about="The same signed lot and admitted snapshot share admission validation; a prospective reading neither admits nor writes. The vector reports failures; unread is not agreement." at=witness:prospective-admission-agrees by=target form=interval measure=count needs=samples/admission/yes/one-boundary.json|samples/admission/no/one-boundary.json|test/admission-boundary.test.ts|vectors/process/admission-boundary.vector.json role=reads scope=admission/one-boundary value=0..0
 bound-lock/1 about="This place own build option, observed from its source tsconfig for the selected historical build profile." at=policy:bound/build-profile by=target form=alphabet measure=id role=writes scope=build/allowImportingTsExtensions shape=tsconfig.json value=true
 bound-lock/1 about="This place own build option, observed from its source tsconfig for the selected historical build profile." at=policy:bound/build-profile by=target form=alphabet measure=id role=writes scope=build/composite shape=tsconfig.json value=true
@@ -76,6 +119,8 @@ bound-lock/1 about="This place requests complete blocks at resolution three from
 bound-lock/1 about="Try it" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/first-use/heading value=lock
 bound-lock/1 about="Two-Sided Constraints on a Valued Lattice" at=policy:bound/010 by=target form=alphabet measure=author role=writes scope=cites/two-sided-constraints value="Ochoa, N."
 bound-lock/1 about="Two-Sided Constraints on a Valued Lattice" at=policy:bound/010 by=target form=alphabet measure=doi role=writes scope=cites/two-sided-constraints value=10.5281/zenodo.21858428
+bound-lock/1 about="Unpaid optional stages carry to 0.1.6 only when the admitted time ceiling reads red; mandatory stages remain gates." at=policy:bound/015-plan by=target form=alphabet measure=id role=writes scope=scope/carry-over value=plan/0.1.6
+bound-lock/1 about="Walk exchanges admitted regional evidence by declared wire; disagreements remain." at=witness:published-plan-evidence by=target form=alphabet measure=status needs=docs/contracts/view-walk.md|samples/no/walk.json|samples/yes/walk.json|vectors/walk-publication.json restsOn=plan/0.1.5/2 role=demands scope=plan/0.1.5/5 value=present
 bound-lock/1 about="What holds" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/what-holds/heading value=lock
 bound-lock/1 about="What is open" at=policy:bound/paid by=target form=alphabet measure=text role=writes scope=prose/en/open/heading value=lock
 bound-lock/1 about="What it refuses" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/refuses/heading value=lock
@@ -83,13 +128,13 @@ bound-lock/1 about="What it refuses" at=policy:bound/010-figure by=target form=a
 bound-lock/1 about="What it rests on" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/rests/heading value=lock
 bound-lock/1 about="What rests on it" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/rested/heading value=lock
 bound-lock/1 about="Write the line as by=target." at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=page/seq/line value=present
+bound-lock/1 about="Zero port invocations applies to selection/help, receipt-only check, prospective evaluation and signing's observation/execution ports. Signing necessarily invokes its declared signer. A shaped render, observation or admitted verification request may execute its explicitly requested provider under the relevant contract. Never hide execution behind a purported inspection command." at=policy:bound/015-plan by=target form=alphabet measure=text role=writes scope=rationale/015/04 value=lock
 bound-lock/1 about="`{scope}` is demanded and not paid" at=policy:bound/paid by=target form=alphabet measure=text role=writes scope=prose/en/open/unpaid value=lock
 bound-lock/1 about="`{scope}` reads `{reading}`, outside its ceiling" at=policy:bound/paid by=target form=alphabet measure=text role=writes scope=prose/en/open/outside value=lock
 bound-lock/1 about="a byte lives only while a standing line names it: the store is the receipts of blobs, laid snapshots and answer caches, and 2G is the ceiling" at=policy:bound/store by=target form=interval measure=bytes role=reads scope=store/bytes value=0..2000000000
 bound-lock/1 about="a capsule as it declares itself: the lines of its own lock, handed whole as the host reads them, never its files" at=policy:bound/regions by=target form=alphabet measure=lines role=reads scope=region/capsule value=capsule.bound
 bound-lock/1 about="a capture of the CLI on the meeting sample agrees with this fold" at=witness:project-coordinates-are-relative by=target form=interval measure=capture-differs needs=samples/yes/meeting.bound role=reads scope=capture/differs value=0..0
 bound-lock/1 about="a fold runs where freedom remains: a region whose bytes meet its receipt at resolution 1 is closed, and the receipt is the result" at=witness:a-fold-over-a-closed-region by=target form=interval measure=idle role=reads scope=fold/idle value=0..0
-bound-lock/1 about="a line of the lock, drawn from the citation sample" at=witness:project-coordinates-are-relative by=target form=alphabet measure=id needs=docs/img/line.svg|samples/yes/line.bound role=demands scope=view/figure-line shape=docs/img/line.svg value=figure-line@1
 bound-lock/1 about="a lock is stale only when its pid is gone, and an accept that dies prints REFUSE·crash" at=witness:a-dead-pid-is-stale by=target form=alphabet measure=id role=reads scope=act/stale value=esrch
 bound-lock/1 about="a one-line index in the tree is loaded by role, each region by name" at=witness:a-located-index-loaded-by-role by=target form=alphabet measure=id role=reads scope=host/located value=role
 bound-lock/1 about="after the host surface cut, the host is the lines the fold prints for src/host|src/observe|src/cli" at=witness:host-io-split-recounted-the-kernel by=target form=interval measure=host-lines role=reads scope=host/lines value=0..3269
@@ -119,7 +164,7 @@ bound-lock/1 about="lines, not a page: blobs, laid snapshots and answer caches n
 bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  push:\n    tags: ['v*']\njobs:\n  release:\n    if: github.event_name == 'push' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.version.outputs.tag }}\n      asset: ${{ steps.archive.outputs.asset }}\n      sha256: ${{ steps.archive.outputs.sha256 }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n          fetch-depth: 0\n      - id: version\n        env:\n          EVENT_NAME: ${{ github.event_name }}\n          REF_NAME: ${{ github.ref_name }}\n        run: |\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          if [ \"$EVENT_NAME\" = push ]; then\n            test \"$REF_NAME\" = \"$version\"\n          fi\n          git rev-parse --verify \"refs/tags/$version\"\n          echo \"tag=$version\" >> \"$GITHUB_OUTPUT\"\n          git checkout --detach \"$version\"\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - run: npm run build\n      - run: npm test\n      - run: node dist/cli/verb.js fold --check\n      - id: archive\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          version=\"${{ steps.version.outputs.tag }}\"\n          asset=\"$(npm pack --ignore-scripts --silent)\"\n          echo \"asset=$asset\" >> \"$GITHUB_OUTPUT\"\n          expected=\"$(sha256sum \"$asset\" | cut -d ' ' -f 1)\"\n          echo \"sha256=$expected\" >> \"$GITHUB_OUTPUT\"\n          if ! gh release view \"$version\" >/dev/null 2>&1; then\n            gh release create \"$version\" \"$asset\" --title \"$version\" --notes \"$(git log -1 --format=%B)\"\n          fi\n          download_dir=\"$(mktemp -d)\"\n          gh release download \"$version\" --pattern \"$asset\" --dir \"$download_dir\"\n          actual=\"$(sha256sum \"$download_dir/$asset\" | cut -d ' ' -f 1)\"\n          test \"$expected\" = \"$actual\"\n  publish:\n    needs: release\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      id-token: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ needs.release.outputs.tag }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0'\n      - env:\n          GH_TOKEN: ${{ github.token }}\n          TAG: ${{ needs.release.outputs.tag }}\n          ASSET: ${{ needs.release.outputs.asset }}\n          EXPECTED: ${{ needs.release.outputs.sha256 }}\n        run: |\n          mkdir candidate\n          gh release download \"$TAG\" --pattern \"$ASSET\" --dir candidate\n          actual=\"$(sha256sum \"candidate/$ASSET\" | cut -d ' ' -f 1)\"\n          test \"$EXPECTED\" = \"$actual\"\n          npm stage publish \"./candidate/$ASSET\" --access public --ignore-scripts\n" at=policy:bound/011-port-release by=target form=alphabet measure=text role=writes scope=prose/en/files/workflow/release shape=.github/workflows/release.yml value=lock
 bound-lock/1 about="name: tag\non:\n  workflow_run:\n    workflows: [test]\n    types: [completed]\njobs:\n  tag:\n    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha }}\n          fetch-depth: 0\n      - run: |\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          git tag --list \"$version\" | grep -q . && exit 0\n          git tag \"$version\" && git push origin \"$version\"\n" at=policy:bound/pipeline by=target form=alphabet measure=text role=writes scope=prose/en/files/workflow/tag shape=.github/workflows/tag.yml value=lock
 bound-lock/1 about="name: test\non:\n  push:\n    branches: [main]\n  pull_request:\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - run: npm test\n      - name: Verify native closure and receipt reuse\n        run: |\n          node dist/cli/verb.js fold --check > \"$RUNNER_TEMP/bound-check.log\" 2>&1 || { cat \"$RUNNER_TEMP/bound-check.log\"; exit 1; }\n          cat \"$RUNNER_TEMP/bound-check.log\"\n          grep -Eq '^PASS +closed' \"$RUNNER_TEMP/bound-check.log\"\n          grep -Eq '^RECEIPTS [1-9][0-9]* read · 0 opened' \"$RUNNER_TEMP/bound-check.log\"\n      - run: npm pack --silent\n" at=policy:bound/pipeline by=target form=alphabet measure=text role=writes scope=prose/en/files/workflow/test shape=.github/workflows/test.yml value=lock
-bound-lock/1 about="npx @lapxo/bound@0.1.4 fold --as help\nnpx @lapxo/bound@0.1.4 fold" at=witness:bound/014-candidate by=target form=alphabet measure=text role=writes scope=prose/en/commands value=lock
+bound-lock/1 about="npx @lapxo/bound@0.1.5 fold --as help\nnpx @lapxo/bound@0.1.5 fold" at=witness:bound/015-prose-version by=target form=alphabet measure=text role=writes scope=prose/en/commands value=lock
 bound-lock/1 about="obligations is the meet. topos is the line. Worlds outside bound read a calendar, a package, a page. Bound reads lines, folds them, lands what was signed, and signs." at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/rests/on value=present
 bound-lock/1 about="one origin is REQUIRED, two that meet inside every bound are FREE, two that meet outside a bound are FORBIDDEN, and two that do not meet are CONFLICT" at=policy:bound/010-states by=target form=alphabet measure=id role=writes scope=notation/states value="one origin=REQUIRED|claims that meet and fit the bounds=FREE|claims that meet outside the bounds=FORBIDDEN|bounds that cross=CONFLICT"
 bound-lock/1 about="take the package in" at=policy:bound/door by=target form=alphabet measure=id role=writes scope=install value=npx
@@ -184,7 +229,6 @@ bound-lock/1 about="the fields the line figure fills" at=policy:bound/readme by=
 bound-lock/1 about="the fields the refuses figure fills" at=policy:bound/010-figure by=target form=alphabet measure=id role=writes scope=form/template/figure/refuses value=input|why
 bound-lock/1 about="the fields the what-holds axiom line fills" at=policy:bound/readme by=target form=alphabet measure=id role=writes scope=form/template/what-holds/axiom value=sentence|name|rests
 bound-lock/1 about="the fold as wire lines, so a script reads lines rather than parsing the human form" at=policy:bound/010 by=target form=alphabet measure=id role=demands scope=view/lines value=lines
-bound-lock/1 about="the fold drawn from the meeting-time sample: two claims that meet and one that falls apart" at=witness:project-coordinates-are-relative by=target form=alphabet measure=id needs=docs/img/fold.svg|samples/yes/meeting.bound role=demands scope=view/figure-fold shape=docs/img/fold.svg value=figure-fold@1
 bound-lock/1 about="the folder the no samples of this place live in" at=witness:project-coordinates-are-relative by=target form=alphabet measure=id role=writes scope=samples/no value=samples/no
 bound-lock/1 about="the folder the yes samples of this place live in" at=witness:project-coordinates-are-relative by=target form=alphabet measure=id role=writes scope=samples/yes value=samples/yes
 bound-lock/1 about="the forge capsule that answers github-actions and renders the publish auth a place names — a token as the secret it names, trusted as the workflow's own identity — packed against the notation release and the algebra release, each laid from its digest; the release before it stays named until no view reads the regions only it answers" at=witness:a-token-auth-no-law-read by=target form=alphabet measure=id role=writes scope=dep/topos-github/actions shape=dist/index.js value=sha256:8ad84ca313988769a933bedf0a7f4fb87d087b9a5911b1df6b984557ddafb294
@@ -234,10 +278,9 @@ bound-lock/1 about="the release of the forge capsule, named by the digest of wha
 bound-lock/1 about="the release of the language capsule, named by the digest of what its published place holds" at=policy:bound/one-cell by=target form=alphabet measure=id role=reads scope=dep/topos-typescript-tree value=sha256:fcd87e3dcb13cb4f4bcb8f96b5cab419b8ee6930612979bb6f143c8a1a3dcc98
 bound-lock/1 about="the release of the lock reader, named by the digest of what its published place holds" at=policy:bound/one-cell by=target form=alphabet measure=id role=reads scope=dep/topos-bound value=sha256:23ea35997c2ada24d7f0da362b9bd112ed52c1ab9bbcdcea1e9eeb91699bd854
 bound-lock/1 about="the release of the node package capsule, named by the digest of what its published place holds" at=policy:bound/one-cell by=target form=alphabet measure=id role=reads scope=dep/topos-node value=sha256:c4ae9ecd8ecc422f6eedc17ae02202611517ae1a0c42ed1dbfcfcc97b534119e
-bound-lock/1 about="the release of the notation, named by the digest of what its published place holds" at=witness:bound/014-sdk-published by=target form=alphabet measure=id needs=node_modules/@lapxo/topos role=reads scope=dep/topos shape=package value=sha256:ff642185cfb19d7555fb941575bd714e54f854c2f4fadf34b156bc684db4b885
+bound-lock/1 about="the release of the notation, named by the digest of what its published place holds" at=witness:published-topos-011 by=target form=alphabet measure=id needs=node_modules/@lapxo/topos role=reads scope=dep/topos shape=package value=sha256:9562133f6ac7a94630333715d62acda5c29e2f0e88d5c68d1b2966b03879c330
 bound-lock/1 about="the release of the pages capsule, named by the digest of what its published place holds" at=policy:bound/one-cell by=target form=alphabet measure=id role=reads scope=dep/topos-doc value=sha256:adc787638f8cb2c9f050b295e30a7959830682e793e6e5f3e265c85bd6ce6ebb
 bound-lock/1 about="the release of the vectors reader, named by the digest of what its published place holds" at=witness:vectors-read-without-a-row-per-region by=target form=alphabet measure=id role=reads scope=dep/topos-json value=sha256:ddee424ba7c852f966569250f6b5520ecf4079a86cec673ac1a4fc88a934a56d
-bound-lock/1 about="the release pin of a world, never drawn on the door" at=policy:bound/readme by=target form=alphabet measure=id role=demands scope=view/release value=line
 bound-lock/1 about="the scopes a born lock keeps an about on, even when the measure is not text" at=policy:bound/wire-words by=target form=alphabet measure=id role=writes scope=audit/wire/kept-about value=license
 bound-lock/1 about="the second head, asked live when its latest word rests on another lock: the program that folds the ledger without bound, run with no key; what it says is read, never kept" at=policy:bound/heads by=target form=alphabet measure=id role=reads scope=head/second value=verify/src/cli.ts
 bound-lock/1 about="the shape a published place pins as: the one word the instrument asks of the lock, never guessed by length or letter" at=policy:bound/wire-words by=target form=alphabet measure=id role=writes scope=audit/wire/pin-shape value=package
@@ -254,23 +297,23 @@ bound-lock/1 about="the typescript tree world after its released capsule: said,
 bound-lock/1 about="the vectors a place holds, a row per region, as the fold counts them from its receipts" at=policy:bound/regions by=target form=alphabet measure=receipts role=reads scope=region/vectors value=vector/**
 bound-lock/1 about="the vectors world saying its own description in its own lock: the regions of 2fb13c6f unchanged, its prose under its key; packed from releases only, topos 0.1.2 and the algebra release, each laid from its digest" at=policy:bound/capsules by=target form=alphabet measure=id role=writes scope=dep/topos-json/own-what shape=dist/index.js value=sha256:5ec73255e3f089e3b9c7bc1d6351a07b8aa302a346fe16ed44cbcb67293c7891
 bound-lock/1 about="the version the forge tags, read from the manifest" at=policy:bound/pipeline by=target form=alphabet measure=id role=writes scope=pipeline/version value="node -p \"require('./package.json').version\""
-bound-lock/1 about="the version this place is bound at" at=witness:bound/014-candidate by=target form=alphabet measure=id role=writes scope=version value=0.1.4
+bound-lock/1 about="the version this place is bound at" at=witness:bound/015-candidate by=target form=alphabet measure=id role=writes scope=version value=0.1.5
 bound-lock/1 about="the writer that vouches each source at the digest a take judged it: a family the wire lists, which bound reads here and never spells" at=policy:bound/store by=target form=alphabet measure=id role=reads scope=store/vouches value=tree
 bound-lock/1 about="this place is a package: class defaults of package resolve here" at=policy:bound/place by=target form=alphabet measure=id role=writes scope=place/kind value=package
 bound-lock/1 about="topos-node with a thin manifest: no typesVersions, main or types, dev dependencies only where a line says so, and a bin field from the place bin/<name> lines" at=policy:bound/capsules by=target form=alphabet measure=id role=writes scope=dep/topos-node/thin-manifest shape=dist/index.js value=sha256:da1fd0bb74f72ae95bce5929055c50ccd150d8903ba5560d99df48bf236d8dc0
 bound-lock/1 about="two renders of an SVG sample are the same bytes" at=witness:project-coordinates-are-relative by=target form=interval measure=redrawn needs=docs/img role=reads scope=figures/redrawn value=0..0
 bound-lock/1 about="usage, rendered from VERB_NAMES and FLAGS, never written by hand" at=policy:bound/010 by=target form=alphabet measure=id role=demands scope=view/help value=help
 bound-lock/1 about="views/world resolves into worlds, and a place's bytes are its files, its lock, and the root lines that resolve into it" at=witness:a-world-line-opens-worlds by=target form=alphabet measure=id role=reads scope=bytes/world value=worlds
-bound-lock/1 about="what a fold refuses, drawn from the first refused case" at=witness:project-coordinates-are-relative by=target form=alphabet measure=id needs=docs/img/refuses.svg role=demands scope=view/figure-refuses shape=docs/img/refuses.svg value=figure-refuses@1
 bound-lock/1 about="what a place own lock says for the tree under its own name: its prose, and the silent substitutions it bounds in its own code, the place written after the steps the glob names" at=policy:bound/places by=target form=alphabet measure=id role=reads scope=place/speaks-under value=prose/*|hazard/silent-substitution
-bound-lock/1 about="what is open, as cards, one lane at a time: <dir>/ --as card --key lane-X" at=policy:bound/views by=target form=alphabet measure=id role=demands scope=view/card value=cells
+bound-lock/1 about="what is open, as cards, one lane at a time: <dir>/ --as card --key lane-X" at=witness:declared-plan-card by=target form=alphabet measure=id role=demands scope=view/card value=demand-card@8
 bound-lock/1 about="what the CLI printed on a sample and the REFUSE a drafted land printed, kept as receipts" at=policy:bound/doi by=target form=alphabet measure=receipts role=reads scope=region/captures value=capture/**|*refused*
 bound-lock/1 about="what the forge runs to check this place: the suites, then a quiet fold" at=policy:bound/pipeline-published-dependencies by=target form=alphabet measure=id role=writes scope=pipeline/check value="npm test && node dist/cli/verb.js fold --check"
 bound-lock/1 about="what the second head found, which leaves the place has written, and the place's own readings as the fold holds them: the verdict line's counts, each of the place's own ceilings as the fold reads it, unpaid and outside reds, RANK readings, the walk, captures, figures, literals and the door" at=witness:project-coordinates-are-relative by=target form=alphabet measure=receipts role=reads scope=region/state value=second/verdict|write/**|leaf/**|verdict/*|audit/*|coordinate/**|asked/**|unpaid/**|outside/**|fold/idle|cost/act|cli/verbs|store/bytes|src/lines|literal/**|duplicate/**|door/unreceipted|figures/**|capture/**|walk/**
 bound-lock/1 about="when the apart claim is withdrawn" at=policy:bound/door by=target form=alphabet measure=id role=writes scope=form/style/fold/back value=2.2
 bound-lock/1 about="where a located world keeps each region file, by directory and extension, so the host loads the tree beside the pin" at=policy:bound/010 by=target form=alphabet measure=id role=writes scope=release/layout value=src/regions:.ts
 bound-lock/1 about="who signs this place" at=policy:bound/010 by=target form=alphabet measure=id role=writes scope=author value=Lapxo
-bound-lock/1 about="{\n  \"name\": \"@lapxo/bound\",\n  \"version\": \"0.1.4\",\n  \"type\": \"module\",\n  \"description\": \"Read the bounds you already wrote, fold them, and name the contradictions.\",\n  \"main\": \"dist/cli/verb.js\",\n  \"types\": \"dist/cli/verb.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/cli/verb.d.ts\",\n      \"default\": \"./dist/cli/verb.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"scripts\": {\n    \"test\": \"node --import ./test/setup.ts --test test/*.test.ts\",\n    \"clean\": \"rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo\",\n    \"build\": \"node tools/build.mjs\",\n    \"prepack\": \"npm run build\"\n  },\n  \"files\": [\n    \"LICENSE\",\n    \"README.md\",\n    \"CONTRIBUTING.md\",\n    \"dist/**/*\",\n    \"TARGET.bound\",\n    \"receipts.bound\",\n    \"docs/usage.md\",\n    \"docs/readme-assets/atlas.svg\"\n  ],\n  \"author\": \"Lapxo\",\n  \"license\": \"MIT\",\n  \"dependencies\": {\n    \"@lapxo/obligations\": \"0.3.5\",\n    \"@lapxo/topos\": \"0.1.9\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.0.0\"\n  },\n  \"sideEffects\": false,\n  \"engines\": {\n    \"node\": \">=22.15\"\n  },\n  \"bin\": {\n    \"bound\": \"./dist/cli/verb.js\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/Lapxo/bound.git\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/bound#readme\",\n  \"bugs\": {\n    \"url\": \"https://github.com/Lapxo/bound/issues\"\n  },\n  \"keywords\": [\n    \"cli\",\n    \"content-addressed\",\n    \"provenance\",\n    \"receipts\",\n    \"constraints\",\n    \"reproducible\"\n  ]\n}" at=witness:bound/014-candidate by=target form=alphabet measure=text role=writes scope=prose/en/files/manifest shape=package.json value=lock
+bound-lock/1 about="{\n  \"name\": \"@lapxo/bound\",\n  \"version\": \"0.1.5\",\n  \"type\": \"module\",\n  \"description\": \"Read the bounds you already wrote, fold them, and name the contradictions.\",\n  \"main\": \"dist/cli/verb.js\",\n  \"types\": \"dist/cli/verb.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/cli/verb.d.ts\",\n      \"default\": \"./dist/cli/verb.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"scripts\": {\n    \"test\": \"node --import ./test/setup.ts --test --test-concurrency=2 test/*.test.ts\",\n    \"clean\": \"rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo\",\n    \"build\": \"node tools/build.mjs\",\n    \"prepack\": \"npm run build\"\n  },\n  \"files\": [\n    \"LICENSE\",\n    \"README.md\",\n    \"CONTRIBUTING.md\",\n    \"dist/**/*\",\n    \"TARGET.bound\",\n    \"receipts.bound\",\n    \"docs/usage.md\",\n    \"docs/readme-assets/atlas.svg\",\n    \"docs/contracts/*.md\"\n  ],\n  \"author\": \"Lapxo\",\n  \"license\": \"MIT\",\n  \"dependencies\": {\n    \"@lapxo/obligations\": \"0.3.5\",\n    \"@lapxo/topos\": \"^0.1.11\",\n    \"acorn\": \"8.19.0\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.0.0\"\n  },\n  \"sideEffects\": false,\n  \"engines\": {\n    \"node\": \">=22.15\"\n  },\n  \"bin\": {\n    \"bound\": \"./dist/cli/verb.js\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/Lapxo/bound.git\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/bound#readme\",\n  \"bugs\": {\n    \"url\": \"https://github.com/Lapxo/bound/issues\"\n  },\n  \"keywords\": [\n    \"cli\",\n    \"content-addressed\",\n    \"provenance\",\n    \"receipts\",\n    \"constraints\",\n    \"reproducible\"\n  ]\n}\n" at=witness:minimal-public-surface-015 by=target form=alphabet measure=text role=writes scope=prose/en/files/manifest shape=package.json value=lock
+bound-lock/1 about="{\n  \"profile\": \"quartet-process@1\",\n  \"scope\": \"contract/published\",\n  \"surface\": [\n    \"contract/published/attest-evidence-view\",\n    \"contract/published/cli/fold\",\n    \"contract/published/cli/land\",\n    \"contract/published/cli/sign\",\n    \"contract/published/pipeline/archive\",\n    \"contract/published/typed-object-sample\",\n    \"contract/published/view/card\",\n    \"contract/published/view/citation-file\",\n    \"contract/published/view/explanation\",\n    \"contract/published/view/guide\",\n    \"contract/published/view/help\",\n    \"contract/published/view/lines\",\n    \"contract/published/view/manifest-render\",\n    \"contract/published/view/programs\",\n    \"contract/published/view/readme-historical\",\n    \"contract/published/view/receipts\",\n    \"contract/published/view/reference\",\n    \"contract/published/view/release-workflow-render\",\n    \"contract/published/view/tsconfig\",\n    \"contract/published/view/usage-profile\",\n    \"contract/published/view/walk\",\n    \"contract/published/view/why\"\n  ],\n  \"note\": \"Explicit public-surface inventory. A selected coordinate without a descriptor is unpaid. Outstanding capability demands are not advertised implementations.\"\n}" at=witness:exact-archive-conformance by=target form=alphabet measure=text role=writes scope=prose/en/files/publication-inventory shape=docs/contracts/publication.inventory.json value=lock
 bound-lock/1 about="{count} hold" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/badge/held value=lock
 bound-lock/1 about="{lo}..{hi} · {state}" at=policy:bound/readme by=target form=alphabet measure=text role=writes scope=prose/en/figure/fold/together value=present
 bound-lock/1 about="{title} (Version {version})" at=policy:bound/010 by=target form=alphabet measure=text role=writes scope=prose/en/cite/versioned value=lock
@@ -329,6 +372,12 @@ bound-lock/1 at=policy:bound/014-host-profile by=target form=interval measure=by
 bound-lock/1 at=policy:bound/014-host-profile by=target form=interval measure=bytes role=writes scope=transport/response-bytes value=0..67108864
 bound-lock/1 at=policy:bound/014-host-profile by=target form=interval measure=milliseconds role=writes scope=reader/timeout value=0..30000
 bound-lock/1 at=policy:bound/014-host-profile by=target form=interval measure=milliseconds role=writes scope=transport/timeout value=0..30000
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=digest role=writes scope=dep/programs shape=ab851507d007068757f4f0a286a5231237ec63499204ab767c343d7ef90ddb49 value=sha256:6dd67481ae70011143764232465eb4d0140d0143a9928080b471bf2df5b5e45a
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=digest role=writes scope=uses/programs value=sha256:bd89b6a84e48b8e0ff392c68806ce5104956f1e9cb018b760fd97ba9a4e822c0
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=id role=demands scope=view/programs value=demand-status@8
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=id role=writes scope=plan/selection value=plan/0.1.5/0|plan/0.1.5/1|plan/0.1.5/2|plan/0.1.5/5|plan/0.1.5/10|plan/0.1.6/3|plan/0.1.6/4|plan/0.1.6/6|plan/0.1.6/7|plan/0.1.6/8|plan/0.1.6/9
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=id role=writes scope=scope/minimum value=plan/0.1.5/0|plan/0.1.5/1|plan/0.1.5/2|plan/0.1.5/5|plan/0.1.5/10
+bound-lock/1 at=policy:bound/015-plan by=target form=alphabet measure=receipts role=writes scope=region/program-evidence value=contract/**|plan/**
 bound-lock/1 at=policy:bound/authority by=owner epoch=1 form=alphabet measure=public-key role=writes scope=keys/owner sig="ed25519:era1:IA0IME384zILkebRhsBRopKbz8uPLRX95xUu45dqM0vrc5RzPaeiyJR9s/bb/QFtY6fLiilDy17p89cN3Tm6AQ==" value="MCowBQYDK2VwAyEAIYI0be8OWhf3HcVceKpibjgZ+hbYJKYO5ayX8Kk16LE="
 bound-lock/1 at=policy:bound/authority by=target form=alphabet measure=class role=writes scope=keys/owner value=authorize
 bound-lock/1 at=policy:bound/authority by=target form=alphabet measure=coverage role=writes scope=keys/owner value=*
@@ -340,7 +389,6 @@ bound-lock/1 at=policy:bound/presentation by=target form=alphabet measure=id rol
 bound-lock/1 at=policy:bound/presentation by=target form=alphabet measure=id role=writes scope=notation/renders value="free=FREE|required=REQUIRED"
 bound-lock/1 at=policy:bound/publish by=target form=alphabet measure=id role=reads scope=publish/keys value=authorize|attest|read
 bound-lock/1 at=policy:bound/release by=target form=alphabet measure=id role=reads scope=release/layout value=dist/regions:.js|src/regions:.ts
-bound-lock/1 at=policy:bound/release by=target form=alphabet measure=id role=writes scope=release/blocks value=integrity|pins|admission|cli
 bound-lock/1 at=policy:bound/split by=target form=alphabet measure=id role=writes scope=split/host value=src/host|src/observe|src/cli
 bound-lock/1 at=policy:bound/split by=target form=alphabet measure=id role=writes scope=split/kernel value=src/fold|src/judge|src/land|src/render|src/kernel
 bound-lock/1 at=policy:bound/split by=target form=interval measure=cli-flags role=reads scope=cli/flags value=0..6
@@ -363,14 +411,18 @@ bound-lock/1 at=policy:prose/render-contract by=target form=alphabet measure=dig
 bound-lock/1 at=policy:prose/render-contract by=target form=alphabet measure=id role=writes scope=dep/prose-render shape=dist/regions/text.js value=sha256:a1c31a72a31eaf8ea7df0fb98235c4b465aee1d9575aebcc480f09b4bf64daf1
 bound-lock/1 at=policy:public-artifact-source by=target form=alphabet measure=id role=writes scope=sources/obligations value=https://registry.npmjs.org/@lapxo/obligations/-/obligations-0.3.5.tgz
 bound-lock/1 at=policy:public-artifact-source by=target form=alphabet measure=id role=writes scope=sources/typescript value=https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz
-bound-lock/1 at=policy:rendering by=target form=alphabet measure=digest role=writes scope=uses/rendering value=sha256:0f7653b659f372fd7bc1b140d0103606ebd8814dee8ef3be30949c6647b482a3
 bound-lock/1 at=policy:selected-wire by=target form=alphabet measure=digest role=writes scope=uses/wire value=sha256:a717c60945add1facfd822b3ee2da73a8fa2f781dd0aa2de9be778e66b8f3591
 bound-lock/1 at=witness:admission-samples-are-inputs by=target form=alphabet measure=coordinates role=reads scope=region/captures value=src/**|test/**|vectors/process/**|dist/**|package.json|TARGET.bound|samples/admission/**
 bound-lock/1 at=witness:admission-samples-are-inputs by=target form=alphabet measure=coordinates role=reads scope=region/vectors value=src/**|test/**|vectors/process/**|dist/**|package.json|TARGET.bound|samples/admission/**
 bound-lock/1 at=witness:bound/014-sdk-source by=target form=alphabet measure=id role=writes scope=sources/topos value=https://registry.npmjs.org/@lapxo/topos/-/topos-0.1.9.tgz
-bound-lock/1 at=witness:explicit-executable-candidate by=target form=alphabet measure=id role=writes scope=dep/topos-doc/born shape=dist/index.js value=sha256:2c507e7fe764e55d08fc27b01567d462060fe50d1896d19866f831a823852ae5
-bound-lock/1 at=witness:process-captures-reader by=target form=alphabet measure=digest role=writes scope=dep/process-readings shape=dist/regions/vectors.js value=sha256:b22d161e8ae7c96789c7fb038b1d755fa149203c7e035c6d2fa5f2a164fecb54
-bound-lock/1 at=witness:process-captures-selection by=target form=alphabet measure=digest role=writes scope=uses/process-readings value=sha256:a55f6849b39e77b6fcd89b2a2ba8fa286a7c8626193bbfe14aef30bef6b29458
+bound-lock/1 at=witness:bound/015-declared-reader-closure by=target form=alphabet measure=digest role=writes scope=dep/source-readings shape=dist/regions/source.js value=sha256:4254d2792e9e9826955869350da433a7c18a2211f158a3bc5f590e40db0153de
+bound-lock/1 at=witness:bound/015-declared-reader-closure by=target form=alphabet measure=digest role=writes scope=uses/source-readings value=sha256:5393797da6adb25038d3ff94935be96376331735b259e125093a9e10e891f4de
+bound-lock/1 at=witness:bound/015-hermetic-render-closure by=target form=alphabet measure=digest role=writes scope=uses/rendering value=sha256:c0094dc8c916b3c8ea9df19666816a28230c01808e5d792833c156e8d454a2f0
+bound-lock/1 at=witness:bound/015-hermetic-render-closure by=target form=alphabet measure=id role=writes scope=dep/topos-doc/born shape=dist/index.js value=sha256:04feef01a8c59cae7ea842198d1faf0091b424129872a847b41c7da0bca6fabf
+bound-lock/1 at=witness:bounded-process-vectors by=target form=alphabet measure=digest role=writes scope=dep/process-readings shape=55b78b6c0a8ae86d84853ae34773b3a6947b31738b1242b20efa0da492ca0547 value=sha256:3f17467234fe9fce12d2859da21f7deba428b8279b387d33cb769e932ada3ecc
+bound-lock/1 at=witness:bounded-process-vectors by=target form=alphabet measure=digest role=writes scope=uses/process-readings value=sha256:1dc6bb7b0a8587eadc52dacc3a74934d8707042a1078182a687d10d3df2deb0e
+bound-lock/1 at=witness:per-reading-publication by=target form=alphabet measure=digest role=writes scope=dep/publication-readings shape=c298746ef68fdf192a0feede8f514e42f28700a2c2bc542edabee7c7c090f64d value=sha256:63404128efbf4173dfcb8ba757cf9c8cc41f692dd13d5d00a0835d8c70dec7e0
+bound-lock/1 at=witness:per-reading-publication by=target form=alphabet measure=digest role=writes scope=uses/publication-readings value=sha256:ded485f3bf8ac0f11c73f61223f4180038b8c44904ea4f573a240b59a651a489
 bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval measure=count needs=samples/core/yes/exchange-cost.json|samples/core/no/exchange-cost.json role=reads scope=exchange/cost value=0..0
 bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval measure=count needs=samples/core/yes/idempotent.json|samples/core/no/idempotent.json role=reads scope=idempotent value=0..0
 bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval measure=count needs=samples/core/yes/no-error.json|samples/core/no/no-error.json role=reads scope=no-error value=0..0
@@ -385,6 +437,18 @@ bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval
 bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval measure=count needs=samples/literal/yes/org.json|samples/literal/no/org.json role=reads scope=literal/org value=0..0
 bound-lock/1 at=witness:project-coordinates-are-relative by=target form=interval measure=count needs=samples/literal/yes/path.json|samples/literal/no/path.json role=reads scope=literal/path value=0..0
 bound-lock/1 at=witness:public-artifact-closure by=target form=alphabet measure=digest needs=node_modules/typescript role=reads scope=dep/typescript shape=package value=sha256:10e108c9cf7d5f2879053dff18515fb405abf2ccef63eaaf017d9c571687a1d3
-bound-lock/1 at=witness:source-reader by=target form=alphabet measure=digest role=writes scope=dep/source-readings shape=dist/regions/source.js value=sha256:5ccae33a9e99f6acba690d9664e22cfe818205841e4e9d3083d4b24fb68d7075
+bound-lock/1 at=witness:public-contracts-by-operation by=target form=alphabet measure=id needs=docs/contracts/archive.md role=demands scope=view/contract-archive-reference shape=docs/contracts/archive.md value=text@3
+bound-lock/1 at=witness:public-contracts-by-operation by=target form=alphabet measure=id needs=docs/contracts/cli.md role=demands scope=view/contract-cli-reference shape=docs/contracts/cli.md value=text@3
+bound-lock/1 at=witness:public-contracts-by-operation by=target form=alphabet measure=id needs=docs/contracts/documents.md role=demands scope=view/contract-documents-reference shape=docs/contracts/documents.md value=text@3
+bound-lock/1 at=witness:public-contracts-by-operation by=target form=alphabet measure=id needs=docs/contracts/views.md role=demands scope=view/contract-views-reference shape=docs/contracts/views.md value=text@3
+bound-lock/1 at=witness:public-instrument-input-is-declared by=target form=alphabet measure=coordinates role=writes scope=region/publication value=docs/contracts/**|samples/**|vectors/**|tools/publication/**|tools/samples/**|dist/**|package.json|TARGET.bound
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=id needs=docs/contracts/publication.inventory.json role=demands scope=view/publication-inventory shape=docs/contracts/publication.inventory.json value=text@3
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=id needs=docs/contracts/publication.md role=demands scope=view/publication-contract shape=docs/contracts/publication.md value=text@3
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=id role=writes scope=release/blocks value=integrity|pins|admission|cli|contract
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=id role=writes scope=release/category/contract value=contract/published
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=receipts role=writes scope=region/program-evidence value=contract/**|plan/**|docs/contracts/**|samples/**|vectors/**
+bound-lock/1 at=witness:publication-is-measured by=target form=alphabet measure=receipts role=writes scope=region/publication value=contract/published/**|docs/contracts/**|samples/**|vectors/**
+bound-lock/1 at=witness:publication-samples by=target form=alphabet measure=id needs=docs/contracts/evidence-view.md role=demands scope=view/contract-evidence-view shape=docs/contracts/evidence-view.md value=text@3
+bound-lock/1 at=witness:publication-samples by=target form=alphabet measure=id needs=docs/contracts/typed-object.md role=demands scope=view/contract-typed-object shape=docs/contracts/typed-object.md value=text@3
+bound-lock/1 at=witness:publish-native-walk-contract by=target form=alphabet measure=id needs=docs/contracts/view-walk.md role=demands scope=view/contract-walk shape=docs/contracts/view-walk.md value=text@3
 bound-lock/1 at=witness:source-region-inputs by=target form=alphabet measure=coordinates role=reads scope=region/source value=src/**/*.ts
-bound-lock/1 at=witness:source-selection by=target form=alphabet measure=digest role=writes scope=uses/source-readings value=sha256:4129c469d3296a1fcda640f59e0d7c37f255b1e88c2f8e2447cd1359a514f356