@lapxo/bound 0.1.6 → 0.1.7

package/dist/cli/release-result.js

@@ -0,0 +1,80 @@
+import { parse } from '@lapxo/topos/wire';
+import { authorityFor, writerFor, releaseSigner } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims } from "../fold/claims.js";
+import { observeText } from "../observe/files.js";
+import { claimLinesIn } from "./args.js";
+import { LOCK } from '@lapxo/topos/wire';
+import { join } from 'node:path';
+/** Judge an external signed approval without landing it, fetching its source,
+ * executing a provider, or changing the release-policy verdict of the place.
+ * The anchor is the place's key, never a key offered by the approval. */
+export function releaseApproval(lock, lines) {
+    const standing = foldClaims(lock).standing;
+    const id = writerFor(standing, 'authorize');
+    if (!id)
+        throw Error('REFUSE·release place names no authorizer');
+    const one = (rows, scope, measure) => {
+        const selected = rows.filter(line => fieldOf(line, 'scope') === scope && (!measure || fieldOf(line, 'measure') === measure) && fieldOf(line, 'value') !== 'withdraw');
+        if (selected.length !== 1)
+            throw Error(`REFUSE·release ${scope} needs one declaration`);
+        return fieldOf(selected[0], 'value');
+    };
+    const anchor = { ...releaseSigner(standing), id, publicKey: one(standing, `keys/${id}`, 'public-key'), coverage: one(standing, `keys/${id}`, 'coverage').split('|') };
+    if (!lines.length)
+        throw Error('REFUSE·release empty approval');
+    for (const line of lines) {
+        const got = parse(line);
+        if (got.kind !== 'fact')
+            throw Error('REFUSE·release malformed approval');
+        if (got.value.fields['by'] !== id || !got.value.fields['sig'])
+            throw Error(`REFUSE·release approval must be signed by ${id}`);
+    }
+    // A separate release place may declare an era; its configuration must itself
+    // authenticate against the existing anchor. No packet key or coverage is used.
+    const wire = lines.filter(line => ['wire/signature-algorithms', 'audit/wire/signature-algorithms', 'wire/era', 'audit/wire/era'].includes(fieldOf(line, 'scope')));
+    let era;
+    try {
+        era = eraOf(wire.length ? foldClaims(wire).standing : standing);
+    }
+    catch {
+        throw Error('REFUSE·release signature era is absent or conflicting');
+    }
+    const authority = authorityFor([], anchor, era.admitted);
+    for (const line of lines) {
+        const verdict = authority.of(line);
+        if (verdict.kind !== 'admitted')
+            throw Error(`REFUSE·release ${fieldOf(line, 'scope')}: ${verdict.why ?? verdict.kind}`);
+    }
+    const released = lines.filter(line => /^release\/[^/]+$/.test(fieldOf(line, 'scope')) && fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'role') === 'writes');
+    if (released.length !== 1)
+        throw Error('REFUSE·release needs one signed release/<tag> digest');
+    const required = (scope, measure) => {
+        const selected = lines.filter(line => fieldOf(line, 'scope') === scope);
+        if (selected.some(line => fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'measure') !== measure))
+            throw Error(`REFUSE·release ${scope} is not an approval declaration`);
+        return one(selected, scope, measure);
+    };
+    const digest = required(fieldOf(released[0], 'scope'), 'digest'), name = required('release/artifact', 'id'), source = required('sources/archive', 'id');
+    if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+        throw Error('REFUSE·release archive needs sha256');
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
+        throw Error('REFUSE·release artifact needs one safe filename');
+    let url;
+    try {
+        url = new URL(source);
+    }
+    catch {
+        throw Error('REFUSE·release archive source needs an absolute URL');
+    }
+    if (url.username || url.password || /[\s\x00-\x1f\x7f]/.test(source))
+        throw Error('REFUSE·release archive source needs a credential-free absolute URL without whitespace');
+    return `READY ${digest} ${name} ${source}`;
+}
+export function printReleaseApproval(root, file) {
+    const text = observeText(file);
+    if (text === undefined)
+        throw Error('REFUSE·release approval file is absent');
+    const lines = text.split('\n').filter(line => line.trim().length > 0);
+    process.stdout.write(releaseApproval(claimLinesIn(join(root, LOCK)), lines) + '\n');
+}

package/dist/cli/standing-result.d.ts

@@ -0,0 +1,5 @@
+/** An evidence projection, never a new authority lock. Authentication uses
+ * the admission snapshot at each local epoch; the existing fold applies
+ * supersessions and withdrawals across all declared classes. Storage layout
+ * and delivery mode do not enter this public boundary. */
+export declare function printStandingResult(root: string): void;

package/dist/cli/standing-result.js

@@ -0,0 +1,39 @@
+import { viewsOf } from "../fold/views.js";
+import { lockStanding } from "../fold/keys.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authorityFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims } from "../fold/claims.js";
+import { storeOf } from "../land/ledger.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+/** An evidence projection, never a new authority lock. Authentication uses
+ * the admission snapshot at each local epoch; the existing fold applies
+ * supersessions and withdrawals across all declared classes. Storage layout
+ * and delivery mode do not enter this public boundary. */
+export function printStandingResult(root) {
+    const store = storeOf(root), view = viewsOf(lockStanding(store)).get('standing');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
+        throw Error('REFUSE·view standing requires a declared standing view');
+    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            const snapshot = admissionHistoryAt(root, epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    process.stdout.write(standing.length ? standing.join('\n') + '\n' : '');
+}

package/dist/cli/verb.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
+import { printReleaseApproval } from "./release-result.js";
 import { printActResult } from "./act-result.js";
+import { printStandingResult } from "./standing-result.js";
 import { withContentStore } from "../host/content-store.js";
-import { withoutEffects } from "../host/read-only.js";
+import { readOnly, withoutEffects } from "../host/read-only.js";
+import { layReleases } from "../host/release.js";
 import { resolveSources, resolveRequested } from "../host/source-content.js";
 import { cellsWithReceipts } from "../host/cell-receipts.js";
 import { renderCells } from '@lapxo/topos/cells-view';
@@ -195,6 +198,12 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
         printActResult(root, coord);
         return EXIT.closed;
     }
+    if (name === 'standing') {
+        if (under || told.length || coord || depth !== undefined)
+            throw Error('REFUSE·standing local committed projection only');
+        printStandingResult(root);
+        return EXIT.closed;
+    }
     if (name === 'evidence' && !under && !told.length && ingressBundles(storeOf(root)).length) {
         const declared = viewsOf(lockStanding(storeOf(root))).get(name);
         if (!declared || declared.shape || !declared.regions.some(region => region.name === 'evidence'))
@@ -231,6 +240,10 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
         }
     }
     const own = place ? rest.filter((line) => admittedIn(root, place, line)) : [];
+    // Executed views use the place's declared mounts before observation, as pass
+    // does. Prospective folds and public standing queries do not lay releases.
+    if (!told.length && !readOnly())
+        layReleases(storeOf(root), root, standingOf(root, under).standing, storeOf(root));
     const fold = told.length
         ? foldPlace(root, entryOf(root), under, false, { standing: standingOf(root, under, ledger), observed: observedClaims(root, storeOf(root), { wait: false }), free: true })
         : foldPlace(root, entryOf(root), under, true);
@@ -447,12 +460,18 @@ async function foldAt(root, under, argv) {
 async function foldRequested(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
     const prospective = as !== undefined && positionalsOf(argv).some(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
-    if (as?.split('@')[0] === 'act' || as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
+    if (as === 'release' || as?.split('@')[0] === 'act' || as === NAMED_VIEWS.help || prospective || argv.includes(FLAGS.check))
         return foldResolved(root, under, argv);
     return resolveRequested(digest => resolveSources(standingOf(root, under).standing, [digest]), () => foldResolved(root, under, argv));
 }
 async function foldResolved(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
+    if (as === 'release') {
+        const approvals = positionalsOf(argv).filter(one => !(existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory()));
+        if (approvals.length !== 1 || argv.includes(FLAGS.check))
+            throw Error('REFUSE·release name one approval file; check does not authorize delivery');
+        return withoutEffects(() => { printReleaseApproval(under ? resolve(root, under) : root, resolve(approvals[0])); return EXIT.closed; });
+    }
     const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
     // Public content is authenticated by its digest, independently of owner history.
     // A named view does not request mounting every release of the instrument.

package/dist/fold/closed.js

@@ -4,7 +4,7 @@ import { dirname, existsSync, join, mkdirSync, relative, resolve, statSync, writ
 import { byBytes, canonical, LOCK, parse, publicationOf, roleAt, roleClaimsOf } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, foldClaims, isConfig, isWire } from "./claims.js";
 import { bytesDigest as hashBytes, fullDigest as hashFull } from "../host/digest.js";
-import { worldAt } from "./places.js";
+import { mountedCoordinatesIn, worldAt } from "./places.js";
 import { ownLockOf } from "./signed.js";
 import { viewsOf } from "./views.js";
 import { storeAt, storeOf } from "../land/ledger.js";
@@ -31,6 +31,7 @@ const lockStamp = (root, place) => {
         return 'none';
     }
 };
+const publishedMounts = (root) => mountedCoordinatesIn(root, (observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire));
 function filesOf(root, place, region, inputs) {
     const step = region.replace(/^receipts\//, '').replace(/\/$/, '');
     const here = join(root, place);
@@ -41,7 +42,10 @@ function filesOf(root, place, region, inputs) {
         const record = parse(line);
         return record.kind === 'fact' ? [record.value.fields] : [];
     }));
-    const owned = coordinatesUnder(join(here, step), root).filter(rel => roleAt(relative(here, join(root, rel)), claims) !== 'foreign');
+    const localMounts = [...mountedCoordinatesIn(here), ...publishedMounts(here)];
+    const mounts = [...new Set([...mountedCoordinatesIn(root), ...publishedMounts(root), ...localMounts.map(coordinate => relative(root, join(here, coordinate)))])];
+    const owned = coordinatesUnder(join(here, step), root).filter(rel => roleAt(relative(here, join(root, rel)), claims) !== 'foreign'
+        && !mounts.some(mount => rel === mount || rel.startsWith(`${mount}/`)));
     // Foreign worlds are not the place's tree. Retain the external files actually handed to its readers.
     const observed = inputs.filter(line => fieldOf(line, 'measure') === 'observed').flatMap(line => {
         const coordinate = fieldOf(line, 'scope');
@@ -101,11 +105,13 @@ function namedReceipts(root, store) {
     const text = observeText(join(root, RECEIPTS));
     const carried = carriedFrom(store, (text ?? '').split('\n').filter(isWire));
     const out = new Map();
+    const mounted = new Set(mountedCoordinatesIn(root));
     for (const line of carried ?? []) {
         if (!isWire(line) || fieldOf(line, 'measure') !== 'digest')
             continue;
         const place = /^write\/([^/]+)\/receipts\.bound$/.exec(fieldOf(line, 'scope'))?.[1];
-        if (place)
+        // A retained dependency receipt is input evidence, not a child-place closure.
+        if (place && !mounted.has(place))
             out.set(place, fieldOf(line, 'value'));
     }
     return out;

package/dist/fold/kept.d.ts

@@ -23,7 +23,7 @@ export declare function movedPoints(store: string, now: readonly string[], key:
     readonly came: readonly string[];
 } | undefined;
 export declare const foldsElsewhere: () => number;
-export declare function keptPlace(store: string, under?: string): PlaceFold | undefined;
+export declare function keptPlace(store: string, under?: string, currentInstrument?: string): PlaceFold | undefined;
 export declare const keptRender: (store: string, key: string, name: string) => string | undefined;
 export declare const keepRender: (store: string, _signer: string, key: string, name: string, _epoch: number, text_: string) => void;
 export declare function keepFold(store: string, key: string, fold: PlaceFold, points: readonly string[], instrument?: string): void;

package/dist/fold/kept.js

@@ -108,7 +108,13 @@ function readingContext(store) {
     return bytesDigest(store, text([...files.filter(file => existsSync(file)).sort()
             .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())), ...segments].join('\n')));
 }
-export function keptPlace(store, under) {
+/** A new judgment changes the result even when the files and reader history do not. */
+function judgmentContext(store, demands) {
+    const scopes = new Set(demands.map(line => fieldOf(line, 'scope')));
+    return bytesDigest(store, text(ledgerLines(store, 'judge')
+        .filter(line => scopes.has(fieldOf(line, 'scope'))).join('\n')));
+}
+export function keptPlace(store, under, currentInstrument) {
     const key = observeText(memoAt(store, lastOf([`place ${under ?? '.'}`])))?.trim();
     if (key === undefined || key === '')
         return undefined;
@@ -119,6 +125,10 @@ export function keptPlace(store, under) {
     if (blob.readingContext !== readingContext(store))
         return undefined;
     const fold = blob.fold;
+    if (currentInstrument !== undefined && fold.instrument !== currentInstrument)
+        return undefined;
+    if (blob.judgmentContext !== judgmentContext(store, linesOf(fold.demands)))
+        return undefined;
     return {
         ...fold,
         standing: linesOf(fold.standing),
@@ -154,7 +164,7 @@ export function keepFold(store, key, fold, points, instrument = '') {
         signed: [...fold.signed],
         kept: false,
     };
-    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store) })));
+    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store), judgmentContext: judgmentContext(store, fold.demands) })));
     const at = memoAt(store, lastOf(points));
     mkdirSync(dirname(at), { recursive: true });
     writeFileSync(`${at}.${process.pid}.part`, `${key}\n`);

package/dist/fold/keys.js

@@ -2,6 +2,7 @@ import { dirname, existsSync, join } from "../host/io.js";
 import { ledgerLines, ledgerWriters, signedLines } from "../land/ledger.js";
 import { fieldOf, foldClaims, isWire, LOCK, selfName } from "./claims.js";
 import { observeText } from "../observe/files.js";
+import { publicLock } from '@lapxo/topos/wire';
 const held = new Map();
 const keyInputs = new Map();
 const merged = new Map();
@@ -68,13 +69,16 @@ export function releaseOf(store) {
         return releases.get(store);
     const at = join(dirname(store), LOCK);
     const lines = ledgerKeyLines(store).length || !existsSync(at) ? [] : (observeText(at) ?? '').split('\n').filter(isWire);
-    const got = lines.some((line) => fieldOf(line, 'scope') === 'publish/bootstrap' && fieldOf(line, 'value') !== 'withdraw') ? lines : undefined;
+    const published = lines.some(line => fieldOf(line, 'scope').startsWith('keys/') && fieldOf(line, 'measure') === 'public-key' && fieldOf(line, 'sig'))
+        && publicLock(lines) !== undefined;
+    const got = published || lines.some((line) => fieldOf(line, 'scope') === 'publish/bootstrap' && fieldOf(line, 'value') !== 'withdraw') ? lines : undefined;
     releases.set(store, got);
     return got;
 }
 function read(store, told = []) {
-    const said = [...ledgerKeyLines(store), ...releaseOf(store) ?? [], ...told]
-        .filter((line) => /\bsig=/.test(line) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
+    const release = releaseOf(store) ?? [], published = publicLock(release) === undefined ? [] : release;
+    const said = [...ledgerKeyLines(store), ...release, ...told]
+        .filter((line) => (/\bsig=/.test(line) || published.includes(line)) && /(?:^|\s)scope=keys\/[^/\s]+\s/.test(line));
     const standing = foldClaims(said).standing.filter((line) => fieldOf(line, 'value') !== 'withdraw')
         .sort((a, b) => (Number(fieldOf(a, 'epoch')) || 0) - (Number(fieldOf(b, 'epoch')) || 0));
     const idOf = (line) => fieldOf(line, 'scope').slice('keys/'.length);

package/dist/fold/places.d.ts

@@ -2,7 +2,11 @@ type Spoken = {
     readonly place: string;
     readonly line: string;
 };
-export declare const placesIn: (root: string) => readonly string[];
+/** A dependency's lock describes the dependency, never a child of its host.
+ * Retiring a mount does not turn its retained bytes into local declarations. */
+export declare function mountedCoordinatesIn(root: string, history?: readonly string[]): readonly string[];
+export declare function localDirectoriesIn(root: string, history?: readonly string[]): readonly string[];
+export declare function placesIn(root: string, history?: readonly string[]): readonly string[];
 /** A directory with no own lock is founded by the root: a line of its region family names the directory's coordinates, and a covered batch that names the place lands its first own lock. */
 export declare const foundableIn: (root: string, standing: readonly string[], family: string, name: string) => boolean;
 export declare const capsuleAt: (root: string, name: string) => boolean;

package/dist/fold/places.js

@@ -1,13 +1,29 @@
 import { join } from "../host/io.js";
-import { CAPSULE, canonical, LOCK, matches, parse } from '@lapxo/topos/wire';
+import { CAPSULE, canonical, EXTENSION, LOCK, matches, parse } from '@lapxo/topos/wire';
+import { lockLines } from "./keys.js";
+import { releasesOf } from "../host/release.js";
+import { archiveCoordinate } from "../host/archive.js";
 import { fieldOf } from "./claims.js";
 import { isCeiling } from "./configures.js";
 import { entriesIn, observeText } from "../observe/files.js";
 import { ownLock } from "../observe/runner.js";
 import { said } from "./wire.js";
 import { ownLockOf } from "./signed.js";
-export const placesIn = (root) => entriesIn(root)
-    .filter((entry) => entry.dir && observeText(join(root, entry.name, LOCK)) !== undefined).map((entry) => entry.name).sort();
+/** A dependency's lock describes the dependency, never a child of its host.
+ * Retiring a mount does not turn its retained bytes into local declarations. */
+export function mountedCoordinatesIn(root, history = lockLines(join(root, EXTENSION))) {
+    return releasesOf(history).flatMap(line => {
+        const needs = fieldOf(line, 'needs');
+        return needs ? [archiveCoordinate(needs)] : [];
+    });
+}
+export function localDirectoriesIn(root, history = lockLines(join(root, EXTENSION))) {
+    const mounts = new Set(mountedCoordinatesIn(root, history));
+    return entriesIn(root).filter(entry => entry.dir && !mounts.has(entry.name)).map(entry => entry.name).sort();
+}
+export function placesIn(root, history = lockLines(join(root, EXTENSION))) {
+    return localDirectoriesIn(root, history).filter(name => observeText(join(root, name, LOCK)) !== undefined);
+}
 /** A directory with no own lock is founded by the root: a line of its region family names the directory's coordinates, and a covered batch that names the place lands its first own lock. */
 export const foundableIn = (root, standing, family, name) => !placesIn(root).includes(name)
     && (entriesIn(root).find((entry) => entry.name === name)?.dir ?? false)

package/dist/fold/readers.js

@@ -43,6 +43,7 @@ const reachOfLine = (module, where) => {
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
     const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
+    const coordinateMeasure = wordOn(standing, 'region-coordinate', ownLock());
     const localMeasures = wordsOf(standing, 'region-measures');
     const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
     const measures = localMeasures.length || !pins.length ? localMeasures
@@ -51,7 +52,7 @@ export function capsuleReadersOf(root, store, standing, lines, resolve = capsule
     const groups = new Map();
     for (const place of ['', ...placesIn(root)]) {
         const where = place ? `${place}/` : '';
-        const own = ownLockOf(root, place).filter((line) => fieldOf(line, 'scope').startsWith('region/') && measures.includes(fieldOf(line, 'measure')) && fieldOf(line, 'value') !== 'withdraw');
+        const own = ownLockOf(root, place).filter((line) => fieldOf(line, 'scope').startsWith('region/') && measures.includes(fieldOf(line, 'measure')) && fieldOf(line, 'measure') === coordinateMeasure && fieldOf(line, 'value') !== 'withdraw');
         const offered = [...own, ...(capsuleAt(root, place) ? world.filter((line) => !own.some((one) => fieldOf(one, 'scope') === fieldOf(line, 'scope'))) : [])];
         if (!offered.length)
             continue;

package/dist/fold/release-policy.js

@@ -92,8 +92,6 @@ export function releasePolicyLines(result) {
     if (result === undefined)
         return [];
     const gates = (result.gates ?? []).map(g => `GATE     ${g.scope} ${g.status} · requires=${g.required.join('|')} · ${g.evidence.map(e => `${e.coordinate}=${e.value}`).join(' | ') || g.reason || 'no evidence'}`);
-    if (result.status === 'absent')
-        return gates;
     return [
         ...gates,
         `RELEASE  policy ${result.status} · fold ${result.snapshot.fold} · instrument ${result.snapshot.instrument}`,

package/dist/fold/zoom.js

@@ -1,7 +1,8 @@
 import { join } from "../host/io.js";
 import { canonical, LOCK, parse, RECEIPTS } from '@lapxo/topos/wire';
 import { fieldOf, foldClaims, isWire } from "./claims.js";
-import { entriesIn, observeText } from "../observe/files.js";
+import { observeText } from "../observe/files.js";
+import { placesIn } from "./places.js";
 /**
  * A line of the tree seen from inside a place: every path it names under the place is read from the place's root, and
  * a path outside it is dropped, since the place alone cannot read it. The place's name drops out of the scope, the condition
@@ -46,10 +47,10 @@ export function zoomed(line, place) {
 }
 /** The lines of each place's own lock that still name the place: seen from inside a place, no scope carries its name. */
 export function namingTheirPlace(root) {
-    return entriesIn(root).filter((entry) => entry.dir && !entry.name.startsWith('.')).flatMap((entry) => {
-        const own = (observeText(join(root, entry.name, LOCK)) ?? '').split('\n').filter(isWire);
+    return placesIn(root).filter(name => !name.startsWith('.')).flatMap((name) => {
+        const own = (observeText(join(root, name, LOCK)) ?? '').split('\n').filter(isWire);
         return foldClaims(own).standing.filter((line) => fieldOf(line, 'value') !== 'withdraw')
-            .map((line) => fieldOf(line, 'scope')).filter((scope) => scope.startsWith(`${entry.name}/`) || scope.includes(`/${entry.name}/`));
+            .map((line) => fieldOf(line, 'scope')).filter((scope) => scope.startsWith(`${name}/`) || scope.includes(`/${name}/`));
     }).length;
 }
 /**

package/dist/host/cell-receipts.js

@@ -3,7 +3,7 @@ import { join, dirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { fileURLToPath } from 'node:url';
 import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lapxo/topos/wire';
-import { cellInputs, cellReceiptContract } from '@lapxo/topos/cell-inputs';
+import { cellInputs, cellReceiptContract, cellInputProfile } from '@lapxo/topos/cell-inputs';
 import { renderCells } from '@lapxo/topos/cells-view';
 import { admittedObjects } from "./objects.js";
 import { objectFold } from "../fold/object.js";
@@ -30,6 +30,7 @@ export async function cellsWithReceipts(root, history, emit) {
             throw Error(`REFUSE·authority receipt input ${record.fields.id}`);
     const config = parsed.value.configuration.filter(f => authority.of(canonical(f)).kind === 'admitted');
     cellReceiptContract(config);
+    const profile = cellInputProfile(config);
     const instrument = ownLock().map(fields);
     const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
     if (!wire)
@@ -38,7 +39,7 @@ export async function cellsWithReceipts(root, history, emit) {
     if (!algorithm)
         throw Error('REFUSE·receipt no digest algorithm');
     const code = implementation(algorithm);
-    const inputs = cellInputs(parsed.value.objects), semantic = new Map(), inputBytes = new Map();
+    const inputs = cellInputs(parsed.value.objects, profile), semantic = new Map(), inputBytes = new Map();
     const pins = new Map();
     for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
         const pin = record.fields.topos;
@@ -47,7 +48,10 @@ export async function cellsWithReceipts(root, history, emit) {
             pins.set(pin, [pin, ...top.dependencies]);
         }
         const scope = `receipts/cells/${record.fields.scope}`;
-        const bytes = [...inputs.get(record.fields.scope), ...pins.get(pin), ...code, 'resolution=1'].sort(byBytes).join('\n');
+        const ownInputs = inputs.get(record.fields.scope);
+        const metadata = [...pins.get(pin), ...code, 'resolution=1'];
+        const bytes = profile === 'semantic-live@1' ? [...ownInputs, ...metadata].sort(byBytes).join('\n') :
+            [...ownInputs, ...metadata.sort(byBytes), `receipt-inputs=${profile}`].join('\n');
         inputBytes.set(scope, bytes);
         semantic.set(scope, fullDigest(bytes, algorithm));
     }

package/dist/host/reading-closures.js

@@ -27,7 +27,8 @@ export function readingClosures(options) {
         if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
             throw Error('REFUSE·input projection ambiguous reading ' + scope);
         const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
-        if (!inputs.length || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
+        // An aggregate reads its declared receipts; it need not reread a leaf file.
+        if ((!inputs.length && !needs.length) || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
             throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
         const n = Number(resolution[1]);
         if (!Number.isSafeInteger(n))

package/dist/host/selected-topos.d.ts

@@ -1,10 +1,13 @@
 import type { StandingTopos } from '@lapxo/topos/standing';
-import { wireAt } from '@lapxo/topos/wire';
+import { wireAt, fromLine } from '@lapxo/topos/wire';
 export interface SelectedTopos {
     readonly digest: string;
     readonly topos: StandingTopos;
 }
 export type ToposResolver = (digest: string) => StandingTopos;
+/** Local grammar is sufficient for locally declared records. Resolve selected
+ * contracts only when a reader is missing; a local refusal remains a refusal. */
+export declare function admittedLine(line: string, local: readonly Readonly<Record<string, string>>[], epoch: number, pins: readonly string[], resolve?: ToposResolver): ReturnType<typeof fromLine>;
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
 export declare function toposAt(digest: string, store?: string): StandingTopos;
 export declare function contentAt(digest: string, store?: string): Uint8Array;

package/dist/host/selected-topos.js

@@ -1,7 +1,22 @@
 import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
-import { parse, wireAt } from '@lapxo/topos/wire';
+import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
+/** Local grammar is sufficient for locally declared records. Resolve selected
+ * contracts only when a reader is missing; a local refusal remains a refusal. */
+export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
+    const own = wireAt(local, epoch);
+    // A signature era alone is not a configuration grammar. An absent list
+    // must be supplied by the selected contract; an explicit local list remains
+    // authoritative and may refuse a field without opening unrelated content.
+    if (own && ['fields', 'required', 'roles', 'forms', 'at-classes'].every(name => own.lists.has(name))) {
+        const got = fromLine(line, own);
+        const needsObject = fieldOf(line, 'type') !== '' && !own.object;
+        if (got.kind === 'fact' || (got.kind === 'refuse' && !needsObject))
+            return got;
+    }
+    return fromLine(line, selectedWireAt(local, epoch, pins, resolve));
+}
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
 export function toposAt(digest, store) {
     const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));

package/dist/land/standing-pin.d.ts

@@ -0,0 +1,3 @@
+/** A new world selection names standing bytes. Artifact aliases remain separate.
+ * Admission reads laid content only; it never fetches or executes a provider. */
+export declare function admitStandingPins(root: string, lines: readonly string[], read?: (digest: string) => Uint8Array): void;

package/dist/land/standing-pin.js

@@ -0,0 +1,49 @@
+import { readStanding } from '@lapxo/topos/standing';
+import { fieldOf } from "../fold/claims.js";
+import { contentAt } from "../host/selected-topos.js";
+import { storeOf } from "./ledger.js";
+import { ContentNeeded } from "../host/content-needed.js";
+import { observeFile } from "../observe/files.js";
+import { createHash } from 'node:crypto';
+import { resolve, relative } from 'node:path';
+/** A declared local file is already held content. Check its bytes before
+ * admission; neither fetch it nor write a CAS entry during this inspection. */
+function heldStanding(root, line) {
+    const digest = fieldOf(line, 'value');
+    try {
+        return contentAt(digest, storeOf(root));
+    }
+    catch (error) {
+        if (!(error instanceof ContentNeeded))
+            throw error;
+    }
+    const name = fieldOf(line, 'needs');
+    if (!name || name.includes('|') || name.includes('*'))
+        throw new ContentNeeded(digest);
+    const path = resolve(root, name), local = relative(resolve(root), path);
+    if (!local || local === '..' || local.startsWith('../'))
+        throw Error('standing coordinate is outside the place');
+    const bytes = observeFile(path);
+    if (bytes === undefined)
+        throw new ContentNeeded(digest);
+    const split = digest.indexOf(':'), algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
+    if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+        throw Error('standing coordinate content hash mismatch');
+    return bytes;
+}
+/** A new world selection names standing bytes. Artifact aliases remain separate.
+ * Admission reads laid content only; it never fetches or executes a provider. */
+export function admitStandingPins(root, lines, read) {
+    for (const line of lines) {
+        const scope = fieldOf(line, 'scope'), value = fieldOf(line, 'value');
+        const parts = scope.split('/');
+        if (!(scope === 'uses' || parts.slice(0, -1).includes('uses')) || value === 'withdraw')
+            continue;
+        try {
+            readStanding(new TextDecoder('utf-8', { fatal: true }).decode(read ? read(value) : heldStanding(root, line)));
+        }
+        catch (error) {
+            throw Error(`REFUSE·pin ${scope} ${value} · ${error instanceof Error ? error.message : String(error)} · nothing landed`);
+        }
+    }
+}

package/docs/contracts/cli.md

@@ -17,3 +17,11 @@ The opt-in `local-act@1` contract is selected by `wire/act-result`, `wire/act-re
 Admission publishes the original signed records, their logical placements and one native result receipt atomically. A failure before commit writes no partial act. The result names the committed digest and local epoch; replay returns the original result without another epoch or origin. A post-commit error is not a rollback. Read the committed result before deciding whether to retry.
 
 The query verifies the record signatures and coverage against the authority snapshot at admission, and the native receipt against its retained provenance. Later key retirement or profile replacement cannot authorize a new act but does not erase a verifiable historical result. Admission is not conformance: the output says `admitted · conformance not asserted`. Missing or corrupt results refuse by name. Host paths and delivery counts are not identity inputs.
+
+## Release approval
+
+`fold --as release <approval-file>` verifies the external approval against the place authorizer, its admitted public key, coverage and signature era. Exactly one signed release/<tag> digest, release/artifact name and sources/archive URL are required. It prints `READY sha256:<digest> <name> <source>` or refuses with the coordinate and cause. This is an approval judgment, distinct from the place release-policy verdict. It never fetches, executes, signs or lands.
+
+## Standing admission
+
+A uses/ selection admits canonical standing bytes, never an archive. The bytes must already be held under their verified digest or in the single local coordinate explicitly named by needs. Admission checks identity and canonical form without fetching, executing or writing the content store. Missing or corrupt bytes refuse the whole lot. A corrupt held copy cannot be hidden by another source. Archives remain separate dependency declarations.

package/docs/contracts/evidence-view.md

@@ -4,3 +4,7 @@ The declared evidence@8 view projects authenticated delivery history of this pla
 
 
 The no sample specifies an uncovered write and tampered signed bytes. Both must refuse by name. Exact withdrawals remove only covered normative lines; authenticated evidence remains inspectable. The vectors assert status, signature verification and observable CLI output. No private key bytes are printed or shipped.
+
+## Folded standing
+
+A place declares `view/standing role=demands form=alphabet measure=id value=standing`. `fold --as standing` authenticates each local line against its admission snapshot, then applies revisions and covered exact withdrawals through the existing fold. Every declared key class participates, including attest. Committed acts and historical journals have the same public output. Retiring a key does not erase its previously admitted evidence. Replay adds nothing. Foreign history grants no local authority. This projection is distinct from authenticated delivery history and does not create a new authority lock. An undeclared standing view refuses by name.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -33,7 +33,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "^0.1.12",
+    "@lapxo/topos": "0.1.13",
     "acorn": "8.19.0"
   },
   "devDependencies": {