@lapxo/bound 0.1.4 → 0.1.6

package/dist/host/release.js

@@ -48,11 +48,33 @@ function layDir(from, into) {
         writeFileSync(dest, bytes, { flag: 'wx' });
     }
 }
-function swapPlace(place, next, digest) {
+function swapPlace(place, next, digest, ready) {
     const old = `${next}.old`;
     if (lstatSync(old, { throwIfNoEntry: false }) !== undefined)
         throw new Error(`REFUSE·release recovery required for ${old}`);
     writeFileSync(join(next, laidMark), digest, { flag: 'wx' });
+    if (ready !== undefined) {
+        // Digest-addressed trees publish once. A verified concurrent winner is reused,
+        // never moved aside while another process may be importing its members.
+        if (ready()) {
+            rmSync(next, { recursive: true, force: true });
+            return;
+        }
+        try {
+            renameSync(next, place);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST' && code !== 'ENOTEMPTY')
+                throw error;
+            if (ready()) {
+                rmSync(next, { recursive: true, force: true });
+                return;
+            }
+            // An existing invalid cache retains the repair/rollback path below.
+        }
+    }
     let moved = false;
     try {
         if (lstatSync(place, { throwIfNoEntry: false }) !== undefined) {
@@ -224,7 +246,7 @@ export function runtimeTreeAt(store, own, digest, contentStore = own, root = '')
     const next = nextPlace(place);
     try {
         layFiles(store, own, files, next);
-        swapPlace(place, next, digest);
+        swapPlace(place, next, digest, () => observeText(join(place, laidMark)) === digest && layoutMatches(place, files));
     }
     catch (error) {
         rmSync(next, { recursive: true, force: true });

package/dist/host/selected-capsules.js

@@ -25,12 +25,12 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
         const loaded = descriptor === undefined ? load() : undefined;
         const capsule = loaded?.capsule ?? {
-            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: requests => {
+            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
                 if (!requests.length)
                     return [];
                 const actual = load();
                 assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
-                return actual.capsule.ask(requests);
+                return actual.capsule.ask(requests, reader);
             },
         };
         const projected = loaded?.offer ?? canonical(offer);
@@ -40,10 +40,10 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
         if (!algorithm)
             throw Error('REFUSE·input instrument has no admitted digest algorithm');
-        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: requests => capsule.ask(requests.map(request => {
+        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: (requests, reader) => capsule.ask(requests.map(request => {
                 const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
                 return provider === undefined ? request : { ...request, provider };
-            })) };
+            }), reader) };
         return { capsule: selected, offer: projected };
     }));
 }

package/dist/host/walk.d.ts

@@ -0,0 +1,6 @@
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export declare function foreignWalkLines(root: string): Promise<readonly string[]>;
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export declare function renderWalk(root: string, resolution: number | undefined, peer: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export declare function landWalk(root: string, lines: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;

package/dist/host/walk.js

@@ -0,0 +1,193 @@
+import { walkProjection, walkAt, walkSnapshot, walkHeaders, readWalkHeaders, readForeignWalk, walkAuthority, walkOrigin, walkInventory, walkSelection, isWalkHeader } from '@lapxo/topos/walk';
+import { canonical, parse, fromLine, wireAt, matches, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { objectProvider } from '@lapxo/topos/object-provider';
+import { standingBytes } from '@lapxo/topos/standing';
+import { fieldOf } from "../fold/claims.js";
+import { lockStanding, lockLines } from "../fold/keys.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { publicKeyOf } from "../fold/signers.js";
+import { signaturesOf } from "../fold/digests.js";
+import { fullDigest } from "./digest.js";
+import { toposAt, contextModuleAt } from "./selected-topos.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot, verifiesFields } from "../land/sign.js";
+import { storeOf } from "../land/ledger.js";
+import { signedOwnerLines, epochOf, localActLines, ownerOf } from "../cli/owner.js";
+import { commitIngress, ingressBundles, ingressCost } from "./ports/ingress.js";
+const refuse = (why) => { throw Error('REFUSE·walk ' + why); };
+const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+    return refuse('not a wire line'); return p.value.fields; };
+const one = (lines, scope, measure) => {
+    const rows = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw');
+    if (rows.length !== 1)
+        return refuse('missing or conflicting ' + scope + ' ' + measure);
+    return fieldOf(rows[0], 'value');
+};
+function policy(root) {
+    const store = storeOf(root), standing = lockStanding(store), contract = walkSelection(standing);
+    const view = one(standing, 'view/walk', 'id');
+    if (view !== 'walk@*')
+        refuse('view/walk must declare walk@*');
+    const masks = standing.filter(line => fieldOf(line, 'scope') === 'view/walk').flatMap(line => fieldOf(line, 'needs').split('|')).filter(Boolean);
+    if (!masks.length)
+        refuse('view/walk has no declared history inputs');
+    const wire = wireAt(standing.map(fields), Number.MAX_SAFE_INTEGER), algorithm = wire?.digests.values().next().value;
+    if (!algorithm)
+        refuse('no admitted digest algorithm');
+    return { store, standing, contract, masks, digest: (bytes) => fullDigest(bytes, algorithm) };
+}
+function context(root, pin, own = false) {
+    const p = policy(root);
+    if (!own && !p.standing.some(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') === pin))
+        refuse('origin context is not selected by digest');
+    const topos = toposAt(pin, p.store), authority = walkAuthority(topos.parts, verifiesFields);
+    const configuration = topos.parts.map(f => canonical({ ...f, by: 'target', epoch: '0' }));
+    return { pin, topos, authority, configuration, origin: walkOrigin(topos.parts), contract: walkSelection(topos.lines) };
+}
+function local(root) {
+    const p = policy(root), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    const history = signedOwnerLines(p.store).filter(line => p.masks.some(mask => matches(mask, fieldOf(line, 'scope'))));
+    if (history.some(line => authority.of(line).kind !== 'admitted'))
+        refuse('local history is not authenticated');
+    const selected = context(root, one(p.standing, 'walk/context', 'digest'), true);
+    return walkSnapshot(history, selected.contract.fields, p.digest, selected.origin, selected.contract.partition);
+}
+const headerInfo = (lines) => {
+    const roots = lines.filter(line => isWalkHeader(line) && fieldOf(line, 'scope') === 'walk/root');
+    if (roots.length !== 1)
+        return refuse('one signed root is required');
+    const at = fieldOf(roots[0], 'at');
+    if (!at.startsWith('receipt:'))
+        return refuse('root has no declared context');
+    return { pin: at.slice(8), base: fieldOf(roots[0], 'condition') };
+};
+async function validateHistory(root, selected, history) {
+    if (!selected.authority.authenticate(history))
+        refuse('origin history is not authenticated');
+    for (const line of history) {
+        const f = fields(line), decoded = fromLine(line, wireAt(selected.topos.parts, Number(f.epoch)));
+        if (decoded.kind !== 'fact')
+            refuse('origin wire ' + decoded.why);
+    }
+    const decoded = objectHistory([...selected.configuration, ...history]);
+    if (decoded.kind !== 'fact')
+        return refuse('origin history ' + decoded.why);
+    if (!decoded.value.objects.length)
+        return;
+    const pinned = new Set(selected.topos.lines);
+    const admit = (f) => Boolean(f.sig) ? selected.authority.of(canonical(f)).kind === 'admitted' : pinned.has(standingBytes([canonical(f)]).trim());
+    const provider = await objectProvider(decoded.value.objects, decoded.value.configuration, { admit, emit: () => { }, topos: pin => toposAt(pin, storeOf(root)), module: pin => contextModuleAt(pin, storeOf(root)) });
+    const checked = validateObjectContext(decoded.value.objects, provider);
+    if (checked.kind !== 'fact')
+        refuse('origin context ' + checked.why);
+}
+async function readBundle(root, bundle, earlier = []) {
+    const lines = bundle.evidence.split('\n').filter(Boolean), info = headerInfo(lines), p = policy(root);
+    const receipts = bundle.receipt.split('\n').filter(Boolean), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    if (receipts.length !== 1 || fieldOf(receipts[0], 'scope') !== 'receipts' || fieldOf(receipts[0], 'role') !== 'writes' || fieldOf(receipts[0], 'form') !== 'alphabet' || fieldOf(receipts[0], 'measure') !== 'digest' || fieldOf(receipts[0], 'at') !== 'receipt:' + info.pin || authority.of(receipts[0]).kind !== 'admitted')
+        refuse('retained import receipt is not authenticated');
+    const selected = context(root, info.pin);
+    const got = readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    if (fieldOf(receipts[0], 'value') !== got.identity)
+        refuse('retained import receipt does not authenticate this ingress');
+    await validateHistory(root, selected, [...new Set([...earlier, ...got.records])]);
+    return { ...got, context: info.pin, regions: walkSnapshot(got.records, selected.contract.fields, p.digest, got.origin, selected.contract.partition).regions };
+}
+async function verifiedIngress(root) {
+    const result = [], history = new Map();
+    const bundles = [...ingressBundles(storeOf(root))].sort((a, b) => epochOf(a.receipt.split('\n')) - epochOf(b.receipt.split('\n')));
+    for (const bundle of bundles) {
+        const info = headerInfo(bundle.evidence.split('\n').filter(Boolean)), origin = context(root, info.pin).origin;
+        if (result.some(prior => prior.origin === origin && prior.context !== info.pin))
+            refuse('origin context changed without declared lineage');
+        const prior = history.get(origin) ?? new Set();
+        const got = await readBundle(root, bundle, [...prior]);
+        for (const line of got.records)
+            prior.add(line);
+        history.set(origin, prior);
+        result.push(got);
+    }
+    return result;
+}
+async function inventory(root) {
+    const p = policy(root), regions = new Map(local(root).regions.map(region => [region.scope, region]));
+    for (const got of (await verifiedIngress(root)).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of got.regions)
+            regions.set(region.scope, region);
+    return walkInventory([[...regions.values()]], p.digest, context(root, one(p.standing, 'walk/context', 'digest'), true).contract.partition);
+}
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export async function foreignWalkLines(root) {
+    const verified = await verifiedIngress(root);
+    return [...new Set(verified.flatMap(got => got.records))];
+}
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export async function renderWalk(root, resolution, peer, key, keyFile, signer) {
+    const p = policy(root), pin = one(p.standing, 'walk/context', 'digest'), selected = context(root, pin, true), own = local(root);
+    const known = peer.length ? (() => { const info = headerInfo(peer), remote = context(root, info.pin); return readWalkHeaders(peer, info.pin, info.base, remote.authority.authenticate); })() : walkSnapshot([], p.contract.fields, p.digest);
+    const projection = walkProjection(selected.contract.projections, resolution);
+    const ownInventory = projection === 'history' ? own : await inventory(root);
+    const selectedPacket = walkAt(ownInventory, known, resolution, selected.contract.projections), by = key ?? ownerOf(p.store), publicKey = publicKeyOf(root, by);
+    if (!publicKey)
+        refuse('unknown local signer ' + by);
+    const drafted = walkHeaders(selectedPacket, pin, known.root, projection !== 'inventory'), epoch = epochOf(localActLines(root));
+    const got = await signConsentLot(drafted, { by, epoch, algorithm: signaturesOf(p.store).era }, publicKey, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+    if (got.kind !== 'fact')
+        return refuse(got.why);
+    if (!selected.authority.authenticate(got.lines) || !selected.authority.authenticate(selectedPacket.records))
+        refuse('local context does not authenticate exported history');
+    return [...got.lines, ...selectedPacket.records, `EXCHANGE ${selectedPacket.touched} touched regions · ${selectedPacket.open} open regions · ${Buffer.byteLength(selectedPacket.records.join('\n') + (selectedPacket.records.length ? '\n' : ''))} payload bytes`];
+}
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export async function landWalk(root, lines, key, keyFile, signer) {
+    const p = policy(root), info = headerInfo(lines), selected = context(root, info.pin);
+    const retained = await verifiedIngress(root);
+    if (retained.some(prior => prior.origin === selected.origin && prior.context !== info.pin))
+        refuse('origin context changed without declared lineage');
+    const previous = (verified) => { const prefixes = new Map(); for (const prior of verified.filter(got => got.origin === selected.origin).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of prior.regions)
+            prefixes.set(region.scope, { ...region, senderEpoch: prior.senderEpoch }); return [...prefixes.values()]; };
+    const payload = lines.filter(line => !isWalkHeader(line));
+    const proof = (prefixes) => readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: prefixes, authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    const raw = proof([]), known = retained.find(prior => prior.identity === raw.identity), got = known ? raw : proof(previous(retained));
+    const history = (prior) => [...new Set([...prior.filter(item => item.origin === selected.origin).flatMap(item => item.records), ...payload])];
+    await validateHistory(root, selected, history(retained));
+    if (!known && info.base !== (await inventory(root)).root)
+        refuse('stale receiver base');
+    if (!payload.length && !readWalkHeaders(lines, info.pin, info.base, selected.authority.authenticate).regions.length)
+        return ['ONCE 0 new evidence lines · 0 import receipts · no regions offered', `EXCHANGE 0 payload bytes · ${Buffer.byteLength(lines.join('\n') + '\n')} protocol bytes · 0 new evidence bytes · 0 new receipt bytes`];
+    const by = key ?? ownerOf(p.store), pub = publicKeyOf(root, by);
+    if (!pub)
+        refuse('unknown receiver signer ' + by);
+    const result = await commitIngress(p.store, got.identity, async () => {
+        if (info.base !== (await inventory(root)).root)
+            refuse('receiver changed before ingress');
+        const current = await verifiedIngress(root);
+        proof(previous(current));
+        await validateHistory(root, selected, history(current));
+        const next = epochOf(localActLines(root)) + 1;
+        const signed = await signConsentLot([got.importReceiptProposal], { by, epoch: next, algorithm: signaturesOf(p.store).era }, pub, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+        if (signed.kind !== 'fact')
+            return refuse(signed.why);
+        const authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+        if (authority.of(signed.lines[0]).kind !== 'admitted')
+            refuse('receiver signer does not cover the import receipt');
+        const grammar = fromLine(signed.lines[0], wireAt(p.standing.map(fields), next));
+        if (grammar.kind !== 'fact')
+            refuse('receiver receipt wire ' + grammar.why);
+        return { evidence: lines.join('\n') + '\n', receipt: signed.lines.join('\n') + '\n' };
+    }, bundle => {
+        try {
+            const retainedLines = bundle.evidence.split('\n').filter(Boolean), retainedInfo = headerInfo(retainedLines);
+            if (retainedInfo.pin !== info.pin)
+                return false;
+            const retainedProof = readForeignWalk(retainedLines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: retainedInfo.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+            const receipts = bundle.receipt.split('\n').filter(Boolean), receipt = receipts[0] ?? '';
+            return receipts.length === 1 && retainedProof.identity === got.identity && fieldOf(receipt, 'scope') === 'receipts' && fieldOf(receipt, 'value') === got.identity && fieldOf(receipt, 'at') === 'receipt:' + info.pin && authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted).of(receipt).kind === 'admitted';
+        }
+        catch {
+            return false;
+        }
+    });
+    return [`${result.kind === 'once' ? 'ONCE' : 'INGRESS'} ${result.kind === 'once' ? 0 : got.records.length} new evidence lines · 1 ${result.kind === 'once' ? 'retained' : 'signed local'} import receipt`, result.receipt.trim(), ingressCost(result, Buffer.byteLength(payload.join('\n') + (payload.length ? '\n' : '')), Buffer.byteLength(lines.filter(isWalkHeader).join('\n') + '\n'))];
+}

package/dist/land/ledger.d.ts

@@ -10,6 +10,7 @@ export declare function writerFile(store: string, writer: string): string;
 export declare function ledgerLines(store: string, writer: string): readonly string[];
 export declare function shardFile(store: string, writer: string, region: string): string;
 export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
+export declare function ledgerWriters(store: string): readonly string[];
 export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
 export declare function signedLines(store: string, writer: string): string[];
 export declare function blobAt(store: string, digest: string): string;

package/dist/land/ledger.js

@@ -1,3 +1,5 @@
+import { actLines, committedLocalActs } from "../host/ports/local-act.js";
+import { readdirSync } from 'node:fs';
 import { requireEffects } from "../host/read-only.js";
 import { appendFileSync, closeSync, dirname, existsSync, join, linkSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "../host/io.js";
 import { storeRoot } from "../host/ports/store.js";
@@ -21,12 +23,29 @@ export function writerFile(store, writer) {
 }
 const held = new Map();
 export function ledgerLines(store, writer) {
-    return linesAt(writerFile(store, writer));
+    return journalLines(store, writer, '.', linesAt(writerFile(store, writer)));
 }
 export function shardFile(store, writer, region) {
     return storeAt(store, 'ledger', writer.replace(/[^a-zA-Z0-9_-]/g, ''), `${region.replace(/\/+$/, '') || '@'}${EXTENSION}`);
 }
-export const shardLines = (store, writer, region) => linesAt(shardFile(store, writer, region));
+export const shardLines = (store, writer, region) => journalLines(store, writer, region, linesAt(shardFile(store, writer, region)));
+const journalMemo = new Map();
+function journalLines(store, writer, place, legacy) {
+    const fresh = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === place).flatMap(p => actLines(p.records).filter(line => fieldOf(line, 'by') === writer)) ?? []);
+    if (!fresh.length)
+        return legacy;
+    const lines = [...new Set([...legacy, ...fresh])], key = store + '\0' + writer + '\0' + place, last = journalMemo.get(key);
+    if (last?.length === lines.length && last.every((line, i) => line === lines[i]))
+        return last;
+    journalMemo.set(key, lines);
+    return lines;
+}
+export function ledgerWriters(store) {
+    const at = join(store, 'ledger');
+    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
+    return [...new Set([...legacy, ...committed])];
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/land/owned.d.ts

@@ -20,4 +20,4 @@ export type Owned = {
  */
 export declare function ownedOf(root: string, signed: readonly string[], admits: (line: string) => boolean, coverage: (by: string) => readonly string[], named?: readonly string[], placedAt?: (line: string) => readonly string[] | undefined): Owned;
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export declare function landOwned(root: string, place: string, lines: readonly string[]): void;
+export declare function landOwned(root: string, place: string, lines: readonly string[], committed?: boolean): void;

package/dist/land/owned.js

@@ -51,14 +51,15 @@ export function ownedOf(root, signed, admits, coverage, named = [], placedAt = (
     return { ledger, own, nowhere: [...placed, ...rest.filter((line) => !lands(line))], forked };
 }
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export function landOwned(root, place, lines) {
+export function landOwned(root, place, lines, committed = false) {
     if (!lines.length)
         return tellOwn(place, []);
     const at = join(root, place, LOCK);
     const text = observeText(at) ?? '';
-    for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
-        landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
-    }
+    if (!committed)
+        for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
+            landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
+        }
     writeFileSync(`${at}.${process.pid}.landing`, `${text.replace(/\n*$/, '\n')}${lines.join('\n')}\n`);
     renameSync(`${at}.${process.pid}.landing`, at);
     tellOwn(place, []);

package/dist/observe/files.js

@@ -1,4 +1,4 @@
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
+import { existsSync, lstatSync, statSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 /**
  * The one place the instrument reads the world: a coordinate's bytes, the entries of a directory, the coordinates under a place,
@@ -7,7 +7,17 @@ import { join, relative, sep } from 'node:path';
 const seen = new Map();
 /** A coordinate read once is kept by its stamp — its inode, size and time — and read again only when the stamp moves. */
 function bytesAt(at) {
-    const st = stampable(at);
+    // Reading follows a link, so its cache stamp must describe the same target.
+    // Directory links have no file bytes; traversal keeps its separate link policy.
+    let st = stampable(at);
+    if (st?.isSymbolicLink()) {
+        try {
+            st = statSync(at);
+        }
+        catch {
+            return undefined;
+        }
+    }
     if (st === undefined || st.isDirectory() || !existsSync(at))
         return undefined;
     const stamp = `${st.ino}-${st.size}-${st.mtimeMs}`;

package/dist/observe/regions.js

@@ -5,13 +5,11 @@ import { createHash } from 'node:crypto';
 import { basename, dirname, join, relative } from 'node:path';
 import { CAPSULE, LOCK, canonical, matches, PROTOCOL } from '@lapxo/topos/wire';
 import { handed, readsOf } from '@lapxo/topos/capsule';
-import { STATES } from '@lapxo/obligations';
 import { foldCeilings } from "../fold/ceilings.js";
 import { fieldOf, wireLinesOf as linesOf } from "../fold/claims.js";
 import { isCeiling } from "../fold/configures.js";
 import { keyFor } from "../fold/keys.js";
 import { casesHeld, placedReadings } from "../fold/observed.js";
-import { verdictsFor } from "../fold/paid.js";
 import { capsuleAt as isWorld, placesIn, spoken } from "../fold/places.js";
 import { rolesOf } from "../fold/roles.js";
 import { ownLockOf } from "../fold/signed.js";
@@ -71,9 +69,8 @@ function askedOf(fold) {
     return fold.under ? [...new Set(capsuleOf(fold).filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'role') === 'render').map((line) => fieldOf(line, 'scope').slice('region/'.length)))]
         .map((name) => ((n) => fact(`asked/${name}`, `${n}..${n}`, 'interval', 'count'))(pinnersOf(fold).map(at).filter((names) => names.has(name)).length)) : [];
 }
-/** The place's verdict line as counts: what the fold lands, forks and refuses, each of the object's four states, and the ceilings it meets. */
+/** File-fold readings and their ceilings; this path computes no object encounters. */
 function verdictOf(fold) {
-    const states = Object.values(verdictsFor(fold));
     const named = (line) => ((cut) => [line.slice(0, cut < 0 ? line.length : cut).trim(), line.slice(cut < 0 ? line.length : cut + 3).trim() || line])(line.indexOf(' · '));
     const here = (fold.under ?? '').replace(/\/$/, '');
     const others = new Set(here ? placesIn(fold.root).filter((place) => place !== here) : []);
@@ -86,7 +83,8 @@ function verdictOf(fold) {
         return !others.has(head);
     };
     return [['claims', fold.claims], ['forks', fold.forks.length + (fold.second.verdict === 'forks' ? 1 : 0)], ['refused', fold.refused.length], ['vacuous', fold.vacuous], ['history', fold.history.length],
-        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length], ...STATES.map((one) => [one, states.filter((state) => state === one).length])].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length]].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        .concat([fact('verdict/computation', 'readings'), fact('verdict/encounters', 'uncomputed')])
         .concat(fold.ceilings.short.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`unpaid/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.over.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`outside/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.unread.filter(mine).map((scope) => fact(`unpaid/${scope}`, 'unread')))

package/dist/render/field.d.ts

@@ -1,9 +1,3 @@
 import type { PlaceFold } from '../cli/place.ts';
-/**
- * The field of a place at resolution N: every bound placed at the place or at none, in the state its poles give, and
- * every coordinate cut to its first N steps in the worst state it holds. Interval poles with no value in common
- * conflict, as two signers on one key do; an alphabet that permits none is a ceiling like any other. A value read
- * outside the poles is forbidden; a bound nothing read, a reader that refused and a demand unpaid are required; the
- * rest is free. It is read off the region summaries and the landed readings, and no reader runs.
- */
+/** Host file-region readings, grouped by coordinate prefix. These statuses do not compute object encounters. */
 export declare function field(fold: PlaceFold, at: number): readonly string[];

package/dist/render/field.js

@@ -3,15 +3,9 @@ import { placesIn } from "../fold/places.js";
 import { placedAt } from "../fold/reach.js";
 import { polesOf, rankOf, unpackRegions } from "../fold/region.js";
 import { INTERVALS } from '@lapxo/topos/forms';
-const WORST = ['CONFLICT', 'FORBIDDEN', 'REQUIRED', 'FREE'];
+const WORST = ['disagreement', 'outside', 'unanswered', 'met'];
 const empty = (ceiling) => ceiling !== undefined && 'lo' in ceiling && !INTERVALS.inhabited(ceiling);
-/**
- * The field of a place at resolution N: every bound placed at the place or at none, in the state its poles give, and
- * every coordinate cut to its first N steps in the worst state it holds. Interval poles with no value in common
- * conflict, as two signers on one key do; an alphabet that permits none is a ceiling like any other. A value read
- * outside the poles is forbidden; a bound nothing read, a reader that refused and a demand unpaid are required; the
- * rest is free. It is read off the region summaries and the landed readings, and no reader runs.
- */
+/** Host file-region readings, grouped by coordinate prefix. These statuses do not compute object encounters. */
 export function field(fold, at) {
     if (fold.regions === undefined)
         return ['GREY     field · this fold carries no region summaries; it is read again at the next fold'];
@@ -25,10 +19,10 @@ export function field(fold, at) {
         ...regions.bounds.filter((bound) => here(bound.line)).map((bound) => {
             const ceiling = (poles.get(bound.region) ?? poles.set(bound.region, polesOf(regions, bound.region)).get(bound.region)).get(`${bound.question} ${bound.measure}`)?.ceiling;
             const got = rankOf(regions, bound, own);
-            return [fieldOf(bound.line, 'scope'), empty(ceiling) ? 'CONFLICT' : got.bars || got.sums ? 'FORBIDDEN' : got.met ? 'FREE' : 'REQUIRED'];
+            return [fieldOf(bound.line, 'scope'), empty(ceiling) ? 'disagreement' : got.bars || got.sums ? 'outside' : got.met ? 'met' : 'unanswered'];
         }),
-        ...fold.missing.filter(here).map((line) => [fieldOf(line, 'scope'), 'REQUIRED']),
-        ...fold.forks.flatMap((fork) => fork.lines.slice(0, 1)).filter(here).map((line) => [fieldOf(line, 'scope'), 'CONFLICT']),
+        ...fold.missing.filter(here).map((line) => [fieldOf(line, 'scope'), 'unanswered']),
+        ...fold.forks.flatMap((fork) => fork.lines.slice(0, 1)).filter(here).map((line) => [fieldOf(line, 'scope'), 'disagreement']),
     ];
     const cells = new Map();
     for (const [scope, state] of states) {
@@ -39,7 +33,7 @@ export function field(fold, at) {
     const ordered = [...cells].sort((a, b) => WORST.indexOf(a[1].state) - WORST.indexOf(b[1].state) || a[0].localeCompare(b[0]));
     return [
         '## field', '', '```',
-        `FIELD    @${at} · ${cells.size} cells · ${states.length} bounds · ${WORST.map((state) => `${state} ${ordered.filter(([, one]) => one.state === state).length}`).join(' · ')}`,
+        `FIELD    @${at} · ${cells.size} groups · ${states.length} bounds · readings · no encounters computed · ${WORST.map((state) => `${state} ${ordered.filter(([, one]) => one.state === state).length}`).join(' · ')}`,
         ...ordered.map(([cell, one]) => `FIELD    ${cell} · ${one.state} · ${one.bounds} bounds`),
         '```',
     ];

package/dist/render/names.d.ts

@@ -1,3 +1,3 @@
 /** The regions bound renders itself, by name: a view that asks any other is answered by a capsule that declares it, or refused whole. */
-export declare const REGION_NAMES: readonly ["receipts", "help", "lines", "red", "forks", "programs", "why", "sign", "take", "history", "field"];
+export declare const REGION_NAMES: readonly ["receipts", "help", "lines", "red", "forks", "programs", "why", "sign", "take", "history", "field", "evidence"];
 export type RegionName = (typeof REGION_NAMES)[number];

package/dist/render/names.js

@@ -1,4 +1,4 @@
 /** The regions bound renders itself, by name: a view that asks any other is answered by a capsule that declares it, or refused whole. */
 export const REGION_NAMES = [
-    'receipts', 'help', 'lines', 'red', 'forks', 'programs', 'why', 'sign', 'take', 'history', 'field',
+    'receipts', 'help', 'lines', 'red', 'forks', 'programs', 'why', 'sign', 'take', 'history', 'field', 'evidence',
 ];

package/dist/render/view.js

@@ -7,26 +7,29 @@ import { capsuleAnswers, capsuleRegions, capsuleViews } from "./capsule.js";
 import { declaredBy } from "../observe/regions.js";
 import { readersBehind } from "../fold/observed.js";
 import { LOCK, canonical, matches } from '@lapxo/topos/wire';
-import { STATES } from '@lapxo/obligations';
 import { fieldOf, foldClaims, selfName } from "../fold/claims.js";
 import { keepRender, keptRender } from "../fold/kept.js";
-import { bytesDigest } from "../fold/digests.js";
-import { writerFor } from "../fold/signers.js";
+import { bytesDigest, signaturesOf } from "../fold/digests.js";
+import { authorityFor, rootSigner, writerFor } from "../fold/signers.js";
 import { lockLines } from "../fold/keys.js";
+import { appliedIn } from "../fold/signed.js";
+import { ledgerLines } from "../land/ledger.js";
 import { horizonOf, moved, shapeLines } from "./shape.js";
 import { rankLines } from "../fold/rank.js";
 import { differing, regionsOf } from "../fold/region.js";
-import { verdictsFor } from "../fold/paid.js";
 import { field } from "./field.js";
 import { helpLines } from "../cli/names.js";
+/** Authenticated delivery history is evidence, not the place's normative standing. */
+const evidence = (fold) => {
+    const authority = authorityFor(lockLines(fold.store), rootSigner(fold.root), signaturesOf(fold.store).admitted);
+    const place = (fold.under ?? '').replace(/\/$/, '');
+    const deliveries = place ? appliedIn(fold.root, place)
+        : [...new Set(authority.admitted.flatMap(key => ledgerLines(fold.store, key.id)))];
+    return deliveries
+        .filter(line => authority.of(line).kind === 'admitted');
+};
 const block = (name, lines) => (lines.length ? [`## ${name}`, '', '```', ...lines, '```'] : []);
 const seconds = (ms) => `${(ms / 1000).toFixed(1)} s`;
-const statesOf = (fold) => {
-    const held = new Map();
-    for (const one of Object.values(verdictsFor(fold)))
-        held.set(one, (held.get(one) ?? 0) + 1);
-    return STATES.flatMap((one) => (held.get(one) ? [`${one} ${held.get(one)}`] : []));
-};
 const programs = (fold) => {
     const median = fold.costs.length ? [...fold.costs].sort((a, b) => a - b)[Math.floor(fold.costs.length / 2)] ?? 0 : 0;
     const turned = moved(fold);
@@ -34,12 +37,13 @@ const programs = (fold) => {
     const refusedByReader = fold.observed.filter((line) => fieldOf(line, 'scope') === 'refuse/reader').length;
     const c = fold.ceilings;
     return block('programs', [
-        `PROGRAMS${fold.under ? ` ${fold.under}` : ''} ${[`${fold.claims} claims`, ...statesOf(fold), `${fold.history.length} history`].join(' · ')}`
+        `PROGRAMS${fold.under ? ` ${fold.under}` : ''} ${[`${fold.claims} claims`, `${fold.history.length} history`].join(' · ')}`
             + ` · ${fold.forks.length + (fold.second.verdict === 'forks' ? 1 : 0)} forks · ${fold.grey.length} grey · ${fold.refused.length} refused · ${fold.vacuous} vacuous`
             + ` · ${secondName()} ${fold.second.verdict}${fold.second.verdict === 'agrees' && !fold.second.external ? ', never disagreed' : ''}`
             + ` · store ${fold.observed.length} observed${refusedByReader ? ` · ${refusedByReader} refuse·reader` : ''}`
             + (fold.under ? ` · ceilings ${c.read} met here · ${c.short.length} short · ${c.over.length} over`
                 : ` · ceilings ${c.read}/${c.total} read · ${c.short.length} short · ${c.over.length} over · ${c.unread.length} unread${c.vacuous.length ? ` · ${c.vacuous.length} vacuous unread` : ''}`)
+            + ' · readings · no encounters computed'
             + ` · ${fold.effects} · take ${fold.costs.length ? seconds(fold.costs[fold.costs.length - 1] ?? 0) : 'none'} last`
             + (fold.costs.length > 1 ? ` · ${seconds(median)} median of ${fold.costs.length}` : ''),
         ...shapeLines(fold),
@@ -134,6 +138,7 @@ const REGIONS = {
     receipts: (fold) => receiptRegion(fold, 1),
     help: () => helpLines(),
     lines: (fold) => fold.standing,
+    evidence,
     red, forks, programs, why, sign, take, history,
     field: (fold) => field(fold, 3),
 };

package/docs/contracts/archive.md

@@ -0,0 +1,11 @@
+# Exact release artifact
+
+Packing is a host operation. An archive digest names those archive bytes; it is not the identity of a Topos standing. The release pipeline makes one archive and transfers that same file to its destinations. Repeating a pack operation is not a proof of identical bytes.
+
+The archive conformance vector declares the host package command, digest algorithm, execution deadline, response bound and its sample packages. It packs each sample once, hashes the resulting bytes, verifies both destination copies, installs offline without package scripts and compares every listed installed member with the input bytes. It executes the installed entry and checks its declared output. Changed archive bytes refuse by digest before they can be treated as the named artifact. The negative control fails when that verification is removed.
+
+The samples use independent packages with different contents. Their outputs and member digests are captured by the executable vector; their file presence alone is not evidence. The selected publication reader measures this quartet through the existing process contract, and native receipts supply its member status to the plan.
+
+This is conformance of the packaging recipe. Acceptance of a particular Bound candidate additionally requires the exact archive audit, clean installation and product CLI captures for that archive. A previous archive's captures cannot certify changed implementation bytes. The final candidate must be rebuilt after admitted metadata changes, with every changed member accounted for. The product witness uses the installed reader directly, without a checkout ledger or source conditions.
+
+Rendering and installation are different boundaries. README, the manifest and the standard MIT text remain native renders. Publication to a registry or forge is a later owner action; this vector does not publish, authenticate to an account, create a tag or infer an external release from a local file.

package/docs/contracts/cli.md

@@ -0,0 +1,19 @@
+# fold
+
+`bound fold` reads the admitted place. Configuration output names readings and says no encounters computed; its counts are not independent-origin states. A declared cells view projects admitted typed history into Obligations. A selected world defines other views; its contract decides when empty output is valid. A refusal or nonzero status wins over any parseable diagnostic stdout. `--check` verifies receipts without inventing a missing reading. The published evidence vector folds fresh places, preserves admitted key attribution, reads a native receipt and checks exact withdrawals. The typed-object quartet covers object states separately.
+
+# land
+
+`bound land <lot>` admits authenticated lines through the same boundary used by signing and previews. Authority, coverage, historical wire and typed context remain distinct checks. Unknown wire and tampered signatures refuse. Exact redelivery returns ONCE; it does not append another origin or grant new authority. Withdrawals remain exact under their declared contract. A refusal does not append a partial act. The published evidence vector lands fresh places, refuses unauthorized writes and tampering, redelivers signed bytes and exercises exact withdrawals. The signing-port vector additionally checks interrupted or invalid command responses do not land a partial lot.
+
+# sign
+
+`bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.
+
+# Committed act results
+
+The opt-in `local-act@1` contract is selected by `wire/act-result`, `wire/act-result-scope` and `wire/act-result-context`. An admitted `view/act measure=id value=act` makes `bound fold --as act <identity>` available. Missing or conflicting declarations refuse; an absent profile preserves the historical interface. Topos defines the canonical record and result contract.
+
+Admission publishes the original signed records, their logical placements and one native result receipt atomically. A failure before commit writes no partial act. The result names the committed digest and local epoch; replay returns the original result without another epoch or origin. A post-commit error is not a rollback. Read the committed result before deciding whether to retry.
+
+The query verifies the record signatures and coverage against the authority snapshot at admission, and the native receipt against its retained provenance. Later key retirement or profile replacement cannot authorize a new act but does not erase a verifiable historical result. Admission is not conformance: the output says `admitted · conformance not asserted`. Missing or corrupt results refuse by name. Host paths and delivery counts are not identity inputs.