@lapxo/bound 0.1.4 → 0.1.6

package/dist/cli/accept.d.ts

@@ -1,7 +1,12 @@
 export type Batch = {
     readonly kind: 'signed';
     readonly signed: readonly string[];
+    readonly records?: readonly string[];
     readonly epoch: number;
+    readonly base: {
+        readonly digest: string;
+        readonly places: readonly string[];
+    };
     readonly keyId?: string;
 } | {
     readonly kind: 'once';

package/dist/cli/accept.js

@@ -1,3 +1,4 @@
+import { commitLocalAct, intactLocalAct, committedLocalActs } from "../host/ports/local-act.js";
 import { withoutEffects } from "../host/read-only.js";
 import { selectedWireAt } from "../host/selected-topos.js";
 import { timing } from "../host/timing.js";
@@ -6,12 +7,12 @@ import { existsSync, rmdirSync, rmSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { closeReceipts, instrumentKeep, instrumentKept } from "../fold/closed.js";
 import { bytesDigest, fullDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
-import { canonical, fromLine, LOCK, parse } from '@lapxo/topos/wire';
+import { canonical, fromLine, LOCK, parse, actIdentity, actResultProfile } from '@lapxo/topos/wire';
 import { fieldOf, isConfig, foldClaims, sayingOf, selfName } from "../fold/claims.js";
 import { isReaderLock } from "../fold/observed.js";
 import { authorityFor, publicKeyOf, rootSigner, writerFor } from "../fold/signers.js";
 import { lockLines, lockStanding } from "../fold/keys.js";
-import { keepVerdict, keptVerdict, land, landBlob, storeOf } from "../land/ledger.js";
+import { keepVerdict, keptVerdict, land, landBlob, ledgerLines, storeOf } from "../land/ledger.js";
 import { signConsentLot, verifiesOwnerLine } from "../land/sign.js";
 import { signerFor } from "../host/signing.js";
 import { appliedIn, ownLockOf } from "../fold/signed.js";
@@ -19,7 +20,7 @@ import { wordOf } from "../fold/wire.js";
 import { hasVouchedTree, landCoordinates, locationsOf, vouchedCoordinates } from "../land/vouched.js";
 import { entriesIn, observeFile } from "../observe/files.js";
 import { coneOf, standingOf } from "./place.js";
-import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
+import { ownLock, ownRoot } from "../observe/runner.js";
 import { widenedWithoutWitness } from "../judge/widening.js";
 import { retractedTogether, withdrawal } from "../land/withdraw.js";
 import { isCeiling } from "../fold/configures.js";
@@ -36,7 +37,7 @@ import { lateFacts } from "../judge/late.js";
 import { paidOf } from "../fold/paid.js";
 import { aliasPinned } from "../land/alias.js";
 import { coordinatesWithdrawn } from "../land/leaving.js";
-import { ownerOf, epochOf, forksItself, forksJoinedBy, renderInto, sideOf, signedDemands, signedOwnerLines } from "./owner.js";
+import { ownerOf, epochOf, localActLines, forksItself, forksJoinedBy, renderInto, sideOf, signedDemands, signedOwnerLines } from "./owner.js";
 import { claimLinesIn, entryOf, namedPlaces, placesOfFile, positionalsOf, valueOf } from "./args.js";
 import { FLAGS } from "./names.js";
 import { judgeDemand, landTake } from "./takes.js";
@@ -53,7 +54,15 @@ function admissionEvidence(root, signed, standing) {
         if (coordinates.refused.length)
             throw Error(`REFUSE·withdraw a file is still read: ${coordinates.refused.map(one => `${one.path} by ${one.by}`).join(' · ')}`);
         const view = `${wordOf(standing, 'families', 'view')}/`;
-        const judged = signed.filter(one => isConfig(one) && fieldOf(one, 'role') === 'demands' && fieldOf(one, 'value') !== 'withdraw' && !fieldOf(one, 'scope').startsWith(view)).map(one => judgeDemand(root, one));
+        const judged = signed.filter(one => isConfig(one) && fieldOf(one, 'role') === 'demands' && fieldOf(one, 'value') !== 'withdraw' && !fieldOf(one, 'scope').startsWith(view)).map(one => {
+            const scope = fieldOf(one, 'scope');
+            const alreadyDemanded = standing.some(held => isConfig(held) && fieldOf(held, 'role') === 'demands'
+                && fieldOf(held, 'value') !== 'withdraw' && fieldOf(held, 'scope') === scope
+                && fieldOf(held, 'form') === fieldOf(one, 'form') && fieldOf(held, 'measure') === fieldOf(one, 'measure'));
+            // Declaring an obligation is not a claim to have discharged it.
+            return alreadyDemanded ? judgeDemand(root, one)
+                : { kind: 'owed', scope, why: 'new demand declared; no conformance reading is claimed' };
+        });
         const refused = judged.filter(one => one.kind === 'refused' || (one.kind === 'judged' && one.verdict.kind === 'refuse'));
         if (refused.length)
             throw Error(`REFUSE·takes ${refused.map(one => `${one.scope}: ${one.kind === 'judged' ? one.verdict.why : one.kind === 'refused' ? one.why : ''}`).join(' · ')}`);
@@ -126,7 +135,9 @@ export async function signedBatch(root, args, files) {
         process.stderr.write(`${selfName()}: REFUSE·place nothing landed · ${stray.join(', ')} is no place of the tree, and no line of the root founds it: --place names the own lock a line lands in\n`);
         return { kind: 'exit', code: 2 };
     }
-    const epoch = epochOf([...lockLines(store), ...destinations.flatMap((place) => appliedIn(root, place))]) + 1;
+    const local = localActLines(root, destinations);
+    const base = { digest: fullDigest(store, local), places: destinations };
+    const epoch = epochOf(local) + 1;
     const stale = proposed.filter((line) => fieldOf(line, 'sig')).flatMap((line) => ((by, key) => (key === undefined || !verifiesOwnerLine(line, key, signaturesOf(store).admitted)
         ? [`${fieldOf(line, 'scope')} · the signature does not hold for ${by || '∅'}`]
         : []))(fieldOf(line, 'by'), publicKeyOf(root, fieldOf(line, 'by'))));
@@ -139,9 +150,13 @@ export async function signedBatch(root, args, files) {
     const [named, places] = [namedPlaces(args), placesIn(root)];
     const inLock = new Set(lockLines(store).map(sayingOf));
     const inPlace = new Map(places.map((place) => [place, new Set(appliedIn(root, place).map(sayingOf))]));
+    const deliveryAuthority = authorityFor(lockLines(store), rootSigner(root), signaturesOf(store).admitted);
+    const delivered = (line) => Boolean(fieldOf(line, 'sig'))
+        && deliveryAuthority.of(line).kind === 'admitted'
+        && ledgerLines(store, fieldOf(line, 'by')).includes(line);
     const held = (line, at = named.length ? named : byFile.flatMap(([heads, lines]) => (lines.includes(line) ? heads : []))) => at.length
         ? at.every((place) => inPlace.get(place)?.has(sayingOf(line)))
-        : inLock.has(sayingOf(line)) || places.some((place) => inPlace.get(place)?.has(sayingOf(line)));
+        : delivered(line) || inLock.has(sayingOf(line)) || places.some((place) => inPlace.get(place)?.has(sayingOf(line)));
     if (proposed.every((line) => held(line))) {
         if (proposed.some(line => !isConfig(line))) {
             try {
@@ -237,7 +252,7 @@ export async function signedBatch(root, args, files) {
         process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)} · nothing landed\n`);
         return { kind: 'exit', code: 1 };
     }
-    return { kind: 'signed', signed, epoch, ...(drafted.length ? { keyId } : {}) };
+    return { kind: 'signed', signed, epoch, base, ...(drafted.length ? { keyId } : {}) };
 }
 /**
  * accept is one act under the descent of its lines. Every place, then the root where they join, only when those lines
@@ -273,7 +288,7 @@ export async function accept(root, args) {
     const where = every ? 'every place · then the root, where the places join' : regions.length ? regions.map((one) => `${one}/`).join(' · ') : 'the root alone, where the places join';
     process.stdout.write(`ACTS     ${where} · ${owned.ledger.length} lines to the ledger${[...owned.own].map(([place, lines]) => ` · ${lines.length} to ${place}'s own lock`).join('')} · before the lock\n`);
     const asked = Date.now();
-    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger }, started, owned, asked, regions));
+    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger, records: batch.signed }, started, owned, asked, regions));
 }
 async function acceptNow(root, batch, started, owned, asked = started, descent = []) {
     const waited = Date.now() - asked;
@@ -283,6 +298,11 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
     const took = timing(spent);
     const { signed, epoch } = batch;
     const store = storeOf(root);
+    const currentBase = fullDigest(store, localActLines(root, batch.base.places));
+    if (currentBase !== batch.base.digest) {
+        process.stderr.write(`${selfName()}: REFUSE·base moved ${batch.base.digest} → ${currentBase} · nothing landed\n`);
+        return 1;
+    }
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed]);
@@ -335,10 +355,32 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
     for (const name of openedBy(descent, told.standing, signed))
         process.stderr.write(`OPEN     ${name}\n`);
     if (owned.own.size)
-        layReleases(store, ownRoot(), ownLock(), ownStore());
-    const landed = took('land', () => [...new Set(signed.map((line) => fieldOf(line, 'by')))].map((by) => land(store, by, signed.filter((line) => fieldOf(line, 'by') === by))));
+        layReleases(store, root, told.standing, store);
+    const resultProfile = actResultProfile(snapshot.standing);
+    let landed = [];
+    if (resultProfile) {
+        const records = batch.records ?? signed;
+        const placements = [...(signed.length ? [{ place: '.', records: signed }] : []), ...[...owned.own].map(([place, records]) => ({ place: `${place}/${LOCK}`, records }))];
+        const digest = (bytes) => bytesDigest(store, new TextEncoder().encode(bytes));
+        const identity = actIdentity(records, { ...resultProfile, digest, placements, localEpoch: epoch });
+        const folder = writerFor(snapshot.standing, 'fold');
+        if (!folder)
+            throw Error('REFUSE·act native result requires a declared fold identity');
+        const receipt = canonical({ scope: resultProfile.scope, at: resultProfile.context, role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: folder, epoch: String(epoch) });
+        const bundle = { records: records.join('\n') + '\n', receipt: receipt + '\n', placements: placements.map(p => ({ place: p.place, records: p.records.join('\n') + '\n' })) };
+        await commitLocalAct(store, identity, descent, async () => bundle, intactLocalAct);
+        // Commitment precedes projections and conformance work. If either fails,
+        // this public identity still names the admitted act; it is never rollback.
+        process.stdout.write(`ACT ${identity} · epoch ${epoch} · admitted · conformance not asserted\n`);
+        for (const line of records)
+            process.stdout.write(line + '\n');
+        process.stdout.write(receipt + '\n');
+        landed = [{ at: 'committed act ' + identity, appended: records.length }];
+    }
+    else
+        landed = took('land', () => [...new Set(signed.map(line => fieldOf(line, 'by')))].map(by => land(store, by, signed.filter(line => fieldOf(line, 'by') === by))));
     for (const [place, lines] of owned.own)
-        landOwned(root, place, lines);
+        landOwned(root, place, lines, resultProfile !== undefined);
     landSaid(store, writerFor(told.standing, 'fold'), []);
     for (const line of signed) {
         const value = fieldOf(line, 'value');
@@ -392,7 +434,7 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
     if (folder !== undefined)
         land(store, folder, [beat(perLine, 'line'), beat(1, fold.kept ? 'kept' : 'folded'), beat(Date.now() - started, 'total')]);
     process.stdout.write(`FACT     signed ${signed.length + own} · landed ${landed.length ? landed.map((one) => `${one.appended} in ${one.at}`).join(' · ') : '0'}${[...owned.own].map(([place, lines]) => ` · ${lines.length} in ${place}/${LOCK}`).join('')} · epoch ${epoch}\n`
-        + `TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · ${Date.now() - started} ms\n`
+        + `TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · readings · no encounters computed · ${Date.now() - started} ms\n`
         + `SPENT    ${spent.join(' ms · ')} ms · ${signed.length} lines\n`);
     if (withdrawn) {
         process.stdout.write(`WITHDRAW ${withdrawn.taken.length} taken · ${withdrawn.exact.length} exact on distributive scales · ${withdrawn.open.length} on open scales, not computed\n`);
@@ -407,6 +449,10 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
  */
 function repaid(root, proposed, started) {
     const store = storeOf(root);
+    const prior = committedLocalActs(store).find(act => { const lines = act.bundle.records.trimEnd().split('\n'); return lines.length === proposed.length && lines.every((line, i) => line === proposed[i]); });
+    if (prior) {
+        process.stdout.write(`ACT ${prior.identity} · epoch ${fieldOf(prior.bundle.receipt.trim(), 'epoch')} · admitted · replay\n` + prior.bundle.records + prior.bundle.receipt);
+    }
     const asked = new Set(proposed.filter((line) => fieldOf(line, 'role') === 'demands').map((line) => fieldOf(line, 'scope')));
     const view = `${wordOf(foldClaims(signedOwnerLines(store)).standing, 'families', 'view')}/`;
     const standingAsked = signedDemands(store).filter((line) => asked.has(fieldOf(line, 'scope')) && !fieldOf(line, 'scope').startsWith(view));
@@ -444,7 +490,7 @@ function repaid(root, proposed, started) {
     }
     const rendered = renderInto(root, store);
     process.stdout.write(`RENDER 0\n`);
-    process.stdout.write(`TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · ${Date.now() - started} ms\n`);
+    process.stdout.write(`TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · readings · no encounters computed · ${Date.now() - started} ms\n`);
     return 0;
 }
 function packTake(one) {

package/dist/cli/act-result.d.ts

@@ -0,0 +1,3 @@
+/** Public query of a committed identity, using the same admission authority.
+ * Native fold evidence has store provenance; it never grants coverage. */
+export declare function printActResult(root: string, identity: string | undefined): void;

package/dist/cli/act-result.js

@@ -0,0 +1,48 @@
+import { actResultOf, actResultProfile } from '@lapxo/topos/wire';
+import { actLines, intactLocalAct, localActResult } from "../host/ports/local-act.js";
+import { storeOf } from "../land/ledger.js";
+import { lockStanding } from "../fold/keys.js";
+import { authorityFor, writerFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, isConfig, foldClaims } from "../fold/claims.js";
+import { ownRecordAdmitted } from "../fold/signed.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { fullDigest } from "../host/digest.js";
+import { wordOf, wireLine } from "../fold/wire.js";
+import { viewsOf } from "../fold/views.js";
+/** Public query of a committed identity, using the same admission authority.
+ * Native fold evidence has store provenance; it never grants coverage. */
+export function printActResult(root, identity) {
+    const store = storeOf(root), standing = lockStanding(store);
+    const view = viewsOf(standing).get('act');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'act'))
+        throw Error('REFUSE·view act requires an admitted result profile and act view');
+    if (!identity)
+        throw Error('REFUSE·act name one committed identity');
+    const bundle = localActResult(store, identity, intactLocalAct);
+    if (!bundle)
+        throw Error('REFUSE·act no committed result ' + identity);
+    const records = actLines(bundle.records), epoch = Number(fieldOf(bundle.receipt.trim(), 'epoch'));
+    const history = admissionHistoryAt(root, epoch), before = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) < epoch);
+    const algorithms = eraOf(foldClaims(before).standing).admitted;
+    const authority = authorityFor(history, admissionAnchor(root), algorithms);
+    const admittedBefore = foldClaims(before.filter(line => authority.of(line).kind === 'admitted')).standing;
+    const profile = actResultProfile(admittedBefore);
+    if (!profile)
+        throw Error('REFUSE·act no result profile at admission');
+    const family = authority.admitted.some(signer => !signer.coverage.includes('*')) ? wordOf(admittedBefore, 'families', 'region') : '';
+    const algorithm = identity.slice(0, identity.indexOf(':'));
+    const named = fieldOf(wireLine(admittedBefore, 'digest-algorithms') ?? '', 'value').split('|').map(value => value.split(':')[0]);
+    if (!named.includes(algorithm))
+        throw Error('REFUSE·act digest algorithm was not admitted at commitment');
+    const result = actResultOf(records, bundle.receipt.trim(), { ...profile, localEpoch: epoch,
+        digest: bytes => fullDigest(bytes, algorithm),
+        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
+        admitsRecord: line => {
+            if (isConfig(line) && Number(fieldOf(line, 'epoch')) !== epoch)
+                return false;
+            return bundle.placements.some(p => actLines(p.records).includes(line) && (p.place === '.' ? authority.of(line).kind === 'admitted' : ownRecordAdmitted(line, p.place.slice(0, p.place.lastIndexOf('/')), family, authority.admitted, algorithms)));
+        },
+        verifiesReceipt: line => fieldOf(line, 'by') === writerFor(admittedBefore, 'fold') && intactLocalAct(identity, bundle), });
+    process.stdout.write(`ACT ${result.identity} · epoch ${result.epoch} · admitted · conformance not asserted\n` + bundle.records + bundle.receipt);
+}

package/dist/cli/owner.d.ts

@@ -14,6 +14,8 @@ export declare function historyOf(root: string, store: string, demands: readonly
 };
 export declare function signedDemands(store: string, root?: string): string[];
 export declare function forkedScopes(store: string): Set<string>;
+/** Import receipts are local acts; foreign evidence and sender epochs never enter this input. */
+export declare function localActLines(root: string, placed?: readonly string[]): readonly string[];
 export declare function epochOf(lines: readonly string[]): number;
 export declare function targetFile(root: string): string;
 export declare function renderInto(root: string, store: string): {

package/dist/cli/owner.js

@@ -1,8 +1,11 @@
+import { committedLocalActs } from "../host/ports/local-act.js";
+import { fileURLToPath } from 'node:url';
+import { ingressReceipts } from "../host/ports/ingress.js";
 import { readOnly } from "../host/read-only.js";
 import { keyFor, lockLines, releaseOf, signedLockLines } from "../fold/keys.js";
 import { existsSync, renameSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { bytesDigest, fullDigest, memoized, signaturesOf } from "../fold/digests.js";
+import { bytesDigest, fullDigest, memoized, signaturesOf, instrumentDigest } from "../fold/digests.js";
 import { claimKey, isConfig, fieldOf, foldClaims, LOCK, selfName } from "../fold/claims.js";
 import { asksThePlace } from "../fold/configures.js";
 import { receiptsIn } from "../fold/receipts.js";
@@ -10,6 +13,7 @@ import { authorityFor, releaseSigner, rootSigner } from "../fold/signers.js";
 import { storeRoot } from "../host/ports/store.js";
 import { blobAt, landBlob, ledgerLines, storeOf } from "../land/ledger.js";
 import { observeText } from "../observe/files.js";
+import { appliedHistoryIn } from "../fold/signed.js";
 import { everLanded, inside, locationsOf } from "../land/vouched.js";
 import { renderTarget } from "../render/target.js";
 export const ownerOf = (store, told = []) => keyFor(store, 'authorize', told);
@@ -47,6 +51,18 @@ export function forkedScopes(store) {
     const lines = signedOwnerLines(store);
     return new Set(foldClaims(lines, forkReceipts(store, lines)).forks.flatMap((f) => f.lines.map((line) => fieldOf(line, 'scope'))));
 }
+/** Import receipts are local acts; foreign evidence and sender epochs never enter this input. */
+export function localActLines(root, placed = []) {
+    const store = storeOf(root), local = lockLines(store), receipts = ingressReceipts(store);
+    if (receipts.length) {
+        const authority = authorityFor(local, rootSigner(root), signaturesOf(store).admitted);
+        for (const receipt of receipts) {
+            if (fieldOf(receipt, 'scope') !== 'receipts' || fieldOf(receipt, 'role') !== 'writes' || fieldOf(receipt, 'form') !== 'alphabet' || fieldOf(receipt, 'measure') !== 'digest' || authority.of(receipt).kind !== 'admitted')
+                throw Error('REFUSE·ingress local import receipt is not admitted');
+        }
+    }
+    return [...local, ...receipts, ...committedLocalActs(store).map(act => act.bundle.receipt.trim()), ...placed.flatMap(place => appliedHistoryIn(root, place))];
+}
 export function epochOf(lines) {
     return lines.reduce((top, line) => Math.max(top, Number(fieldOf(line, 'epoch')) || 0), 0);
 }
@@ -92,7 +108,7 @@ export function renderedLock(root, store, told = []) {
     }
     const anchor = [join(storeRoot(root), `${selfName()}.keys`), join(storeOf(root), `${selfName()}.keys`)].map((at) => observeText(at) ?? '').join('\n');
     const judged = ledgerLines(store, 'judge');
-    const key = `lock ${fullDigest(store, [new Date().toISOString().slice(0, 10), anchor, `${judged.length} ${judged.at(-1) ?? ''}`, ...owned])}`;
+    const key = `lock ${fullDigest(store, [instrumentDigest(store, fileURLToPath(import.meta.url), [], root), new Date().toISOString().slice(0, 10), anchor, `${judged.length} ${judged.at(-1) ?? ''}`, ...owned])}`;
     const held = memoized(store, key, () => {
         const bytes = new TextEncoder().encode(JSON.stringify(render()));
         const digest = bytesDigest(store, bytes);

package/dist/cli/pass.js

@@ -6,9 +6,9 @@ import { foldPlace, standingOf } from "./place.js";
 import { fieldOf, selfName } from "../fold/claims.js";
 import { observedClaims } from "../fold/observed.js";
 import { layReleases, resolvedOf } from "../host/release.js";
-import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
+import { ownLock, ownRoot, processOf } from "../observe/runner.js";
 import { landLaid } from "../fold/laid.js";
-import { actSeconds, idleCount, instrumentKeep, instrumentKept, meets, noteIdle, receiptPlaces, receiptsSeen } from "../fold/closed.js";
+import { actSeconds, closeReceipts, idleCount, instrumentKeep, instrumentKept, meets, noteIdle, receiptPlaces, receiptsSeen } from "../fold/closed.js";
 import { algorithmCost, instrumentOf, instrumentDigest } from "../fold/digests.js";
 import { writerFor } from "../fold/signers.js";
 import { defaulted, placesOf, viewsOf } from "../fold/views.js";
@@ -24,6 +24,7 @@ import { releasePolicyLines } from "../fold/release-policy.js";
 import { carriedFrom } from "../fold/resolved.js";
 import { wireLine } from "../fold/wire.js";
 import { isWire, RECEIPTS } from "../fold/claims.js";
+import { withoutEffects } from "../host/read-only.js";
 /**
  * The pass of a place, in one process: the releases its instrument names are laid out first, its readers observe
  * once, each place a view writes in is folded once, the places before the root whose door reads them, and every coordinate a
@@ -74,7 +75,7 @@ async function checked(root, entry, under) {
 export async function pass(root, entry, under, check) {
     if (check) {
         // Verification reads existing evidence; it grants no admission authority.
-        return emptyLedger(storeOf(root)) ? checked(root, entry, under) : underTheLock(storeOf(root), 'check', () => checked(root, entry, under));
+        return withoutEffects(() => emptyLedger(storeOf(root)) ? checked(root, entry, under) : underTheLock(storeOf(root), 'check', () => checked(root, entry, under)));
     }
     if (!under && emptyLedger(storeOf(root))) {
         sayStranger(root);
@@ -85,8 +86,11 @@ export async function pass(root, entry, under, check) {
         const swept = await sweep(root, entry, under, check, []);
         for (const coordinate of check ? swept.written : [])
             process.stdout.write(`DIFFERS  ${coordinate}\n`);
+        // Byte seals describe the completed render pass, not its intermediate outputs.
+        if (!swept.written.length)
+            await closeReceipts(root, storeOf(root));
         const closed = meets(root, storeOf(root), under ?? '') && !swept.written.length;
-        const fold = foldPlace(root, entry, under, false, { standing: swept.standingAt.get(under ?? '') ?? standingOf(root, under), observed: swept.observed.length ? swept.observed : observedClaims(root, storeOf(root), { wait: false }), free: true });
+        const fold = foldPlace(root, entry, under, false, { standing: swept.standingAt.get(under ?? '') ?? standingOf(root, under), observed: swept.settled ? [] : swept.observed.length ? swept.observed : observedClaims(root, storeOf(root), { wait: false }), free: !swept.settled });
         for (const line of releasePolicyLines(fold.release))
             process.stdout.write(`${line}\n`);
         if (closed) {
@@ -140,14 +144,15 @@ async function sweep(root, entry, under, check, told, journal, given, keep, reac
             process.stderr.write(`CLOSED   ${under} · lock ${lock} ms · hash ${hash} ms\n`);
         const seconds = actSeconds();
         process.stderr.write(`COST     act ${seconds} s\n`);
-        return { same: 0, written: [], places: under === undefined ? read.count : 1, observed: [], standingAt: new Map(), folds: new Map(), said: [] };
+        return { same: 0, written: [], places: under === undefined ? read.count : 1, observed: [], standingAt: new Map(), folds: new Map(), said: [], settled: true };
     }
-    layReleases(store, ownRoot(), ownLock(), ownStore());
+    const lock = standingOf(root, undefined, told);
+    // A place asks for its own mounts; the instrument catalog is not a consumer dependency.
+    layReleases(store, root, lock.standing, store);
     const descent = reach ?? (under ? [under.replace(/\/$/, '')] : undefined);
     const limited = descent !== undefined;
     const observed = given ?? observedClaims(root, store, { wait: true, ...(descent !== undefined ? { reach: descent } : {}) });
-    const lock = standingOf(root, undefined, told);
-    landLaid(store, ownRoot(), ownLock(), writerFor(lock.standing, 'fold'));
+    landLaid(store, root, lock.standing, writerFor(lock.standing, 'fold'));
     const shaped = (standing) => [...viewsOf(standing).values()].flatMap((view) => ('regions' in view && view.shape ? [view] : []));
     const views = shaped(lock.standing);
     const tree = viewsOf(lock.lock);
@@ -264,8 +269,8 @@ async function sweep(root, entry, under, check, told, journal, given, keep, reac
     }
     const said = [...answered.values()].flat();
     if (!check && journal === undefined)
-        landSaid(store, writerFor(lock.standing, 'fold'), [...resolvedOf(store, ownRoot(), ownLock(), ownStore()), ...said]);
-    return { same, written, places: places.length + (under ? 0 : 1), observed, standingAt, folds, said: journal === undefined ? [] : said };
+        landSaid(store, writerFor(lock.standing, 'fold'), [...resolvedOf(store, root, lock.standing, store), ...said]);
+    return { same, written, places: places.length + (under ? 0 : 1), observed, standingAt, folds, said: journal === undefined ? [] : said, settled: false };
 }
 function drawParallel(jobs) {
     const out = new Map();

package/dist/cli/place.js

@@ -7,7 +7,7 @@ import { basename, join } from 'node:path';
 import { observeText } from "../observe/files.js";
 import { placesOf, viewsOf } from "../fold/views.js";
 import { prerender, viewOf } from "../render/view.js";
-import { meets } from "../fold/closed.js";
+import { meets, instrumentKept } from "../fold/closed.js";
 import { foldPoints, keepFold, keptPlace } from "../fold/kept.js";
 import { openCells } from "../render/open.js";
 import { boundOf, packRegions, regionsNamed, regionsOf, unlikeReplay } from "../fold/region.js";
@@ -165,6 +165,13 @@ function inheritedOf(root, standing) {
 export function coneOf(root, entry, ceilings, descent) {
     const store = storeOf(root);
     const { standing, rendered } = standingOf(root);
+    // Admission consumes the verified completed fold; it does not ask providers again.
+    // Receipt bytes, reader history and instrument identity must all still agree.
+    if (meets(root, store, '') && instrumentKept(store) === instrumentOf(store, entry, standing, root, ownLock())) {
+        const held = keptPlace(store);
+        if (held !== undefined)
+            return { standing, observed: held.observed, own: held.own, kept: true };
+    }
     const named = regionsNamed(standing);
     const reach = descent !== undefined && descent.length ? [...descent] : [...new Set(ceilings.map((line) => boundOf(named, line).region))];
     const read = observedClaims(root, store, { wait: false, ...(reach.includes('') ? {} : { reach }) });

package/dist/cli/verb.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { printActResult } from "./act-result.js";
 import { withContentStore } from "../host/content-store.js";
 import { withoutEffects } from "../host/read-only.js";
 import { resolveSources, resolveRequested } from "../host/source-content.js";
@@ -10,6 +11,7 @@ import { objectFold } from "../fold/object.js";
 import { OBJECT_VIEW } from '@lapxo/topos/wire';
 import { toposStanding } from '@lapxo/topos/standing';
 import { wireAt, parse as parseWire } from '@lapxo/topos/wire';
+import { lockStanding } from "../fold/keys.js";
 import { ownLock } from "../observe/runner.js";
 import { signedOwnerLines } from "./owner.js";
 import { existsSync, lstatSync, mkdirSync, writeFileSync } from 'node:fs';
@@ -42,6 +44,9 @@ import { ownerOf, renderInto, signedDemands, targetFile } from "./owner.js";
 import { claimLinesIn, entryOf, namedPlaces, positionalsOf, valueOf } from "./args.js";
 import { EXIT, FLAGS, NAMED_VIEWS, helpLines } from "./names.js";
 import { accept, signedBatch } from "./accept.js";
+import { renderWalk, landWalk, foreignWalkLines } from "../host/walk.js";
+import { isWalkHeader } from '@lapxo/topos/walk';
+import { ingressBundles, ingressReceipts } from "../host/ports/ingress.js";
 /** The first land of a lock: TARGET.bound into an empty owner ledger, then the sources that lock names. */
 async function firstLand(root, args) {
     const started = Date.now();
@@ -184,6 +189,23 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
         process.stderr.write(`${selfName()}: the owner ledger is empty; land it before rendering a view\n`);
         return EXIT.refuse;
     }
+    if (name === 'act') {
+        if (under || told.length)
+            throw Error('REFUSE·act committed identity query only');
+        printActResult(root, coord);
+        return EXIT.closed;
+    }
+    if (name === 'evidence' && !under && !told.length && ingressBundles(storeOf(root)).length) {
+        const declared = viewsOf(lockStanding(storeOf(root))).get(name);
+        if (!declared || declared.shape || !declared.regions.some(region => region.name === 'evidence'))
+            throw Error('REFUSE·view foreign evidence requires a declared evidence view');
+        const received = await foreignWalkLines(root), authority = authorityFor(lockLines(storeOf(root)), rootSigner(root), signaturesOf(storeOf(root)).admitted);
+        const local = [...new Set(authority.admitted.flatMap(key => ledgerLines(storeOf(root), key.id)))].filter(line => authority.of(line).kind === 'admitted');
+        for (const line of [...new Set([...local, ...ingressReceipts(storeOf(root)), ...received])])
+            process.stdout.write(line + '\n');
+        process.stdout.write('FACT authenticated histories · readings · no encounters computed\n');
+        return EXIT.closed;
+    }
     const at = Date.now();
     const place = under?.replace(/\/$/, '');
     const released = releaseOf(storeOf(root));
@@ -367,6 +389,12 @@ async function landVerb(root, rest) {
     process.once('uncaughtException', (error) => die(error instanceof Error ? error.message : String(error)));
     process.once('unhandledRejection', (error) => die(error instanceof Error ? error.message : String(error)));
     try {
+        const proposed = batch.flatMap(claimLinesIn);
+        if (proposed.some(isWalkHeader)) {
+            for (const line of await landWalk(root, proposed, valueOf(rest, FLAGS.key), valueOf(rest, FLAGS.keyFile), valueOf(rest, FLAGS.signer)))
+                process.stdout.write(line + '\n');
+            return EXIT.closed;
+        }
         return await accept(root, rest);
     }
     catch (error) {
@@ -395,7 +423,7 @@ function foldFile(at) {
         process.stdout.write(`${line}\n`);
     for (const fork of folded.forks)
         process.stdout.write(`FORK     ${fork.key}${fork.state ? ` · ${fork.state}` : ''}\n`);
-    process.stdout.write(`FACT     ${folded.standing.length} standing · ${folded.forks.length} forks · ${basename(at)}\n`);
+    process.stdout.write(`FACT     ${folded.standing.length} standing · ${folded.forks.length} forks · ${basename(at)} · readings · no encounters computed\n`);
     return EXIT.closed;
 }
 function foldVerb(root, rest) {
@@ -419,7 +447,7 @@ async function foldAt(root, under, argv) {
 async function foldRequested(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
     const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
-    if (as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+    if (as?.split('@')[0] === 'act' || as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
         return foldResolved(root, under, argv);
     return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
 }
@@ -429,6 +457,19 @@ async function foldResolved(root, under, argv) {
     // Public content is authenticated by its digest, independently of owner history.
     // A named view does not request mounting every release of the instrument.
     const receiptCheck = as === undefined && argv.includes(FLAGS.check);
+    if (as?.split('@')[0] === 'walk') {
+        if (argv.includes(FLAGS.check))
+            throw Error('REFUSE·walk check does not initiate or sign an exchange');
+        if (under || inputs.length > 1)
+            throw Error('REFUSE·walk one place and one authenticated peer inventory per fold');
+        const depth = as.split('@')[1];
+        if (depth !== undefined && (!/^(0|[1-9][0-9]*)$/.test(depth) || !Number.isSafeInteger(Number(depth))))
+            throw Error('REFUSE·walk invalid resolution');
+        const peer = inputs.length ? claimLinesIn(inputs[0]) : [];
+        for (const line of await renderWalk(root, depth === undefined ? undefined : Number(depth), peer, valueOf(argv, FLAGS.key), valueOf(argv, FLAGS.keyFile), valueOf(argv, FLAGS.signer)))
+            process.stdout.write(line + '\n');
+        return EXIT.closed;
+    }
     if (as === OBJECT_VIEW) {
         const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
         if (inputs.length > 1)
@@ -463,6 +504,11 @@ async function foldResolved(root, under, argv) {
     }
     const named = inputs;
     const coord = positionalsOf(argv).find((one) => one !== under?.replace(/\/$/, '') && !one.startsWith('-') && !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
+    if (as === 'act') {
+        if (positionalsOf(argv).length !== 1)
+            throw Error('REFUSE·act name one committed identity');
+        return view(root, under, as, [], coord);
+    }
     if ((as === 'why' || as === NAMED_VIEWS.because || as.split('@')[0] === 'why') && coord !== undefined)
         return view(root, under, as === NAMED_VIEWS.because ? 'why' : as, [], coord, key);
     if (!named.length)

package/dist/fold/admission-history.d.ts

@@ -0,0 +1,6 @@
+import type { Signer } from '@lapxo/topos/wire';
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export declare function admissionHistoryAt(root: string, epoch: number): readonly string[];
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export declare function admissionAnchor(root: string): Signer;

package/dist/fold/admission-history.js

@@ -0,0 +1,22 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { ledgerLines, ledgerWriters, storeOf } from "../land/ledger.js";
+import { fieldOf, isConfig, selfName } from "./claims.js";
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export function admissionHistoryAt(root, epoch) {
+    const store = storeOf(root);
+    return [...new Set(ledgerWriters(store).flatMap(writer => ledgerLines(store, writer)))]
+        .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
+}
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export function admissionAnchor(root) {
+    const at = join(storeOf(root), `${selfName()}.keys`);
+    const keys = JSON.parse(readFileSync(at, 'utf8'));
+    const anchors = Object.values(keys);
+    if (anchors.length !== 1 || !anchors[0]?.publicKey || !anchors[0].coverage.length)
+        throw Error('REFUSE·act historical admission requires one bootstrap anchor');
+    const anchor = anchors[0];
+    return { id: anchor.id, keyClass: 'authorize', publicKey: anchor.publicKey, coverage: anchor.coverage,
+        depth: { lo: 1, hi: 16 }, admittedBy: [] };
+}

package/dist/fold/claims.js

@@ -38,7 +38,11 @@ function regionsOf(line) {
 }
 function contracted(line, sides, receipts) {
     const scope = fieldsOf(line)['scope'] ?? '';
-    const mine = exclusive(regionsOf(line), sides.filter((other) => other !== line).map(regionsOf));
+    const named = regionsOf(line);
+    // File receipts can discharge only declared file regions. No region is not an empty proof.
+    if (named.length === 0)
+        return false;
+    const mine = exclusive(named, sides.filter((other) => other !== line).map(regionsOf));
     const touched = receipts.filter((r) => r.scope === scope).flatMap((r) => r.moved.map((coordinate) => point(coordinate)));
     return contracts(mine, touched);
 }