@lapxo/bound 0.1.8 → 0.1.9

package/dist/land/ledger.d.ts

@@ -11,6 +11,10 @@ export declare function ledgerLines(store: string, writer: string): readonly str
 export declare function shardFile(store: string, writer: string, region: string): string;
 export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
 export declare function ledgerWriters(store: string): readonly string[];
+/** One synchronous root-history read, not a retained authority snapshot.
+ * Preserve writer order and each writer's legacy-before-committed ordering.
+ * Every call rereads the complete committed inventory exactly once. */
+export declare function rootLedgerLines(store: string): readonly string[];
 export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
 export declare function signedLines(store: string, writer: string): string[];
 export declare function blobAt(store: string, digest: string): string;

package/dist/land/ledger.js

@@ -40,12 +40,30 @@ function journalLines(store, writer, place, legacy) {
     journalMemo.set(key, lines);
     return lines;
 }
-export function ledgerWriters(store) {
+function legacyWriters(store) {
     const at = join(store, 'ledger');
-    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    return existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+}
+export function ledgerWriters(store) {
+    const legacy = legacyWriters(store);
     const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
     return [...new Set([...legacy, ...committed])];
 }
+/** One synchronous root-history read, not a retained authority snapshot.
+ * Preserve writer order and each writer's legacy-before-committed ordering.
+ * Every call rereads the complete committed inventory exactly once. */
+export function rootLedgerLines(store) {
+    const legacy = legacyWriters(store), acts = committedLocalActs(store);
+    const fresh = acts.flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records)) ?? []);
+    const writers = [...new Set([...legacy, ...fresh.map(line => fieldOf(line, 'by'))])];
+    return writers.flatMap(writer => {
+        // Authority-history identity needs actual bytes. A writer's size and mtime
+        // cannot distinguish a same-size edit or stand in for an admission proof.
+        const at = writerFile(store, writer), prior = existsSync(at) ? readFileSync(at, 'utf8').split('\n').filter(line => line.startsWith(PROTOCOL)) : [];
+        const committed = fresh.filter(line => fieldOf(line, 'by') === writer);
+        return committed.length ? [...new Set([...prior, ...committed])] : prior;
+    });
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/observe/runner.d.ts

@@ -1,4 +1,8 @@
 export declare const ownRoot: () => string;
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export declare function instrumentStoreAt(root: string): string;
 export declare const ownStore: () => string;
 export declare const ownLock: () => readonly string[];
 export declare const sourceOf: () => string;

package/dist/observe/runner.js

@@ -21,8 +21,15 @@ const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
 const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
 const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
 export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
-export const ownStore = () => existsSync(join(ownRoot(), EXTENSION, 'ledger'))
-    ? join(ownRoot(), EXTENSION) : join(ownRoot(), '..', EXTENSION);
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export function instrumentStoreAt(root) {
+    const lines = (observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire);
+    const published = lines.length > 0 && publicLock(lines) !== undefined;
+    return published || existsSync(join(root, EXTENSION, 'ledger')) ? join(root, EXTENSION) : join(root, '..', EXTENSION);
+}
+export const ownStore = () => instrumentStoreAt(ownRoot());
 /** The colocated public artifact is read without an unrelated parent's authority store. */
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;

package/docs/contracts/cli.md

@@ -25,3 +25,16 @@ The query verifies the record signatures and coverage against the authority snap
 ## Standing admission
 
 A uses/ selection admits canonical standing bytes, never an archive. The bytes must already be held under their verified digest or in the single local coordinate explicitly named by needs. Admission checks identity and canonical form without fetching, executing or writing the content store. Missing or corrupt bytes refuse the whole lot. A corrupt held copy cannot be hidden by another source. Archives remain separate dependency declarations.
+
+
+## Declared reading identity
+
+A place selects both `wire/reading-context value=reading-context@1` and `wire/reading-receipt value=reading-receipt@1`. Partial or conflicting selections refuse. Every reader under this profile declares an input projection; a legacy reader is refused by name instead of receiving a new identity without its closure.
+
+The host commits the full instrument reference, the verified capsule implementation, effective reader policy, declared transitive references, each input's actual bytes and dependent receipt identities. The process environment is captured explicitly: inherited variable values (hashed, never printed), the place working directory, child flags, runtime bytes and platform conditions. The same captured boundary is handed to execution and keys the capsule cache. These references grant neither authority nor independence and cannot prove undeclared inputs absent.
+
+An unchanged cross-process fold reads retained receipts with zero opened readings. Changed input reopens that reading and its dependents; changing shared implementation, policy or execution conditions invalidates the readings that depend on them. The semantic receipt names the reading and result together; elapsed time and signature envelopes remain separate. Old receipts are not promoted.
+
+Retained evidence may be inspected without asserting a current response. Reusing a current response also requires the existing snapshot-access contract: matching principal, authorization, request, implementation and snapshot, declared freshness, and both inspection and reuse permission. Unknown or expired freshness, withdrawn permission or changed context refuse before running a provider. A new observation needs its own admitted act.
+
+`fold --check` verifies the retained published evidence and instrument. It opens no reader and grants no permission to assert an old response today. A live fold additionally compares the current captured execution boundary.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -33,7 +33,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "0.1.13",
+    "@lapxo/topos": "^0.1.17",
     "acorn": "8.19.0"
   },
   "devDependencies": {