@lapxo/bound 0.1.8 → 0.1.9

package/dist/host/reading-context.js

@@ -0,0 +1,53 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { readFileSync, realpathSync } from 'node:fs';
+import { release } from 'node:os';
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+const active = new AsyncLocalStorage();
+export const readingBoundary = active.getStore.bind(active);
+export function withReadingBoundary(identity, execution, run) {
+    if (execution) {
+        const algorithm = identity.split(':')[0];
+        const hash = (text) => algorithm + ':' + createHash(algorithm).update(text).digest('hex');
+        const expected = readingEnvironment(hash, execution.env, execution.cwd, execution.flags);
+        const named = [...execution.context.environment].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+        if (JSON.stringify([...expected].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) !== JSON.stringify(named))
+            throw Error('REFUSE·reading execution environment differs from its identity');
+    }
+    return active.run({ identity, execution }, run);
+}
+/** References commit the actual inherited boundary. Values are hashed, never
+ * carried as environment secrets. No empty map is substituted for unknown input. */
+// The running runtime is resolved once for this act; mutable input bytes are not
+// stored in this slot. Later processes establish their own runtime reference.
+const runtimes = new Map();
+const runtimeOf = (algorithm) => { const held = runtimes.get(algorithm); if (held)
+    return held; const digest = algorithm + ':' + createHash(algorithm).update(readFileSync(process.execPath)).digest('hex'); runtimes.set(algorithm, digest); return digest; };
+export function readingEnvironment(hash, env = process.env, cwd = process.cwd(), flags = process.execArgv) {
+    const inherited = Object.entries(env).filter((entry) => entry[1] !== undefined);
+    return [
+        ['variables', hash(JSON.stringify(inherited.sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))))],
+        ['cwd', hash(realpathSync(cwd))], ['flags', hash(JSON.stringify(flags))],
+        ['runtime', runtimeOf(hash('').split(':')[0])],
+        ['platform', hash(JSON.stringify([process.platform, process.arch, process.versions, release()]))],
+    ];
+}
+export function readingProfile(lines, field) {
+    const values = (scope) => lines.filter(line => field(line, 'scope') === scope && field(line, 'role') === 'writes' && field(line, 'value') !== 'withdraw');
+    const contexts = values('wire/reading-context'), receipts = values('wire/reading-receipt');
+    if (!contexts.length && !receipts.length)
+        return false;
+    if (contexts.length !== 1 || receipts.length !== 1 || field(contexts[0], 'value') !== 'reading-context@1' || field(receipts[0], 'value') !== 'reading-receipt@1')
+        throw Error('REFUSE·reading identity ambiguous or incomplete profiles');
+    return true;
+}
+/** The caller supplies verified implementation and transitive references. This
+ * constructor adds the process boundary that the host will actually hand over. */
+export function readingExecution(input, hash, boundary = { env: process.env, cwd: process.cwd(), flags: process.execArgv }) {
+    const env = Object.fromEntries(Object.entries(boundary.env).filter((entry) => entry[1] !== undefined));
+    const cwd = boundary.cwd, flags = Object.freeze([...boundary.flags]);
+    Object.freeze(env);
+    const context = { ...input, environment: readingEnvironment(hash, env, cwd, flags) };
+    readingIdentityBytes(context);
+    return { context, env, cwd, flags };
+}

package/dist/host/root-clock-source.d.ts

@@ -0,0 +1,85 @@
+import { type PlaceReceipt, type ClockBudget } from '@lapxo/topos/core';
+import type { PlaceActBudget } from './ports/place-act.ts';
+export interface RootClockSourceSelection {
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly bootstrapCheckpoint: {
+        scope: string;
+        measure: string;
+    };
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+}
+export declare function rootClockSource(root: string, selected: RootClockSourceSelection): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+/** Source mapping is an explicit Root declaration; absence never means a zero
+ * clock or an inferred cursor. Existing legacy callers do not request it. */
+export declare function declaredRootClockSource(root: string): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+export declare function hasRootClockSource(root: string): boolean;
+export interface PortablePlaceContext {
+    readonly identity: string;
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly authority: {
+        anchor: import('@lapxo/topos/wire').Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+}
+/** Historical inspection ONLY. The expected acting Root anchor and resource
+ * selection come from the consumer's selected place, never from this packet.
+ * This function returns data and cannot construct a current command permit. */
+export declare function inspectPortablePlaceContexts(encoded: string, expectedAnchor: import('@lapxo/topos/wire').Signer, selected: RootClockSourceSelection): {
+    identity: string;
+    context: import("@lapxo/topos/core").PlaceAct;
+}[];
+/** Prospective configuration is checked as authenticated Root history, never
+ * against a prose birth condition. Initial heads are explicit typed selections;
+ * stored committed chains cannot disappear when a selection is activated or
+ * replaced. Preview reads only; the real admission repeats under its Root lock. */
+export declare function assertProspectiveRootClockSelection(root: string, signed: readonly string[]): void;

package/dist/host/root-clock-source.js

@@ -0,0 +1,305 @@
+import { existsSync, opendirSync, statSync } from 'node:fs';
+import { join, basename } from 'node:path';
+/** Actual stored Root cursor. Inputs are fixed host selections from admitted
+ * lines, never packet epochs, receipt maxima, or caller-supplied verification. */
+import { committedLocalActs, actLines } from "./ports/local-act.js";
+import { verifiedLegacyActResult } from "../cli/act-result.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authorityFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims, isConfig, selfName } from "../fold/claims.js";
+import { authenticatedRootStanding } from "./admitted-place.js";
+import { verifiesOwnerLine } from "../land/sign.js";
+import { placesIn } from "../fold/places.js";
+import { appliedHistoryIn } from "../fold/signed.js";
+import { storeOf } from "../land/ledger.js";
+import { hostClockSelection } from "./place-clock-selection.js";
+import { readPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
+import { placeActResult, placeActHeads } from "./ports/place-act.js";
+import { rootAuthorityProtection } from "../land/act.js";
+import { readOnly } from "./read-only.js";
+const fail = (s) => { throw Error('REFUSE·Root cursor ' + s); };
+function sourceSelection(selected) {
+    const b = selected?.resources;
+    if (!b || Object.keys(b).sort().join(',') !== 'acts,bytes,lines,places' || Object.values(b).some(n => !Number.isSafeInteger(n) || n < 1) || typeof selected.selector !== 'string' || !selected.selector || typeof selected.profileSelector !== 'string' || !selected.profileSelector || !selected.bootstrapCheckpoint || Object.keys(selected.bootstrapCheckpoint).sort().join(',') !== 'measure,scope' || typeof selected.bootstrapCheckpoint.scope !== 'string' || !selected.bootstrapCheckpoint.scope || typeof selected.bootstrapCheckpoint.measure !== 'string' || !selected.bootstrapCheckpoint.measure)
+        fail('missing admitted source selection');
+    if (!selected.inherited?.clock || Object.keys(selected.inherited.clock).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || !selected.inherited.storage || Object.keys(selected.inherited.storage).sort().join(',') !== 'acts,bytes' || [...Object.values(selected.inherited.clock), ...Object.values(selected.inherited.storage)].some(n => !Number.isSafeInteger(n) || n < 1))
+        fail('missing inherited source budgets');
+    return b;
+}
+function boundedInventory(root, selected) {
+    const b = sourceSelection(selected), store = storeOf(root);
+    let bytes = 0, files = 0, entries = 0;
+    const limit = b.acts * (b.places + 2) + b.lines;
+    if (!Number.isSafeInteger(limit))
+        fail('source file bound');
+    const visit = (path) => { if (!existsSync(path))
+        return; const s = statSync(path); if (s.isDirectory()) {
+        const directory = opendirSync(path);
+        try {
+            for (let entry = directory.readSync(); entry; entry = directory.readSync()) {
+                if (++entries > limit)
+                    fail('source entry budget');
+                if (basename(path) === 'ledger' && entry.name === 'place-acts')
+                    continue;
+                visit(join(path, entry.name));
+            }
+        }
+        finally {
+            directory.closeSync();
+        }
+    }
+    else {
+        if (!s.isFile() || ++files > limit || (bytes += s.size) > b.bytes)
+            fail('source file/byte budget');
+    } };
+    visit(join(store, 'ledger'));
+    visit(join(store, selfName() + '.keys'));
+}
+function current(root, selected) {
+    const b = sourceSelection(selected);
+    boundedInventory(root, selected);
+    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER);
+    if (history.length > b.lines)
+        fail('history line budget');
+    let bytes = 0;
+    for (const line of history)
+        if ((bytes += Buffer.byteLength(line)) > b.bytes)
+            fail('history byte budget');
+    const acts = committedLocalActs(storeOf(root));
+    if (acts.length > b.acts)
+        fail('act inventory budget');
+    const rooted = acts.flatMap(a => { const roots = a.bundle.placements?.filter(p => p.place === '.') ?? []; if (!roots.some(p => actLines(p.records).some(isConfig)))
+        return []; const verified = verifiedLegacyActResult(root, a.identity); return [{ ...verified, identity: a.identity, roots }]; });
+    // Comparison is over verified committed Root CONFIGURATION acts only. This
+    // is the existing local-act cursor, not a new maximum over arbitrary records.
+    rooted.sort((a, b) => a.epoch - b.epoch);
+    if (rooted.some((a, i) => i > 0 && a.epoch === rooted[i - 1].epoch && a.identity !== rooted[i - 1].identity))
+        fail('ambiguous committed Root cursor');
+    const latest = rooted.at(-1), anchor = admissionAnchor(root);
+    let checkpoint;
+    if (latest) {
+        const rows = latest.roots.flatMap(p => actLines(p.records)).filter(isConfig);
+        if (!rows.length)
+            fail('verified Root act has no configuration checkpoint');
+        checkpoint = rows[0];
+    }
+    else {
+        const rows = history.filter(l => fieldOf(l, 'scope') === selected.bootstrapCheckpoint.scope && fieldOf(l, 'measure') === selected.bootstrapCheckpoint.measure);
+        if (rows.length !== 1)
+            fail('bootstrap checkpoint missing/ambiguous');
+        checkpoint = rows[0];
+    }
+    const epoch = Number(fieldOf(checkpoint, 'epoch'));
+    if (!Number.isSafeInteger(epoch) || epoch < 0)
+        fail('unknown committed Root epoch');
+    // This synchronous observation already read the full current inventory. Select
+    // its admission prefix without opening that same inventory a second time;
+    // the next current() invocation still reads and authenticates fresh bytes.
+    const prefix = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch), algorithms = eraOf(foldClaims(prefix.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted;
+    const auth = authorityFor(prefix, anchor, algorithms);
+    if (auth.of(checkpoint).kind !== 'admitted')
+        fail('checkpoint is not authenticated');
+    const places = placesIn(root);
+    if (places.length > b.places)
+        fail('legacy namespace inventory budget');
+    const legacy = [...new Set([...history, ...places.flatMap(p => appliedHistoryIn(root, p))])];
+    if (legacy.length + prefix.length > b.lines || legacy.reduce((n, l) => n + Buffer.byteLength(l), 0) + prefix.reduce((n, l) => n + Buffer.byteLength(l), 0) > b.bytes)
+        fail('legacy origin inventory budget');
+    return { history: prefix, anchor, algorithms, authorityCheckpoint: checkpoint, legacyOriginals: legacy };
+}
+export function rootClockSource(root, selected) {
+    const state = current(root, selected), visiting = new Set(), cache = new Map();
+    const historical = (encoded) => {
+        const cached = cache.get(encoded);
+        if (cached)
+            return cached;
+        if (visiting.has(encoded) || visiting.size >= selected.resources.acts)
+            fail('historical predecessor cycle/budget');
+        visiting.add(encoded);
+        try {
+            const context = readPlaceActContext(encoded, selected.inherited.clock), epoch = context.root.epoch;
+            const saved = admissionHistoryAt(root, Number(epoch));
+            const rows = saved.filter(l => isConfig(l) && fieldOf(l, 'epoch') === epoch);
+            if (!rows.length)
+                fail('historical checkpoint absent');
+            // First obtain the explicitly declared historical genesis, without scanning
+            // current receiver chains. Each non-genesis predecessor is then authenticated
+            // through its stored signed receipt before supplying these HOST-only heads.
+            const basic = hostClockSelection({ ...input, history: saved, authorityCheckpoint: rows[0], legacyOriginals: saved, authenticatedReceiverHeads: [], readCurrent: () => current(root, selected) });
+            const heads = context.places.map(p => {
+                const initial = basic.trust.initialHeads.find(h => h.place === p.place);
+                if (initial?.identity === p.previous)
+                    return initial;
+                const prior = placeActResult(input.store, p.previous, { historical }, basic.selection.storageBudget);
+                if (!prior)
+                    fail('historical predecessor absent');
+                const decoded = readPlaceActContext(prior.context, selected.inherited.clock), place = decoded.places.find(one => one.place === p.place);
+                if (!place)
+                    fail('historical predecessor namespace absent');
+                return { place: p.place, identity: p.previous, epoch: place.epoch };
+            });
+            const result = hostClockSelection({ ...input, history: saved, authorityCheckpoint: rows[0], legacyOriginals: saved, authenticatedReceiverHeads: heads, readCurrent: () => current(root, selected) }).trust.contract;
+            cache.set(encoded, result);
+            return result;
+        }
+        finally {
+            visiting.delete(encoded);
+        }
+    };
+    const input = { store: storeOf(root), selector: selected.selector, profileSelector: selected.profileSelector, ...state, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, readCurrent: () => current(root, selected), historical };
+    const resolved = hostClockSelection(input);
+    // Host-only bytes from this exact authenticated constructor observation. This
+    // is not a retained authority cache: every constructor calls current() again.
+    const observedAnchor = Object.freeze({ ...state.anchor, coverage: Object.freeze([...state.anchor.coverage]), depth: Object.freeze({ ...state.anchor.depth }), admittedBy: Object.freeze([...state.anchor.admittedBy]) });
+    const observation = Object.freeze({ history: Object.freeze([...state.history]), anchor: observedAnchor, algorithms: Object.freeze([...state.algorithms]) });
+    return { ...resolved, observation, resources: Object.freeze({ ...selected.resources }), authority: (encoded) => { const context = readPlaceActContext(encoded, selected.inherited.clock), saved = admissionHistoryAt(root, Number(context.root.epoch)); const rows = saved.filter(l => isConfig(l) && fieldOf(l, 'epoch') === context.root.epoch); if (!rows.length)
+            fail('public historical checkpoint absent'); return { anchor: state.anchor, history: saved, checkpoint: rows[0] }; } };
+}
+/** Source mapping is an explicit Root declaration; absence never means a zero
+ * clock or an inferred cursor. Existing legacy callers do not request it. */
+export function declaredRootClockSource(root) {
+    const live = authenticatedRootStanding(root), rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
+    if (rows.length !== 1)
+        fail('requires one admitted source mapping');
+    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live).admitted;
+    if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
+        fail('mapping is not Root signed');
+    const about = fieldOf(line, 'about');
+    let value;
+    try {
+        value = JSON.parse(about);
+    }
+    catch {
+        return fail('mapping JSON invalid');
+    }
+    if (!value || Object.keys(value).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || value.profile !== 'place-act-context@1' || JSON.stringify(value) !== about)
+        fail('unknown/noncanonical mapping');
+    return rootClockSource(root, value);
+}
+export function hasRootClockSource(root) { return authenticatedRootStanding(root).some(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw'); }
+/** Historical inspection ONLY. The expected acting Root anchor and resource
+ * selection come from the consumer's selected place, never from this packet.
+ * This function returns data and cannot construct a current command permit. */
+export function inspectPortablePlaceContexts(encoded, expectedAnchor, selected) {
+    sourceSelection(selected);
+    if (typeof encoded !== 'string' || Buffer.byteLength(encoded) > selected.resources.bytes)
+        fail('portable byte budget');
+    let rows;
+    try {
+        rows = JSON.parse(encoded);
+    }
+    catch {
+        return fail('portable JSON');
+    }
+    if (!Array.isArray(rows) || rows.length > selected.resources.acts)
+        fail('portable context inventory budget');
+    const byId = new Map();
+    for (const row of rows) {
+        if (!row || typeof row.identity !== 'string' || typeof row.context !== 'string' || !row.authority || JSON.stringify(row.authority.anchor) !== JSON.stringify(expectedAnchor) || !Array.isArray(row.authority.history) || !Array.isArray(row.receipts) || byId.has(row.identity))
+            fail('portable anchor/shape/identity');
+        byId.set(row.identity, row);
+    }
+    const done = new Map(), visiting = new Set();
+    const inspect = (id) => {
+        const saved = done.get(id);
+        if (saved)
+            return saved;
+        const row = byId.get(id);
+        if (!row || visiting.has(id))
+            fail('portable predecessor missing/cyclic');
+        visiting.add(id);
+        try {
+            const context = readPlaceActContext(row.context, selected.inherited.clock), input = { store: '', selector: selected.selector, profileSelector: selected.profileSelector, history: row.authority.history, anchor: expectedAnchor, algorithms: eraOf(foldClaims(row.authority.history.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted, legacyOriginals: row.authority.history, authorityCheckpoint: row.authority.checkpoint, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, authenticatedReceiverHeads: [], readCurrent: () => fail('portable inspection has no current Root authority'), historical: () => fail('portable inspection uses declared predecessor graph') };
+            const basic = hostClockSelection(input), heads = context.places.map(p => { const initial = basic.trust.initialHeads.find(h => h.place === p.place); if (initial?.identity === p.previous)
+                return initial; const parent = inspect(p.previous), place = parent.context.places.find(one => one.place === p.place); if (!place)
+                fail('portable predecessor namespace'); return { place: p.place, identity: p.previous, epoch: place.epoch }; });
+            const contract = hostClockSelection({ ...input, authenticatedReceiverHeads: heads }).trust.contract, result = placeActReceiptsOf(row.context, row.receipts, contract);
+            if (result.identity !== id)
+                fail('portable identity differs');
+            const value = { contract, context };
+            done.set(id, value);
+            return value;
+        }
+        finally {
+            visiting.delete(id);
+        }
+    };
+    for (const id of byId.keys())
+        inspect(id);
+    return [...done].map(([identity, value]) => ({ identity, context: value.context }));
+}
+/** Prospective configuration is checked as authenticated Root history, never
+ * against a prose birth condition. Initial heads are explicit typed selections;
+ * stored committed chains cannot disappear when a selection is activated or
+ * replaced. Preview reads only; the real admission repeats under its Root lock. */
+export function assertProspectiveRootClockSelection(root, signed) {
+    const sourceScope = 'wire/place-act-context-source';
+    const before = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER);
+    const selectors = [sourceScope, 'wire/place-act-context-selection', 'wire/place-act-context'];
+    // Ordinary lots need no clock projection, including bootstrap before an
+    // admission anchor exists. Raw stored delivery is not authenticated claims.
+    if (!before.some(l => fieldOf(l, 'scope') === sourceScope) && !signed.some(l => selectors.includes(fieldOf(l, 'scope'))))
+        return;
+    const oldLive = authenticatedRootStanding(root).filter(l => fieldOf(l, 'value') !== 'withdraw');
+    const oldMapping = oldLive.find(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'measure') === 'text');
+    if (oldMapping) {
+        const anchor = admissionAnchor(root), algorithms = eraOf(oldLive.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).admitted;
+        if (fieldOf(oldMapping, 'by') !== anchor.id || !verifiesOwnerLine(oldMapping, anchor.publicKey, algorithms))
+            fail('existing source mapping is not Root signed');
+        let old;
+        try {
+            old = JSON.parse(fieldOf(oldMapping, 'about'));
+        }
+        catch {
+            return fail('existing source mapping JSON invalid');
+        }
+        selectors.push(old.selector, old.profileSelector);
+    }
+    if (!signed.some(l => selectors.includes(fieldOf(l, 'scope'))))
+        return;
+    if (signed.every(line => before.includes(line)))
+        return;
+    const store = storeOf(root);
+    if (!readOnly())
+        rootAuthorityProtection(store);
+    const history = [...new Set([...before, ...signed])], live = foldClaims([...oldLive, ...signed].filter(isConfig)).standing.filter(l => fieldOf(l, 'value') !== 'withdraw'), rows = live.filter(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'measure') === 'text');
+    if (!rows.length) {
+        if (signed.some(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'value') === 'withdraw'))
+            return;
+        return fail('activation requires source and selection together');
+    }
+    if (rows.length !== 1)
+        fail('prospective source mapping ambiguous');
+    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).admitted;
+    if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
+        fail('prospective mapping is not Root signed');
+    const about = fieldOf(line, 'about');
+    let selected;
+    try {
+        selected = JSON.parse(about);
+    }
+    catch {
+        return fail('prospective source mapping JSON invalid');
+    }
+    if (!selected || Object.keys(selected).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || selected.profile !== 'place-act-context@1' || JSON.stringify(selected) !== about)
+        fail('unsupported prospective source mapping');
+    sourceSelection(selected);
+    const positive = (scope, measure) => signed.filter(l => fieldOf(l, 'scope') === scope && fieldOf(l, 'measure') === measure && fieldOf(l, 'value') !== 'withdraw');
+    if (!oldMapping && (positive(sourceScope, 'text').length !== 1 || positive(selected.selector, 'text').length !== 1))
+        fail('activation requires source and selection together');
+    const checkpoint = signed.filter(isConfig).at(-1) ?? fail('prospective authority checkpoint absent');
+    if (!oldMapping && positive(selected.bootstrapCheckpoint.scope, selected.bootstrapCheckpoint.measure).length !== 1)
+        fail('initial authority checkpoint must land with selection');
+    const old = oldMapping ? declaredRootClockSource(root) : undefined;
+    const actualLegacy = [...new Set([...before, ...placesIn(root).flatMap(place => appliedHistoryIn(root, place))])];
+    const observed = { history, anchor, algorithms, authorityCheckpoint: checkpoint, legacyOriginals: actualLegacy };
+    const resolved = hostClockSelection({ store, selector: selected.selector, profileSelector: selected.profileSelector, ...observed, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, readCurrent: () => observed, historical: encoded => { if (!old)
+            return fail('committed receiver history precedes initial selection'); return old.trust.historical(encoded); } });
+    const heads = placeActHeads(store, resolved.trust.initialHeads, resolved.trust, resolved.selection.storageBudget), expected = old ? old.trust.current().heads : resolved.trust.initialHeads;
+    for (const head of expected) {
+        const actual = heads.find(one => one.place === head.place);
+        if (!actual || actual.identity !== head.identity || actual.epoch !== head.epoch)
+            fail('prospective selection resets committed receiver ' + head.place);
+    }
+}

package/dist/host/selected-capsules.js

@@ -24,7 +24,7 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         };
         const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
         const loaded = descriptor === undefined ? load() : undefined;
-        const capsule = loaded?.capsule ?? {
+        const supplied = loaded === undefined ? {
             digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
                 if (!requests.length)
                     return [];
@@ -32,7 +32,8 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
                 assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
                 return actual.capsule.ask(requests, reader);
             },
-        };
+        } : { ...loaded.capsule, selection: `${digest} ${offer.scope}` };
+        const capsule = { ...supplied, selectedWorld: { standing: topos, offer: offer.scope ?? '' } };
         const projected = loaded?.offer ?? canonical(offer);
         if (!providerInputRegions(topos, offer.scope ?? '').length)
             return { capsule, offer: projected };

package/dist/land/act.d.ts

@@ -1,4 +1,30 @@
 export declare function underTheRegions<T>(store: string, regions: readonly string[], what: string, act: () => T | Promise<T>): Promise<T>;
+/** Protect the root authority/policy read through child publication. This is
+ * exclusion only: callers must authenticate contexts and compare prepared heads
+ * while held. It creates no grant, clock advance, lease or automatic recovery. */
+export declare function underAuthorityRegions<T>(store: string, regions: readonly string[], what: string, act: () => T | Promise<T>): Promise<T>;
+/** Protect an authority snapshot without taking a child region. The acquisition
+ * gate and temporary root marker exclude a root mutation while registering the
+ * shared read; existing child acts continue independently. This is exclusion,
+ * never authorization or a clock advance. */
+export declare function underRootAuthority<T>(store: string, what: string, act: () => T | Promise<T>): Promise<T>;
+export interface RootAuthorityProtection {
+    readonly store: string;
+    readonly lock: string;
+    readonly pid: number;
+    readonly token: string;
+}
+/** The fixed host may hand its child evidence of an actual held exclusion.
+ * It is an operational envelope, not a grant, signer or receipt identity. */
+export declare function rootAuthorityProtection(store: string): RootAuthorityProtection;
+/** expectedStore and expectedParent come from the fixed host's inheritance
+ * channel, never from world data. Matching a live lock proves exclusion only;
+ * signature, coverage and current context still require verification. */
+export declare function assertRootAuthorityProtection(proof: RootAuthorityProtection, expectedStore: string, expectedParent: number): void;
+/** A child can publish independently, but the joined root projection and its
+ * derived ledger appends have one writer. Authority protection already excludes
+ * root mutations, so this lock needs no acquisition-gate upgrade. */
+export declare function underRootProjection<T>(store: string, what: string, act: () => T | Promise<T>): Promise<T>;
 export declare const holdRoot: (store: string, what: string) => Promise<void>;
 export declare function underTheLock<T>(store: string, what: string, act: () => T | Promise<T>): Promise<T>;
 export declare const holds: (store: string, region: string) => boolean;

package/dist/land/act.js

@@ -59,7 +59,7 @@ const lockFiles = (locks) => coordinatesUnder(locks, locks).filter((file) => {
 });
 const overlaps = (a, b) => !a || !b || a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
 const treeAt = (store) => join(store, 'lock');
-const named = (at) => (basename(at) === 'lock' ? 'the store' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
+const named = (at) => (basename(at) === 'lock' ? 'the store' : basename(at).startsWith('@authority-') ? 'root authority' : basename(at) === '@projection' ? 'root projection' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
 const owns = (at) => {
     for (let frame = context.getStore(); frame !== undefined; frame = frame.parent) {
         const token = frame.locks.get(at);
@@ -69,6 +69,8 @@ const owns = (at) => {
     return false;
 };
 const ownsRegion = (store) => [...held.keys()].some((at) => at.startsWith(`${join(store, 'locks')}/`) && owns(at));
+const ownsAuthority = (store) => [...held.keys()].some((at) => dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-') && owns(at));
+const projectionAt = (store) => join(store, 'locks', '@projection');
 /** Reentry belongs to an awaited act's context. Another process or async act has no inherited authority. */
 async function hold(at, what) {
     if (owns(at))
@@ -142,10 +144,12 @@ async function framed(takes, act) {
         }
     });
 }
-export function underTheRegions(store, regions, what, act) {
+function guardedRegions(store, regions, what, act, rootAuthority) {
     return framed(async () => {
         const tree = treeAt(store);
         const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
+        if (rootAuthority && (asked.includes('') || (ownsRegion(store) && !owns(tree) && !ownsAuthority(store))))
+            throw new Error(`${selfName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
         if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
             for (const region of asked)
                 await hold(regionAt(store, region), what);
@@ -159,18 +163,32 @@ export function underTheRegions(store, regions, what, act) {
         try {
             const locks = join(store, 'locks');
             for (;;) {
-                const conflict = lockFiles(locks).find((file) => asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file))) && !owns(join(locks, file)));
+                const conflict = lockFiles(locks).find((file) => !owns(join(locks, file))
+                    && (file.startsWith('@authority-') || file === '@projection' ? asked.includes('')
+                        : asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file)))));
                 if (conflict === undefined)
                     break;
                 const at = join(locks, conflict);
                 const began = Date.now();
+                let told = false;
                 for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
                     if (!alive(holder.pid))
                         throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
                     overAMinute(at, began, holder);
+                    if (!told) {
+                        process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+                        told = true;
+                    }
                     await pauseFor(250);
                 }
+                if (told)
+                    process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
             }
+            // Registered under the same acquisition gate as every legacy writer.
+            // Root writes overlap all locks; siblings keep distinct region locks.
+            // '@' is encoded for real region coordinates, so this is host bookkeeping.
+            if (rootAuthority)
+                await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
             for (const region of asked.filter(Boolean).sort())
                 await hold(regionAt(store, region), what);
             if (asked.includes(''))
@@ -188,6 +206,81 @@ export function underTheRegions(store, regions, what, act) {
         }
     }, act);
 }
+export function underTheRegions(store, regions, what, act) {
+    return guardedRegions(store, regions, what, act, false);
+}
+/** Protect the root authority/policy read through child publication. This is
+ * exclusion only: callers must authenticate contexts and compare prepared heads
+ * while held. It creates no grant, clock advance, lease or automatic recovery. */
+export function underAuthorityRegions(store, regions, what, act) {
+    return guardedRegions(store, regions, what, act, true);
+}
+/** Protect an authority snapshot without taking a child region. The acquisition
+ * gate and temporary root marker exclude a root mutation while registering the
+ * shared read; existing child acts continue independently. This is exclusion,
+ * never authorization or a clock advance. */
+export function underRootAuthority(store, what, act) {
+    return framed(async () => {
+        const tree = treeAt(store), root = regionAt(store, '');
+        if (owns(tree) || owns(root) || ownsAuthority(store))
+            return;
+        if (ownsRegion(store))
+            throw new Error(`${selfName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
+        await hold(tree, what);
+        try {
+            await hold(root, what);
+            await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
+        }
+        finally {
+            const frame = context.getStore();
+            for (const at of [root, tree]) {
+                const token = frame.locks.get(at);
+                if (token !== undefined) {
+                    release(at, token);
+                    frame.locks.delete(at);
+                }
+            }
+        }
+    }, act);
+}
+/** The fixed host may hand its child evidence of an actual held exclusion.
+ * It is an operational envelope, not a grant, signer or receipt identity. */
+export function rootAuthorityProtection(store) {
+    const locks = [treeAt(store), regionAt(store, ''), ...held.keys()].filter(at => at === treeAt(store) || at === regionAt(store, '') || dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-'));
+    const lock = locks.find(owns);
+    if (lock === undefined)
+        throw Error(`${selfName()}: REFUSE·lock root authority is not protected`);
+    const holder = holderOf(lock);
+    if (holder?.pid !== process.pid || holder.token !== held.get(lock))
+        throw Error(`${selfName()}: REFUSE·lock authority protection changed`);
+    return Object.freeze({ store, lock, pid: holder.pid, token: holder.token });
+}
+/** expectedStore and expectedParent come from the fixed host's inheritance
+ * channel, never from world data. Matching a live lock proves exclusion only;
+ * signature, coverage and current context still require verification. */
+export function assertRootAuthorityProtection(proof, expectedStore, expectedParent) {
+    if (!proof || proof.store !== expectedStore || !Number.isSafeInteger(expectedParent) || expectedParent <= 0 || proof.pid !== expectedParent
+        || typeof proof.lock !== 'string' || typeof proof.token !== 'string' || !proof.token
+        || !(proof.lock === treeAt(expectedStore) || proof.lock === regionAt(expectedStore, '')
+            || dirname(proof.lock) === join(expectedStore, 'locks') && basename(proof.lock).startsWith('@authority-'))) {
+        throw Error(`${selfName()}: REFUSE·lock invalid inherited authority protection`);
+    }
+    const holder = holderOf(proof.lock);
+    if (!alive(expectedParent) || holder?.pid !== proof.pid || holder.token !== proof.token)
+        throw Error(`${selfName()}: REFUSE·lock inherited authority protection ended`);
+}
+/** A child can publish independently, but the joined root projection and its
+ * derived ledger appends have one writer. Authority protection already excludes
+ * root mutations, so this lock needs no acquisition-gate upgrade. */
+export function underRootProjection(store, what, act) {
+    return framed(async () => {
+        if (owns(treeAt(store)) || owns(regionAt(store, '')))
+            return;
+        if (!ownsAuthority(store))
+            throw new Error(`${selfName()}: REFUSE·lock root projection requires authority protection`);
+        await hold(projectionAt(store), what);
+    }, act);
+}
 export const holdRoot = async (store, what) => {
     if (!owns(treeAt(store)))
         await hold(regionAt(store, ''), what);