@lapxo/bound 0.1.5 → 0.1.7

package/dist/cli/accept.js

@@ -1,12 +1,13 @@
+import { commitLocalAct, intactLocalAct, committedLocalActs } from "../host/ports/local-act.js";
 import { withoutEffects } from "../host/read-only.js";
-import { selectedWireAt } from "../host/selected-topos.js";
+import { admittedLine } from "../host/selected-topos.js";
 import { timing } from "../host/timing.js";
 import { admittedObjects } from "../host/objects.js";
 import { existsSync, rmdirSync, rmSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { closeReceipts, instrumentKeep, instrumentKept } from "../fold/closed.js";
 import { bytesDigest, fullDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
-import { canonical, fromLine, LOCK, parse } from '@lapxo/topos/wire';
+import { canonical, LOCK, parse, actIdentity, actResultProfile } from '@lapxo/topos/wire';
 import { fieldOf, isConfig, foldClaims, sayingOf, selfName } from "../fold/claims.js";
 import { isReaderLock } from "../fold/observed.js";
 import { authorityFor, publicKeyOf, rootSigner, writerFor } from "../fold/signers.js";
@@ -35,6 +36,7 @@ import { outsideTheirCapsule } from "../fold/own.js";
 import { lateFacts } from "../judge/late.js";
 import { paidOf } from "../fold/paid.js";
 import { aliasPinned } from "../land/alias.js";
+import { admitStandingPins } from "../land/standing-pin.js";
 import { coordinatesWithdrawn } from "../land/leaving.js";
 import { ownerOf, epochOf, localActLines, forksItself, forksJoinedBy, renderInto, sideOf, signedDemands, signedOwnerLines } from "./owner.js";
 import { claimLinesIn, entryOf, namedPlaces, placesOfFile, positionalsOf, valueOf } from "./args.js";
@@ -110,6 +112,16 @@ function refusesAdmission(root, signed, standing) {
     }
     return false;
 }
+function refusesStandingPins(root, lines) {
+    try {
+        admitStandingPins(root, lines);
+        return false;
+    }
+    catch (error) {
+        process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)}\n`);
+        return true;
+    }
+}
 /** A batch signed as accept signs it: at the next epoch, by the key it names, each line read by the wire it would land under. */
 export async function signedBatch(root, args, files) {
     const byFile = files.map((file) => [placesOfFile(file), claimLinesIn(file)]);
@@ -134,7 +146,9 @@ export async function signedBatch(root, args, files) {
         process.stderr.write(`${selfName()}: REFUSE·place nothing landed · ${stray.join(', ')} is no place of the tree, and no line of the root founds it: --place names the own lock a line lands in\n`);
         return { kind: 'exit', code: 2 };
     }
-    const epoch = epochOf(localActLines(root, destinations)) + 1;
+    const local = localActLines(root, destinations);
+    const base = { digest: fullDigest(store, local), places: destinations };
+    const epoch = epochOf(local) + 1;
     const stale = proposed.filter((line) => fieldOf(line, 'sig')).flatMap((line) => ((by, key) => (key === undefined || !verifiesOwnerLine(line, key, signaturesOf(store).admitted)
         ? [`${fieldOf(line, 'scope')} · the signature does not hold for ${by || '∅'}`]
         : []))(fieldOf(line, 'by'), publicKeyOf(root, fieldOf(line, 'by'))));
@@ -203,12 +217,14 @@ export async function signedBatch(root, args, files) {
         return got.kind === 'fact' ? [got.value.fields] : [];
     });
     for (const line of signed) {
-        const got = fromLine(line, selectedWireAt(wireLines, Number(fieldOf(line, 'epoch')), foldClaims(signedOwnerLines(store)).standing.filter(one => fieldOf(one, 'scope').startsWith('uses/') && fieldOf(one, 'value') !== 'withdraw')));
+        const got = admittedLine(line, wireLines, Number(fieldOf(line, 'epoch')), foldClaims(signedOwnerLines(store)).standing.filter(one => fieldOf(one, 'scope').startsWith('uses/') && fieldOf(one, 'value') !== 'withdraw'));
         if (got.kind !== 'fact') {
             process.stderr.write(`${selfName()}: REFUSE·wire ${fieldOf(line, 'scope')} · ${got.why} · nothing landed\n`);
             return { kind: 'exit', code: 1 };
         }
     }
+    if (refusesStandingPins(root, signed))
+        return { kind: 'exit', code: 1 };
     const taken = retractedTogether(signed);
     if (taken.length) {
         for (const pair of taken) {
@@ -249,7 +265,7 @@ export async function signedBatch(root, args, files) {
         process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)} · nothing landed\n`);
         return { kind: 'exit', code: 1 };
     }
-    return { kind: 'signed', signed, epoch, ...(drafted.length ? { keyId } : {}) };
+    return { kind: 'signed', signed, epoch, base, ...(drafted.length ? { keyId } : {}) };
 }
 /**
  * accept is one act under the descent of its lines. Every place, then the root where they join, only when those lines
@@ -285,7 +301,7 @@ export async function accept(root, args) {
     const where = every ? 'every place · then the root, where the places join' : regions.length ? regions.map((one) => `${one}/`).join(' · ') : 'the root alone, where the places join';
     process.stdout.write(`ACTS     ${where} · ${owned.ledger.length} lines to the ledger${[...owned.own].map(([place, lines]) => ` · ${lines.length} to ${place}'s own lock`).join('')} · before the lock\n`);
     const asked = Date.now();
-    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger }, started, owned, asked, regions));
+    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger, records: batch.signed }, started, owned, asked, regions));
 }
 async function acceptNow(root, batch, started, owned, asked = started, descent = []) {
     const waited = Date.now() - asked;
@@ -294,7 +310,14 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
     const spent = [`sign ${asked - started}`, `wait ${waited}`];
     const took = timing(spent);
     const { signed, epoch } = batch;
+    if (refusesStandingPins(root, batch.records ?? signed))
+        return 1;
     const store = storeOf(root);
+    const currentBase = fullDigest(store, localActLines(root, batch.base.places));
+    if (currentBase !== batch.base.digest) {
+        process.stderr.write(`${selfName()}: REFUSE·base moved ${batch.base.digest} → ${currentBase} · nothing landed\n`);
+        return 1;
+    }
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed]);
@@ -348,9 +371,31 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
         process.stderr.write(`OPEN     ${name}\n`);
     if (owned.own.size)
         layReleases(store, root, told.standing, store);
-    const landed = took('land', () => [...new Set(signed.map((line) => fieldOf(line, 'by')))].map((by) => land(store, by, signed.filter((line) => fieldOf(line, 'by') === by))));
+    const resultProfile = actResultProfile(snapshot.standing);
+    let landed = [];
+    if (resultProfile) {
+        const records = batch.records ?? signed;
+        const placements = [...(signed.length ? [{ place: '.', records: signed }] : []), ...[...owned.own].map(([place, records]) => ({ place: `${place}/${LOCK}`, records }))];
+        const digest = (bytes) => bytesDigest(store, new TextEncoder().encode(bytes));
+        const identity = actIdentity(records, { ...resultProfile, digest, placements, localEpoch: epoch });
+        const folder = writerFor(snapshot.standing, 'fold');
+        if (!folder)
+            throw Error('REFUSE·act native result requires a declared fold identity');
+        const receipt = canonical({ scope: resultProfile.scope, at: resultProfile.context, role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: folder, epoch: String(epoch) });
+        const bundle = { records: records.join('\n') + '\n', receipt: receipt + '\n', placements: placements.map(p => ({ place: p.place, records: p.records.join('\n') + '\n' })) };
+        await commitLocalAct(store, identity, descent, async () => bundle, intactLocalAct);
+        // Commitment precedes projections and conformance work. If either fails,
+        // this public identity still names the admitted act; it is never rollback.
+        process.stdout.write(`ACT ${identity} · epoch ${epoch} · admitted · conformance not asserted\n`);
+        for (const line of records)
+            process.stdout.write(line + '\n');
+        process.stdout.write(receipt + '\n');
+        landed = [{ at: 'committed act ' + identity, appended: records.length }];
+    }
+    else
+        landed = took('land', () => [...new Set(signed.map(line => fieldOf(line, 'by')))].map(by => land(store, by, signed.filter(line => fieldOf(line, 'by') === by))));
     for (const [place, lines] of owned.own)
-        landOwned(root, place, lines);
+        landOwned(root, place, lines, resultProfile !== undefined);
     landSaid(store, writerFor(told.standing, 'fold'), []);
     for (const line of signed) {
         const value = fieldOf(line, 'value');
@@ -419,6 +464,10 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
  */
 function repaid(root, proposed, started) {
     const store = storeOf(root);
+    const prior = committedLocalActs(store).find(act => { const lines = act.bundle.records.trimEnd().split('\n'); return lines.length === proposed.length && lines.every((line, i) => line === proposed[i]); });
+    if (prior) {
+        process.stdout.write(`ACT ${prior.identity} · epoch ${fieldOf(prior.bundle.receipt.trim(), 'epoch')} · admitted · replay\n` + prior.bundle.records + prior.bundle.receipt);
+    }
     const asked = new Set(proposed.filter((line) => fieldOf(line, 'role') === 'demands').map((line) => fieldOf(line, 'scope')));
     const view = `${wordOf(foldClaims(signedOwnerLines(store)).standing, 'families', 'view')}/`;
     const standingAsked = signedDemands(store).filter((line) => asked.has(fieldOf(line, 'scope')) && !fieldOf(line, 'scope').startsWith(view));

package/dist/cli/act-result.d.ts

@@ -0,0 +1,3 @@
+/** Public query of a committed identity, using the same admission authority.
+ * Native fold evidence has store provenance; it never grants coverage. */
+export declare function printActResult(root: string, identity: string | undefined): void;

package/dist/cli/act-result.js

@@ -0,0 +1,48 @@
+import { actResultOf, actResultProfile } from '@lapxo/topos/wire';
+import { actLines, intactLocalAct, localActResult } from "../host/ports/local-act.js";
+import { storeOf } from "../land/ledger.js";
+import { lockStanding } from "../fold/keys.js";
+import { authorityFor, writerFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, isConfig, foldClaims } from "../fold/claims.js";
+import { ownRecordAdmitted } from "../fold/signed.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { fullDigest } from "../host/digest.js";
+import { wordOf, wireLine } from "../fold/wire.js";
+import { viewsOf } from "../fold/views.js";
+/** Public query of a committed identity, using the same admission authority.
+ * Native fold evidence has store provenance; it never grants coverage. */
+export function printActResult(root, identity) {
+    const store = storeOf(root), standing = lockStanding(store);
+    const view = viewsOf(standing).get('act');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'act'))
+        throw Error('REFUSE·view act requires an admitted result profile and act view');
+    if (!identity)
+        throw Error('REFUSE·act name one committed identity');
+    const bundle = localActResult(store, identity, intactLocalAct);
+    if (!bundle)
+        throw Error('REFUSE·act no committed result ' + identity);
+    const records = actLines(bundle.records), epoch = Number(fieldOf(bundle.receipt.trim(), 'epoch'));
+    const history = admissionHistoryAt(root, epoch), before = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) < epoch);
+    const algorithms = eraOf(foldClaims(before).standing).admitted;
+    const authority = authorityFor(history, admissionAnchor(root), algorithms);
+    const admittedBefore = foldClaims(before.filter(line => authority.of(line).kind === 'admitted')).standing;
+    const profile = actResultProfile(admittedBefore);
+    if (!profile)
+        throw Error('REFUSE·act no result profile at admission');
+    const family = authority.admitted.some(signer => !signer.coverage.includes('*')) ? wordOf(admittedBefore, 'families', 'region') : '';
+    const algorithm = identity.slice(0, identity.indexOf(':'));
+    const named = fieldOf(wireLine(admittedBefore, 'digest-algorithms') ?? '', 'value').split('|').map(value => value.split(':')[0]);
+    if (!named.includes(algorithm))
+        throw Error('REFUSE·act digest algorithm was not admitted at commitment');
+    const result = actResultOf(records, bundle.receipt.trim(), { ...profile, localEpoch: epoch,
+        digest: bytes => fullDigest(bytes, algorithm),
+        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
+        admitsRecord: line => {
+            if (isConfig(line) && Number(fieldOf(line, 'epoch')) !== epoch)
+                return false;
+            return bundle.placements.some(p => actLines(p.records).includes(line) && (p.place === '.' ? authority.of(line).kind === 'admitted' : ownRecordAdmitted(line, p.place.slice(0, p.place.lastIndexOf('/')), family, authority.admitted, algorithms)));
+        },
+        verifiesReceipt: line => fieldOf(line, 'by') === writerFor(admittedBefore, 'fold') && intactLocalAct(identity, bundle), });
+    process.stdout.write(`ACT ${result.identity} · epoch ${result.epoch} · admitted · conformance not asserted\n` + bundle.records + bundle.receipt);
+}

package/dist/cli/owner.js

@@ -1,3 +1,4 @@
+import { committedLocalActs } from "../host/ports/local-act.js";
 import { fileURLToPath } from 'node:url';
 import { ingressReceipts } from "../host/ports/ingress.js";
 import { readOnly } from "../host/read-only.js";
@@ -12,7 +13,7 @@ import { authorityFor, releaseSigner, rootSigner } from "../fold/signers.js";
 import { storeRoot } from "../host/ports/store.js";
 import { blobAt, landBlob, ledgerLines, storeOf } from "../land/ledger.js";
 import { observeText } from "../observe/files.js";
-import { appliedIn } from "../fold/signed.js";
+import { appliedHistoryIn } from "../fold/signed.js";
 import { everLanded, inside, locationsOf } from "../land/vouched.js";
 import { renderTarget } from "../render/target.js";
 export const ownerOf = (store, told = []) => keyFor(store, 'authorize', told);
@@ -60,7 +61,7 @@ export function localActLines(root, placed = []) {
                 throw Error('REFUSE·ingress local import receipt is not admitted');
         }
     }
-    return [...local, ...receipts, ...placed.flatMap(place => appliedIn(root, place))];
+    return [...local, ...receipts, ...committedLocalActs(store).map(act => act.bundle.receipt.trim()), ...placed.flatMap(place => appliedHistoryIn(root, place))];
 }
 export function epochOf(lines) {
     return lines.reduce((top, line) => Math.max(top, Number(fieldOf(line, 'epoch')) || 0), 0);

package/dist/cli/pass.js

@@ -13,12 +13,12 @@ import { algorithmCost, instrumentOf, instrumentDigest } from "../fold/digests.j
 import { writerFor } from "../fold/signers.js";
 import { defaulted, placesOf, viewsOf } from "../fold/views.js";
 import { ownLockOf } from "../fold/signed.js";
-import { worldAt, worldsIn } from "../fold/places.js";
+import { localDirectoriesIn, worldAt, worldsIn } from "../fold/places.js";
 import { wordsOf } from "../fold/wire.js";
 import { land, ledgerLines, replaceWhole, storeOf } from "../land/ledger.js";
 import { holdRoot, holds, underTheLock } from "../land/act.js";
 import { emptyLedger, sayStranger } from "../fold/stranger.js";
-import { entriesIn, observeFile, observeText } from "../observe/files.js";
+import { observeFile, observeText } from "../observe/files.js";
 import { render, renderedOf, unrendered, viewOf } from "../render/view.js";
 import { releasePolicyLines } from "../fold/release-policy.js";
 import { carriedFrom } from "../fold/resolved.js";
@@ -90,7 +90,9 @@ export async function pass(root, entry, under, check) {
         if (!swept.written.length)
             await closeReceipts(root, storeOf(root));
         const closed = meets(root, storeOf(root), under ?? '') && !swept.written.length;
-        const fold = foldPlace(root, entry, under, false, { standing: swept.standingAt.get(under ?? '') ?? standingOf(root, under), observed: swept.settled ? [] : swept.observed.length ? swept.observed : observedClaims(root, storeOf(root), { wait: false }), free: !swept.settled });
+        // Sealed files do not imply an empty reading. If a retained fold is stale,
+        // foldPlace must reload its evidence; a valid retained fold still costs no read.
+        const fold = foldPlace(root, entry, under, false, { standing: swept.standingAt.get(under ?? '') ?? standingOf(root, under), ...(swept.settled ? {} : { observed: swept.observed.length ? swept.observed : observedClaims(root, storeOf(root), { wait: false }) }), free: !swept.settled });
         for (const line of releasePolicyLines(fold.release))
             process.stdout.write(`${line}\n`);
         if (closed) {
@@ -166,7 +168,7 @@ async function sweep(root, entry, under, check, told, journal, given, keep, reac
         return picked.length ? picked : [...worldPlaces];
     };
     const placeless = views.filter((view) => !worldList.includes(view.name) && !placesOf(lock.standing, view).length);
-    const holding = entriesIn(root).filter((entry) => entry.dir && placeless.some((view) => observeText(join(root, entry.name, view.shape)) !== undefined)).map((entry) => `${entry.name}/`);
+    const holding = localDirectoriesIn(root).filter((name) => placeless.some((view) => observeText(join(root, name, view.shape)) !== undefined)).map((name) => `${name}/`);
     const descended = (place) => !limited || descent.some((one) => one === '' || place === `${one}/` || place.startsWith(`${one}/`));
     const reached = limited ? descent.filter((one) => one !== '').map((one) => (one.endsWith('/') ? one : `${one}/`)) : [];
     const places = [...new Set([...views.flatMap(resolved), ...holding, ...reached])]

package/dist/cli/place.d.ts

@@ -69,6 +69,6 @@ export declare function coneOf(root: string, entry: string, ceilings: readonly s
 export declare const ownCeilings: (under?: string) => readonly string[];
 export declare function foldPlace(root: string, entry: string, under?: string, look?: boolean, given?: {
     readonly standing: ReturnType<typeof standingOf>;
-    readonly observed: readonly string[];
+    readonly observed?: readonly string[];
     readonly free?: boolean;
 }): PlaceFold;

package/dist/cli/place.js

@@ -195,7 +195,7 @@ export function foldPlace(root, entry, under, look = true, given) {
     const closed = meets(root, store, under ?? '');
     const digestMs = Date.now() - digestAt;
     if (closed && given?.free !== true) {
-        const prior = keptPlace(store, under);
+        const prior = keptPlace(store, under, instrumentOf(store, entry, standingOf(root).standing, root, ownLock()));
         if (prior !== undefined) {
             process.stderr.write(`CLOSED   ${under || '.'} · digest ${digestMs} ms\n`);
             return { ...prior, kept: true };

package/dist/cli/release-result.d.ts

@@ -0,0 +1,5 @@
+/** Judge an external signed approval without landing it, fetching its source,
+ * executing a provider, or changing the release-policy verdict of the place.
+ * The anchor is the place's key, never a key offered by the approval. */
+export declare function releaseApproval(lock: readonly string[], lines: readonly string[]): string;
+export declare function printReleaseApproval(root: string, file: string): void;

package/dist/cli/release-result.js

@@ -0,0 +1,80 @@
+import { parse } from '@lapxo/topos/wire';
+import { authorityFor, writerFor, releaseSigner } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims } from "../fold/claims.js";
+import { observeText } from "../observe/files.js";
+import { claimLinesIn } from "./args.js";
+import { LOCK } from '@lapxo/topos/wire';
+import { join } from 'node:path';
+/** Judge an external signed approval without landing it, fetching its source,
+ * executing a provider, or changing the release-policy verdict of the place.
+ * The anchor is the place's key, never a key offered by the approval. */
+export function releaseApproval(lock, lines) {
+    const standing = foldClaims(lock).standing;
+    const id = writerFor(standing, 'authorize');
+    if (!id)
+        throw Error('REFUSE·release place names no authorizer');
+    const one = (rows, scope, measure) => {
+        const selected = rows.filter(line => fieldOf(line, 'scope') === scope && (!measure || fieldOf(line, 'measure') === measure) && fieldOf(line, 'value') !== 'withdraw');
+        if (selected.length !== 1)
+            throw Error(`REFUSE·release ${scope} needs one declaration`);
+        return fieldOf(selected[0], 'value');
+    };
+    const anchor = { ...releaseSigner(standing), id, publicKey: one(standing, `keys/${id}`, 'public-key'), coverage: one(standing, `keys/${id}`, 'coverage').split('|') };
+    if (!lines.length)
+        throw Error('REFUSE·release empty approval');
+    for (const line of lines) {
+        const got = parse(line);
+        if (got.kind !== 'fact')
+            throw Error('REFUSE·release malformed approval');
+        if (got.value.fields['by'] !== id || !got.value.fields['sig'])
+            throw Error(`REFUSE·release approval must be signed by ${id}`);
+    }
+    // A separate release place may declare an era; its configuration must itself
+    // authenticate against the existing anchor. No packet key or coverage is used.
+    const wire = lines.filter(line => ['wire/signature-algorithms', 'audit/wire/signature-algorithms', 'wire/era', 'audit/wire/era'].includes(fieldOf(line, 'scope')));
+    let era;
+    try {
+        era = eraOf(wire.length ? foldClaims(wire).standing : standing);
+    }
+    catch {
+        throw Error('REFUSE·release signature era is absent or conflicting');
+    }
+    const authority = authorityFor([], anchor, era.admitted);
+    for (const line of lines) {
+        const verdict = authority.of(line);
+        if (verdict.kind !== 'admitted')
+            throw Error(`REFUSE·release ${fieldOf(line, 'scope')}: ${verdict.why ?? verdict.kind}`);
+    }
+    const released = lines.filter(line => /^release\/[^/]+$/.test(fieldOf(line, 'scope')) && fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'role') === 'writes');
+    if (released.length !== 1)
+        throw Error('REFUSE·release needs one signed release/<tag> digest');
+    const required = (scope, measure) => {
+        const selected = lines.filter(line => fieldOf(line, 'scope') === scope);
+        if (selected.some(line => fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'measure') !== measure))
+            throw Error(`REFUSE·release ${scope} is not an approval declaration`);
+        return one(selected, scope, measure);
+    };
+    const digest = required(fieldOf(released[0], 'scope'), 'digest'), name = required('release/artifact', 'id'), source = required('sources/archive', 'id');
+    if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+        throw Error('REFUSE·release archive needs sha256');
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
+        throw Error('REFUSE·release artifact needs one safe filename');
+    let url;
+    try {
+        url = new URL(source);
+    }
+    catch {
+        throw Error('REFUSE·release archive source needs an absolute URL');
+    }
+    if (url.username || url.password || /[\s\x00-\x1f\x7f]/.test(source))
+        throw Error('REFUSE·release archive source needs a credential-free absolute URL without whitespace');
+    return `READY ${digest} ${name} ${source}`;
+}
+export function printReleaseApproval(root, file) {
+    const text = observeText(file);
+    if (text === undefined)
+        throw Error('REFUSE·release approval file is absent');
+    const lines = text.split('\n').filter(line => line.trim().length > 0);
+    process.stdout.write(releaseApproval(claimLinesIn(join(root, LOCK)), lines) + '\n');
+}

package/dist/cli/standing-result.d.ts

@@ -0,0 +1,5 @@
+/** An evidence projection, never a new authority lock. Authentication uses
+ * the admission snapshot at each local epoch; the existing fold applies
+ * supersessions and withdrawals across all declared classes. Storage layout
+ * and delivery mode do not enter this public boundary. */
+export declare function printStandingResult(root: string): void;

package/dist/cli/standing-result.js

@@ -0,0 +1,39 @@
+import { viewsOf } from "../fold/views.js";
+import { lockStanding } from "../fold/keys.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authorityFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims } from "../fold/claims.js";
+import { storeOf } from "../land/ledger.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+/** An evidence projection, never a new authority lock. Authentication uses
+ * the admission snapshot at each local epoch; the existing fold applies
+ * supersessions and withdrawals across all declared classes. Storage layout
+ * and delivery mode do not enter this public boundary. */
+export function printStandingResult(root) {
+    const store = storeOf(root), view = viewsOf(lockStanding(store)).get('standing');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
+        throw Error('REFUSE·view standing requires a declared standing view');
+    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            const snapshot = admissionHistoryAt(root, epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    process.stdout.write(standing.length ? standing.join('\n') + '\n' : '');
+}

package/dist/cli/verb.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
+import { printReleaseApproval } from "./release-result.js";
+import { printActResult } from "./act-result.js";
+import { printStandingResult } from "./standing-result.js";
 import { withContentStore } from "../host/content-store.js";
-import { withoutEffects } from "../host/read-only.js";
+import { readOnly, withoutEffects } from "../host/read-only.js";
+import { layReleases } from "../host/release.js";
 import { resolveSources, resolveRequested } from "../host/source-content.js";
 import { cellsWithReceipts } from "../host/cell-receipts.js";
 import { renderCells } from '@lapxo/topos/cells-view';
@@ -188,6 +192,18 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
         process.stderr.write(`${selfName()}: the owner ledger is empty; land it before rendering a view\n`);
         return EXIT.refuse;
     }
+    if (name === 'act') {
+        if (under || told.length)
+            throw Error('REFUSE·act committed identity query only');
+        printActResult(root, coord);
+        return EXIT.closed;
+    }
+    if (name === 'standing') {
+        if (under || told.length || coord || depth !== undefined)
+            throw Error('REFUSE·standing local committed projection only');
+        printStandingResult(root);
+        return EXIT.closed;
+    }
     if (name === 'evidence' && !under && !told.length && ingressBundles(storeOf(root)).length) {
         const declared = viewsOf(lockStanding(storeOf(root))).get(name);
         if (!declared || declared.shape || !declared.regions.some(region => region.name === 'evidence'))
@@ -224,6 +240,10 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
         }
     }
     const own = place ? rest.filter((line) => admittedIn(root, place, line)) : [];
+    // Executed views use the place's declared mounts before observation, as pass
+    // does. Prospective folds and public standing queries do not lay releases.
+    if (!told.length && !readOnly())
+        layReleases(storeOf(root), root, standingOf(root, under).standing, storeOf(root));
     const fold = told.length
         ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }), free: true })
         : foldPlace(root, entryOf(root), under, true);
@@ -440,12 +460,18 @@ async function foldAt(root, under, argv) {
 async function foldRequested(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
     const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
-    if (as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+    if (as === 'release' || as?.split('@')[0] === 'act' || as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
         return foldResolved(root, under, argv);
     return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
 }
 async function foldResolved(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
+    if (as === 'release') {
+        const approvals = positionalsOf(argv).filter(one => !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
+        if (approvals.length !== 1 || argv.includes(FLAGS.check))
+            throw Error('REFUSE·release name one approval file; check does not authorize delivery');
+        return withoutEffects(() => { printReleaseApproval(under ? resolve(root, under) : root, resolve(approvals[0])); return EXIT.closed; });
+    }
     const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
     // Public content is authenticated by its digest, independently of owner history.
     // A named view does not request mounting every release of the instrument.
@@ -497,6 +523,11 @@ async function foldResolved(root, under, argv) {
     }
     const named = inputs;
     const coord = positionalsOf(argv).find((one) => one !== under?.replace(/\/$/, '') && !one.startsWith('-') && !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
+    if (as === 'act') {
+        if (positionalsOf(argv).length !== 1)
+            throw Error('REFUSE·act name one committed identity');
+        return view(root, under, as, [], coord);
+    }
     if ((as === 'why' || as === NAMED_VIEWS.because || as.split('@')[0] === 'why') && coord !== undefined)
         return view(root, under, as === NAMED_VIEWS.because ? 'why' : as, [], coord, key);
     if (!named.length)

package/dist/fold/admission-history.d.ts

@@ -0,0 +1,6 @@
+import type { Signer } from '@lapxo/topos/wire';
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export declare function admissionHistoryAt(root: string, epoch: number): readonly string[];
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export declare function admissionAnchor(root: string): Signer;

package/dist/fold/admission-history.js

@@ -0,0 +1,22 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { ledgerLines, ledgerWriters, storeOf } from "../land/ledger.js";
+import { fieldOf, isConfig, selfName } from "./claims.js";
+/** Local admission history only. Foreign ingress is evidence, never coverage.
+ * The clock cutoff is meaningful for configuration; object clocks stay intact. */
+export function admissionHistoryAt(root, epoch) {
+    const store = storeOf(root);
+    return [...new Set(ledgerWriters(store).flatMap(writer => ledgerLines(store, writer)))]
+        .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
+}
+/** The existing bootstrap's public root of trust, not today's key selection. */
+export function admissionAnchor(root) {
+    const at = join(storeOf(root), `${selfName()}.keys`);
+    const keys = JSON.parse(readFileSync(at, 'utf8'));
+    const anchors = Object.values(keys);
+    if (anchors.length !== 1 || !anchors[0]?.publicKey || !anchors[0].coverage.length)
+        throw Error('REFUSE·act historical admission requires one bootstrap anchor');
+    const anchor = anchors[0];
+    return { id: anchor.id, keyClass: 'authorize', publicKey: anchor.publicKey, coverage: anchor.coverage,
+        depth: { lo: 1, hi: 16 }, admittedBy: [] };
+}

package/dist/fold/closed.js

@@ -4,7 +4,7 @@ import { dirname, existsSync, join, mkdirSync, relative, resolve, statSync, writ
 import { byBytes, canonical, LOCK, parse, publicationOf, roleAt, roleClaimsOf } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, foldClaims, isConfig, isWire } from "./claims.js";
 import { bytesDigest as hashBytes, fullDigest as hashFull } from "../host/digest.js";
-import { worldAt } from "./places.js";
+import { mountedCoordinatesIn, worldAt } from "./places.js";
 import { ownLockOf } from "./signed.js";
 import { viewsOf } from "./views.js";
 import { storeAt, storeOf } from "../land/ledger.js";
@@ -31,6 +31,7 @@ const lockStamp = (root, place) => {
         return 'none';
     }
 };
+const publishedMounts = (root) => mountedCoordinatesIn(root, (observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire));
 function filesOf(root, place, region, inputs) {
     const step = region.replace(/^receipts\//, '').replace(/\/$/, '');
     const here = join(root, place);
@@ -41,7 +42,10 @@ function filesOf(root, place, region, inputs) {
         const record = parse(line);
         return record.kind === 'fact' ? [record.value.fields] : [];
     }));
-    const owned = coordinatesUnder(join(here, step), root).filter(rel => roleAt(relative(here, join(root, rel)), claims) !== 'foreign');
+    const localMounts = [...mountedCoordinatesIn(here), ...publishedMounts(here)];
+    const mounts = [...new Set([...mountedCoordinatesIn(root), ...publishedMounts(root), ...localMounts.map(coordinate => relative(root, join(here, coordinate)))])];
+    const owned = coordinatesUnder(join(here, step), root).filter(rel => roleAt(relative(here, join(root, rel)), claims) !== 'foreign'
+        && !mounts.some(mount => rel === mount || rel.startsWith(`${mount}/`)));
     // Foreign worlds are not the place's tree. Retain the external files actually handed to its readers.
     const observed = inputs.filter(line => fieldOf(line, 'measure') === 'observed').flatMap(line => {
         const coordinate = fieldOf(line, 'scope');
@@ -101,11 +105,13 @@ function namedReceipts(root, store) {
     const text = observeText(join(root, RECEIPTS));
     const carried = carriedFrom(store, (text ?? '').split('\n').filter(isWire));
     const out = new Map();
+    const mounted = new Set(mountedCoordinatesIn(root));
     for (const line of carried ?? []) {
         if (!isWire(line) || fieldOf(line, 'measure') !== 'digest')
             continue;
         const place = /^write\/([^/]+)\/receipts\.bound$/.exec(fieldOf(line, 'scope'))?.[1];
-        if (place)
+        // A retained dependency receipt is input evidence, not a child-place closure.
+        if (place && !mounted.has(place))
             out.set(place, fieldOf(line, 'value'));
     }
     return out;

package/dist/fold/digests.js

@@ -1,5 +1,6 @@
+import { ledgerLines, ledgerWriters } from "../land/ledger.js";
 import { readOnly } from "../host/read-only.js";
-import { appendFileSync, dirname, join, mkdirSync, readdirSync, relative, resolve } from "../host/io.js";
+import { appendFileSync, dirname, join, mkdirSync, readdirSync, realpathSync, relative, resolve } from "../host/io.js";
 import { bytesDigest as bytesWith, fullDigest as fullWith } from "../host/digest.js";
 import { coordinatesUnder, observeFile, observeText, stampOf } from "../observe/files.js";
 import { releaseOf, signedLockLines } from "./keys.js";
@@ -32,10 +33,8 @@ function namedAlgorithm(store) {
         const contract = published === undefined ? undefined : wireLine(published, 'digest-algorithms');
         return contract === undefined ? undefined : fieldOf(contract, 'value').split('|')[0]?.split(':')[0];
     }
-    for (const entry of readdirSync(join(store, 'ledger'), { withFileTypes: true })) {
-        if (!entry.isFile() || !entry.name.endsWith(EXTENSION))
-            continue;
-        const text = observeText(join(store, 'ledger', entry.name)) ?? '';
+    for (const writer of ledgerWriters(store)) {
+        const text = ledgerLines(store, writer).join('\n');
         let from = 0;
         while (from < text.length) {
             const at = (() => {
@@ -176,14 +175,19 @@ export function instrumentCoordinates(store, entry, standing = [], root = dirnam
         const digest = coordinateDigest(store, at);
         if (digest === undefined)
             return;
-        seen.set(at, digest);
-        for (const one of importsOf(store, at, digest)) {
+        // The host loader resolves links before loading a module. Count that module
+        // once, while retaining distinct modules even when their bytes are equal.
+        const module = realpathSync(at);
+        if (seen.has(module))
+            return;
+        seen.set(module, digest);
+        for (const one of importsOf(store, module, digest)) {
             if (one.startsWith('node:') || builtinModules.includes(one))
                 continue;
             if (one.startsWith('.'))
-                walk(resolve(dirname(at), one));
+                walk(resolve(dirname(module), one));
             else
-                walk(createRequire(at).resolve(one));
+                walk(createRequire(module).resolve(one));
         }
     };
     walk(resolve(entry));

package/dist/fold/kept.d.ts

@@ -23,7 +23,7 @@ export declare function movedPoints(store: string, now: readonly string[], key:
     readonly came: readonly string[];
 } | undefined;
 export declare const foldsElsewhere: () => number;
-export declare function keptPlace(store: string, under?: string): PlaceFold | undefined;
+export declare function keptPlace(store: string, under?: string, currentInstrument?: string): PlaceFold | undefined;
 export declare const keptRender: (store: string, key: string, name: string) => string | undefined;
 export declare const keepRender: (store: string, _signer: string, key: string, name: string, _epoch: number, text_: string) => void;
 export declare function keepFold(store: string, key: string, fold: PlaceFold, points: readonly string[], instrument?: string): void;