@lapxo/bound 0.1.8 → 0.1.9

package/dist/cli/accept.js

@@ -1,3 +1,5 @@
+import { assertProspectiveRootClockSelection } from "../host/root-clock-source.js";
+import { hasContextualPlace, landContextualPlace } from "../host/contextual-place.js";
 import { commitLocalAct, intactLocalAct, committedLocalActs } from "../host/ports/local-act.js";
 import { withoutEffects } from "../host/read-only.js";
 import { admittedLine } from "../host/selected-topos.js";
@@ -26,7 +28,7 @@ import { retractedTogether, withdrawal } from "../land/withdraw.js";
 import { isCeiling } from "../fold/configures.js";
 import { inertIn } from "../land/inert.js";
 import { landSaid } from "./pass.js";
-import { underTheLock, underTheRegions } from "../land/act.js";
+import { underTheLock, underTheRegions, underAuthorityRegions, underRootProjection } from "../land/act.js";
 import { openedBy } from "../fold/opened.js";
 import { touchedBy } from "../fold/reach.js";
 import { landOwned, ownedOf } from "../land/owned.js";
@@ -46,6 +48,7 @@ import { judgeDemand, landTake } from "./takes.js";
 function admissionEvidence(root, signed, standing) {
     return withoutEffects(() => {
         const store = storeOf(root);
+        assertProspectiveRootClockSelection(root, signed);
         const reads = !signed.some(isReaderLock) && signed.some(isCeiling);
         const fold = reads ? coneOf(root, entryOf(root), signed.filter(isCeiling)) : { standing, observed: [], own: {}, kept: true };
         const inert = inertIn(signed, { standing: fold.standing, ceiling: isCeiling, signsReader: !reads, observed: fold.observed, own: fold.own, epoch: epochOf([...lockLines(store), ...signed]) });
@@ -277,6 +280,14 @@ export async function signedBatch(root, args, files) {
  */
 export async function accept(root, args) {
     const started = Date.now();
+    const contextFiles = positionalsOf(args);
+    if (contextFiles.length === 1 && hasContextualPlace(root) && !claimLinesIn(contextFiles[0]).length) {
+        if (namedPlaces(args).length || valueOf(args, FLAGS.key) || valueOf(args, FLAGS.keyFile) || valueOf(args, FLAGS.signer))
+            throw Error('REFUSE·contextual place accepts one already signed context envelope');
+        const result = await landContextualPlace(root, contextFiles[0]);
+        process.stdout.write(JSON.stringify({ profile: 'place-act-context@1', identity: result.identity, status: result.kind, context: result.context, receipts: result.receipts }) + '\n');
+        return 0;
+    }
     const named = namedPlaces(args);
     const placed = positionalsOf(args).reduce((all, file) => ((places) => (places.length ? claimLinesIn(file).reduce((got, line) => got.set(sayingOf(line), [...new Set([...(got.get(sayingOf(line)) ?? []), ...places])]), all) : all))(placesOfFile(file)), new Map());
     const batch = await signedBatch(root, args, positionalsOf(args));
@@ -301,7 +312,11 @@ export async function accept(root, args) {
     const where = every ? 'every place · then the root, where the places join' : regions.length ? regions.map((one) => `${one}/`).join(' · ') : 'the root alone, where the places join';
     process.stdout.write(`ACTS     ${where} · ${owned.ledger.length} lines to the ledger${[...owned.own].map(([place, lines]) => ` · ${lines.length} to ${place}'s own lock`).join('')} · before the lock\n`);
     const asked = Date.now();
-    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger, records: batch.signed }, started, owned, asked, regions));
+    // Root-ledger writes may change grants or inherited policies. Child-only
+    // lots read that authority through publication, without excluding siblings.
+    const rootWrite = owned.ledger.length > 0 || every || regions.length === 0;
+    const enter = rootWrite ? underTheRegions : underAuthorityRegions;
+    return enter(store, rootWrite ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger, records: batch.signed }, started, owned, asked, regions));
 }
 async function acceptNow(root, batch, started, owned, asked = started, descent = []) {
     const waited = Date.now() - asked;
@@ -318,6 +333,13 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
         process.stderr.write(`${selfName()}: REFUSE·base moved ${batch.base.digest} → ${currentBase} · nothing landed\n`);
         return 1;
     }
+    try {
+        assertProspectiveRootClockSelection(root, signed);
+    }
+    catch (error) {
+        process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : String(error)} · nothing landed\n`);
+        return 1;
+    }
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed]);
@@ -396,67 +418,69 @@ async function acceptNow(root, batch, started, owned, asked = started, descent =
         landed = took('land', () => [...new Set(signed.map(line => fieldOf(line, 'by')))].map(by => land(store, by, signed.filter(line => fieldOf(line, 'by') === by))));
     for (const [place, lines] of owned.own)
         landOwned(root, place, lines, resultProfile !== undefined);
-    landSaid(store, writerFor(told.standing, 'fold'), []);
-    for (const line of signed) {
-        const value = fieldOf(line, 'value');
-        if (!/^[a-z0-9-]+:[0-9a-f]{32,}$/.test(value))
-            continue;
-        for (const need of locationsOf(fieldOf(line, 'needs')).locations) {
-            const at = join(root, need);
-            const bytes = observeFile(at);
-            if (bytes === undefined)
+    return underRootProjection(store, 'projection', async () => {
+        landSaid(store, writerFor(told.standing, 'fold'), []);
+        for (const line of signed) {
+            const value = fieldOf(line, 'value');
+            if (!/^[a-z0-9-]+:[0-9a-f]{32,}$/.test(value))
                 continue;
-            if (bytesDigest(store, bytes) === value)
-                landBlob(store, value, bytes);
+            for (const need of locationsOf(fieldOf(line, 'needs')).locations) {
+                const at = join(root, need);
+                const bytes = observeFile(at);
+                if (bytes === undefined)
+                    continue;
+                if (bytesDigest(store, bytes) === value)
+                    landBlob(store, value, bytes);
+            }
         }
-    }
-    if (coordinates.taken.length) {
-        for (const path of coordinates.taken) {
-            if (existsSync(join(root, path)))
-                rmSync(join(root, path), { recursive: true });
-            for (let dir = dirname(path); dir !== '.' && existsSync(join(root, dir)) && !entriesIn(join(root, dir)).length; dir = dirname(dir))
-                rmdirSync(join(root, dir));
+        if (coordinates.taken.length) {
+            for (const path of coordinates.taken) {
+                if (existsSync(join(root, path)))
+                    rmSync(join(root, path), { recursive: true });
+                for (let dir = dirname(path); dir !== '.' && existsSync(join(root, dir)) && !entriesIn(join(root, dir)).length; dir = dirname(dir))
+                    rmdirSync(join(root, dir));
+            }
+            landCoordinates(store, new Map(), coordinates.taken, `withdraw:epoch-${epoch}`);
+            for (const path of coordinates.taken)
+                process.stdout.write(`GONE     ${path} · withdrawn by its line\n`);
         }
-        landCoordinates(store, new Map(), coordinates.taken, `withdraw:epoch-${epoch}`);
-        for (const path of coordinates.taken)
-            process.stdout.write(`GONE     ${path} · withdrawn by its line\n`);
-    }
-    for (const one of judged)
-        landTake(root, one, []);
-    const standingAsked = [...signed, ...fold.standing].filter((line) => fieldOf(line, 'role') === 'demands' && fieldOf(line, 'value') !== 'withdraw');
-    const paidScopes = new Set(paidOf(store, standingAsked, fold.observed, view).paid.map((line) => fieldOf(line, 'scope')));
-    const late = lateFacts(store, [...signed, ...fold.standing], paidScopes);
-    if (late.length) {
-        land(store, 'judge', late);
-        for (const line of late)
-            if (fieldOf(line, 'measure') !== 'cone')
-                process.stdout.write(`LATE     ${fieldOf(line, 'scope')} · answered from the landed cone\n`);
-    }
-    if (signed.some((line) => fieldOf(line, 'scope').startsWith(`${basename(ownRoot())}/`) && !fieldOf(line, 'scope').split('/').slice(1, -1).includes('uses'))) {
-        const code = instrumentOf(store, entryOf(root), told.standing, root, ownLock());
-        if (instrumentKept(store) !== code) {
-            const open = await closeReceipts(root, store);
-            instrumentKeep(store, code);
-            process.stderr.write(`open by instrument · ${open.length}\n`);
+        for (const one of judged)
+            landTake(root, one, []);
+        const standingAsked = [...signed, ...fold.standing].filter((line) => fieldOf(line, 'role') === 'demands' && fieldOf(line, 'value') !== 'withdraw');
+        const paidScopes = new Set(paidOf(store, standingAsked, fold.observed, view).paid.map((line) => fieldOf(line, 'scope')));
+        const late = lateFacts(store, [...signed, ...fold.standing], paidScopes);
+        if (late.length) {
+            land(store, 'judge', late);
+            for (const line of late)
+                if (fieldOf(line, 'measure') !== 'cone')
+                    process.stdout.write(`LATE     ${fieldOf(line, 'scope')} · answered from the landed cone\n`);
         }
-    }
-    const rendered = took('render', () => renderInto(root, store));
-    process.stdout.write(`RENDER 0\n`);
-    const own = new Set([...owned.own.values()].flat()).size;
-    const perLine = Math.round((Date.now() - started) / Math.max(1, signed.length + own));
-    const folder = writerFor(fold.standing, 'fold');
-    const beat = (ms, at) => canonical({ scope: 'beat/accept', role: 'writes', form: 'interval', measure: 'ms', value: `${ms}..${ms}`, by: folder ?? '', at: `place:${at}` });
-    if (folder !== undefined)
-        land(store, folder, [beat(perLine, 'line'), beat(1, fold.kept ? 'kept' : 'folded'), beat(Date.now() - started, 'total')]);
-    process.stdout.write(`FACT     signed ${signed.length + own} · landed ${landed.length ? landed.map((one) => `${one.appended} in ${one.at}`).join(' · ') : '0'}${[...owned.own].map(([place, lines]) => ` · ${lines.length} in ${place}/${LOCK}`).join('')} · epoch ${epoch}\n`
-        + `TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · readings · no encounters computed · ${Date.now() - started} ms\n`
-        + `SPENT    ${spent.join(' ms · ')} ms · ${signed.length} lines\n`);
-    if (withdrawn) {
-        process.stdout.write(`WITHDRAW ${withdrawn.taken.length} taken · ${withdrawn.exact.length} exact on distributive scales · ${withdrawn.open.length} on open scales, not computed\n`);
-        for (const line of withdrawn.inexact)
-            process.stdout.write(`INEXACT  ${fieldOf(line, 'scope')} · its scale is not distributive: what the others hold is not what they held without it\n`);
-    }
-    return 0;
+        if (signed.some((line) => fieldOf(line, 'scope').startsWith(`${basename(ownRoot())}/`) && !fieldOf(line, 'scope').split('/').slice(1, -1).includes('uses'))) {
+            const code = instrumentOf(store, entryOf(root), told.standing, root, ownLock());
+            if (instrumentKept(store) !== code) {
+                const open = await closeReceipts(root, store);
+                instrumentKeep(store, code);
+                process.stderr.write(`open by instrument · ${open.length}\n`);
+            }
+        }
+        const rendered = took('render', () => renderInto(root, store));
+        process.stdout.write(`RENDER 0\n`);
+        const own = new Set([...owned.own.values()].flat()).size;
+        const perLine = Math.round((Date.now() - started) / Math.max(1, signed.length + own));
+        const folder = writerFor(fold.standing, 'fold');
+        const beat = (ms, at) => canonical({ scope: 'beat/accept', role: 'writes', form: 'interval', measure: 'ms', value: `${ms}..${ms}`, by: folder ?? '', at: `place:${at}` });
+        if (folder !== undefined)
+            land(store, folder, [beat(perLine, 'line'), beat(1, fold.kept ? 'kept' : 'folded'), beat(Date.now() - started, 'total')]);
+        process.stdout.write(`FACT     signed ${signed.length + own} · landed ${landed.length ? landed.map((one) => `${one.appended} in ${one.at}`).join(' · ') : '0'}${[...owned.own].map(([place, lines]) => ` · ${lines.length} in ${place}/${LOCK}`).join('')} · epoch ${epoch}\n`
+            + `TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · readings · no encounters computed · ${Date.now() - started} ms\n`
+            + `SPENT    ${spent.join(' ms · ')} ms · ${signed.length} lines\n`);
+        if (withdrawn) {
+            process.stdout.write(`WITHDRAW ${withdrawn.taken.length} taken · ${withdrawn.exact.length} exact on distributive scales · ${withdrawn.open.length} on open scales, not computed\n`);
+            for (const line of withdrawn.inexact)
+                process.stdout.write(`INEXACT  ${fieldOf(line, 'scope')} · its scale is not distributive: what the others hold is not what they held without it\n`);
+        }
+        return 0;
+    });
 }
 /**
  * A batch landed twice is one: nothing of it lands again. What it left unpaid is judged again, the way it would be now:

package/dist/cli/act-result.d.ts

@@ -1,3 +1,12 @@
+import { type ActResult } from '@lapxo/topos/wire';
+import { type LocalActBundle } from '../host/ports/local-act.ts';
 /** Public query of a committed identity, using the same admission authority.
  * Native fold evidence has store provenance; it never grants coverage. */
+export declare function verifiedLegacyActResult(root: string, identity: string): {
+    result: ActResult;
+    bundle: LocalActBundle;
+    records: readonly string[];
+    epoch: number;
+    history: readonly string[];
+};
 export declare function printActResult(root: string, identity: string | undefined): void;

package/dist/cli/act-result.js

@@ -1,31 +1,68 @@
+import { hashText } from "../host/hash.js";
+import { hasContextualPlace, contextualAct } from "../host/contextual-place.js";
+import { createHash } from 'node:crypto';
 import { actResultOf, actResultProfile } from '@lapxo/topos/wire';
 import { actLines, intactLocalAct, localActResult } from "../host/ports/local-act.js";
 import { storeOf } from "../land/ledger.js";
 import { lockStanding } from "../fold/keys.js";
 import { authorityFor, writerFor } from "../fold/signers.js";
 import { eraOf } from "../fold/digests.js";
-import { fieldOf, isConfig, foldClaims } from "../fold/claims.js";
+import { fieldOf, isConfig, foldClaims, parsedLine } from "../fold/claims.js";
 import { ownRecordAdmitted } from "../fold/signed.js";
 import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
 import { fullDigest } from "../host/digest.js";
 import { wordOf, wireLine } from "../fold/wire.js";
 import { viewsOf } from "../fold/views.js";
+/** Historical proof only. Exact current bodies, admission history and bootstrap
+ * anchor are reread before lookup; this never retains a current command grant. */
+const historicalProofs = new WeakMap();
+function proofFingerprint(identity, bundle, history, anchor, algorithms) {
+    const hash = createHash('sha256'), text = hashText.bind(undefined, hash);
+    text('legacy-act-historical-proof/1');
+    text(identity);
+    text(bundle.records);
+    text(bundle.receipt);
+    text(bundle.placements === undefined ? 'absent' : 'present');
+    text(String(bundle.placements?.length ?? 0));
+    for (const placement of bundle.placements ?? []) {
+        text(placement.place);
+        text(placement.records);
+    }
+    text(String(history.length));
+    for (const line of history)
+        text(line);
+    text(JSON.stringify(anchor));
+    text(String(algorithms.length));
+    for (const algorithm of algorithms)
+        text(algorithm);
+    return hash.digest('hex');
+}
+const freshResult = (result) => ({ ...result, records: [...result.records] });
 /** Public query of a committed identity, using the same admission authority.
  * Native fold evidence has store provenance; it never grants coverage. */
-export function printActResult(root, identity) {
-    const store = storeOf(root), standing = lockStanding(store);
-    const view = viewsOf(standing).get('act');
-    if (!view || view.shape || !view.regions.some(region => region.name === 'act'))
-        throw Error('REFUSE·view act requires an admitted result profile and act view');
-    if (!identity)
-        throw Error('REFUSE·act name one committed identity');
-    const bundle = localActResult(store, identity, intactLocalAct);
+export function verifiedLegacyActResult(root, identity) {
+    const store = storeOf(root);
+    let observation;
+    const bundle = localActResult(store, identity, (id, current) => {
+        const receipt = parsedLine(current.receipt.trim());
+        if (receipt.kind !== 'fact')
+            return intactLocalAct(id, current);
+        const epoch = Number(fieldOf(current.receipt.trim(), 'epoch'));
+        const history = admissionHistoryAt(root, epoch), before = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) < epoch);
+        const algorithms = eraOf(foldClaims(before).standing).admitted, anchor = admissionAnchor(root);
+        const fingerprint = proofFingerprint(id, current, history, anchor, algorithms), cached = historicalProofs.get(receipt.value);
+        const retained = cached?.fingerprint === fingerprint ? cached.result : undefined;
+        observation = { epoch, history, before, algorithms, anchor, key: receipt.value, fingerprint, ...(retained ? { retained } : {}) };
+        return retained !== undefined || intactLocalAct(id, current);
+    });
     if (!bundle)
         throw Error('REFUSE·act no committed result ' + identity);
-    const records = actLines(bundle.records), epoch = Number(fieldOf(bundle.receipt.trim(), 'epoch'));
-    const history = admissionHistoryAt(root, epoch), before = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) < epoch);
-    const algorithms = eraOf(foldClaims(before).standing).admitted;
-    const authority = authorityFor(history, admissionAnchor(root), algorithms);
+    if (!observation)
+        throw Error('REFUSE·act historical proof observation absent');
+    const records = actLines(bundle.records), { epoch, history, before, algorithms, anchor, retained } = observation;
+    if (retained)
+        return { result: freshResult(retained), bundle, records, epoch, history };
+    const authority = authorityFor(history, anchor, algorithms);
     const admittedBefore = foldClaims(before.filter(line => authority.of(line).kind === 'admitted')).standing;
     const profile = actResultProfile(admittedBefore);
     if (!profile)
@@ -44,5 +81,23 @@ export function printActResult(root, identity) {
             return bundle.placements.some(p => actLines(p.records).includes(line) && (p.place === '.' ? authority.of(line).kind === 'admitted' : ownRecordAdmitted(line, p.place.slice(0, p.place.lastIndexOf('/')), family, authority.admitted, algorithms)));
         },
         verifiesReceipt: line => fieldOf(line, 'by') === writerFor(admittedBefore, 'fold') && intactLocalAct(identity, bundle), });
+    const kept = Object.freeze({ ...result, records: Object.freeze([...result.records]) });
+    historicalProofs.set(observation.key, { fingerprint: observation.fingerprint, result: kept });
+    return { result: freshResult(kept), bundle, records, epoch, history };
+}
+export function printActResult(root, identity) {
+    const store = storeOf(root), standing = lockStanding(store), view = viewsOf(standing).get('act');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'act'))
+        throw Error('REFUSE·view act requires an admitted result profile and act view');
+    if (!identity)
+        throw Error('REFUSE·act name one committed identity');
+    if (hasContextualPlace(root)) {
+        const contextual = contextualAct(root, identity);
+        if (contextual) {
+            process.stdout.write(JSON.stringify(contextual) + '\n');
+            return;
+        }
+    }
+    const { result, bundle } = verifiedLegacyActResult(root, identity);
     process.stdout.write(`ACT ${result.identity} · epoch ${result.epoch} · admitted · conformance not asserted\n` + bundle.records + bundle.receipt);
 }

package/dist/cli/args.d.ts

@@ -5,6 +5,7 @@ export declare function entryOf(root: string): string;
 export declare function valueOf(args: readonly string[], flag: string): string | undefined;
 export declare const valuesOf: (args: readonly string[], flag: string) => readonly string[];
 export declare const namedPlaces: (args: readonly string[]) => readonly string[];
+export declare function positionalIndexes(args: readonly string[]): number[];
 export declare function positionalsOf(args: readonly string[]): string[];
 export declare const placesOfFile: (file: string) => readonly string[];
 export declare function claimLinesIn(file: string): string[];

package/dist/cli/args.js

@@ -14,7 +14,7 @@ export function valueOf(args, flag) {
 }
 export const valuesOf = (args, flag) => args.flatMap((arg, i) => (arg === flag && args[i + 1] !== undefined ? [args[i + 1]] : []));
 export const namedPlaces = (args) => valuesOf(args, FLAGS.place).map((one) => one.replace(/\/$/, ''));
-export function positionalsOf(args) {
+export function positionalIndexes(args) {
     const out = [];
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i] ?? '';
@@ -23,10 +23,13 @@ export function positionalsOf(args) {
             continue;
         }
         if (!arg.startsWith('--'))
-            out.push(arg);
+            out.push(i);
     }
     return out;
 }
+export function positionalsOf(args) {
+    return positionalIndexes(args).map(index => args[index]);
+}
 export const placesOfFile = (file) => (observeText(file) ?? '').split('\n').map((line) => line.trim())
     .filter((line) => line.startsWith('# place ')).map((line) => line.slice('# place '.length).trim().replace(/\/$/, '')).filter(Boolean);
 export function claimLinesIn(file) {

package/dist/cli/custodian.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/custodian.js

@@ -0,0 +1,29 @@
+/** Fixed sync-to-async transport executable. It never resets producer counters
+ * or grants. Its stdin budget comes from the fixed host argv before reading.
+ */
+import { createConnection } from 'node:net';
+import { scheduleDeadline } from "../host/native/deadline.js";
+const cap = Number(process.argv[2]);
+if (!Number.isSafeInteger(cap) || cap < 1)
+    throw Error('REFUSE·producer sync client input resources');
+const chunks = [];
+let size = 0;
+for await (const chunk of process.stdin) {
+    const raw = Buffer.from(chunk);
+    size += raw.length;
+    if (size > cap)
+        throw Error('REFUSE·producer sync client input bytes');
+    chunks.push(raw);
+}
+const { endpoint, frame } = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+if (!endpoint || typeof endpoint.socket !== 'string' || !Number.isSafeInteger(endpoint.timeoutMs) || endpoint.timeoutMs < 1 || !Number.isSafeInteger(endpoint.responseBytes) || endpoint.responseBytes < 1 || typeof frame !== 'string' || Buffer.byteLength(frame) > endpoint.responseBytes)
+    throw Error('REFUSE·producer sync client binding');
+const socket = createConnection(endpoint.socket), remaining = Math.max(1, Math.min(endpoint.timeoutMs, endpoint.deadlineMs - Date.now())), cancel = scheduleDeadline(process.hrtime.bigint() + BigInt(remaining) * 1000000n, () => socket.destroy(Error('REFUSE·producer IPC timeout')));
+let bytes = 0;
+socket.once('connect', () => socket.write(frame + '\n'));
+socket.on('data', chunk => { bytes += chunk.length; if (bytes > endpoint.responseBytes)
+    socket.destroy(Error('REFUSE·producer IPC response bytes'));
+else
+    process.stdout.write(chunk); });
+socket.once('error', error => { process.stderr.write(error.message); process.exitCode = 1; });
+socket.once('close', cancel);

package/dist/cli/native-descendant.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/native-descendant.js

@@ -0,0 +1,19 @@
+/** Fixed descendant entry. The caller supplies only a sealed operational envelope;
+ * actual grants/counters live in the retained Root producer service.
+ */
+import { createHash } from 'node:crypto';
+import { readBoundedFile } from "../host/native/bounded-file.js";
+import { installDescendantBoundary } from "../host/native/descendants.js";
+import { protectNativeLoaderRegistration } from "../host/native/loader.js";
+import { assertNativeRuntime } from "../host/native/runtime.js";
+const url = new URL(import.meta.url), path = url.searchParams.get('config'), cap = Number(url.searchParams.get('bytes')), expected = url.searchParams.get('digest');
+if (!path || !expected || !Number.isSafeInteger(cap) || cap < 1)
+    throw Error('REFUSE·native descendant inherited envelope absent');
+assertNativeRuntime(process.env, []);
+const raw = readBoundedFile(path, cap, 'descendant host envelope');
+if ('sha256:' + createHash('sha256').update(raw).digest('hex') !== expected)
+    throw Error('REFUSE·native descendant envelope changed');
+const config = JSON.parse(raw.toString('utf8'));
+config.custodian.preload = url.href;
+installDescendantBoundary(config);
+protectNativeLoaderRegistration();

package/dist/cli/native.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/native.js

@@ -0,0 +1,60 @@
+import { sha256 as hash } from "../host/hash.js";
+/** Fixed instrument child. Root authority and reading identity arrive through the
+ * inherited supervisor argv; request JSON supplies neither verifier nor grant.
+ */
+import { realpathSync } from 'node:fs';
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+import { readBoundedBatch } from "../host/native/bounded-file.js";
+import { inheritedNativeGuard, inheritedNativeRoot } from "../host/native/root.js";
+import { authenticateNativeProfile, loadSignedNativeReading, answerNativeReading } from "../host/native/reading.js";
+import { readingEnvironment } from "../host/reading-context.js";
+import { assertNativeRuntime } from "../host/native/runtime.js";
+import { nativeReferenceInputs } from "../host/native/references.js";
+const fail = (why) => { throw Error('REFUSE·native dispatcher ' + why); };
+const ordered = (value) => [...value].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+async function run() {
+    const inherited = { store: process.argv[2], parent: Number(process.argv[8]), expected: JSON.parse(process.argv[4]) }, coordinate = process.argv[3], inputLimit = Number(process.argv[6]), phase = process.argv[7], execution = JSON.parse(process.argv[9]);
+    if (phase !== 'act')
+        fail('effects forbidden during ' + phase);
+    if (!Number.isSafeInteger(inputLimit) || inputLimit < 1)
+        fail('missing inherited input limit');
+    if (!execution?.context || !execution.env || !Array.isArray(execution.flags) || !execution.cwd)
+        fail('missing complete inherited reading identity');
+    assertNativeRuntime(process.env, process.execArgv);
+    const identity = hash(readingIdentityBytes(execution.context));
+    if (JSON.stringify(ordered(readingEnvironment(hash, execution.env, execution.cwd, execution.flags))) !== JSON.stringify(ordered(execution.context.environment)))
+        fail('inherited execution differs from context');
+    if (JSON.stringify(ordered(readingEnvironment(hash))) !== JSON.stringify(ordered(execution.context.environment)))
+        fail('actual child environment differs from inherited identity');
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of process.stdin) {
+        const got = Buffer.from(chunk);
+        bytes += got.length;
+        if (bytes > inputLimit)
+            fail('input bytes exceeded');
+        chunks.push(got);
+    }
+    const frame = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    const current = inheritedNativeRoot(inherited, frame.proof), guard = inheritedNativeGuard(inherited, frame.proof), authenticated = authenticateNativeProfile(current, coordinate), profile = authenticated.profile;
+    const selected = authenticated.selection;
+    if (execution.context.implementation !== profile.selection.archive)
+        fail('reading implementation differs from selected archive');
+    if (!Array.isArray(frame.locations) || frame.locations.length !== profile.selection.members.length || frame.locations.length > profile.selection.budget.members)
+        fail('image member budget/count');
+    const runtime = frame.locations.find((location) => location.member === profile.selection.runtime);
+    if (!runtime || realpathSync(runtime.path) !== realpathSync(process.execPath))
+        fail('runtime differs from executing interpreter');
+    nativeReferenceInputs(execution.context.inputs, profile.selection.members.map(member => ['native/' + member.coordinate, member.digest]));
+    const imagePaths = profile.selection.members.map(member => { const rows = frame.locations.filter((location) => location.member === member.coordinate); if (rows.length !== 1)
+        return fail('missing/ambiguous actual member ' + member.coordinate); return { path: rows[0].path, coordinate: member.coordinate }; });
+    const raw = readBoundedBatch([...imagePaths, { path: frame.archive, coordinate: 'implementation archive' }], profile.selection.budget.bytes), archive = raw.at(-1), members = profile.selection.members.map((member, index) => ({ ...member, bytes: new Uint8Array(raw[index]) }));
+    if (hash(archive) !== profile.selection.archive)
+        fail('implementation archive differs');
+    const handoff = { place: inherited.expected.namespace, instrument: execution.context.instrument, policy: execution.context.policy, authoritySnapshot: identity, budget: profile.selection.budget, members, bindings: profile.selection.bindings, loads: profile.selection.loads };
+    const image = { cwd: execution.cwd, locations: frame.locations, runtime: profile.selection.runtime, preload: profile.selection.preload ?? undefined, nativePreloadMembers: profile.selection.nativePreloadMembers, condition: profile.selection.condition, commandPort: profile.port };
+    const handle = await loadSignedNativeReading(selected, { profile, handoff, image, archive }, guard);
+    const results = await answerNativeReading(handle, frame.requests, profile.selection.reader, { phase: 'act', guard });
+    process.stdout.write(JSON.stringify(results) + '\n');
+}
+run().catch(error => { process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n'); process.exitCode = 1; });

package/dist/cli/observe.js

@@ -1,6 +1,13 @@
 import { resolve } from 'node:path';
 import { observedClaims } from "../fold/observed.js";
 import { storeOf } from "../land/ledger.js";
+import { withContentStore } from "../host/content-store.js";
+import { lockStanding } from "../fold/keys.js";
+import { underRootAuthority } from "../land/act.js";
 /** One reader, run to the end behind a fold that did not wait for it: what it lands, the next fold reads. */
-const [root = '.', only] = process.argv.slice(2);
-observedClaims(resolve(root), storeOf(resolve(root)), { wait: true, ...(only === undefined ? {} : { only }) });
+const args = process.argv.slice(2);
+if (args.length > 3 || (args[2] !== undefined && (args[1] === undefined || !/^sha256:[a-f0-9]{64}$/.test(args[2]))))
+    throw Error('REFUSE·reader invalid internal background arguments');
+const [root = '.', only, selected] = args;
+const place = resolve(root), store = storeOf(place);
+await underRootAuthority(store, 'reader authority', () => withContentStore(store, () => observedClaims(place, store, { wait: true, ...(only === undefined ? {} : { only }), ...(selected === undefined ? {} : { selected }) }), () => lockStanding(store)));

package/dist/cli/pass.js

@@ -25,6 +25,7 @@ import { carriedFrom } from "../fold/resolved.js";
 import { wireLine } from "../fold/wire.js";
 import { isWire, RECEIPTS } from "../fold/claims.js";
 import { withoutEffects } from "../host/read-only.js";
+import { assertNativeReaderGrantsCurrent } from "../host/native/route.js";
 /**
  * The pass of a place, in one process: the releases its instrument names are laid out first, its readers observe
  * once, each place a view writes in is folded once, the places before the root whose door reads them, and every coordinate a
@@ -43,7 +44,7 @@ import { withoutEffects } from "../host/read-only.js";
 async function checked(root, entry, under) {
     const started = Date.now();
     const store = storeOf(root);
-    if (!meets(root, store, under ?? '')) {
+    if (!meets(root, store, under ?? '', false)) {
         process.stderr.write(`${selfName()}: REFUSE·check receipts are open; a fold must close them\n`);
         return 1;
     }
@@ -132,6 +133,10 @@ async function sweep(root, entry, under, check, told, journal, given, keep, reac
     };
     const settled = met && sameInstrument && !missingView();
     if (settled) {
+        // File and receipt seals authenticate retained evidence. A normal quiet
+        // fold also needs today's acting Root grant; --check uses checked() above
+        // and intentionally performs historical inspection without fresh effects.
+        assertNativeReaderGrantsCurrent(store);
         const ms = Date.now() - digestAt;
         const read = receiptsSeen();
         const lock = algorithmCost();

package/dist/cli/standing-result.js

@@ -1,11 +1,8 @@
+import { hasContextualPlace, contextualStanding } from "../host/contextual-place.js";
+import { authenticatedStanding } from "../host/admitted-place.js";
 import { viewsOf } from "../fold/views.js";
 import { lockStanding } from "../fold/keys.js";
-import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
-import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
-import { fieldOf, foldClaims } from "../fold/claims.js";
 import { storeOf } from "../land/ledger.js";
-import { foldedEvidence } from '@lapxo/topos/contract';
 /** An evidence projection, never a new authority lock. Authentication uses
  * the admission snapshot at each local epoch; the existing fold applies
  * supersessions and withdrawals across all declared classes. Storage layout
@@ -14,26 +11,10 @@ export function printStandingResult(root) {
     const store = storeOf(root), view = viewsOf(lockStanding(store)).get('standing');
     if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
         throw Error('REFUSE·view standing requires a declared standing view');
-    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
-    const snapshots = new Map();
-    const admitted = history.filter(line => {
-        const epoch = Number(fieldOf(line, 'epoch')) || 0;
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            const snapshot = admissionHistoryAt(root, epoch);
-            // The signature vocabulary is configuration, not the as-yet
-            // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
-            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        return authority.of(line).kind === 'admitted';
-    });
-    // The host authenticates against historical authority; Topos projects the
-    // authenticated history using the instrument's existing fold.
-    const { standing } = foldedEvidence(admitted, {
-        classification: () => 'local',
-        fold: lines => foldClaims(lines).standing,
-    });
+    if (hasContextualPlace(root)) {
+        process.stdout.write(JSON.stringify(contextualStanding(root)) + '\n');
+        return;
+    }
+    const standing = authenticatedStanding(root);
     process.stdout.write(standing.length ? standing.join('\n') + '\n' : '');
 }