@lapxo/bound 0.1.4 → 0.1.6

package/dist/host/capsule-process.js

@@ -1,3 +1,4 @@
+import { actCosts } from "./act-cost.js";
 import { boundedProcess } from "./process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { PROTOCOL } from '@lapxo/topos/wire';
@@ -33,23 +34,25 @@ export function validResponse(value, request) {
 }
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
 export function executeCapsule(command, args, requests, limits = {}, lifetime) {
-    const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime);
-    if ('error' in run && run.error)
-        throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
-    if (run.signal !== null || run.status !== 0)
-        throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
-    const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
-    let values;
-    try {
-        values = JSON.parse(last);
-    }
-    catch (error) {
-        throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
-    }
-    if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
-        throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
-    }
-    if (run.stderr)
-        process.stderr.write(run.stderr);
-    return values;
+    return actCosts.measure(() => {
+        const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime);
+        if ('error' in run && run.error)
+            throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
+        if (run.signal !== null || run.status !== 0)
+            throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
+        const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
+        let values;
+        try {
+            values = JSON.parse(last);
+        }
+        catch (error) {
+            throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
+        }
+        if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
+            throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
+        }
+        if (run.stderr)
+            process.stderr.write(run.stderr);
+        return values;
+    });
 }

package/dist/host/capsule.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderReference } from '@lapxo/topos/wire';
 import type { Declaration } from '@lapxo/topos/capsule';
 import type { Request, Response } from '@lapxo/topos/contract';
 export interface Capsule {
@@ -5,7 +6,7 @@ export interface Capsule {
     readonly digest: string;
     readonly declaration: Declaration;
     readonly lines: readonly string[];
-    readonly ask: (requests: readonly Request[]) => readonly (Response | undefined)[];
+    readonly ask: (requests: readonly Request[], reader?: ReaderReference) => readonly (Response | undefined)[];
 }
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
 export declare function capsuleAt(digest: string, entry: string, store?: string): Capsule | undefined;

package/dist/host/capsule.js

@@ -38,9 +38,9 @@ function unpacked(digest, bytes) {
 }
 /**
  * A capsule is the bytes a digest names in the instrument's own store, and only when they hash to it: its own lock is
- * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept in one
- * slot of the capsule, the place and the region; the body of the request is the hit, so a file that moved misses and
- * overwrites the slot, and a request asked again for the same bytes is read back and never run twice. Operational failures never enter the cache; refusals and abstentions are asked again.
+ * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept by the
+ * digest of its complete declared request and implementation; distinct views retain distinct answers, and the same
+ * request reads its verified answer without running again. Operational failures never enter the cache; refusals and abstentions are asked again.
  */
 const capsules = new Map();
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
@@ -60,10 +60,10 @@ export function capsuleAt(digest, entry, store) {
     if (!entry || isAbsolute(entry) || (coordinate === '..' || coordinate.startsWith(`..${sep}`)) || entry.split(/[\\/]/).includes('..')) {
         throw new Error(`REFUSE·capsule ${digest} declared entry ${entry || '(absent)'} unavailable`);
     }
-    const capsule = { digest, ...known, ask: (requests) => {
+    const capsule = { digest, ...known, ask: (requests, reader) => {
             if (!statSync(module, { throwIfNoEntry: false })?.isFile())
                 throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, cacheStore, module);
+            return answered(digest, bytes, requests, names, root, cacheStore, module, reader);
         } };
     capsules.set(identity, capsule);
     return capsule;
@@ -86,17 +86,18 @@ const spawnOf = (at, names) => {
     return child;
 };
 export const childFlags = (argv = process.execArgv) => argv.filter((flag, i) => !/^(-e|-p|--eval|--print)$/.test(argv[i - 1] ?? '') && !/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(flag));
-function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry) {
+function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry, reader) {
     const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
     if (!child.length) {
         process.stderr.write(`LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const slotOf = (request) => sha(`${digest}\n${loader}${request.verb}\n${request.rootScope}\n${request.region ?? ''}`);
-    const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
-    const kept = requests.map((request) => storeAt(cacheStore, 'cas', 'answers', slotOf(request)));
+    const lifetime = readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader ?? digest);
+    const policy = lifetime === undefined ? '' : JSON.stringify(lifetime) + '\n';
+    const hitOf = (request) => sha(`${digest}\n${loader}${policy}${JSON.stringify(request)}`);
     const hits = requests.map(hitOf);
+    const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
     const held = kept.map((at, i) => {
         const text = observeText(at);
         if (text === undefined)
@@ -115,7 +116,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
-    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), digest));
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, lifetime);
     return requests.map((request, i) => {
         if (held[i] !== undefined)
             return held[i];
@@ -123,7 +124,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         if (said?.kind === 'fact') {
             const text = JSON.stringify({ format: 'capsule-answer/2', hit: hits[i], said });
             replaceWhole(kept[i], text);
-            holdStore(cacheStore, 'answers', slotOf(request), Buffer.byteLength(text));
+            holdStore(cacheStore, 'answers', hits[i], Buffer.byteLength(text));
         }
         return said;
     });
@@ -149,5 +150,5 @@ export function locatedAt(tree, place, cacheStore = ownStore()) {
             }
         }
     const digest = `sha256:${hash.digest('hex')}`;
-    return { digest, ...known, ask: (requests) => answered(digest, new Uint8Array(), requests, names, at, cacheStore) };
+    return { digest, ...known, ask: (requests, reader) => answered(digest, new Uint8Array(), requests, names, at, cacheStore, undefined, reader) };
 }

package/dist/host/io.d.ts

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/io.js

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/ports/ingress.d.ts

@@ -0,0 +1,24 @@
+/** Prepared by the admitted Topos contract and receiver signer. The host does not infer origins, coverage or epochs. */
+export interface IngressBundle {
+    readonly evidence: string;
+    readonly receipt: string;
+}
+export interface IngressResult extends IngressBundle {
+    readonly kind: 'landed' | 'once';
+    readonly evidenceBytes: number;
+    readonly receiptBytes: number;
+}
+export interface IngressStorage {
+    publish(staged: string, committed: string): void;
+}
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export declare const nativeIngressStorage: IngressStorage;
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export declare function ingressReceipts(store: string): readonly string[];
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export declare function ingressEvidence(store: string, identity: string): IngressBundle | undefined;
+export declare function ingressBundles(store: string): readonly IngressBundle[];
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export declare function commitIngress(store: string, identity: string, prepare: (localImportReceipts: readonly string[]) => Promise<IngressBundle>, verify: (bundle: IngressBundle) => boolean, storage?: IngressStorage): Promise<IngressResult>;
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export declare function ingressCost(result: IngressResult, deliveredBytes: number, protocolBytes: number): string;

package/dist/host/ports/ingress.js

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheLock } from "../../land/act.js";
+import { nativePublicationStorage, publishBundle } from "./publication.js";
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export const nativeIngressStorage = nativePublicationStorage;
+const directory = (store) => join(store, 'ingress');
+const nameOf = (identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·ingress missing import identity');
+    return 'committed-' + encodeURIComponent(identity);
+};
+const read = (at) => ({ evidence: readFileSync(join(at, 'evidence.bound'), 'utf8'), receipt: readFileSync(join(at, 'receipt.bound'), 'utf8') });
+const measured = (kind, bundle) => ({ kind, ...bundle, evidenceBytes: Buffer.byteLength(bundle.evidence), receiptBytes: Buffer.byteLength(bundle.receipt) });
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export function ingressReceipts(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().flatMap(name => read(join(root, name)).receipt.split('\n').filter(Boolean));
+}
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export function ingressEvidence(store, identity) {
+    const at = join(directory(store), nameOf(identity));
+    return existsSync(at) ? read(at) : undefined;
+}
+export function ingressBundles(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().map(name => read(join(root, name)));
+}
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export async function commitIngress(store, identity, prepare, verify, storage = nativeIngressStorage) {
+    requireEffects('foreign evidence ingress');
+    return underTheLock(store, 'ingress', async () => {
+        const root = directory(store), at = join(root, nameOf(identity));
+        if (existsSync(at)) {
+            const prior = read(at);
+            if (verify(prior) !== true)
+                throw Error('REFUSE·ingress committed bytes do not verify');
+            return measured('once', prior);
+        }
+        const bundle = await prepare(ingressReceipts(store));
+        if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
+            throw Error('REFUSE·ingress evidence and receipt do not verify');
+        publishBundle(at, { 'evidence.bound': bundle.evidence, 'receipt.bound': bundle.receipt }, storage);
+        return measured('landed', bundle);
+    });
+}
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export function ingressCost(result, deliveredBytes, protocolBytes) {
+    if (!Number.isSafeInteger(deliveredBytes) || deliveredBytes < 0 || !Number.isSafeInteger(protocolBytes) || protocolBytes < 0)
+        throw Error('REFUSE·ingress invalid exchange byte measurement');
+    return `EXCHANGE ${deliveredBytes} payload bytes · ${protocolBytes} protocol bytes · ${result.kind === 'once' ? 0 : result.evidenceBytes} new evidence bytes · ${result.kind === 'once' ? 0 : result.receiptBytes} new receipt bytes`;
+}

package/dist/host/ports/local-act.d.ts

@@ -0,0 +1,34 @@
+import type { PublicationStorage } from './publication.ts';
+/** Prepared and verified by the selected Topos admission/result contract. */
+export interface LocalActBundle {
+    readonly records: string;
+    readonly receipt: string;
+    readonly placements?: readonly {
+        place: string;
+        records: string;
+    }[];
+}
+export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
+export declare const actLines: (bytes: string) => readonly string[];
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Committed segments are part of this ledger, not a second authority source. */
+export declare function committedLocalActs(store: string): readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[];
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage): Promise<LocalActBundle & {
+    readonly kind: 'landed' | 'once';
+}>;

package/dist/host/ports/local-act.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheRegions } from "../../land/act.js";
+import { publishBundle, nativePublicationStorage } from "./publication.js";
+import { actIdentity, parse, canonical } from '@lapxo/topos/wire';
+import { fullDigest } from "../digest.js";
+const atOf = (store, identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·act missing identity');
+    return join(store, 'ledger', 'acts', 'committed-' + encodeURIComponent(identity));
+};
+const read = (at) => {
+    try {
+        const placements = readdirSync(at).filter(name => name.startsWith('place-') && name.endsWith('.bound')).map(name => ({
+            place: decodeURIComponent(name.slice(6, -6)), records: readFileSync(join(at, name), 'utf8'),
+        }));
+        return {
+            records: readFileSync(join(at, 'records.bound'), 'utf8'),
+            receipt: readFileSync(join(at, 'receipt.bound'), 'utf8'),
+            ...(placements.length ? { placements } : {}),
+        };
+    }
+    catch (error) {
+        throw Error(`REFUSE·act committed result unreadable · ${error.code ?? 'read failed'}`);
+    }
+};
+export const actLines = (bytes) => {
+    if (!bytes.endsWith('\n'))
+        throw Error('REFUSE·act truncated committed lines');
+    return bytes.slice(0, -1).split('\n');
+};
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export function intactLocalAct(identity, bundle) {
+    if (!bundle.receipt.endsWith('\n') || bundle.receipt.slice(0, -1).includes('\n'))
+        return false;
+    const receipt = parse(bundle.receipt.slice(0, -1));
+    if (receipt.kind !== 'fact' || !bundle.placements?.length)
+        return false;
+    const f = receipt.value.fields;
+    if (canonical(f) !== bundle.receipt.slice(0, -1) || !/^(0|[1-9][0-9]*)$/.test(f['epoch'] ?? ''))
+        return false;
+    if (f['value'] !== identity || f['role'] !== 'writes' || f['form'] !== 'alphabet' || f['measure'] !== 'digest')
+        return false;
+    return actIdentity(actLines(bundle.records), { scope: f['scope'] ?? '', context: f['at'] ?? '',
+        localEpoch: Number(f['epoch']), digest: bytes => fullDigest(bytes, identity.slice(0, identity.indexOf(':'))),
+        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
+    }) === identity;
+}
+/** Committed segments are part of this ledger, not a second authority source. */
+export function committedLocalActs(store) {
+    const root = join(store, 'ledger', 'acts');
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).map(name => {
+        const identity = decodeURIComponent(name.slice(10)), bundle = read(join(root, name));
+        if (!intactLocalAct(identity, bundle))
+            throw Error('REFUSE·act committed journal seal does not verify');
+        return { identity, bundle };
+    }).sort((a, b) => {
+        const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
+        return epoch(a.bundle) - epoch(b.bundle);
+    });
+}
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export function localActResult(store, identity, verify) {
+    const at = atOf(store, identity);
+    if (!existsSync(at))
+        return undefined;
+    const bundle = read(at);
+    if (verify(identity, bundle) !== true)
+        throw Error('REFUSE·act committed result does not verify');
+    return bundle;
+}
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
+    requireEffects('local act commitment');
+    return underTheRegions(store, regions, 'land', async () => {
+        const prior = localActResult(store, identity, verify);
+        if (prior)
+            return { kind: 'once', ...prior };
+        const bundle = await prepare();
+        if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
+            throw Error('REFUSE·act prepared result does not verify');
+        const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
+        for (const p of bundle.placements ?? [])
+            files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
+        publishBundle(atOf(store, identity), files, storage);
+        return { kind: 'landed', ...bundle };
+    });
+}

package/dist/host/ports/publication.d.ts

@@ -0,0 +1,10 @@
+export interface PublicationStorage {
+    publish(staged: string, committed: string): void;
+}
+export declare const nativePublicationStorage: PublicationStorage;
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;

package/dist/host/ports/publication.js

@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+const syncDirectory = (path) => {
+    const fd = openSync(path, 'r');
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+};
+export const nativePublicationStorage = {
+    publish(staged, committed) { renameSync(staged, committed); syncDirectory(dirname(committed)); },
+};
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export function publishBundle(committed, files, storage = nativePublicationStorage) {
+    requireEffects('atomic publication');
+    const entries = Object.entries(files);
+    if (!entries.length || entries.some(([name]) => !name || name === '.' || name === '..' || /[\\/\0]/.test(name))) {
+        throw Error('REFUSE·commit invalid publication members');
+    }
+    const root = dirname(committed);
+    const created = mkdirSync(root, { recursive: true });
+    // Persist newly created directory entries up to their existing parent too.
+    if (created !== undefined)
+        for (let at = root;; at = dirname(at)) {
+            syncDirectory(at);
+            if (at === dirname(created))
+                break;
+        }
+    const staged = join(root, '.stage-' + randomUUID());
+    mkdirSync(staged, { mode: 0o700 });
+    try {
+        for (const [name, bytes] of entries) {
+            const fd = openSync(join(staged, name), 'wx', 0o600);
+            try {
+                writeFileSync(fd, bytes);
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        syncDirectory(staged);
+        storage.publish(staged, committed);
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
+    }
+}

package/dist/host/reading-closures.d.ts

@@ -0,0 +1,31 @@
+import type { ReaderLifetime, ReaderReference } from '@lapxo/topos/wire';
+import type { Capsule } from './capsule.ts';
+type File = {
+    readonly place: string;
+    readonly text: string;
+};
+export declare const inputLines: (files: readonly File[]) => readonly string[];
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export declare function readingClosures(options: {
+    root: string;
+    store: string;
+    reader: string;
+    speaker: string;
+    digest: (text: string) => string;
+    capsule: Capsule;
+    region: string;
+    projection: string;
+    readerReference?: ReaderReference;
+    lifetime?: ReaderLifetime;
+    allowsEmpty?: boolean;
+    files: readonly File[];
+    emit?: (line: string) => void;
+}): {
+    lines: readonly string[];
+    read: number;
+    opened: number;
+    executed: number;
+};
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export declare function verifiedReadingReceipts(store: string, lines: readonly string[], digest: (text: string) => string): number | undefined;
+export {};

package/dist/host/reading-closures.js

@@ -0,0 +1,146 @@
+import { actCosts } from "./act-cost.js";
+import { mkdirSync, readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { canonical, parse, PROTOCOL, byBytes } from '@lapxo/topos/wire';
+import { replaceWhole, landShard, shardLines } from "../land/ledger.js";
+import { fieldOf } from "../fold/claims.js";
+import { readOnly } from "./read-only.js";
+const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
+    throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
+export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export function readingClosures(options) {
+    const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
+    const algorithm = hash('').split(':')[0], handed = new Map(files.map(file => [file.place, file.text]));
+    if (handed.size !== files.length)
+        throw Error('REFUSE·input projection has duplicate handed coordinates');
+    const verify = () => { for (const file of files)
+        if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
+            throw Error('REFUSE·input changed ' + file.place); };
+    verify();
+    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }], options.readerReference)[0];
+    if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
+        throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
+    const plans = new Map();
+    for (const line of projected.lines) {
+        const f = fields(line), scope = f.scope ?? '', resolution = /^receipt:(\d+)$/.exec(f.at ?? '');
+        if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
+            throw Error('REFUSE·input projection ambiguous reading ' + scope);
+        const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
+        if (!inputs.length || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
+            throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
+        const n = Number(resolution[1]);
+        if (!Number.isSafeInteger(n))
+            throw Error('REFUSE·input projection invalid resolution ' + scope);
+        plans.set(scope, { scope, inputs, needs, resolution: n, line: canonical({ scope, form: f.form, measure: f.measure, role: f.role, value: inputs.join('|'), needs: needs.join('|'), at: f.at }) });
+    }
+    if (!plans.size)
+        throw Error('REFUSE·input projection returned no readings');
+    const ordered = [], visiting = new Set(), done = new Set();
+    const visit = (scope) => { if (done.has(scope))
+        return; if (visiting.has(scope))
+        throw Error('REFUSE·input projection dependency cycle ' + scope); const p = plans.get(scope); if (!p)
+        throw Error('REFUSE·input projection missing reading ' + scope); visiting.add(scope); for (const need of p.needs)
+        visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
+    for (const scope of plans.keys())
+        visit(scope);
+    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection, ...(options.lifetime === undefined ? [] : [JSON.stringify(options.lifetime)])].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
+    const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
+    const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
+    const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
+        replaceWhole(path, text); return digest; };
+    const load = (digest) => { if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
+        return; const path = carried(digest); if (!existsSync(path))
+        return; const text = readFileSync(path, 'utf8'); return hash(text) === digest ? text : undefined; };
+    let read = 0, opened = 0, executed = 0;
+    for (const plan of ordered) {
+        actCosts.measure(() => {
+            const closure = [plan.line, canonical({ scope: 'implementation', role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: 'host', at: 'policy:input-identity' }), ...plan.inputs.map(input => canonical({ scope: input, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(handed.get(input)), by: 'host', at: 'policy:input-identity' })), ...plan.needs.map(need => canonical({ scope: need, role: 'writes', form: 'alphabet', measure: 'digest', value: results.get(need).digest, by: 'host', at: 'policy:input-identity' }))].sort(byBytes).join('\n') + '\n';
+            const input = hash(closure), scope = 'receipts/readings/' + hash(plan.scope).split(':')[1] + '/' + input.split(':')[1], matching = prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input).at(-1);
+            const count = matching && prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by).at(-1);
+            const heldOutput = count && load(fieldOf(count, 'at').replace(/^place:/, ''));
+            const heldLines = heldOutput?.split('\n').filter(Boolean);
+            const output = heldLines !== undefined && fieldOf(count, 'value') === `${heldLines.length}..${heldLines.length}` && heldLines.every(line => { const f = fields(line); return f.by === by && f.at === 'place:' + input; }) ? heldOutput : undefined;
+            let lines, payload;
+            if (output !== undefined && load(input) === closure) {
+                if (output === '' && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                lines = output.split('\n').filter(Boolean);
+                for (const line of lines)
+                    fields(line);
+                payload = fieldOf(count, 'at').replace(/^place:/, '');
+            }
+            else {
+                if (readOnly())
+                    throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
+                const started = process.hrtime.bigint();
+                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }], options.readerReference)[0];
+                if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
+                    throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
+                lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))
+                    throw Error('REFUSE·reading malformed claim ' + plan.scope); const span = unknown.bound; const text = canonical({ scope: unknown.scope, measure: unknown.measure, role: unknown.role, form: span.kind === 'interval' ? 'interval' : 'alphabet', value: span.kind === 'interval' ? `${span.lo}..${span.hi}` : Array.isArray(span.values) ? span.values.join('|') : '', by, at: 'place:' + input }); fields(text); return text; });
+                if (!lines.length && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                executed++;
+                verify();
+                payload = saved(lines.length ? [...lines].sort(byBytes).join('\n') + '\n' : '');
+                if (saved(closure) !== input)
+                    throw Error('REFUSE·receipt input closure mismatch');
+                const seconds = (Number(process.hrtime.bigint() - started) / 1e9).toFixed(6);
+                landShard(store, speaker, journal, [canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${lines.length}..${lines.length}`, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input }), canonical({ scope, role: 'writes', form: 'interval', measure: 's', value: seconds + '..' + seconds, by, at: 'place:' + input })]);
+                if (plan.resolution === 1)
+                    opened++;
+            }
+            results.set(plan.scope, { digest: payload, lines });
+            out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), ...lines);
+            if (plan.resolution === 1) {
+                read++;
+                const native = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && ((fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input) || (fieldOf(line, 'measure') === 'count') || (fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input))).map(line => {
+                    const f = fields(line), id = f.measure === 'bytes' ? f.value : f.measure === 'count' ? (f.at ?? '').replace(/^place:/, '') : undefined;
+                    if (id === undefined)
+                        return line;
+                    const bytes = load(id);
+                    if (bytes === undefined)
+                        throw Error('REFUSE·receipt missing verified carrier ' + id);
+                    // The full-resolution native row carries the actual verified UTF-8 bytes.
+                    // Its semantic count/digest is unchanged; a public copy needs no private CAS.
+                    return canonical({ ...f, about: bytes });
+                });
+                out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), ...native);
+            }
+        });
+    }
+    verify();
+    emit(`RECEIPTS ${read} read · ${opened} opened · reading closures`);
+    return { lines: out, read, opened, executed };
+}
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export function verifiedReadingReceipts(store, lines, digest) {
+    const units = lines.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'role') === 'writes');
+    const load = (id, row) => {
+        const hex = id.split(':')[1];
+        if (!hex || !/^[a-f0-9]+$/.test(hex))
+            return;
+        const supplied = fields(row).about;
+        // A supplied carrier must authenticate even if an old local copy still exists.
+        if (supplied !== undefined)
+            return digest(supplied) === id ? supplied : undefined;
+        const path = join(store, 'cas', 'carried', hex);
+        if (!existsSync(path))
+            return;
+        const bytes = readFileSync(path, 'utf8');
+        return digest(bytes) === id ? bytes : undefined;
+    };
+    for (const unit of units) {
+        const input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), by = fieldOf(unit, 'by'), counts = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes');
+        if (counts.length !== 1 || load(input, unit) === undefined)
+            return;
+        const count = counts[0], output = load(fieldOf(count, 'at').replace(/^place:/, ''), count);
+        if (output === undefined)
+            return;
+        const rows = output.split('\n').filter(Boolean);
+        if (fieldOf(count, 'value') !== `${rows.length}..${rows.length}` || rows.some(line => fieldOf(line, 'by') !== by || fieldOf(line, 'at') !== 'place:' + input))
+            return;
+    }
+    return units.length;
+}