@lapxo/bound 0.1.5 → 0.1.7

package/dist/host/ports/local-act.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheRegions } from "../../land/act.js";
+import { publishBundle, nativePublicationStorage } from "./publication.js";
+import { actIdentity, parse, canonical } from '@lapxo/topos/wire';
+import { fullDigest } from "../digest.js";
+const atOf = (store, identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·act missing identity');
+    return join(store, 'ledger', 'acts', 'committed-' + encodeURIComponent(identity));
+};
+const read = (at) => {
+    try {
+        const placements = readdirSync(at).filter(name => name.startsWith('place-') && name.endsWith('.bound')).map(name => ({
+            place: decodeURIComponent(name.slice(6, -6)), records: readFileSync(join(at, name), 'utf8'),
+        }));
+        return {
+            records: readFileSync(join(at, 'records.bound'), 'utf8'),
+            receipt: readFileSync(join(at, 'receipt.bound'), 'utf8'),
+            ...(placements.length ? { placements } : {}),
+        };
+    }
+    catch (error) {
+        throw Error(`REFUSE·act committed result unreadable · ${error.code ?? 'read failed'}`);
+    }
+};
+export const actLines = (bytes) => {
+    if (!bytes.endsWith('\n'))
+        throw Error('REFUSE·act truncated committed lines');
+    return bytes.slice(0, -1).split('\n');
+};
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export function intactLocalAct(identity, bundle) {
+    if (!bundle.receipt.endsWith('\n') || bundle.receipt.slice(0, -1).includes('\n'))
+        return false;
+    const receipt = parse(bundle.receipt.slice(0, -1));
+    if (receipt.kind !== 'fact' || !bundle.placements?.length)
+        return false;
+    const f = receipt.value.fields;
+    if (canonical(f) !== bundle.receipt.slice(0, -1) || !/^(0|[1-9][0-9]*)$/.test(f['epoch'] ?? ''))
+        return false;
+    if (f['value'] !== identity || f['role'] !== 'writes' || f['form'] !== 'alphabet' || f['measure'] !== 'digest')
+        return false;
+    return actIdentity(actLines(bundle.records), { scope: f['scope'] ?? '', context: f['at'] ?? '',
+        localEpoch: Number(f['epoch']), digest: bytes => fullDigest(bytes, identity.slice(0, identity.indexOf(':'))),
+        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
+    }) === identity;
+}
+/** Committed segments are part of this ledger, not a second authority source. */
+export function committedLocalActs(store) {
+    const root = join(store, 'ledger', 'acts');
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).map(name => {
+        const identity = decodeURIComponent(name.slice(10)), bundle = read(join(root, name));
+        if (!intactLocalAct(identity, bundle))
+            throw Error('REFUSE·act committed journal seal does not verify');
+        return { identity, bundle };
+    }).sort((a, b) => {
+        const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
+        return epoch(a.bundle) - epoch(b.bundle);
+    });
+}
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export function localActResult(store, identity, verify) {
+    const at = atOf(store, identity);
+    if (!existsSync(at))
+        return undefined;
+    const bundle = read(at);
+    if (verify(identity, bundle) !== true)
+        throw Error('REFUSE·act committed result does not verify');
+    return bundle;
+}
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
+    requireEffects('local act commitment');
+    return underTheRegions(store, regions, 'land', async () => {
+        const prior = localActResult(store, identity, verify);
+        if (prior)
+            return { kind: 'once', ...prior };
+        const bundle = await prepare();
+        if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
+            throw Error('REFUSE·act prepared result does not verify');
+        const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
+        for (const p of bundle.placements ?? [])
+            files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
+        publishBundle(atOf(store, identity), files, storage);
+        return { kind: 'landed', ...bundle };
+    });
+}

package/dist/host/ports/publication.d.ts

@@ -0,0 +1,10 @@
+export interface PublicationStorage {
+    publish(staged: string, committed: string): void;
+}
+export declare const nativePublicationStorage: PublicationStorage;
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;

package/dist/host/ports/publication.js

@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+const syncDirectory = (path) => {
+    const fd = openSync(path, 'r');
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+};
+export const nativePublicationStorage = {
+    publish(staged, committed) { renameSync(staged, committed); syncDirectory(dirname(committed)); },
+};
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export function publishBundle(committed, files, storage = nativePublicationStorage) {
+    requireEffects('atomic publication');
+    const entries = Object.entries(files);
+    if (!entries.length || entries.some(([name]) => !name || name === '.' || name === '..' || /[\\/\0]/.test(name))) {
+        throw Error('REFUSE·commit invalid publication members');
+    }
+    const root = dirname(committed);
+    const created = mkdirSync(root, { recursive: true });
+    // Persist newly created directory entries up to their existing parent too.
+    if (created !== undefined)
+        for (let at = root;; at = dirname(at)) {
+            syncDirectory(at);
+            if (at === dirname(created))
+                break;
+        }
+    const staged = join(root, '.stage-' + randomUUID());
+    mkdirSync(staged, { mode: 0o700 });
+    try {
+        for (const [name, bytes] of entries) {
+            const fd = openSync(join(staged, name), 'wx', 0o600);
+            try {
+                writeFileSync(fd, bytes);
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        syncDirectory(staged);
+        storage.publish(staged, committed);
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
+    }
+}

package/dist/host/reading-closures.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime, ReaderReference } from '@lapxo/topos/wire';
 import type { Capsule } from './capsule.ts';
 type File = {
     readonly place: string;
@@ -14,6 +15,8 @@ export declare function readingClosures(options: {
     capsule: Capsule;
     region: string;
     projection: string;
+    readerReference?: ReaderReference;
+    lifetime?: ReaderLifetime;
     allowsEmpty?: boolean;
     files: readonly File[];
     emit?: (line: string) => void;

package/dist/host/reading-closures.js

@@ -18,7 +18,7 @@ export function readingClosures(options) {
         if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
             throw Error('REFUSE·input changed ' + file.place); };
     verify();
-    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }])[0];
+    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }], options.readerReference)[0];
     if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
         throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
     const plans = new Map();
@@ -27,7 +27,8 @@ export function readingClosures(options) {
         if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
             throw Error('REFUSE·input projection ambiguous reading ' + scope);
         const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
-        if (!inputs.length || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
+        // An aggregate reads its declared receipts; it need not reread a leaf file.
+        if ((!inputs.length && !needs.length) || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
             throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
         const n = Number(resolution[1]);
         if (!Number.isSafeInteger(n))
@@ -44,7 +45,7 @@ export function readingClosures(options) {
         visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
     for (const scope of plans.keys())
         visit(scope);
-    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
+    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection, ...(options.lifetime === undefined ? [] : [JSON.stringify(options.lifetime)])].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
     const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
     const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
     const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
@@ -74,7 +75,7 @@ export function readingClosures(options) {
                 if (readOnly())
                     throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
                 const started = process.hrtime.bigint();
-                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }])[0];
+                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }], options.readerReference)[0];
                 if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
                     throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
                 lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))

package/dist/host/selected-capsules.js

@@ -25,12 +25,12 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
         const loaded = descriptor === undefined ? load() : undefined;
         const capsule = loaded?.capsule ?? {
-            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: requests => {
+            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
                 if (!requests.length)
                     return [];
                 const actual = load();
                 assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
-                return actual.capsule.ask(requests);
+                return actual.capsule.ask(requests, reader);
             },
         };
         const projected = loaded?.offer ?? canonical(offer);
@@ -40,10 +40,10 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
         if (!algorithm)
             throw Error('REFUSE·input instrument has no admitted digest algorithm');
-        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: requests => capsule.ask(requests.map(request => {
+        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: (requests, reader) => capsule.ask(requests.map(request => {
                 const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
                 return provider === undefined ? request : { ...request, provider };
-            })) };
+            }), reader) };
         return { capsule: selected, offer: projected };
     }));
 }

package/dist/host/selected-topos.d.ts

@@ -1,10 +1,13 @@
 import type { StandingTopos } from '@lapxo/topos/standing';
-import { wireAt } from '@lapxo/topos/wire';
+import { wireAt, fromLine } from '@lapxo/topos/wire';
 export interface SelectedTopos {
     readonly digest: string;
     readonly topos: StandingTopos;
 }
 export type ToposResolver = (digest: string) => StandingTopos;
+/** Local grammar is sufficient for locally declared records. Resolve selected
+ * contracts only when a reader is missing; a local refusal remains a refusal. */
+export declare function admittedLine(line: string, local: readonly Readonly<Record<string, string>>[], epoch: number, pins: readonly string[], resolve?: ToposResolver): ReturnType<typeof fromLine>;
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
 export declare function toposAt(digest: string, store?: string): StandingTopos;
 export declare function contentAt(digest: string, store?: string): Uint8Array;

package/dist/host/selected-topos.js

@@ -1,7 +1,22 @@
 import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
-import { parse, wireAt } from '@lapxo/topos/wire';
+import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
+/** Local grammar is sufficient for locally declared records. Resolve selected
+ * contracts only when a reader is missing; a local refusal remains a refusal. */
+export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
+    const own = wireAt(local, epoch);
+    // A signature era alone is not a configuration grammar. An absent list
+    // must be supplied by the selected contract; an explicit local list remains
+    // authoritative and may refuse a field without opening unrelated content.
+    if (own && ['fields', 'required', 'roles', 'forms', 'at-classes'].every(name => own.lists.has(name))) {
+        const got = fromLine(line, own);
+        const needsObject = fieldOf(line, 'type') !== '' && !own.object;
+        if (got.kind === 'fact' || (got.kind === 'refuse' && !needsObject))
+            return got;
+    }
+    return fromLine(line, selectedWireAt(local, epoch, pins, resolve));
+}
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
 export function toposAt(digest, store) {
     const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));

package/dist/land/ledger.d.ts

@@ -10,6 +10,7 @@ export declare function writerFile(store: string, writer: string): string;
 export declare function ledgerLines(store: string, writer: string): readonly string[];
 export declare function shardFile(store: string, writer: string, region: string): string;
 export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
+export declare function ledgerWriters(store: string): readonly string[];
 export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
 export declare function signedLines(store: string, writer: string): string[];
 export declare function blobAt(store: string, digest: string): string;

package/dist/land/ledger.js

@@ -1,3 +1,5 @@
+import { actLines, committedLocalActs } from "../host/ports/local-act.js";
+import { readdirSync } from 'node:fs';
 import { requireEffects } from "../host/read-only.js";
 import { appendFileSync, closeSync, dirname, existsSync, join, linkSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "../host/io.js";
 import { storeRoot } from "../host/ports/store.js";
@@ -21,12 +23,29 @@ export function writerFile(store, writer) {
 }
 const held = new Map();
 export function ledgerLines(store, writer) {
-    return linesAt(writerFile(store, writer));
+    return journalLines(store, writer, '.', linesAt(writerFile(store, writer)));
 }
 export function shardFile(store, writer, region) {
     return storeAt(store, 'ledger', writer.replace(/[^a-zA-Z0-9_-]/g, ''), `${region.replace(/\/+$/, '') || '@'}${EXTENSION}`);
 }
-export const shardLines = (store, writer, region) => linesAt(shardFile(store, writer, region));
+export const shardLines = (store, writer, region) => journalLines(store, writer, region, linesAt(shardFile(store, writer, region)));
+const journalMemo = new Map();
+function journalLines(store, writer, place, legacy) {
+    const fresh = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === place).flatMap(p => actLines(p.records).filter(line => fieldOf(line, 'by') === writer)) ?? []);
+    if (!fresh.length)
+        return legacy;
+    const lines = [...new Set([...legacy, ...fresh])], key = store + '\0' + writer + '\0' + place, last = journalMemo.get(key);
+    if (last?.length === lines.length && last.every((line, i) => line === lines[i]))
+        return last;
+    journalMemo.set(key, lines);
+    return lines;
+}
+export function ledgerWriters(store) {
+    const at = join(store, 'ledger');
+    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
+    return [...new Set([...legacy, ...committed])];
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/land/owned.d.ts

@@ -20,4 +20,4 @@ export type Owned = {
  */
 export declare function ownedOf(root: string, signed: readonly string[], admits: (line: string) => boolean, coverage: (by: string) => readonly string[], named?: readonly string[], placedAt?: (line: string) => readonly string[] | undefined): Owned;
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export declare function landOwned(root: string, place: string, lines: readonly string[]): void;
+export declare function landOwned(root: string, place: string, lines: readonly string[], committed?: boolean): void;

package/dist/land/owned.js

@@ -51,14 +51,15 @@ export function ownedOf(root, signed, admits, coverage, named = [], placedAt = (
     return { ledger, own, nowhere: [...placed, ...rest.filter((line) => !lands(line))], forked };
 }
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export function landOwned(root, place, lines) {
+export function landOwned(root, place, lines, committed = false) {
     if (!lines.length)
         return tellOwn(place, []);
     const at = join(root, place, LOCK);
     const text = observeText(at) ?? '';
-    for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
-        landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
-    }
+    if (!committed)
+        for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
+            landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
+        }
     writeFileSync(`${at}.${process.pid}.landing`, `${text.replace(/\n*$/, '\n')}${lines.join('\n')}\n`);
     renameSync(`${at}.${process.pid}.landing`, at);
     tellOwn(place, []);

package/dist/land/standing-pin.d.ts

@@ -0,0 +1,3 @@
+/** A new world selection names standing bytes. Artifact aliases remain separate.
+ * Admission reads laid content only; it never fetches or executes a provider. */
+export declare function admitStandingPins(root: string, lines: readonly string[], read?: (digest: string) => Uint8Array): void;

package/dist/land/standing-pin.js

@@ -0,0 +1,49 @@
+import { readStanding } from '@lapxo/topos/standing';
+import { fieldOf } from "../fold/claims.js";
+import { contentAt } from "../host/selected-topos.js";
+import { storeOf } from "./ledger.js";
+import { ContentNeeded } from "../host/content-needed.js";
+import { observeFile } from "../observe/files.js";
+import { createHash } from 'node:crypto';
+import { resolve, relative } from 'node:path';
+/** A declared local file is already held content. Check its bytes before
+ * admission; neither fetch it nor write a CAS entry during this inspection. */
+function heldStanding(root, line) {
+    const digest = fieldOf(line, 'value');
+    try {
+        return contentAt(digest, storeOf(root));
+    }
+    catch (error) {
+        if (!(error instanceof ContentNeeded))
+            throw error;
+    }
+    const name = fieldOf(line, 'needs');
+    if (!name || name.includes('|') || name.includes('*'))
+        throw new ContentNeeded(digest);
+    const path = resolve(root, name), local = relative(resolve(root), path);
+    if (!local || local === '..' || local.startsWith('../'))
+        throw Error('standing coordinate is outside the place');
+    const bytes = observeFile(path);
+    if (bytes === undefined)
+        throw new ContentNeeded(digest);
+    const split = digest.indexOf(':'), algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
+    if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+        throw Error('standing coordinate content hash mismatch');
+    return bytes;
+}
+/** A new world selection names standing bytes. Artifact aliases remain separate.
+ * Admission reads laid content only; it never fetches or executes a provider. */
+export function admitStandingPins(root, lines, read) {
+    for (const line of lines) {
+        const scope = fieldOf(line, 'scope'), value = fieldOf(line, 'value');
+        const parts = scope.split('/');
+        if (!(scope === 'uses' || parts.slice(0, -1).includes('uses')) || value === 'withdraw')
+            continue;
+        try {
+            readStanding(new TextDecoder('utf-8', { fatal: true }).decode(read ? read(value) : heldStanding(root, line)));
+        }
+        catch (error) {
+            throw Error(`REFUSE·pin ${scope} ${value} · ${error instanceof Error ? error.message : String(error)} · nothing landed`);
+        }
+    }
+}

package/dist/observe/files.js

@@ -1,4 +1,4 @@
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
+import { existsSync, lstatSync, statSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 /**
  * The one place the instrument reads the world: a coordinate's bytes, the entries of a directory, the coordinates under a place,
@@ -7,7 +7,17 @@ import { join, relative, sep } from 'node:path';
 const seen = new Map();
 /** A coordinate read once is kept by its stamp — its inode, size and time — and read again only when the stamp moves. */
 function bytesAt(at) {
-    const st = stampable(at);
+    // Reading follows a link, so its cache stamp must describe the same target.
+    // Directory links have no file bytes; traversal keeps its separate link policy.
+    let st = stampable(at);
+    if (st?.isSymbolicLink()) {
+        try {
+            st = statSync(at);
+        }
+        catch {
+            return undefined;
+        }
+    }
     if (st === undefined || st.isDirectory() || !existsSync(at))
         return undefined;
     const stamp = `${st.ino}-${st.size}-${st.mtimeMs}`;

package/docs/contracts/cli.md

@@ -9,3 +9,19 @@
 # sign
 
 `bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.
+
+# Committed act results
+
+The opt-in `local-act@1` contract is selected by `wire/act-result`, `wire/act-result-scope` and `wire/act-result-context`. An admitted `view/act measure=id value=act` makes `bound fold --as act <identity>` available. Missing or conflicting declarations refuse; an absent profile preserves the historical interface. Topos defines the canonical record and result contract.
+
+Admission publishes the original signed records, their logical placements and one native result receipt atomically. A failure before commit writes no partial act. The result names the committed digest and local epoch; replay returns the original result without another epoch or origin. A post-commit error is not a rollback. Read the committed result before deciding whether to retry.
+
+The query verifies the record signatures and coverage against the authority snapshot at admission, and the native receipt against its retained provenance. Later key retirement or profile replacement cannot authorize a new act but does not erase a verifiable historical result. Admission is not conformance: the output says `admitted · conformance not asserted`. Missing or corrupt results refuse by name. Host paths and delivery counts are not identity inputs.
+
+## Release approval
+
+`fold --as release <approval-file>` verifies the external approval against the place authorizer, its admitted public key, coverage and signature era. Exactly one signed release/<tag> digest, release/artifact name and sources/archive URL are required. It prints `READY sha256:<digest> <name> <source>` or refuses with the coordinate and cause. This is an approval judgment, distinct from the place release-policy verdict. It never fetches, executes, signs or lands.
+
+## Standing admission
+
+A uses/ selection admits canonical standing bytes, never an archive. The bytes must already be held under their verified digest or in the single local coordinate explicitly named by needs. Admission checks identity and canonical form without fetching, executing or writing the content store. Missing or corrupt bytes refuse the whole lot. A corrupt held copy cannot be hidden by another source. Archives remain separate dependency declarations.

package/docs/contracts/evidence-view.md

@@ -4,3 +4,7 @@ The declared evidence@8 view projects authenticated delivery history of this pla
 
 
 The no sample specifies an uncovered write and tampered signed bytes. Both must refuse by name. Exact withdrawals remove only covered normative lines; authenticated evidence remains inspectable. The vectors assert status, signature verification and observable CLI output. No private key bytes are printed or shipped.
+
+## Folded standing
+
+A place declares `view/standing role=demands form=alphabet measure=id value=standing`. `fold --as standing` authenticates each local line against its admission snapshot, then applies revisions and covered exact withdrawals through the existing fold. Every declared key class participates, including attest. Committed acts and historical journals have the same public output. Retiring a key does not erase its previously admitted evidence. Replay adds nothing. Foreign history grants no local authority. This projection is distinct from authenticated delivery history and does not create a new authority lock. An undeclared standing view refuses by name.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -33,7 +33,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "^0.1.11",
+    "@lapxo/topos": "0.1.13",
     "acorn": "8.19.0"
   },
   "devDependencies": {