@lapxo/bound 0.1.8 → 0.1.9

package/dist/cli/verb.js

@@ -42,9 +42,9 @@ import { placesIn } from "../fold/places.js";
 import { isCeiling } from "../fold/configures.js";
 import { readingsIn } from "../land/inert.js";
 import { pass } from "./pass.js";
-import { underTheLock, underTheRegions } from "../land/act.js";
+import { underTheLock, underTheRegions, underRootAuthority } from "../land/act.js";
 import { ownerOf, renderInto, signedDemands, targetFile } from "./owner.js";
-import { claimLinesIn, entryOf, namedPlaces, positionalsOf, valueOf } from "./args.js";
+import { claimLinesIn, entryOf, namedPlaces, positionalIndexes, positionalsOf, valueOf } from "./args.js";
 import { EXIT, FLAGS, NAMED_VIEWS, helpLines } from "./names.js";
 import { accept, signedBatch } from "./accept.js";
 import { renderWalk, landWalk, foreignWalkLines } from "../host/walk.js";
@@ -182,12 +182,18 @@ function beat(root, fold, ms) {
  * as if the batch had landed: the batch is signed and folded, never landed, and nothing is written — `--as rank <batch>`
  * is what a batch would move, read before land.
  */
-async function view(root, under, asked, told = [], coord, key, includePolicy = true) {
+async function view(root, under, asked, told = [], coord, key, includePolicy = true, authorityHeld = false) {
     const [name = asked, depth] = asked.split('@');
     if (name === NAMED_VIEWS.help) {
         process.stdout.write(`${helpLines().join('\n')}\n`);
         return EXIT.closed;
     }
+    // A declared executable reader holds the acting Root's authority throughout
+    // observation and publication. This predicate acquires exclusion only; the
+    // native route authenticates the actual declaration before use.
+    if (!authorityHeld && !told.length && !readOnly() && lockStanding(storeOf(root)).some(line => /^reader\/.+\/port$/.test(fieldOf(line, 'scope')) && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') !== 'withdraw')) {
+        return underRootAuthority(storeOf(root), 'view reader authority', () => view(root, under, asked, told, coord, key, includePolicy, true));
+    }
     if (!lockLines(storeOf(root)).length) {
         process.stderr.write(`${selfName()}: the owner ledger is empty; land it before rendering a view\n`);
         return EXIT.refuse;
@@ -565,8 +571,21 @@ function main(argv) {
     const run = verb in VERBS ? VERBS[verb] : undefined;
     const places = positionalsOf(run === undefined ? argv : argv.slice(1)).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (run !== undefined) {
-        const root = resolve(places[0] ?? '.');
-        return withContentStore(storeOf(root), () => run(root, argv.slice(1), argv));
+        const rest = argv.slice(1);
+        const roots = positionalIndexes(rest).filter(index => {
+            const path = resolve(rest[index]);
+            return existsSync(path) && lstatSync(path).isDirectory();
+        });
+        if (roots.length > 1) {
+            process.stderr.write(`${selfName()}: REFUSE·root name one acting directory\n`);
+            return EXIT.usage;
+        }
+        const selected = roots[0];
+        const root = resolve(selected === undefined ? '.' : rest[selected]);
+        const normalized = selected === undefined ? rest : rest.filter((_, index) => index !== selected);
+        return withContentStore(storeOf(root), () => verb === 'fold' && selected !== undefined
+            ? foldAt(root, undefined, normalized)
+            : run(root, normalized, [verb, ...normalized]));
     }
     const under = argv[0] ?? '';
     if (under && !under.startsWith('-') && places.includes(under)) {

package/dist/fold/admission-history.js

@@ -1,12 +1,12 @@
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
-import { ledgerLines, ledgerWriters, storeOf } from "../land/ledger.js";
+import { rootLedgerLines, storeOf } from "../land/ledger.js";
 import { fieldOf, isConfig, selfName } from "./claims.js";
 /** Local admission history only. Foreign ingress is evidence, never coverage.
  * The clock cutoff is meaningful for configuration; object clocks stay intact. */
 export function admissionHistoryAt(root, epoch) {
     const store = storeOf(root);
-    return [...new Set(ledgerWriters(store).flatMap(writer => ledgerLines(store, writer)))]
+    return [...new Set(rootLedgerLines(store))]
         .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
 }
 /** The existing bootstrap's public root of trust, not today's key selection. */

package/dist/fold/claims.d.ts

@@ -1,4 +1,8 @@
+import { parse } from '@lapxo/topos/wire';
 export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
+/** Pure syntax is retained by the exact record bytes, never by a path, epoch or
+ * claimed digest. This does not retain admission, coverage or current grants. */
+export declare function parsedLine(line: string): ReturnType<typeof parse>;
 export declare const fieldOf: (line: string, name: string) => string;
 export declare const fieldsOf: (line: string) => Record<string, string>;
 export declare function selfName(): string;

package/dist/fold/claims.js

@@ -4,12 +4,31 @@ import { ENVELOPE, PROTOCOL, recordKind, signedBytes, parse } from '@lapxo/topos
 export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
 import { ownRoot } from "../observe/runner.js";
 const decoded = new Map();
+const parsed = new Map();
+const kinds = new Map();
+/** Pure syntax is retained by the exact record bytes, never by a path, epoch or
+ * claimed digest. This does not retain admission, coverage or current grants. */
+export function parsedLine(line) {
+    const held = parsed.get(line);
+    if (held !== undefined)
+        return held;
+    const got = parse(line);
+    if (got.kind === 'fact') {
+        Object.freeze(got.value.fields);
+        if (got.value.keys)
+            Object.freeze(got.value.keys);
+        Object.freeze(got.value);
+    }
+    Object.freeze(got);
+    parsed.set(line, got);
+    return got;
+}
 /** Field access uses the Topos wire parser; decoding is shared for this CLI process. */
 function wireFields(line) {
     const held = decoded.get(line);
     if (held !== undefined)
         return held;
-    const got = parse(line);
+    const got = parsedLine(line);
     const fields = got.kind === 'fact' ? got.value.fields : {};
     decoded.set(line, fields);
     return fields;
@@ -19,8 +38,9 @@ export const fieldsOf = (line) => ({ ...wireFields(line) });
 export function selfName() { return basename(ownRoot()); }
 export function isWire(line) { return line.startsWith(PROTOCOL); }
 export const wireLinesOf = (text) => (text ?? '').split('\n').filter(isWire);
-export const isConfig = (line) => { const k = recordKind(line); return k.kind === 'fact' && k.value === 'config'; };
-export const sayingOf = (line) => !isConfig(line) ? ((p) => p.kind === 'fact' ? signedBytes(p.value.fields) : line)(parse(line)) : Object.entries(fieldsOf(line)).filter(([k]) => !ENVELOPE.has(k)).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => `${k}=${v}`).join(' ');
+export const isConfig = (line) => { const held = kinds.get(line); if (held !== undefined)
+    return held; const k = recordKind(line), value = k.kind === 'fact' && k.value === 'config'; kinds.set(line, value); return value; };
+export const sayingOf = (line) => !isConfig(line) ? ((p) => p.kind === 'fact' ? signedBytes(p.value.fields) : line)(parsedLine(line)) : Object.entries(fieldsOf(line)).filter(([k]) => !ENVELOPE.has(k)).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => `${k}=${v}`).join(' ');
 /** One key per claim: scope, role and measure; what a line says, its envelope set aside, is one however often it landed. */
 export function claimKey(line) {
     const f = fieldsOf(line);

package/dist/fold/closed.d.ts

@@ -12,4 +12,4 @@ export declare function instrumentKeep(store: string, id: string): void;
 export declare function receiptPlaces(root: string, store: string): readonly string[];
 export declare function closeReceipts(root: string, store: string, semantic?: ReadonlyMap<string, string>): Promise<readonly string[]>;
 /** One comparison. A place meets its receipt; the root meets when every receipt it names meets. */
-export declare function meets(root: string, store: string, place: string): boolean;
+export declare function meets(root: string, store: string, place: string, current?: boolean): boolean;

package/dist/fold/closed.js

@@ -1,5 +1,8 @@
 import { actCosts } from "../host/act-cost.js";
 import { verifiedReadingReceipts } from "../host/reading-closures.js";
+import { readingProfile } from "../host/reading-context.js";
+import { currentReadingEnvironment } from "../host/native/receipt-environment.js";
+import { childFlags } from "../host/capsule.js";
 import { dirname, existsSync, join, mkdirSync, relative, resolve, statSync, writeFileSync } from "../host/io.js";
 import { byBytes, canonical, LOCK, parse, publicationOf, roleAt, roleClaimsOf } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, foldClaims, isConfig, isWire } from "./claims.js";
@@ -60,13 +63,21 @@ function filesOf(root, place, region, inputs) {
     return [...new Set([...owned, ...observed, ...own])].filter(rel => rel !== receipt && !rel.split('/').some(part => part === '.bound' || part === '.cache' || part === '.git'));
 }
 const rooted = new Map();
+let lastConfiguration;
 function publicConfiguration(lines) {
+    const input = lines.join('\n');
+    // Retain only this pure projection. Callers still read and hash the actual
+    // files; neither a timestamp nor a previous seal proves their current bytes.
+    if (lastConfiguration?.input === input)
+        return lastConfiguration.output;
     if (!lines.length || !lines.every(isConfig))
         return lines;
     const folded = foldClaims(lines);
     if (folded.forks.length)
         throw Error('REFUSE·receipt disputed configuration standing');
-    return publicationOf(folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'));
+    const output = publicationOf(folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'));
+    lastConfiguration = { input, output };
+    return output;
 }
 function rootLines(root, place) {
     const name = place.replace(/\/$/, '');
@@ -167,7 +178,7 @@ export async function closeReceipts(root, store, semantic) {
     return open;
 }
 /** One comparison. A place meets its receipt; the root meets when every receipt it names meets. */
-export function meets(root, store, place) {
+export function meets(root, store, place, current = true) {
     const name = place.replace(/\/$/, '');
     if (name === '') {
         const at = Date.now();
@@ -178,11 +189,12 @@ export function meets(root, store, place) {
         let closed = (own.length > 0 ? ownClosed : named.size > 0) && [...named].every(([one, expected]) => {
             const bytes = observeFile(join(root, one, RECEIPTS));
             const algorithm = expected.split(':')[0];
-            return bytes !== undefined && hashBytes(bytes, algorithm) === expected && meets(root, store, `${one}/`);
+            return bytes !== undefined && hashBytes(bytes, algorithm) === expected && meets(root, store, `${one}/`, current);
         });
         if (closed && carried) {
             const algorithm = algorithmIn(own.join('\n'));
-            const readings = verifiedReadingReceipts(store, carried, text => hashFull(text, algorithm));
+            const profile = readingProfile((observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire), fieldOf);
+            const readings = verifiedReadingReceipts(store, carried, text => hashFull(text, algorithm), current && profile ? currentReadingEnvironment(store, root, text => hashFull(text, algorithm), childFlags()) : undefined, profile);
             if (readings === undefined)
                 closed = false;
             else if (readings)

package/dist/fold/digests.d.ts

@@ -26,4 +26,4 @@ export declare function memoized(store: string, key: string, compute: () => stri
  */
 export declare function instrumentOf(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): string;
 export declare function instrumentDigest(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): string;
-export declare function instrumentCoordinates(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): ReadonlyMap<string, string>;
+export declare function instrumentCoordinates(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[], fresh?: boolean): ReadonlyMap<string, string>;

package/dist/fold/digests.js

@@ -167,12 +167,13 @@ export function instrumentDigest(store, entry, standing = [], root = dirname(res
     const seen = instrumentCoordinates(store, entry, standing, root, releases);
     return bytesDigest(store, new TextEncoder().encode([...seen.values()].sort().join('\n')));
 }
-export function instrumentCoordinates(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
+export function instrumentCoordinates(store, entry, standing = [], root = dirname(resolve(entry)), releases = [], fresh = false) {
     const seen = new Map();
     const walk = (at) => {
         if (seen.has(at))
             return;
-        const digest = coordinateDigest(store, at);
+        const bytes = fresh ? observeFile(at) : undefined;
+        const digest = fresh ? (bytes === undefined ? undefined : bytesDigest(store, bytes)) : coordinateDigest(store, at);
         if (digest === undefined)
             return;
         // The host loader resolves links before loading a module. Count that module

package/dist/fold/evidence.d.ts

@@ -22,7 +22,7 @@ export interface SnapshotInput {
     };
 }
 export declare function snapshotVerdict(input: SnapshotInput): {
-    verdict: "none" | "grey" | "agrees" | "forks" | "stale";
+    verdict: "none" | "grey" | "stale" | "agrees" | "forks";
     external: boolean;
     epoch: number;
 };

package/dist/fold/kept.js

@@ -1,3 +1,4 @@
+import { encodeUTF8 } from "../host/io.js";
 import { actLines, committedLocalActs } from "../host/ports/local-act.js";
 import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
@@ -10,7 +11,7 @@ import { keyFor, keyOf, lockSigners } from "./keys.js";
 import { sourceOf, vouching } from "../land/vouched.js";
 import { wordsOf } from "./wire.js";
 import { ownLock } from "../observe/runner.js";
-const text = (s) => new TextEncoder().encode(s);
+const text = encodeUTF8;
 const atOf = (line) => {
     if (line.includes(' about='))
         return fieldOf(line, 'at');

package/dist/fold/observed.d.ts

@@ -30,5 +30,6 @@ export declare function observedClaims(root: string, store: string, options?: {
     readonly only?: string;
     readonly reach?: readonly string[];
     readonly answered?: Map<string, string>;
+    readonly selected?: string;
 }): readonly string[];
 export {};

package/dist/fold/observed.js

@@ -1,11 +1,17 @@
+import { authenticatedStanding } from "../host/admitted-place.js";
 import { actCosts } from "../host/act-cost.js";
 import { readingClosures } from "../host/reading-closures.js";
+import { readingExecution, readingProfile } from "../host/reading-context.js";
+import { withNativeReaderRoute } from "../host/native-reader-context.js";
+import { prepareNativeReaderRoute, assertNativeRouteCurrent, materializeNativeRoute } from "../host/native/route.js";
+import { verifiedContent } from "../host/content-store.js";
+import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
 import { readerLifetime, readerAllowsEmpty, assertReaderInputs, parse as parseLifetime } from '@lapxo/topos/wire';
 import { readOnly } from "../host/read-only.js";
-import { basename, dirname, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
+import { basename, dirname, relative, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
 import { bundleOf, processOf } from "../observe/runner.js";
 import { canonical, parse, PROTOCOL } from '@lapxo/topos/wire';
-import { bytesDigest, memoized } from "./digests.js";
+import { bytesDigest, memoized, instrumentCoordinates } from "./digests.js";
 import { land, landMemo, landShard, memoAt, shardLines, storeAt } from "../land/ledger.js";
 import { fieldOf, isWire } from "./claims.js";
 import { rolesOf } from "./roles.js";
@@ -154,8 +160,10 @@ function carried(store) {
     return carriedIn(store).flatMap((file) => (observeText(file) ?? '').split('\n'))
         .filter((line) => isWire(line) && speaker !== undefined && fieldOf(line, 'by').split(':')[0] === speaker);
 }
+const readerSelection = (reader) => reader.capsule?.selected?.selection === undefined ? undefined : 'sha256:' + sha(JSON.stringify([reader.capsule.selected.selection, reader.capsule.region, reader.module, reader.where, [...reader.capsule.globs]]));
+const readerScope = (reader) => reader.capsule?.selected?.selection === undefined ? `reader/${reader.module}` : `reader/${reader.module}/${sha(`${reader.capsule.selected.selection}\n${reader.capsule.region}`)}`;
 const lineagesOf = (store, speaker, readers, regions) => new Set(readers.flatMap((reader) => shardLines(store, speaker, regionIn(regions, reader.module))
-    .filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}` && /(?:^|\s)measure=(?:identity|extension)\s/.test(line)).map((line) => fieldOf(line, 'value'))));
+    .filter((line) => fieldOf(line, 'scope') === readerScope(reader) && /(?:^|\s)measure=(?:identity|extension)\s/.test(line)).map((line) => fieldOf(line, 'value'))));
 export function readerLines(store) {
     const readers = readersOf(store);
     const regions = [...new Set(readers.flatMap((reader) => reader.where.map(trimmed)))];
@@ -188,8 +196,28 @@ export function observedClaims(root, store, options = {}) {
     const standing = lockStanding(store);
     const lines = readersOf(store);
     const readers = [...lines, ...capsuleReadersOf(root, store, standing, lines)];
+    if (options.selected !== undefined) {
+        if (!/^sha256:[a-f0-9]{64}$/.test(options.selected) || options.only === undefined)
+            throw Error('REFUSE·reader invalid internal background selector');
+        if (readers.filter(reader => reader.module === options.only && readerSelection(reader) === options.selected).length !== 1)
+            throw Error('REFUSE·reader internal background selector is not uniquely adopted');
+    }
     if (!readers.length)
         return carried(store);
+    const modern = readingProfile(standing, fieldOf);
+    const implementation = modern ? instrumentCoordinates(store, processOf('verb'), [], ownRoot(), ownLock(), true) : undefined;
+    if (implementation)
+        for (const module of [processOf('host'), processOf('lifetime', 'host')])
+            for (const [coordinate, digest] of instrumentCoordinates(store, module, [], ownRoot(), ownLock(), true))
+                implementation.set(coordinate, digest);
+    const code = implementation ? bytesDigest(store, new TextEncoder().encode([...implementation.values()].sort().join('\n'))) : undefined;
+    const transitive = implementation ? [...implementation].map(([coordinate, digest]) => [relative(ownRoot(), coordinate), digest]) : [];
+    if (modern)
+        for (const line of ownLock().filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads' && fieldOf(line, 'value') !== 'withdraw')) {
+            const digest = fieldOf(line, 'value');
+            verifiedContent(digest, store, ownStore());
+            transitive.push([fieldOf(line, 'scope'), digest]);
+        }
     const speaker = keyFor(store, 'read');
     const regions = [...new Set(readers.flatMap((reader) => reader.where.map(trimmed)))];
     const whole = options.only === undefined && options.reach === undefined;
@@ -258,6 +286,8 @@ export function observedClaims(root, store, options = {}) {
     for (const reader of readers) {
         if (options.only !== undefined && reader.module !== options.only)
             continue;
+        if (options.selected !== undefined && readerSelection(reader) !== options.selected)
+            continue;
         if (!readerReaches(options.reach, reader.where))
             continue;
         const started = Date.now();
@@ -274,12 +304,23 @@ export function observedClaims(root, store, options = {}) {
             if (projection.length !== 1 || !asked)
                 throw Error('REFUSE·input projection is ambiguous ' + reader.module);
             const files = [...new Set(reader.where.flatMap(where => handedAt(root, reader, roleOf, look, where)))].sort().map(place => ({ place, text: observeText(resolve(root, place)) ?? '' }));
-            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
+            const hash = (text) => bytesDigest(store, Buffer.from(text));
+            const allowsEmpty = readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module);
+            const native = prepareNativeReaderRoute(store, { id: reader.id, module: reader.module });
+            if (native && !modern)
+                throw Error('REFUSE·native reader requires complete reading identity ' + reader.module);
+            if (native && asked.digest !== native.profile.selection.archive)
+                throw Error('REFUSE·native reader implementation differs ' + reader.module);
+            const image = native ? materializeNativeRoute(native) : undefined;
+            const execution = modern ? readingExecution({ instrument: code, implementation: asked.digest, policy: hash(JSON.stringify([reader.id, reader.module, reader.kind, reader.shape, reader.where, lifetime ?? null, allowsEmpty])), inputs: [...transitive, ...(native?.inputs ?? []), ...(image ? [['native/mount', image.mountIdentity]] : [])] }, hash, { env: process.env, cwd: image?.cwd ?? root, flags: native ? [] : childFlags() }) : undefined;
+            const result = withNativeReaderRoute(native, () => readingClosures({ root, store, ...(execution ? { context: execution.context, execution } : {}), reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, ...(native ? { assertCurrent: () => assertNativeRouteCurrent(native) } : {}), region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), livePlace: () => authenticatedStanding(root), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty, files, emit: line => process.stderr.write(line + '\n') }));
             out.push(...result.lines);
             ran += result.executed;
             read += result.read - result.opened;
             return false;
         }
+        if (modern)
+            throw Error('REFUSE·reader ' + reader.module + ' complete reading identity requires a declared input projection');
         const endAct = actCosts.begin();
         try {
             const source = reader.capsule === undefined ? observeFile(module) : asked === undefined ? undefined : new Uint8Array();
@@ -287,9 +328,11 @@ export function observedClaims(root, store, options = {}) {
             const offered = offersOf(root, store, reader, roleOf, look, (where) => reached(trimmed(where)));
             assertReaderInputs(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module, offered.length);
             const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
+            const selectedBy = reader.capsule?.selected?.selection === undefined ? undefined : sha(`${reader.capsule.selected.selection}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`);
             const kept = whole && legacy === undefined && answered === undefined && source ? sha([
                 speaker, reader.module, JSON.stringify(lifetime), reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
                 reader.capsule === undefined ? '' : `${reader.capsule.selected?.selection ?? reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
+                ...(selectedBy === undefined ? [] : [selectedBy]),
                 ...offered.map((offer) => `${offer.place} ${offer.digest?.() ?? bytesDigest(store, offer.bytes())}`),
             ].join('\n')) : undefined;
             const stored = kept === undefined ? undefined : observeText(memoAt(store, `observed/${kept}`));
@@ -301,10 +344,12 @@ export function observedClaims(root, store, options = {}) {
             }
             const mark = out.length;
             const home = regionIn(regions, reader.module);
-            const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}`);
-            const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value'));
+            const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === readerScope(reader));
+            // Short selected-origin identities remain stored history; they cannot name
+            // an unambiguous current origin or supply its held observations.
+            const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value')).filter(value => selectedBy === undefined || /^[a-f0-9]{64}$/.test(value));
             const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
-            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
+            const measured = reader.capsule !== undefined ? { by: source ? selectedBy ?? sha(`${reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
                 : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime, kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
                     : { by: 'none', lines: [] };
             const by = measured.by;
@@ -400,7 +445,7 @@ export function observedClaims(root, store, options = {}) {
                 const running = existsSync(marker) && Date.now() - statSync(marker).mtimeMs < 30 * 60 * 1000 && Number.isInteger(pid) && pid > 0 && alive(pid);
                 if (!running) {
                     mkdirSync(dirname(marker), { recursive: true });
-                    const child = spawn(process.execPath, [...childFlags(), processOf('observe'), root, reader.module], { cwd: root, detached: true, stdio: 'ignore' });
+                    const child = spawn(process.execPath, [...childFlags(), processOf('observe'), root, reader.module, ...(readerSelection(reader) === undefined ? [] : [readerSelection(reader)])], { cwd: root, detached: true, stdio: 'ignore' });
                     child.unref();
                     writeFileSync(marker, `${reader.module}\n${child.pid ?? ''}\n`);
                 }
@@ -455,7 +500,7 @@ export function observedClaims(root, store, options = {}) {
                 const over = bytesDigest(store, new TextEncoder().encode(due.map((d) => d.digest).sort().join('\n'))).replace(/^sha256:/, '');
                 level.push(canonical({ scope: `cost/reader/${reader.module}`, role: 'writes', form: 'interval', measure: 'ms', value: `${spent}..${spent}`, by: `${speaker}:${by}`, at: `place:${over}` }));
                 if (lineage.at(-1) !== by)
-                    level.push(canonical({ scope: `reader/${reader.module}`, role: 'writes', form: 'alphabet', measure: 'identity', value: by, by: `${speaker}:${by}`, at: `place:${by}` }));
+                    level.push(canonical({ scope: readerScope(reader), role: 'writes', form: 'alphabet', measure: 'identity', value: by, by: `${speaker}:${by}`, at: `place:${by}` }));
                 rmSync(storeAt(store, 'pending', by), { force: true });
             }
             for (const plan of plans.filter((one) => one.said !== undefined)) {

package/dist/fold/readers.d.ts

@@ -30,9 +30,10 @@ export type Look = {
 export declare function lookOf(root: string, roleOf: (coordinate: string) => CoordinateRole): Look;
 /**
  * The reader regions of the capsules a place can run, where the place's own lock offers them or, at a world, the wire's offers/world list does for a
- * region its own lock does not name: `region/<name>` under a measure the wire's region-measures list names gives the region and its coordinates, and the first capsule, pinned before carried, that writes the region
- * reads them, handed the coordinates it declares it reads among those the place offers. A capsule region takes over what a
- * place's declared region. A standing reader for that same provider and region keeps ownership, so nothing is read twice.
+ * region its own lock does not name: each selected capsule that writes a declared region reads the coordinates
+ * it declares among the place's offered coordinates. Selection identifies attribution, never independence.
+ * An existing reader suppresses only that same selected provider, region and place; an ambiguous legacy
+ * owner refuses instead of hiding another provider or invoking the same provider twice.
  * A newly declared region does not need a retired reader in private history to be observed.
  */
 export declare function capsuleReadersOf(root: string, store: string, standing: readonly string[], lines: readonly ReaderClaim[], resolve?: typeof capsulesFor): readonly ReaderClaim[];

package/dist/fold/readers.js

@@ -1,5 +1,5 @@
 import { resolve } from "../host/io.js";
-import { canonical, fields, matches } from '@lapxo/topos/wire';
+import { canonical, fields, matches, byBytes } from '@lapxo/topos/wire';
 import { namesAt, wordOn, wordsOf, wireLine } from "./wire.js";
 import { fits } from "../observe/match.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
@@ -36,13 +36,14 @@ const reachOfLine = (module, where) => {
 };
 /**
  * The reader regions of the capsules a place can run, where the place's own lock offers them or, at a world, the wire's offers/world list does for a
- * region its own lock does not name: `region/<name>` under a measure the wire's region-measures list names gives the region and its coordinates, and the first capsule, pinned before carried, that writes the region
- * reads them, handed the coordinates it declares it reads among those the place offers. A capsule region takes over what a
- * place's declared region. A standing reader for that same provider and region keeps ownership, so nothing is read twice.
+ * region its own lock does not name: each selected capsule that writes a declared region reads the coordinates
+ * it declares among the place's offered coordinates. Selection identifies attribution, never independence.
+ * An existing reader suppresses only that same selected provider, region and place; an ambiguous legacy
+ * owner refuses instead of hiding another provider or invoking the same provider twice.
  * A newly declared region does not need a retired reader in private history to be observed.
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
-    const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
+    const origin = (capsule) => capsule?.selected?.selection;
     const coordinateMeasure = wordOn(standing, 'region-coordinate', ownLock());
     const localMeasures = wordsOf(standing, 'region-measures');
     const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
@@ -59,16 +60,20 @@ export function capsuleReadersOf(root, store, standing, lines, resolve = capsule
         const capsules = resolve(standing, place, root);
         for (const line of offered) {
             const region = fieldOf(line, 'scope').slice('region/'.length);
-            const by = capsules.find(({ capsule }) => capsule.lines.some((one) => fieldOf(one, 'scope') === `region/${region}` && fieldOf(one, 'measure') === 'writes'));
-            const pkg = fieldOf(by?.offer ?? '', 'scope').split('/')[1] ?? '';
-            if (by === undefined || reaching.has(`${pkg} ${region} ${where || '/'}`))
-                continue;
-            const key = `${by.capsule.selection ?? by.capsule.digest} ${region}`;
-            const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), selected: by.capsule, region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
-            group.globs.set(where, fieldOf(line, 'value').split('|').filter(Boolean));
+            for (const by of capsules.filter(({ capsule }) => capsule.lines.some((one) => fieldOf(one, 'scope') === `region/${region}` && fieldOf(one, 'measure') === 'writes'))) {
+                const pkg = fieldOf(by.offer, 'scope').split('/')[1] ?? '';
+                const reaches = lines.filter(reader => reachOfLine(reader.module, reader.where).includes(`${pkg} ${region} ${where || '/'}`));
+                if (reaches.some(reader => origin(reader.capsule) === undefined))
+                    throw Error(`REFUSE·reader ${pkg}/${region} existing provider origin unmeasured at ${where || '/'}`);
+                if (by.capsule.selection !== undefined && lines.some(reader => origin(reader.capsule) === by.capsule.selection && reader.capsule?.region === region && reader.where.some(place => place.replace(/\/?$/, '/') === (where || '/'))))
+                    continue;
+                const key = `${by.capsule.selection ?? by.capsule.digest} ${region}`;
+                const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), selected: by.capsule, region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
+                group.globs.set(where, fieldOf(line, 'value').split('|').filter(Boolean));
+            }
         }
     }
-    return [...groups.values()].map((group) => ({ id: group.module, shape: ['run'], where: [...group.globs.keys()], module: group.module, kind: 'process',
+    return [...groups.entries()].sort(([a], [b]) => byBytes(a, b)).map(([, group]) => ({ id: group.module, shape: ['run'], where: [...group.globs.keys()], module: group.module, kind: 'process',
         capsule: { selected: group.selected, digest: group.digest, entry: group.entry, region: group.region, reads: group.reads, globs: group.globs } }));
 }
 export function handedAt(root, reader, roleOf, look, place) {

package/dist/fold/resolved.js

@@ -41,7 +41,17 @@ export function receiptsOf(fold) {
     const ran = [...new Set(fold.observed.filter((line) => fieldOf(line, 'measure') !== 'observed'
             && mine.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)))];
     const ranAt = new Set(ran.map((line) => `${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`));
-    const cones = new Set(fold.observed.filter((line) => fieldOf(line, 'measure') === 'observed' && own(fieldOf(line, 'scope')) && ranAt.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)).map(bytesOnly));
+    const cones = new Set(fold.observed.filter((line) => {
+        if (fieldOf(line, 'measure') !== 'observed')
+            return false;
+        const at = fieldOf(line, 'at'), by = fieldOf(line, 'by');
+        // A physical input witnesses an owned reading's base, without becoming
+        // another location of its result. Even a foreign input belongs in that
+        // reading's portable carrier; its own child place is not the reader.
+        if (at.startsWith('witness:'))
+            return ranAt.has(`${by} place:${at.slice('witness:'.length)}`);
+        return own(fieldOf(line, 'scope')) && ranAt.has(`${by} ${at}`);
+    }).map(bytesOnly));
     const paid = ledgerLines(fold.store, 'judge').filter((line) => fold.paid.some((demand) => fieldOf(demand, 'scope') === fieldOf(line, 'scope')
         && !(closed.length > 0 && fieldOf(demand, 'needs').split('|').filter(Boolean).length > 0
             && fieldOf(demand, 'needs').split('|').filter(Boolean).every((need) => closed.some((one) => need.startsWith(one))))));

package/dist/fold/signers.js

@@ -1,7 +1,7 @@
 import { existsSync, join } from "../host/io.js";
-import { authorityOf, isKeyClaim, parse, signersOf } from '@lapxo/topos/wire';
+import { authorityOf, isKeyClaim, signersOf } from '@lapxo/topos/wire';
 import { verifiesFields } from "../land/sign.js";
-import { fieldOf, selfName } from "./claims.js";
+import { fieldOf, selfName, parsedLine as parse } from "./claims.js";
 import { keyFor, lockStanding } from "./keys.js";
 import { storeRoot } from "../host/ports/store.js";
 import { storeOf } from "../land/ledger.js";

package/dist/host/adapters/modules/javascript.d.ts

@@ -1 +1,3 @@
 export declare function moduleImports(source: string, coordinate: string): readonly string[];
+/** A JavaScript literal value; syntax inventory never executes it. */
+export declare const stringLiteral: (node: unknown) => string | undefined;

package/dist/host/adapters/modules/javascript.js

@@ -15,12 +15,7 @@ export function moduleImports(source, coordinate) {
         throw Error('REFUSE·source module syntax cannot be read: ' + coordinate);
     }
     const found = new Set();
-    const literal = (node) => {
-        if (!node || typeof node !== 'object')
-            return;
-        const n = node;
-        return n['type'] === 'Literal' && typeof n['value'] === 'string' ? n['value'] : undefined;
-    };
+    const literal = stringLiteral;
     const visit = (node) => {
         if (!node || typeof node !== 'object')
             return;
@@ -46,3 +41,10 @@ export function moduleImports(source, coordinate) {
     visit(tree);
     return [...found];
 }
+/** A JavaScript literal value; syntax inventory never executes it. */
+export const stringLiteral = (node) => {
+    if (!node || typeof node !== 'object')
+        return;
+    const n = node;
+    return n['type'] === 'Literal' && typeof n['value'] === 'string' ? n['value'] : undefined;
+};

package/dist/host/admitted-place.d.ts

@@ -0,0 +1,5 @@
+/** Existing admission-snapshot authentication and folded live projection.
+ * Consumer configuration evidence only; never a new authority lock. */
+export declare function authenticatedRootStanding(root: string): readonly string[];
+/** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
+export declare const authenticatedStanding: typeof authenticatedRootStanding;

package/dist/host/admitted-place.js

@@ -0,0 +1,54 @@
+import { hashText } from "./hash.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authorityFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+import { createHash } from 'node:crypto';
+// One bounded historical projection, never a current authority/lease verdict.
+// Its complete inputs are reread before lookup, including original signatures.
+let historicalProjection;
+function historicalIdentity(history, anchor) {
+    const hash = createHash('sha256'), text = hashText.bind(undefined, hash);
+    text('authenticated-root-history/1');
+    text(String(history.length));
+    for (const line of history)
+        text(line);
+    text(JSON.stringify(anchor));
+    return hash.digest('hex');
+}
+/** Existing admission-snapshot authentication and folded live projection.
+ * Consumer configuration evidence only; never a new authority lock. */
+export function authenticatedRootStanding(root) {
+    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
+    const identity = historicalIdentity(history, anchor);
+    if (historicalProjection?.identity === identity)
+        return [...historicalProjection.standing];
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            // This invocation has freshly read the complete signed inventory. Derive
+            // the same historical cutoff without reopening it for every epoch; the
+            // next invocation still rereads every authority input.
+            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    historicalProjection = { identity, standing: Object.freeze([...standing]) };
+    return [...standing];
+}
+/** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
+export const authenticatedStanding = authenticatedRootStanding;

package/dist/host/capsule-process.d.ts

@@ -18,4 +18,4 @@ export declare class CapsuleProcessError extends Error {
 }
 export declare function validResponse(value: unknown, request: Request): value is Response;
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>, lifetime?: ReaderLifetime): readonly Response[];
+export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer' | 'env' | 'cwd'>, lifetime?: ReaderLifetime): readonly Response[];