@lapxo/bound 0.1.5 → 0.1.7

package/dist/fold/kept.js

@@ -1,8 +1,9 @@
+import { actLines, committedLocalActs } from "../host/ports/local-act.js";
 import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
-import { landMemo, ledgerLines, memoAt, shardFile, writerFile } from "../land/ledger.js";
+import { landMemo, ledgerLines, ledgerWriters, memoAt, shardFile, writerFile } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { EXTENSION, fieldOf } from "./claims.js";
 import { keyFor, keyOf, lockSigners } from "./keys.js";
@@ -36,7 +37,7 @@ export function foldPoints(store, standing, under, keeper, instrument = '', obse
         `take ${digestOf(ledgerLines(store, 'take').filter((line) => reads.scopes.has(fieldOf(line, 'scope').replace(/^take\//, ''))))}`,
         `tree ${digestOf(ledgerLines(store, tree ?? '').filter((line) => (sourceOf(line) ?? '').startsWith(reads.place)))}`,
     ];
-    const heads = (existsSync(join(store, 'ledger')) ? readdirSync(join(store, 'ledger')) : []).filter((name) => name.endsWith(EXTENSION)).map((name) => name.slice(0, -EXTENSION.length))
+    const heads = ledgerWriters(store)
         .filter((writer) => writer !== keeper && writer !== 'gate' && !writer.startsWith('reader') && !(reads && (signers.has(writer) || writer === 'judge' || writer === 'take' || writer === tree)))
         .map((writer) => `${writer} ${writer === liveWriter(store, standing) ? lastWord(store, writer) : bytesDigest(store, text(ledgerLines(store, writer).join('\n')))}`);
     const written = [...new Set([...viewsOf(standing).values()].flatMap((view) => ('regions' in view && view.shape ? [view.shape] : [])))].sort()
@@ -100,10 +101,20 @@ function readingContext(store) {
     const speaker = keyOf(store, 'read');
     const files = speaker === undefined ? [] : [writerFile(store, speaker), ...coordinatesUnder(dirname(shardFile(store, speaker, '')), store)
             .filter(file => file.endsWith(EXTENSION)).map(file => join(store, file))];
-    return bytesDigest(store, text(files.filter(file => existsSync(file)).sort()
-        .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())).join('\n')));
+    const segments = speaker === undefined ? [] : committedLocalActs(store).flatMap(act => act.bundle.placements?.flatMap(placement => {
+        const records = actLines(placement.records).filter(line => fieldOf(line, 'by') === speaker);
+        return records.length ? [placement.place + '\n' + records.join('\n')] : [];
+    }) ?? []);
+    return bytesDigest(store, text([...files.filter(file => existsSync(file)).sort()
+            .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())), ...segments].join('\n')));
 }
-export function keptPlace(store, under) {
+/** A new judgment changes the result even when the files and reader history do not. */
+function judgmentContext(store, demands) {
+    const scopes = new Set(demands.map(line => fieldOf(line, 'scope')));
+    return bytesDigest(store, text(ledgerLines(store, 'judge')
+        .filter(line => scopes.has(fieldOf(line, 'scope'))).join('\n')));
+}
+export function keptPlace(store, under, currentInstrument) {
     const key = observeText(memoAt(store, lastOf([`place ${under ?? '.'}`])))?.trim();
     if (key === undefined || key === '')
         return undefined;
@@ -114,6 +125,10 @@ export function keptPlace(store, under) {
     if (blob.readingContext !== readingContext(store))
         return undefined;
     const fold = blob.fold;
+    if (currentInstrument !== undefined && fold.instrument !== currentInstrument)
+        return undefined;
+    if (blob.judgmentContext !== judgmentContext(store, linesOf(fold.demands)))
+        return undefined;
     return {
         ...fold,
         standing: linesOf(fold.standing),
@@ -149,7 +164,7 @@ export function keepFold(store, key, fold, points, instrument = '') {
         signed: [...fold.signed],
         kept: false,
     };
-    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store) })));
+    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store), judgmentContext: judgmentContext(store, fold.demands) })));
     const at = memoAt(store, lastOf(points));
     mkdirSync(dirname(at), { recursive: true });
     writeFileSync(`${at}.${process.pid}.part`, `${key}\n`);

package/dist/fold/keys.js

@@ -1,8 +1,10 @@
 import { dirname, existsSync, join } from "../host/io.js";
-import { ledgerLines, signedLines } from "../land/ledger.js";
-import { EXTENSION, fieldOf, foldClaims, isWire, LOCK, selfName } from "./claims.js";
-import { entriesIn, observeText } from "../observe/files.js";
+import { ledgerLines, ledgerWriters, signedLines } from "../land/ledger.js";
+import { fieldOf, foldClaims, isWire, LOCK, selfName } from "./claims.js";
+import { observeText } from "../observe/files.js";
+import { publicLock } from '@lapxo/topos/wire';
 const held = new Map();
+const keyInputs = new Map();
 const merged = new Map();
 /**
  * Whose lines carry a class of writing, as the lock says it. Every ledger the store keeps is read, the key claims
@@ -47,13 +49,15 @@ export function signedLockLines(store, told = []) {
     return lockSigners(store, told).flatMap((id) => signedLines(store, id));
 }
 function keysOf(store, told) {
-    const mine = told.length ? read(store, told) : held.get(store) ?? read(store);
+    const input = ledgerKeyLines(store).join('\n');
+    const mine = told.length ? read(store, told) : keyInputs.get(store) === input ? held.get(store) ?? read(store) : read(store);
+    if (!told.length)
+        keyInputs.set(store, input);
     if (!told.length)
         held.set(store, mine);
     return mine;
 }
-const ledgerKeyLines = (store) => (existsSync(join(store, 'ledger')) ? entriesIn(join(store, 'ledger')).map((entry) => entry.name) : [])
-    .filter((name) => name.endsWith(EXTENSION)).flatMap((name) => ledgerLines(store, name.slice(0, -EXTENSION.length)))
+const ledgerKeyLines = (store) => ledgerWriters(store).flatMap(writer => ledgerLines(store, writer))
     .filter((line) => /\bsig=/.test(line) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
 const releases = new Map();
 /**
@@ -65,13 +69,16 @@ export function releaseOf(store) {
         return releases.get(store);
     const at = join(dirname(store), LOCK);
     const lines = ledgerKeyLines(store).length || !existsSync(at) ? [] : (observeText(at) ?? '').split('\n').filter(isWire);
-    const got = lines.some((line) => fieldOf(line, 'scope') === 'publish/bootstrap' && fieldOf(line, 'value') !== 'withdraw') ? lines : undefined;
+    const published = lines.some(line => fieldOf(line, 'scope').startsWith('keys/') && fieldOf(line, 'measure') === 'public-key' && fieldOf(line, 'sig'))
+        && publicLock(lines) !== undefined;
+    const got = published || lines.some((line) => fieldOf(line, 'scope') === 'publish/bootstrap' && fieldOf(line, 'value') !== 'withdraw') ? lines : undefined;
     releases.set(store, got);
     return got;
 }
 function read(store, told = []) {
-    const said = [...ledgerKeyLines(store), ...releaseOf(store) ?? [], ...told]
-        .filter((line) => /\bsig=/.test(line) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
+    const release = releaseOf(store) ?? [], published = publicLock(release) === undefined ? [] : release;
+    const said = [...ledgerKeyLines(store), ...release, ...told]
+        .filter((line) => (/\bsig=/.test(line) || published.includes(line)) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
     const standing = foldClaims(said).standing.filter((line) => fieldOf(line, 'value') !== 'withdraw')
         .sort((a, b) => (Number(fieldOf(a, 'epoch')) || 0) - (Number(fieldOf(b, 'epoch')) || 0));
     const idOf = (line) => fieldOf(line, 'scope').slice('keys/'.length);

package/dist/fold/observed.js

@@ -267,13 +267,14 @@ export function observedClaims(root, store, options = {}) {
     }
     function observeOne(reader, started) {
         const module = resolve(root, reader.module);
+        const lifetime = readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), { id: reader.id, module: reader.module });
         const asked = reader.capsule === undefined ? undefined : reader.capsule.selected ?? capsuleAt(reader.capsule.digest, reader.capsule.entry);
         const projection = reader.capsule === undefined ? [] : (asked?.lines ?? []).filter(line => fieldOf(line, 'scope') === `region/${reader.capsule.region}` && fieldOf(line, 'measure') === 'input-projection' && fieldOf(line, 'value') !== 'withdraw');
         if (projection.length) {
             if (projection.length !== 1 || !asked)
                 throw Error('REFUSE·input projection is ambiguous ' + reader.module);
             const files = [...new Set(reader.where.flatMap(where => handedAt(root, reader, roleOf, look, where)))].sort().map(place => ({ place, text: observeText(resolve(root, place)) ?? '' }));
-            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
+            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
             out.push(...result.lines);
             ran += result.executed;
             read += result.read - result.opened;
@@ -287,7 +288,7 @@ export function observedClaims(root, store, options = {}) {
             assertReaderInputs(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module, offered.length);
             const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
             const kept = whole && legacy === undefined && answered === undefined && source ? sha([
-                speaker, reader.module, reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
+                speaker, reader.module, JSON.stringify(lifetime), reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
                 reader.capsule === undefined ? '' : `${reader.capsule.selected?.selection ?? reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
                 ...offered.map((offer) => `${offer.place} ${offer.digest?.() ?? bytesDigest(store, offer.bytes())}`),
             ].join('\n')) : undefined;
@@ -302,9 +303,9 @@ export function observedClaims(root, store, options = {}) {
             const home = regionIn(regions, reader.module);
             const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}`);
             const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value'));
-            const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
-            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}`).slice(0, 12) : 'none', lines: [] }
-                : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime: readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
+            const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
+            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
+                : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime, kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
                     : { by: 'none', lines: [] };
             const by = measured.by;
             const level = [...measured.lines];
@@ -419,12 +420,12 @@ export function observedClaims(root, store, options = {}) {
                         ? asked.ask(due.map((d) => ({
                             protocol: PROTOCOL, verb: 'read', rootScope: d.place, region: reader.capsule.region, held: heldOf(d.place, d.region),
                             files: (reader.capsule.reads.some((read) => read.includes('@')) ? handedAt(root, reader, roleOf, look, d.place) : [d.place]).map((coordinate) => ({ place: coordinate, text: observeText(resolve(root, coordinate)) ?? '' })),
-                        }))).map((answer) => {
+                        })), { id: reader.id, module: reader.module }).map((answer) => {
                             if (answer?.kind !== 'fact')
                                 throw new Error(`REFUSE·reader ${reader.module} · ${answer?.why ?? 'no capsule answer'}`);
                             return (answer.claims ?? []);
                         })
-                        : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })), readerLifetime(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module));
+                        : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })), lifetime);
                 }
                 catch (error) {
                     const why = `REFUSE·reader ${reader.module} · ${error instanceof Error ? error.message : String(error)}`;

package/dist/fold/places.d.ts

@@ -2,7 +2,11 @@ type Spoken = {
     readonly place: string;
     readonly line: string;
 };
-export declare const placesIn: (root: string) => readonly string[];
+/** A dependency's lock describes the dependency, never a child of its host.
+ * Retiring a mount does not turn its retained bytes into local declarations. */
+export declare function mountedCoordinatesIn(root: string, history?: readonly string[]): readonly string[];
+export declare function localDirectoriesIn(root: string, history?: readonly string[]): readonly string[];
+export declare function placesIn(root: string, history?: readonly string[]): readonly string[];
 /** A directory with no own lock is founded by the root: a line of its region family names the directory's coordinates, and a covered batch that names the place lands its first own lock. */
 export declare const foundableIn: (root: string, standing: readonly string[], family: string, name: string) => boolean;
 export declare const capsuleAt: (root: string, name: string) => boolean;

package/dist/fold/places.js

@@ -1,13 +1,29 @@
 import { join } from "../host/io.js";
-import { CAPSULE, canonical, LOCK, matches, parse } from '@lapxo/topos/wire';
+import { CAPSULE, canonical, EXTENSION, LOCK, matches, parse } from '@lapxo/topos/wire';
+import { lockLines } from "./keys.js";
+import { releasesOf } from "../host/release.js";
+import { archiveCoordinate } from "../host/archive.js";
 import { fieldOf } from "./claims.js";
 import { isCeiling } from "./configures.js";
 import { entriesIn, observeText } from "../observe/files.js";
 import { ownLock } from "../observe/runner.js";
 import { said } from "./wire.js";
 import { ownLockOf } from "./signed.js";
-export const placesIn = (root) => entriesIn(root)
-    .filter((entry) => entry.dir && observeText(join(root, entry.name, LOCK)) !== undefined).map((entry) => entry.name).sort();
+/** A dependency's lock describes the dependency, never a child of its host.
+ * Retiring a mount does not turn its retained bytes into local declarations. */
+export function mountedCoordinatesIn(root, history = lockLines(join(root, EXTENSION))) {
+    return releasesOf(history).flatMap(line => {
+        const needs = fieldOf(line, 'needs');
+        return needs ? [archiveCoordinate(needs)] : [];
+    });
+}
+export function localDirectoriesIn(root, history = lockLines(join(root, EXTENSION))) {
+    const mounts = new Set(mountedCoordinatesIn(root, history));
+    return entriesIn(root).filter(entry => entry.dir && !mounts.has(entry.name)).map(entry => entry.name).sort();
+}
+export function placesIn(root, history = lockLines(join(root, EXTENSION))) {
+    return localDirectoriesIn(root, history).filter(name => observeText(join(root, name, LOCK)) !== undefined);
+}
 /** A directory with no own lock is founded by the root: a line of its region family names the directory's coordinates, and a covered batch that names the place lands its first own lock. */
 export const foundableIn = (root, standing, family, name) => !placesIn(root).includes(name)
     && (entriesIn(root).find((entry) => entry.name === name)?.dir ?? false)

package/dist/fold/readers.js

@@ -43,6 +43,7 @@ const reachOfLine = (module, where) => {
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
     const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
+    const coordinateMeasure = wordOn(standing, 'region-coordinate', ownLock());
     const localMeasures = wordsOf(standing, 'region-measures');
     const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
     const measures = localMeasures.length || !pins.length ? localMeasures
@@ -51,7 +52,7 @@ export function capsuleReadersOf(root, store, standing, lines, resolve = capsule
     const groups = new Map();
     for (const place of ['', ...placesIn(root)]) {
         const where = place ? `${place}/` : '';
-        const own = ownLockOf(root, place).filter((line) => fieldOf(line, 'scope').startsWith('region/') && measures.includes(fieldOf(line, 'measure')) && fieldOf(line, 'value') !== 'withdraw');
+        const own = ownLockOf(root, place).filter((line) => fieldOf(line, 'scope').startsWith('region/') && measures.includes(fieldOf(line, 'measure')) && fieldOf(line, 'measure') === coordinateMeasure && fieldOf(line, 'value') !== 'withdraw');
         const offered = [...own, ...(capsuleAt(root, place) ? world.filter((line) => !own.some((one) => fieldOf(one, 'scope') === fieldOf(line, 'scope'))) : [])];
         if (!offered.length)
             continue;

package/dist/fold/release-policy.js

@@ -92,8 +92,6 @@ export function releasePolicyLines(result) {
     if (result === undefined)
         return [];
     const gates = (result.gates ?? []).map(g => `GATE     ${g.scope} ${g.status} · requires=${g.required.join('|')} · ${g.evidence.map(e => `${e.coordinate}=${e.value}`).join(' | ') || g.reason || 'no evidence'}`);
-    if (result.status === 'absent')
-        return gates;
     return [
         ...gates,
         `RELEASE  policy ${result.status} · fold ${result.snapshot.fold} · instrument ${result.snapshot.instrument}`,

package/dist/fold/signed.d.ts

@@ -1,3 +1,4 @@
+import { authorityFor } from './signers.ts';
 /** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
 export declare const tellOwn: (place: string, lines: readonly string[]) => void;
 /**
@@ -16,3 +17,7 @@ export declare const admittedIn: (root: string, place: string, line: string) =>
 export declare const appliedIn: (root: string, place: string) => readonly string[];
 export declare const forksIn: (root: string, place: string) => readonly string[];
 export declare const writtenIn: (root: string, place: string) => number;
+/** Authenticated history excludes prospective lines told only for admission. */
+export declare const appliedHistoryIn: (root: string, place: string) => readonly string[];
+/** Shared signature/window/coordinate coverage boundary for own history. */
+export declare function ownRecordAdmitted(line: string, place: string, family: string, signers: ReturnType<typeof authorityFor>['admitted'], algorithms: readonly string[]): boolean;

package/dist/fold/signed.js

@@ -13,7 +13,7 @@ const held = new Map();
 const told = new Map();
 /** Lines told to a place's own lock for a preview: folded as if the file held them, and standing only as its signed lines do. */
 export const tellOwn = (place, lines) => void told.set(place, lines);
-function verified(root, place) {
+function verified(root, place, preview = true) {
     const store = storeOf(root);
     const lock = lockLines(store);
     const publicText = observeText(join(root, place, LOCK)) ?? '';
@@ -21,7 +21,7 @@ function verified(root, place) {
     const algorithms = hasAuthority ? signaturesOf(store).admitted : [];
     const signers = algorithms.length ? authorityFor(lock, rootSigner(root), algorithms).admitted : [];
     const history = signers.flatMap(signer => place ? shardLines(store, signer.id, `${place}/${LOCK}`) : ledgerLines(store, signer.id)).filter(line => fieldOf(line, 'sig') !== '');
-    const text = [publicText, ...history, ...(told.get(place) ?? [])].join('\n');
+    const text = [publicText, ...history, ...(preview ? told.get(place) ?? [] : [])].join('\n');
     const key = `${root} ${place}`;
     const last = held.get(key);
     if (last !== undefined && last.text === text && last.lock === lock)
@@ -30,19 +30,7 @@ function verified(root, place) {
     // Unrestricted coverage does not construct a region coordinate. Restricted
     // coverage still requires the lock's declared namespace before comparison.
     const family = signers.some(signer => !signer.coverage.includes('*')) ? wordOf(lockStanding(store), 'families', 'region') : '';
-    const stands = (line) => {
-        const got = parse(line);
-        if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)
-            return false;
-        const fields = got.value.fields;
-        const signer = signers.find((one) => one.id === fields['by']);
-        const epoch = Number(fields['epoch']) || 0;
-        if (signer === undefined || !verifiesFields(fields, signer.publicKey, algorithms))
-            return false;
-        const window = windowAt(signer, epoch);
-        return epoch >= window.start && (window.close === null || epoch <= window.close)
-            && signer.coverage.some((prefix) => prefix === '*' || within(region(`${family}/${place}/${fields['scope'] ?? ''}`, './'), region(prefix, './')));
-    };
+    const stands = (line) => ownRecordAdmitted(line, place, family, signers, algorithms);
     const applied = new Set(lines.filter(stands));
     // A published copy of an authenticated delivery is not another inscription.
     const projected = new Set([...applied].map(sayingOf));
@@ -75,3 +63,19 @@ export const admittedIn = (root, place, line) => verified(root, place).applied.h
 export const appliedIn = (root, place) => [...verified(root, place).applied];
 export const forksIn = (root, place) => ((got) => foldClaims(got.lines.filter((line) => got.applied.has(line) || (!/ sig=/.test(line) && !got.projected.has(sayingOf(line))))).forks.map((fork) => fork.key))(verified(root, place));
 export const writtenIn = (root, place) => ((got) => got.lines.filter((line) => !got.applied.has(line)).length)(verified(root, place));
+/** Authenticated history excludes prospective lines told only for admission. */
+export const appliedHistoryIn = (root, place) => [...verified(root, place, false).applied];
+/** Shared signature/window/coordinate coverage boundary for own history. */
+export function ownRecordAdmitted(line, place, family, signers, algorithms) {
+    const got = parse(line);
+    if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)
+        return false;
+    const fields = got.value.fields;
+    const signer = signers.find((one) => one.id === fields['by']);
+    const epoch = Number(fields['epoch']) || 0;
+    if (signer === undefined || !verifiesFields(fields, signer.publicKey, algorithms))
+        return false;
+    const window = windowAt(signer, epoch);
+    return epoch >= window.start && (window.close === null || epoch <= window.close)
+        && signer.coverage.some((prefix) => prefix === '*' || within(region(`${family}/${place}/${fields['scope'] ?? ''}`, './'), region(prefix, './')));
+}

package/dist/fold/zoom.js

@@ -1,7 +1,8 @@
 import { join } from "../host/io.js";
 import { canonical, LOCK, parse, RECEIPTS } from '@lapxo/topos/wire';
 import { fieldOf, foldClaims, isWire } from "./claims.js";
-import { entriesIn, observeText } from "../observe/files.js";
+import { observeText } from "../observe/files.js";
+import { placesIn } from "./places.js";
 /**
  * A line of the tree seen from inside a place: every path it names under the place is read from the place's root, and
  * a path outside it is dropped, since the place alone cannot read it. The place's name drops out of the scope, the condition
@@ -46,10 +47,10 @@ export function zoomed(line, place) {
 }
 /** The lines of each place's own lock that still name the place: seen from inside a place, no scope carries its name. */
 export function namingTheirPlace(root) {
-    return entriesIn(root).filter((entry) => entry.dir && !entry.name.startsWith('.')).flatMap((entry) => {
-        const own = (observeText(join(root, entry.name, LOCK)) ?? '').split('\n').filter(isWire);
+    return placesIn(root).filter(name => !name.startsWith('.')).flatMap((name) => {
+        const own = (observeText(join(root, name, LOCK)) ?? '').split('\n').filter(isWire);
         return foldClaims(own).standing.filter((line) => fieldOf(line, 'value') !== 'withdraw')
-            .map((line) => fieldOf(line, 'scope')).filter((scope) => scope.startsWith(`${entry.name}/`) || scope.includes(`/${entry.name}/`));
+            .map((line) => fieldOf(line, 'scope')).filter((scope) => scope.startsWith(`${name}/`) || scope.includes(`/${name}/`));
     }).length;
 }
 /**

package/dist/host/capsule.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderReference } from '@lapxo/topos/wire';
 import type { Declaration } from '@lapxo/topos/capsule';
 import type { Request, Response } from '@lapxo/topos/contract';
 export interface Capsule {
@@ -5,7 +6,7 @@ export interface Capsule {
     readonly digest: string;
     readonly declaration: Declaration;
     readonly lines: readonly string[];
-    readonly ask: (requests: readonly Request[]) => readonly (Response | undefined)[];
+    readonly ask: (requests: readonly Request[], reader?: ReaderReference) => readonly (Response | undefined)[];
 }
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
 export declare function capsuleAt(digest: string, entry: string, store?: string): Capsule | undefined;

package/dist/host/capsule.js

@@ -60,10 +60,10 @@ export function capsuleAt(digest, entry, store) {
     if (!entry || isAbsolute(entry) || (coordinate === '..' || coordinate.startsWith(`..${sep}`)) || entry.split(/[\\/]/).includes('..')) {
         throw new Error(`REFUSE·capsule ${digest} declared entry ${entry || '(absent)'} unavailable`);
     }
-    const capsule = { digest, ...known, ask: (requests) => {
+    const capsule = { digest, ...known, ask: (requests, reader) => {
             if (!statSync(module, { throwIfNoEntry: false })?.isFile())
                 throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, cacheStore, module);
+            return answered(digest, bytes, requests, names, root, cacheStore, module, reader);
         } };
     capsules.set(identity, capsule);
     return capsule;
@@ -86,14 +86,16 @@ const spawnOf = (at, names) => {
     return child;
 };
 export const childFlags = (argv = process.execArgv) => argv.filter((flag, i) => !/^(-e|-p|--eval|--print)$/.test(argv[i - 1] ?? '') && !/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(flag));
-function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry) {
+function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry, reader) {
     const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
     if (!child.length) {
         process.stderr.write(`LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
+    const lifetime = readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader ?? digest);
+    const policy = lifetime === undefined ? '' : JSON.stringify(lifetime) + '\n';
+    const hitOf = (request) => sha(`${digest}\n${loader}${policy}${JSON.stringify(request)}`);
     const hits = requests.map(hitOf);
     const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
     const held = kept.map((at, i) => {
@@ -114,7 +116,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
-    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), digest));
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, lifetime);
     return requests.map((request, i) => {
         if (held[i] !== undefined)
             return held[i];
@@ -148,5 +150,5 @@ export function locatedAt(tree, place, cacheStore = ownStore()) {
             }
         }
     const digest = `sha256:${hash.digest('hex')}`;
-    return { digest, ...known, ask: (requests) => answered(digest, new Uint8Array(), requests, names, at, cacheStore) };
+    return { digest, ...known, ask: (requests, reader) => answered(digest, new Uint8Array(), requests, names, at, cacheStore, undefined, reader) };
 }

package/dist/host/cell-receipts.js

@@ -3,7 +3,7 @@ import { join, dirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { fileURLToPath } from 'node:url';
 import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lapxo/topos/wire';
-import { cellInputs, cellReceiptContract } from '@lapxo/topos/cell-inputs';
+import { cellInputs, cellReceiptContract, cellInputProfile } from '@lapxo/topos/cell-inputs';
 import { renderCells } from '@lapxo/topos/cells-view';
 import { admittedObjects } from "./objects.js";
 import { objectFold } from "../fold/object.js";
@@ -30,6 +30,7 @@ export async function cellsWithReceipts(root, history, emit) {
             throw Error(`REFUSE·authority receipt input ${record.fields.id}`);
     const config = parsed.value.configuration.filter(f => authority.of(canonical(f)).kind === 'admitted');
     cellReceiptContract(config);
+    const profile = cellInputProfile(config);
     const instrument = ownLock().map(fields);
     const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
     if (!wire)
@@ -38,7 +39,7 @@ export async function cellsWithReceipts(root, history, emit) {
     if (!algorithm)
         throw Error('REFUSE·receipt no digest algorithm');
     const code = implementation(algorithm);
-    const inputs = cellInputs(parsed.value.objects), semantic = new Map(), inputBytes = new Map();
+    const inputs = cellInputs(parsed.value.objects, profile), semantic = new Map(), inputBytes = new Map();
     const pins = new Map();
     for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
         const pin = record.fields.topos;
@@ -47,7 +48,10 @@ export async function cellsWithReceipts(root, history, emit) {
             pins.set(pin, [pin, ...top.dependencies]);
         }
         const scope = `receipts/cells/${record.fields.scope}`;
-        const bytes = [...inputs.get(record.fields.scope), ...pins.get(pin), ...code, 'resolution=1'].sort(byBytes).join('\n');
+        const ownInputs = inputs.get(record.fields.scope);
+        const metadata = [...pins.get(pin), ...code, 'resolution=1'];
+        const bytes = profile === 'semantic-live@1' ? [...ownInputs, ...metadata].sort(byBytes).join('\n') :
+            [...ownInputs, ...metadata.sort(byBytes), `receipt-inputs=${profile}`].join('\n');
         inputBytes.set(scope, bytes);
         semantic.set(scope, fullDigest(bytes, algorithm));
     }

package/dist/host/io.d.ts

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/io.js

@@ -1,7 +1,7 @@
 /** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
 export { spawn, spawnSync } from 'node:child_process';
 export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 export { tmpdir } from 'node:os';
 export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';

package/dist/host/ports/ingress.js

@@ -1,23 +1,10 @@
-import { randomUUID } from 'node:crypto';
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { requireEffects } from "../read-only.js";
 import { underTheLock } from "../../land/act.js";
-const syncDirectory = (path) => { const fd = openSync(path, 'r'); try {
-    fsyncSync(fd);
-}
-finally {
-    closeSync(fd);
-} };
-const durableFile = (path, text) => { const fd = openSync(path, 'wx', 0o600); try {
-    writeFileSync(fd, text);
-    fsyncSync(fd);
-}
-finally {
-    closeSync(fd);
-} };
+import { nativePublicationStorage, publishBundle } from "./publication.js";
 /** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
-export const nativeIngressStorage = { publish(staged, committed) { renameSync(staged, committed); syncDirectory(join(committed, '..')); } };
+export const nativeIngressStorage = nativePublicationStorage;
 const directory = (store) => join(store, 'ingress');
 const nameOf = (identity) => {
     if (!identity || identity.includes('\0'))
@@ -58,18 +45,7 @@ export async function commitIngress(store, identity, prepare, verify, storage =
         const bundle = await prepare(ingressReceipts(store));
         if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
             throw Error('REFUSE·ingress evidence and receipt do not verify');
-        mkdirSync(root, { recursive: true });
-        const staged = join(root, '.stage-' + randomUUID());
-        mkdirSync(staged, { mode: 0o700 });
-        try {
-            durableFile(join(staged, 'evidence.bound'), bundle.evidence);
-            durableFile(join(staged, 'receipt.bound'), bundle.receipt);
-            syncDirectory(staged);
-            storage.publish(staged, at);
-        }
-        finally {
-            rmSync(staged, { recursive: true, force: true });
-        }
+        publishBundle(at, { 'evidence.bound': bundle.evidence, 'receipt.bound': bundle.receipt }, storage);
         return measured('landed', bundle);
     });
 }

package/dist/host/ports/local-act.d.ts

@@ -0,0 +1,34 @@
+import type { PublicationStorage } from './publication.ts';
+/** Prepared and verified by the selected Topos admission/result contract. */
+export interface LocalActBundle {
+    readonly records: string;
+    readonly receipt: string;
+    readonly placements?: readonly {
+        place: string;
+        records: string;
+    }[];
+}
+export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
+export declare const actLines: (bytes: string) => readonly string[];
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Committed segments are part of this ledger, not a second authority source. */
+export declare function committedLocalActs(store: string): readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[];
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage): Promise<LocalActBundle & {
+    readonly kind: 'landed' | 'once';
+}>;