@lapxo/bound 0.1.5 → 0.1.6

package/dist/fold/admission-history.d.ts

@@ -0,0 +1,6 @@
+import type { Signer } from '@lapxo/topos/wire';
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export declare function admissionHistoryAt(root: string, epoch: number): readonly string[];
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export declare function admissionAnchor(root: string): Signer;

package/dist/fold/admission-history.js

@@ -0,0 +1,22 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { ledgerLines, ledgerWriters, storeOf } from "../land/ledger.js";
+import { fieldOf, isConfig, selfName } from "./claims.js";
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export function admissionHistoryAt(root, epoch) {
+    const store = storeOf(root);
+    return [...new Set(ledgerWriters(store).flatMap(writer => ledgerLines(store, writer)))]
+        .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
+}
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export function admissionAnchor(root) {
+    const at = join(storeOf(root), `${selfName()}.keys`);
+    const keys = JSON.parse(readFileSync(at, 'utf8'));
+    const anchors = Object.values(keys);
+    if (anchors.length !== 1 || !anchors[0]?.publicKey || !anchors[0].coverage.length)
+        throw Error('REFUSE·act historical admission requires one bootstrap anchor');
+    const anchor = anchors[0];
+    return { id: anchor.id, keyClass: 'authorize', publicKey: anchor.publicKey, coverage: anchor.coverage,
+        depth: { lo: 1, hi: 16 }, admittedBy: [] };
+}

package/dist/fold/digests.js

@@ -1,5 +1,6 @@
+import { ledgerLines, ledgerWriters } from "../land/ledger.js";
 import { readOnly } from "../host/read-only.js";
-import { appendFileSync, dirname, join, mkdirSync, readdirSync, relative, resolve } from "../host/io.js";
+import { appendFileSync, dirname, join, mkdirSync, readdirSync, realpathSync, relative, resolve } from "../host/io.js";
 import { bytesDigest as bytesWith, fullDigest as fullWith } from "../host/digest.js";
 import { coordinatesUnder, observeFile, observeText, stampOf } from "../observe/files.js";
 import { releaseOf, signedLockLines } from "./keys.js";
@@ -32,10 +33,8 @@ function namedAlgorithm(store) {
         const contract = published === undefined ? undefined : wireLine(published, 'digest-algorithms');
         return contract === undefined ? undefined : fieldOf(contract, 'value').split('|')[0]?.split(':')[0];
     }
-    for (const entry of readdirSync(join(store, 'ledger'), { withFileTypes: true })) {
-        if (!entry.isFile() || !entry.name.endsWith(EXTENSION))
-            continue;
-        const text = observeText(join(store, 'ledger', entry.name)) ?? '';
+    for (const writer of ledgerWriters(store)) {
+        const text = ledgerLines(store, writer).join('\n');
         let from = 0;
         while (from < text.length) {
             const at = (() => {
@@ -176,14 +175,19 @@ export function instrumentCoordinates(store, entry, standing = [], root = dirnam
         const digest = coordinateDigest(store, at);
         if (digest === undefined)
             return;
-        seen.set(at, digest);
-        for (const one of importsOf(store, at, digest)) {
+        // The host loader resolves links before loading a module. Count that module
+        // once, while retaining distinct modules even when their bytes are equal.
+        const module = realpathSync(at);
+        if (seen.has(module))
+            return;
+        seen.set(module, digest);
+        for (const one of importsOf(store, module, digest)) {
             if (one.startsWith('node:') || builtinModules.includes(one))
                 continue;
             if (one.startsWith('.'))
-                walk(resolve(dirname(at), one));
+                walk(resolve(dirname(module), one));
             else
-                walk(createRequire(at).resolve(one));
+                walk(createRequire(module).resolve(one));
         }
     };
     walk(resolve(entry));

package/dist/fold/kept.js

@@ -1,8 +1,9 @@
+import { actLines, committedLocalActs } from "../host/ports/local-act.js";
 import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
-import { landMemo, ledgerLines, memoAt, shardFile, writerFile } from "../land/ledger.js";
+import { landMemo, ledgerLines, ledgerWriters, memoAt, shardFile, writerFile } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { EXTENSION, fieldOf } from "./claims.js";
 import { keyFor, keyOf, lockSigners } from "./keys.js";
@@ -36,7 +37,7 @@ export function foldPoints(store, standing, under, keeper, instrument = '', obse
         `take ${digestOf(ledgerLines(store, 'take').filter((line) => reads.scopes.has(fieldOf(line, 'scope').replace(/^take\//, ''))))}`,
         `tree ${digestOf(ledgerLines(store, tree ?? '').filter((line) => (sourceOf(line) ?? '').startsWith(reads.place)))}`,
     ];
-    const heads = (existsSync(join(store, 'ledger')) ? readdirSync(join(store, 'ledger')) : []).filter((name) => name.endsWith(EXTENSION)).map((name) => name.slice(0, -EXTENSION.length))
+    const heads = ledgerWriters(store)
         .filter((writer) => writer !== keeper && writer !== 'gate' && !writer.startsWith('reader') && !(reads && (signers.has(writer) || writer === 'judge' || writer === 'take' || writer === tree)))
         .map((writer) => `${writer} ${writer === liveWriter(store, standing) ? lastWord(store, writer) : bytesDigest(store, text(ledgerLines(store, writer).join('\n')))}`);
     const written = [...new Set([...viewsOf(standing).values()].flatMap((view) => ('regions' in view && view.shape ? [view.shape] : [])))].sort()
@@ -100,8 +101,12 @@ function readingContext(store) {
     const speaker = keyOf(store, 'read');
     const files = speaker === undefined ? [] : [writerFile(store, speaker), ...coordinatesUnder(dirname(shardFile(store, speaker, '')), store)
             .filter(file => file.endsWith(EXTENSION)).map(file => join(store, file))];
-    return bytesDigest(store, text(files.filter(file => existsSync(file)).sort()
-        .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())).join('\n')));
+    const segments = speaker === undefined ? [] : committedLocalActs(store).flatMap(act => act.bundle.placements?.flatMap(placement => {
+        const records = actLines(placement.records).filter(line => fieldOf(line, 'by') === speaker);
+        return records.length ? [placement.place + '\n' + records.join('\n')] : [];
+    }) ?? []);
+    return bytesDigest(store, text([...files.filter(file => existsSync(file)).sort()
+            .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())), ...segments].join('\n')));
 }
 export function keptPlace(store, under) {
     const key = observeText(memoAt(store, lastOf([`place ${under ?? '.'}`])))?.trim();

package/dist/fold/keys.js

@@ -1,8 +1,9 @@
 import { dirname, existsSync, join } from "../host/io.js";
-import { ledgerLines, signedLines } from "../land/ledger.js";
-import { EXTENSION, fieldOf, foldClaims, isWire, LOCK, selfName } from "./claims.js";
-import { entriesIn, observeText } from "../observe/files.js";
+import { ledgerLines, ledgerWriters, signedLines } from "../land/ledger.js";
+import { fieldOf, foldClaims, isWire, LOCK, selfName } from "./claims.js";
+import { observeText } from "../observe/files.js";
 const held = new Map();
+const keyInputs = new Map();
 const merged = new Map();
 /**
  * Whose lines carry a class of writing, as the lock says it. Every ledger the store keeps is read, the key claims
@@ -47,13 +48,15 @@ export function signedLockLines(store, told = []) {
     return lockSigners(store, told).flatMap((id) => signedLines(store, id));
 }
 function keysOf(store, told) {
-    const mine = told.length ? read(store, told) : held.get(store) ?? read(store);
+    const input = ledgerKeyLines(store).join('\n');
+    const mine = told.length ? read(store, told) : keyInputs.get(store) === input ? held.get(store) ?? read(store) : read(store);
+    if (!told.length)
+        keyInputs.set(store, input);
     if (!told.length)
         held.set(store, mine);
     return mine;
 }
-const ledgerKeyLines = (store) => (existsSync(join(store, 'ledger')) ? entriesIn(join(store, 'ledger')).map((entry) => entry.name) : [])
-    .filter((name) => name.endsWith(EXTENSION)).flatMap((name) => ledgerLines(store, name.slice(0, -EXTENSION.length)))
+const ledgerKeyLines = (store) => ledgerWriters(store).flatMap(writer => ledgerLines(store, writer))
     .filter((line) => /\bsig=/.test(line) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
 const releases = new Map();
 /**

package/dist/fold/observed.js

@@ -267,13 +267,14 @@ export function observedClaims(root, store, options = {}) {
     }
     function observeOne(reader, started) {
         const module = resolve(root, reader.module);
+        const lifetime = readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), { id: reader.id, module: reader.module });
         const asked = reader.capsule === undefined ? undefined : reader.capsule.selected ?? capsuleAt(reader.capsule.digest, reader.capsule.entry);
         const projection = reader.capsule === undefined ? [] : (asked?.lines ?? []).filter(line => fieldOf(line, 'scope') === `region/${reader.capsule.region}` && fieldOf(line, 'measure') === 'input-projection' && fieldOf(line, 'value') !== 'withdraw');
         if (projection.length) {
             if (projection.length !== 1 || !asked)
                 throw Error('REFUSE·input projection is ambiguous ' + reader.module);
             const files = [...new Set(reader.where.flatMap(where => handedAt(root, reader, roleOf, look, where)))].sort().map(place => ({ place, text: observeText(resolve(root, place)) ?? '' }));
-            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
+            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
             out.push(...result.lines);
             ran += result.executed;
             read += result.read - result.opened;
@@ -287,7 +288,7 @@ export function observedClaims(root, store, options = {}) {
             assertReaderInputs(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module, offered.length);
             const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
             const kept = whole && legacy === undefined && answered === undefined && source ? sha([
-                speaker, reader.module, reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
+                speaker, reader.module, JSON.stringify(lifetime), reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
                 reader.capsule === undefined ? '' : `${reader.capsule.selected?.selection ?? reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
                 ...offered.map((offer) => `${offer.place} ${offer.digest?.() ?? bytesDigest(store, offer.bytes())}`),
             ].join('\n')) : undefined;
@@ -302,9 +303,9 @@ export function observedClaims(root, store, options = {}) {
             const home = regionIn(regions, reader.module);
             const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}`);
             const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value'));
-            const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
-            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}`).slice(0, 12) : 'none', lines: [] }
-                : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime: readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
+            const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
+            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
+                : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime, kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
                     : { by: 'none', lines: [] };
             const by = measured.by;
             const level = [...measured.lines];
@@ -419,12 +420,12 @@ export function observedClaims(root, store, options = {}) {
                         ? asked.ask(due.map((d) => ({
                             protocol: PROTOCOL, verb: 'read', rootScope: d.place, region: reader.capsule.region, held: heldOf(d.place, d.region),
                             files: (reader.capsule.reads.some((read) => read.includes('@')) ? handedAt(root, reader, roleOf, look, d.place) : [d.place]).map((coordinate) => ({ place: coordinate, text: observeText(resolve(root, coordinate)) ?? '' })),
-                        }))).map((answer) => {
+                        })), { id: reader.id, module: reader.module }).map((answer) => {
                             if (answer?.kind !== 'fact')
                                 throw new Error(`REFUSE·reader ${reader.module} · ${answer?.why ?? 'no capsule answer'}`);
                             return (answer.claims ?? []);
                         })
-                        : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })), readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module));
+                        : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })), lifetime);
                 }
                 catch (error) {
                     const why = `REFUSE·reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}`;

package/dist/fold/signed.d.ts

@@ -1,3 +1,4 @@
+import { authorityFor } from './signers.ts';
 /** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
 export declare const tellOwn: (place: string, lines: readonly string[]) => void;
 /**
@@ -16,3 +17,7 @@ export declare const admittedIn: (root: string, place: string, line: string) =>
 export declare const appliedIn: (root: string, place: string) => readonly string[];
 export declare const forksIn: (root: string, place: string) => readonly string[];
 export declare const writtenIn: (root: string, place: string) => number;
+/** Authenticated history excludes prospective lines told only for admission. */
+export declare const appliedHistoryIn: (root: string, place: string) => readonly string[];
+/** Shared signature/window/coordinate coverage boundary for own history. */
+export declare function ownRecordAdmitted(line: string, place: string, family: string, signers: ReturnType<typeof authorityFor>['admitted'], algorithms: readonly string[]): boolean;

package/dist/fold/signed.js

@@ -13,7 +13,7 @@ const held = new Map();
 const told = new Map();
 /** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
 export const tellOwn = (place, lines) => void told.set(place, lines);
-function verified(root, place) {
+function verified(root, place, preview = true) {
     const store = storeOf(root);
     const lock = lockLines(store);
     const publicText = observeText(join(root, place, LOCK)) ?? '';
@@ -21,7 +21,7 @@ function verified(root, place) {
     const algorithms = hasAuthority ? signaturesOf(store).admitted : [];
     const signers = algorithms.length ? authorityFor(lock, rootSigner(root), algorithms).admitted : [];
     const history = signers.flatMap(signer => place ? shardLines(store, signer.id, `${place}/${LOCK}`) : ledgerLines(store, signer.id)).filter(line => fieldOf(line, 'sig') !== '');
-    const text = [publicText, ...history, ...(told.get(place) ?? [])].join('\n');
+    const text = [publicText, ...history, ...(preview ? told.get(place) ?? [] : [])].join('\n');
     const key = `${root} ${place}`;
     const last = held.get(key);
     if (last !== undefined && last.text === text && last.lock === lock)
@@ -30,19 +30,7 @@ function verified(root, place) {
     // Unrestricted coverage does not construct a region coordinate. Restricted
     // coverage still requires the lock's declared namespace before comparison.
     const family = signers.some(signer => !signer.coverage.includes('*')) ? wordOf(lockStanding(store), 'families', 'region') : '';
-    const stands = (line) => {
-        const got = parse(line);
-        if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)
-            return false;
-        const fields = got.value.fields;
-        const signer = signers.find((one) => one.id === fields['by']);
-        const epoch = Number(fields['epoch']) || 0;
-        if (signer === undefined || !verifiesFields(fields, signer.publicKey, algorithms))
-            return false;
-        const window = windowAt(signer, epoch);
-        return epoch >= window.start && (window.close === null || epoch <= window.close)
-            && signer.coverage.some((prefix) => prefix === '*' || within(region(`${family}/${place}/${fields['scope'] ?? ''}`, './'), region(prefix, './')));
-    };
+    const stands = (line) => ownRecordAdmitted(line, place, family, signers, algorithms);
     const applied = new Set(lines.filter(stands));
     // A published copy of an authenticated delivery is not another inscription.
     const projected = new Set([...applied].map(sayingOf));
@@ -75,3 +63,19 @@ export const admittedIn = (root, place, line) => verified(root, place).applied.h
 export const appliedIn = (root, place) => [...verified(root, place).applied];
 export const forksIn = (root, place) => ((got) => foldClaims(got.lines.filter((line) => got.applied.has(line) || (!/ sig=/.test(line) && !got.projected.has(sayingOf(line))))).forks.map((fork) => fork.key))(verified(root, place));
 export const writtenIn = (root, place) => ((got) => got.lines.filter((line) => !got.applied.has(line)).length)(verified(root, place));
+/** Authenticated history excludes prospective lines told only for admission. */
+export const appliedHistoryIn = (root, place) => [...verified(root, place, false).applied];
+/** Shared signature/window/coordinate coverage boundary for own history. */
+export function ownRecordAdmitted(line, place, family, signers, algorithms) {
+    const got = parse(line);
+    if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)
+        return false;
+    const fields = got.value.fields;
+    const signer = signers.find((one) => one.id === fields['by']);
+    const epoch = Number(fields['epoch']) || 0;
+    if (signer === undefined || !verifiesFields(fields, signer.publicKey, algorithms))
+        return false;
+    const window = windowAt(signer, epoch);
+    return epoch >= window.start && (window.close === null || epoch <= window.close)
+        && signer.coverage.some((prefix) => prefix === '*' || within(region(`${family}/${place}/${fields['scope'] ?? ''}`, './'), region(prefix, './')));
+}

package/dist/host/capsule.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderReference } from '@lapxo/topos/wire';
 import type { Declaration } from '@lapxo/topos/capsule';
 import type { Request, Response } from '@lapxo/topos/contract';
 export interface Capsule {
@@ -5,7 +6,7 @@ export interface Capsule {
     readonly digest: string;
     readonly declaration: Declaration;
     readonly lines: readonly string[];
-    readonly ask: (requests: readonly Request[]) => readonly (Response | undefined)[];
+    readonly ask: (requests: readonly Request[], reader?: ReaderReference) => readonly (Response | undefined)[];
 }
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
 export declare function capsuleAt(digest: string, entry: string, store?: string): Capsule | undefined;

package/dist/host/capsule.js

@@ -60,10 +60,10 @@ export function capsuleAt(digest, entry, store) {
     if (!entry || isAbsolute(entry) || (coordinate === '..' || coordinate.startsWith(`..${sep}`)) || entry.split(/[\\/]/).includes('..')) {
         throw new Error(`REFUSE·capsule ${digest} declared entry ${entry || '(absent)'} unavailable`);
     }
-    const capsule = { digest, ...known, ask: (requests) => {
+    const capsule = { digest, ...known, ask: (requests, reader) => {
             if (!statSync(module, { throwIfNoEntry: false })?.isFile())
                 throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, cacheStore, module);
+            return answered(digest, bytes, requests, names, root, cacheStore, module, reader);
         } };
     capsules.set(identity, capsule);
     return capsule;
@@ -86,14 +86,16 @@ const spawnOf = (at, names) => {
     return child;
 };
 export const childFlags = (argv = process.execArgv) => argv.filter((flag, i) => !/^(-e|-p|--eval|--print)$/.test(argv[i - 1] ?? '') && !/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(flag));
-function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry) {
+function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry, reader) {
     const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
     if (!child.length) {
         process.stderr.write(`LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
+    const lifetime = readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader ?? digest);
+    const policy = lifetime === undefined ? '' : JSON.stringify(lifetime) + '\n';
+    const hitOf = (request) => sha(`${digest}\n${loader}${policy}${JSON.stringify(request)}`);
     const hits = requests.map(hitOf);
     const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
     const held = kept.map((at, i) => {
@@ -114,7 +116,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
-    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), digest));
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, lifetime);
     return requests.map((request, i) => {
         if (held[i] !== undefined)
             return held[i];
@@ -148,5 +150,5 @@ export function locatedAt(tree, place, cacheStore = ownStore()) {
             }
         }
     const digest = `sha256:${hash.digest('hex')}`;
-    return { digest, ...known, ask: (requests) => answered(digest, new Uint8Array(), requests, names, at, cacheStore) };
+    return { digest, ...known, ask: (requests, reader) => answered(digest, new Uint8Array(), requests, names, at, cacheStore, undefined, reader) };
 }

package/dist/host/io.d.ts

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/io.js

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/ports/ingress.js

@@ -1,23 +1,10 @@
-import { randomUUID } from 'node:crypto';
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { requireEffects } from "../read-only.js";
 import { underTheLock } from "../../land/act.js";
-const syncDirectory = (path) => { const fd = openSync(path, 'r'); try {
-    fsyncSync(fd);
-}
-finally {
-    closeSync(fd);
-} };
-const durableFile = (path, text) => { const fd = openSync(path, 'wx', 0o600); try {
-    writeFileSync(fd, text);
-    fsyncSync(fd);
-}
-finally {
-    closeSync(fd);
-} };
+import { nativePublicationStorage, publishBundle } from "./publication.js";
 /** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
-export const nativeIngressStorage = { publish(staged, committed) { renameSync(staged, committed); syncDirectory(join(committed, '..')); } };
+export const nativeIngressStorage = nativePublicationStorage;
 const directory = (store) => join(store, 'ingress');
 const nameOf = (identity) => {
     if (!identity || identity.includes('\0'))
@@ -58,18 +45,7 @@ export async function commitIngress(store, identity, prepare, verify, storage =
         const bundle = await prepare(ingressReceipts(store));
         if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
             throw Error('REFUSE·ingress evidence and receipt do not verify');
-        mkdirSync(root, { recursive: true });
-        const staged = join(root, '.stage-' + randomUUID());
-        mkdirSync(staged, { mode: 0o700 });
-        try {
-            durableFile(join(staged, 'evidence.bound'), bundle.evidence);
-            durableFile(join(staged, 'receipt.bound'), bundle.receipt);
-            syncDirectory(staged);
-            storage.publish(staged, at);
-        }
-        finally {
-            rmSync(staged, { recursive: true, force: true });
-        }
+        publishBundle(at, { 'evidence.bound': bundle.evidence, 'receipt.bound': bundle.receipt }, storage);
         return measured('landed', bundle);
     });
 }

package/dist/host/ports/local-act.d.ts

@@ -0,0 +1,34 @@
+import type { PublicationStorage } from './publication.ts';
+/** Prepared and verified by the selected Topos admission/result contract. */
+export interface LocalActBundle {
+    readonly records: string;
+    readonly receipt: string;
+    readonly placements?: readonly {
+        place: string;
+        records: string;
+    }[];
+}
+export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
+export declare const actLines: (bytes: string) => readonly string[];
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Committed segments are part of this ledger, not a second authority source. */
+export declare function committedLocalActs(store: string): readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[];
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage): Promise<LocalActBundle & {
+    readonly kind: 'landed' | 'once';
+}>;

package/dist/host/ports/local-act.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheRegions } from "../../land/act.js";
+import { publishBundle, nativePublicationStorage } from "./publication.js";
+import { actIdentity, parse, canonical } from '@lapxo/topos/wire';
+import { fullDigest } from "../digest.js";
+const atOf = (store, identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·act missing identity');
+    return join(store, 'ledger', 'acts', 'committed-' + encodeURIComponent(identity));
+};
+const read = (at) => {
+    try {
+        const placements = readdirSync(at).filter(name => name.startsWith('place-') && name.endsWith('.bound')).map(name => ({
+            place: decodeURIComponent(name.slice(6, -6)), records: readFileSync(join(at, name), 'utf8'),
+        }));
+        return {
+            records: readFileSync(join(at, 'records.bound'), 'utf8'),
+            receipt: readFileSync(join(at, 'receipt.bound'), 'utf8'),
+            ...(placements.length ? { placements } : {}),
+        };
+    }
+    catch (error) {
+        throw Error(`REFUSE·act committed result unreadable · ${error.code ?? 'read failed'}`);
+    }
+};
+export const actLines = (bytes) => {
+    if (!bytes.endsWith('\n'))
+        throw Error('REFUSE·act truncated committed lines');
+    return bytes.slice(0, -1).split('\n');
+};
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export function intactLocalAct(identity, bundle) {
+    if (!bundle.receipt.endsWith('\n') || bundle.receipt.slice(0, -1).includes('\n'))
+        return false;
+    const receipt = parse(bundle.receipt.slice(0, -1));
+    if (receipt.kind !== 'fact' || !bundle.placements?.length)
+        return false;
+    const f = receipt.value.fields;
+    if (canonical(f) !== bundle.receipt.slice(0, -1) || !/^(0|[1-9][0-9]*)$/.test(f['epoch'] ?? ''))
+        return false;
+    if (f['value'] !== identity || f['role'] !== 'writes' || f['form'] !== 'alphabet' || f['measure'] !== 'digest')
+        return false;
+    return actIdentity(actLines(bundle.records), { scope: f['scope'] ?? '', context: f['at'] ?? '',
+        localEpoch: Number(f['epoch']), digest: bytes => fullDigest(bytes, identity.slice(0, identity.indexOf(':'))),
+        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
+    }) === identity;
+}
+/** Committed segments are part of this ledger, not a second authority source. */
+export function committedLocalActs(store) {
+    const root = join(store, 'ledger', 'acts');
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).map(name => {
+        const identity = decodeURIComponent(name.slice(10)), bundle = read(join(root, name));
+        if (!intactLocalAct(identity, bundle))
+            throw Error('REFUSE·act committed journal seal does not verify');
+        return { identity, bundle };
+    }).sort((a, b) => {
+        const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
+        return epoch(a.bundle) - epoch(b.bundle);
+    });
+}
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export function localActResult(store, identity, verify) {
+    const at = atOf(store, identity);
+    if (!existsSync(at))
+        return undefined;
+    const bundle = read(at);
+    if (verify(identity, bundle) !== true)
+        throw Error('REFUSE·act committed result does not verify');
+    return bundle;
+}
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
+    requireEffects('local act commitment');
+    return underTheRegions(store, regions, 'land', async () => {
+        const prior = localActResult(store, identity, verify);
+        if (prior)
+            return { kind: 'once', ...prior };
+        const bundle = await prepare();
+        if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
+            throw Error('REFUSE·act prepared result does not verify');
+        const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
+        for (const p of bundle.placements ?? [])
+            files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
+        publishBundle(atOf(store, identity), files, storage);
+        return { kind: 'landed', ...bundle };
+    });
+}

package/dist/host/ports/publication.d.ts

@@ -0,0 +1,10 @@
+export interface PublicationStorage {
+    publish(staged: string, committed: string): void;
+}
+export declare const nativePublicationStorage: PublicationStorage;
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;

package/dist/host/ports/publication.js

@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+const syncDirectory = (path) => {
+    const fd = openSync(path, 'r');
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+};
+export const nativePublicationStorage = {
+    publish(staged, committed) { renameSync(staged, committed); syncDirectory(dirname(committed)); },
+};
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export function publishBundle(committed, files, storage = nativePublicationStorage) {
+    requireEffects('atomic publication');
+    const entries = Object.entries(files);
+    if (!entries.length || entries.some(([name]) => !name || name === '.' || name === '..' || /[\\/\0]/.test(name))) {
+        throw Error('REFUSE·commit invalid publication members');
+    }
+    const root = dirname(committed);
+    const created = mkdirSync(root, { recursive: true });
+    // Persist newly created directory entries up to their existing parent too.
+    if (created !== undefined)
+        for (let at = root;; at = dirname(at)) {
+            syncDirectory(at);
+            if (at === dirname(created))
+                break;
+        }
+    const staged = join(root, '.stage-' + randomUUID());
+    mkdirSync(staged, { mode: 0o700 });
+    try {
+        for (const [name, bytes] of entries) {
+            const fd = openSync(join(staged, name), 'wx', 0o600);
+            try {
+                writeFileSync(fd, bytes);
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        syncDirectory(staged);
+        storage.publish(staged, committed);
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
+    }
+}

package/dist/host/reading-closures.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime, ReaderReference } from '@lapxo/topos/wire';
 import type { Capsule } from './capsule.ts';
 type File = {
     readonly place: string;
@@ -14,6 +15,8 @@ export declare function readingClosures(options: {
     capsule: Capsule;
     region: string;
     projection: string;
+    readerReference?: ReaderReference;
+    lifetime?: ReaderLifetime;
     allowsEmpty?: boolean;
     files: readonly File[];
     emit?: (line: string) => void;