@lapxo/bound 0.1.8 → 0.2.0

package/dist/land/ledger.js

@@ -40,12 +40,30 @@ function journalLines(store, writer, place, legacy) {
     journalMemo.set(key, lines);
     return lines;
 }
-export function ledgerWriters(store) {
+function legacyWriters(store) {
     const at = join(store, 'ledger');
-    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    return existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+}
+export function ledgerWriters(store) {
+    const legacy = legacyWriters(store);
     const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
     return [...new Set([...legacy, ...committed])];
 }
+/** One synchronous root-history read, not a retained authority snapshot.
+ * Preserve writer order and each writer's legacy-before-committed ordering.
+ * Every call rereads the complete committed inventory exactly once. */
+export function rootLedgerLines(store) {
+    const legacy = legacyWriters(store), acts = committedLocalActs(store);
+    const fresh = acts.flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records)) ?? []);
+    const writers = [...new Set([...legacy, ...fresh.map(line => fieldOf(line, 'by'))])];
+    return writers.flatMap(writer => {
+        // Authority-history identity needs actual bytes. A writer's size and mtime
+        // cannot distinguish a same-size edit or stand in for an admission proof.
+        const at = writerFile(store, writer), prior = existsSync(at) ? readFileSync(at, 'utf8').split('\n').filter(line => line.startsWith(PROTOCOL)) : [];
+        const committed = fresh.filter(line => fieldOf(line, 'by') === writer);
+        return committed.length ? [...new Set([...prior, ...committed])] : prior;
+    });
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/observe/regions.d.ts

@@ -27,3 +27,7 @@ type Ask = (declaration: Declaration, one: Asking, verb: 'render' | 'read', shap
  */
 export declare const askingOf: (fold: Placed) => Ask;
 export declare function capsuleReadingsOver(fold: Placed): readonly string[];
+/** Current judgement excludes authenticated outcomes of the selected producer batches; retained evidence stays in its carrier. */
+export declare const currentReceiptObservations: (fold: Parameters<typeof capsulesOf>[0]) => readonly string[];
+/** Preserve prior producer outcomes in the owning place's public carrier, independently of current judgement. */
+export declare const retiredReceiptHistory: (fold: Parameters<typeof capsulesOf>[0]) => readonly string[];

package/dist/observe/regions.js

@@ -1,3 +1,11 @@
+import { childFlags } from "../host/capsule.js";
+import { readingProfile, readingExecution, withReadingBoundary } from "../host/reading-context.js";
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+import { portableReadingReceipt, verifiedReadingReceipts } from "../host/reading-closures.js";
+import { bytesDigest, instrumentCoordinates } from "../fold/digests.js";
+import { ownRoot, processOf } from "./runner.js";
+import { contentPolicy } from "../host/content-store.js";
+import { carriedFrom } from "../fold/resolved.js";
 import { selectedCapsules } from "../host/selected-capsules.js";
 import { selectionLines, projectionLines } from "../fold/reach.js";
 export { selectionLines } from "../fold/reach.js";
@@ -22,6 +30,7 @@ import { ownLock } from "./runner.js";
 import { nameOf } from "../render/page.js";
 import { placeLines, takenFor } from "../fold/place-inputs.js";
 import { isRegionDeclaration } from "../fold/region-declarations.js";
+const receiptHasher = (store) => (text) => bytesDigest(store, new TextEncoder().encode(text));
 const fact = (scope, value, form = 'alphabet', measure = 'fact') => canonical({ scope, role: 'writes', form, measure, value, by: 'fold', at: 'place:fold' });
 const described = (local = []) => {
     const lock = ownLock();
@@ -164,12 +173,30 @@ function capsuleReadings(fold) {
     return known.get(place) ?? known.set(place, readingsAt(fold, place)).get(place);
 }
 function readingsAt(fold, place) {
-    const asking = askingOf(fold);
     const speaker = keyFor(fold.store, 'read');
     return capsulesOf(fold).flatMap((capsule) => {
         const writing = new Set(capsule.lines.filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'measure') === 'writes').map((line) => fieldOf(line, 'scope').slice('region/'.length)));
         const receipts = Object.keys(capsule.declaration.writes).filter((name) => capsule.declaration.writes[name] === 'receipt' && !writing.has(name)).sort();
+        const target = modernReceiptInputs(fold, capsule.selection ?? capsule.digest);
+        const asking = askingOf({ ...fold, observed: target.current });
         const requests = receipts.flatMap((name) => ((request) => (request === undefined ? [] : [request]))(asking(capsule.declaration, { name, at: 3 }, 'read', '')));
+        const modern = readingProfile(fold.standing, fieldOf);
+        if (modern && requests.length) {
+            const hash = receiptHasher(fold.store);
+            const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts]));
+            const coordinates = instrumentCoordinates(fold.store, processOf('verb'), [], ownRoot(), ownLock(), true), instrument = hash([...coordinates.values()].sort().join('\n'));
+            const legacy = target.legacy;
+            return requests.flatMap(request => {
+                const execution = readingExecution({ instrument, implementation: capsule.digest, policy: hash(JSON.stringify([contentPolicy(), capsule.selection ?? null, capsule.lines])), inputs: [['world', capsule.selection ?? capsule.digest], ['batch', batch], ['request', hash(JSON.stringify(request))], ...legacy, ...[...coordinates].map(([name, id]) => ['host/' + relative(ownRoot(), name), id])] }, hash, { env: process.env, cwd: fold.root, flags: childFlags() });
+                const closure = new TextDecoder().decode(readingIdentityBytes(execution.context)), input = hash(closure), said = withReadingBoundary(input, execution, () => capsule.ask([request]))[0];
+                if (said?.kind !== 'fact')
+                    throw Error(`REFUSE·capsule ${capsule.digest} · ${request.region} · ${said?.why ?? 'no answer'}`);
+                const by = speaker + ':' + batch.slice(7), at = 'place:' + input;
+                const lines = (said.claims ?? []).map((row) => canonical({ scope: row.scope, role: row.role, measure: row.measure, form: row.bound.kind === 'interval' ? 'interval' : 'alphabet', value: row.bound.kind === 'interval' ? `${row.bound.lo ?? 0}..${row.bound.hi ?? 0}` : (row.bound.values ?? []).join('|'), by, at }));
+                const output = lines.join('\n') + (lines.length ? '\n' : ''), scope = 'receipts/readings/' + hash(request.region ?? '').slice(7) + '/' + input.slice(7);
+                return [canonical({ scope: place, role: 'writes', form: 'alphabet', measure: 'observed', value: input.slice(7, 23), by, at }), ...lines, ...portableReadingReceipt(scope, by, closure, output, hash)];
+            });
+        }
         const answers = capsule.ask(requests);
         const refused = requests.filter((_, i) => answers[i]?.kind !== 'fact');
         if (refused.length)
@@ -196,3 +223,84 @@ export function capsuleReadingsOver(fold) {
     return [...capsuleReadings(fold), ...places.flatMap((place) => capsuleReadings({ ...fold, under: `${place}/`,
             standing: [...new Set([...said.filter((one) => one.place === place).map((one) => one.line), ...fold.standing])] }))];
 }
+/** Current judgement excludes authenticated outcomes of the selected producer batches; retained evidence stays in its carrier. */
+export const currentReceiptObservations = (fold) => modernReceiptInputs(fold).current;
+/** Preserve prior producer outcomes in the owning place's public carrier, independently of current judgement. */
+export const retiredReceiptHistory = (fold) => { const carried = carriedFrom(fold.store, (observeText(join(fold.root, fold.under ?? '', 'receipts.bound')) ?? '').split('\n').filter(line => line.startsWith('bound-lock/'))) ?? []; const all = [...new Set([...fold.observed, ...carried])], current = new Set(modernReceiptInputs({ ...fold, observed: all }).current); return all.filter(line => !current.has(line)); };
+/** A modern capsule batch cannot consume its own retained outcomes. Full context units bind history; legacy conversion never supplies a current answer. */
+function modernReceiptInputs(fold, target) {
+    if (!readingProfile(fold.standing, fieldOf))
+        return { current: fold.observed, legacy: [] };
+    const observed = [...new Set(fold.observed)];
+    const hash = receiptHasher(fold.store), allSelected = capsulesOf(fold), selected = allSelected.filter(c => { const writing = new Set(c.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))); return Object.keys(c.declaration.writes).some(n => c.declaration.writes[n] === 'receipt' && !writing.has(n)); });
+    if (!selected.length)
+        return { current: fold.observed, legacy: [] };
+    const speaker = keyFor(fold.store, 'read'), removed = new Set(), refs = [];
+    const units = observed.filter(l => fieldOf(l, 'scope').startsWith('receipts/readings/') && fieldOf(l, 'measure') === 'bytes' && fieldOf(l, 'role') === 'writes');
+    if (verifiedReadingReceipts(fold.store, observed, hash, undefined, true) === undefined)
+        throw Error('REFUSE·capsule receipt carrier context invalid');
+    for (const capsule of selected) {
+        if (target !== undefined && (capsule.selection ?? capsule.digest) !== target)
+            continue;
+        const writing = new Set(capsule.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))), receipts = Object.keys(capsule.declaration.writes).filter(n => capsule.declaration.writes[n] === 'receipt' && !writing.has(n)).sort();
+        if (!receipts.length)
+            continue;
+        const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts])), knownLegacy = new Set();
+        for (const unit of units) {
+            const about = fieldOf(unit, 'about');
+            if (!about)
+                continue;
+            let c;
+            try {
+                c = JSON.parse(about);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(c) || c[0] !== 'reading-context@1' || c[2] !== capsule.digest || !Array.isArray(c[4]) || !c[4].some(([n, id]) => n === 'batch' && id === batch) || !c[4].some(([n, id]) => n === 'world' && id === (capsule.selection ?? capsule.digest)))
+                continue;
+            const expectedBy = speaker + ':' + batch.slice(7);
+            if (fieldOf(unit, 'by') !== expectedBy)
+                continue;
+            if (fold.standing.some(line => fieldOf(line, 'scope') === 'keys/' + expectedBy && fieldOf(line, 'value') !== 'withdraw'))
+                throw Error('REFUSE·modern capsule receipt producer ambiguous');
+            const namedScope = fieldOf(unit, 'scope'), inputIdentity = fieldOf(unit, 'value');
+            if (!receipts.some(name => namedScope === 'receipts/readings/' + hash(name).slice(7) + '/' + inputIdentity.slice(7)))
+                throw Error('REFUSE·modern capsule receipt scope differs from declared region');
+            for (const [n, id] of c[4])
+                if (typeof n === 'string' && n.startsWith('legacy/output/') && n === 'legacy/output/' + id) {
+                    knownLegacy.add(id);
+                    refs.push([n, id]);
+                }
+            const by = fieldOf(unit, 'by'), input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), output = observed.find(l => fieldOf(l, 'scope') === scope && fieldOf(l, 'by') === by && fieldOf(l, 'measure') === 'count');
+            const payload = output ? fieldOf(output, 'at') : '';
+            for (const l of observed)
+                if (fieldOf(l, 'by') === by && (fieldOf(l, 'at') === 'place:' + input || fieldOf(l, 'at') === payload || fieldOf(l, 'scope') === scope || fieldOf(l, 'scope') === [scope, 'identity'].join('/')))
+                    removed.add(l);
+        }
+        const alias = capsule.digest.slice(7, 19), by = speaker + ':' + alias, groups = new Map();
+        for (const l of observed)
+            if (fieldOf(l, 'by') === by) {
+                const at = fieldOf(l, 'at');
+                groups.set(at, [...(groups.get(at) ?? []), l]);
+            }
+        if (groups.size) {
+            if (selected.filter(c => c.digest === capsule.digest).length !== 1 || receipts.length !== 1 || new Set(allSelected.filter(c => c.digest.slice(7, 19) === alias).map(c => c.digest)).size !== 1 || fold.standing.some(l => fieldOf(l, 'scope') === 'keys/' + by && fieldOf(l, 'value') !== 'withdraw'))
+                throw Error('REFUSE·legacy capsule receipt producer ambiguous');
+            for (const [at, group] of groups) {
+                if (!/^place:sha256:[a-f0-9]{64}$/.test(at) || group.filter(l => fieldOf(l, 'measure') === 'observed' && fieldOf(l, 'scope') === (fold.under || './')).length !== 1)
+                    throw Error('REFUSE·legacy capsule receipt occurrence ambiguous');
+                const id = hash(group.join('\n'));
+                if (!knownLegacy.has(id)) {
+                    const candidate = observed.filter(l => !removed.has(l) && !group.includes(l)), request = askingOf({ ...fold, observed: candidate })(capsule.declaration, { name: receipts[0], at: 3 }, 'read', '');
+                    if (!request || at !== 'place:' + hash(JSON.stringify(request)))
+                        throw Error('REFUSE·legacy capsule receipt context unavailable · expected ' + at + ' · current ' + (request ? hash(JSON.stringify(request)) : 'absent'));
+                }
+                refs.push(['legacy/output/' + id, id]);
+                for (const l of group)
+                    removed.add(l);
+            }
+        }
+    }
+    return { current: observed.filter(l => !removed.has(l)), legacy: [...new Map(refs.map(([n, id]) => [n + ' ' + id, [n, id]])).values()] };
+}

package/dist/observe/runner.d.ts

@@ -1,4 +1,8 @@
 export declare const ownRoot: () => string;
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export declare function instrumentStoreAt(root: string): string;
 export declare const ownStore: () => string;
 export declare const ownLock: () => readonly string[];
 export declare const sourceOf: () => string;

package/dist/observe/runner.js

@@ -21,8 +21,15 @@ const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
 const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
 const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
 export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
-export const ownStore = () => existsSync(join(ownRoot(), EXTENSION, 'ledger'))
-    ? join(ownRoot(), EXTENSION) : join(ownRoot(), '..', EXTENSION);
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export function instrumentStoreAt(root) {
+    const lines = (observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire);
+    const published = lines.length > 0 && publicLock(lines) !== undefined;
+    return published || existsSync(join(root, EXTENSION, 'ledger')) ? join(root, EXTENSION) : join(root, '..', EXTENSION);
+}
+export const ownStore = () => instrumentStoreAt(ownRoot());
 /** The colocated public artifact is read without an unrelated parent's authority store. */
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;

package/dist/wasm/adapter.d.ts

@@ -0,0 +1,51 @@
+export interface WasmLimits {
+    readonly memoryBytes: number;
+    readonly stackBytes: number;
+    readonly executionMs: number;
+}
+export interface WasmTrust {
+    readonly runtime: string;
+    readonly wasm: string;
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+    readonly byteLengths: {
+        readonly runtime: number;
+        readonly wasm: number;
+        readonly modules: Readonly<Record<string, number>>;
+    };
+}
+export interface WasmRequest {
+    readonly trusted: WasmTrust;
+    readonly assets: {
+        readonly runtime: Uint8Array | ArrayBuffer;
+        readonly wasm: Uint8Array | ArrayBuffer;
+    };
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases?: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+}
+export interface WasmResult {
+    readonly output: string;
+    readonly initializedMs: number;
+    readonly executionMs: number;
+}
+export interface WorkerPort {
+    postMessage(message: WasmRequest): void;
+    terminate(): unknown;
+    addEventListener?(type: string, listener: (event: {
+        data?: unknown;
+        message?: string;
+    }) => void): void;
+    on?(type: string, listener: (value: unknown) => void): void;
+}
+export declare function digest(bytes: Uint8Array): Promise<string>;
+export declare function preflight(request: WasmRequest): void;
+export declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+export declare function evaluateWasm(request: WasmRequest, { workerFactory, signal, lifetimeMs }: {
+    readonly workerFactory?: () => WorkerPort;
+    readonly signal?: AbortSignal;
+    readonly lifetimeMs: number;
+}): Promise<WasmResult>;

package/dist/wasm/adapter.js

@@ -0,0 +1,180 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+const owns = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+const assetNames = ['runtime', 'wasm'], limitNames = ['memoryBytes', 'stackBytes', 'executionMs'];
+// Host adapter only. Source integrity grants neither admission nor authority.
+function refuse(cause) { throw Error('REFUSE·wasm ' + cause); }
+export async function digest(bytes) { return 'sha256:' + Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes.slice().buffer))).map(x => x.toString(16).padStart(2, '0')).join(''); }
+async function verified(bytes, expected) { if (typeof SharedArrayBuffer !== 'undefined' && (bytes instanceof SharedArrayBuffer || (ArrayBuffer.isView(bytes) && bytes.buffer instanceof SharedArrayBuffer)))
+    refuse('shared assets unsupported'); const copy = (bytes instanceof Uint8Array ? new Uint8Array(bytes) : new Uint8Array(bytes)).slice(); if (!/^sha256:[a-f0-9]{64}$/.test(expected) || await digest(copy) !== expected)
+    refuse('integrity'); return copy; }
+const text = new TextEncoder();
+// Exact host-declared sizes bound copies, hashing and worker handoff before work.
+export function preflight(request) {
+    if (!request || Object.keys(request).some(k => !['trusted', 'assets', 'modules', 'aliases', 'entry', 'limits'].includes(k)))
+        refuse('request fields');
+    const { trusted, assets, modules, entry, aliases = {}, limits } = request, sizes = trusted?.byteLengths;
+    if (!sizes || !modules || !assets)
+        refuse('declared byte sizes');
+    if (Object.keys(assets).length !== 2 || Object.keys(assets).some(k => !['runtime', 'wasm'].includes(k)))
+        refuse('asset fields');
+    if (!limits || Object.keys(limits).length !== 3 || Object.keys(limits).some(k => !['memoryBytes', 'stackBytes', 'executionMs'].includes(k)))
+        refuse('limit fields');
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits[name]) || limits[name] <= 0 || limits[name] !== trusted.limits?.[name])
+            refuse('limit ' + name);
+    if (typeof entry !== 'string' || entry !== trusted.entry || !aliases || Object.values(aliases).some(v => typeof v !== 'string') || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const names = Object.keys(modules), expected = Object.keys(trusted.modules ?? {});
+    if (names.length !== expected.length || names.some(n => !owns(trusted.modules, n)))
+        refuse('module count');
+    const size = (n, want) => { if (!Number.isSafeInteger(want) || want < 0)
+        refuse('declared size ' + n); return want; };
+    for (const name of assetNames) {
+        const v = assets[name];
+        if (typeof SharedArrayBuffer !== 'undefined' && (v instanceof SharedArrayBuffer || (ArrayBuffer.isView(v) && v.buffer instanceof SharedArrayBuffer)))
+            refuse('shared assets unsupported');
+        if (!(v instanceof Uint8Array || v instanceof ArrayBuffer) || v.byteLength !== size(name, sizes[name]))
+            refuse('asset bytes ' + name);
+    }
+    for (const name of names) {
+        const source = modules[name], want = size(name, sizes.modules?.[name]);
+        if (typeof source !== 'string' || source.length > want)
+            refuse('module bytes ' + name);
+        let bytes = 0;
+        for (let i = 0; i < source.length; i++) {
+            const c = source.charCodeAt(i);
+            bytes += c < 128 ? 1 : c < 2048 ? 2 : c >= 55296 && c <= 56319 && i + 1 < source.length && source.charCodeAt(i + 1) >= 56320 && source.charCodeAt(i + 1) <= 57343 ? (i++, 4) : 3;
+            if (bytes > want)
+                refuse('module bytes ' + name);
+        }
+        if (bytes !== want)
+            refuse('module bytes ' + name);
+    }
+}
+export async function runWasmRequest(request) {
+    preflight(request);
+    try {
+        request = structuredClone(request);
+    }
+    catch {
+        refuse('request is not cloneable');
+    }
+    const { trusted, assets, modules, aliases = {}, entry, limits } = request;
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits?.[name]) || limits[name] <= 0 || limits[name] !== trusted?.limits?.[name])
+            refuse('limit ' + name);
+    if (entry !== trusted.entry || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const runtime = await verified(assets.runtime, trusted.runtime), wasm = await verified(assets.wasm, trusted.wasm), sources = {};
+    for (const [id, source] of Object.entries(modules)) {
+        if (!owns(trusted.modules, id))
+            refuse('undeclared module ' + id);
+        sources[id] = new TextDecoder('utf-8', { fatal: true }).decode(await verified(text.encode(source), trusted.modules[id]));
+    }
+    if (Object.keys(trusted.modules).some(id => !owns(sources, id)))
+        refuse('missing module');
+    if (!owns(sources, entry))
+        refuse('entry');
+    // The runtime is a closed esbuild ESM bundle: no imports and no second fetch.
+    const url = 'data:text/javascript;base64,' + bytesBase64(runtime), factory = await import(__rewriteRelativeImportExtension(url));
+    const started = performance.now(), quick = await factory.createQuickJS(wasm);
+    const rt = quick.newRuntime();
+    let context;
+    try {
+        context = rt.newContext();
+        const memory = rt.computeMemoryUsage();
+        let initializedMemory;
+        try {
+            initializedMemory = context.dump(memory);
+        }
+        finally {
+            memory.dispose();
+        }
+        const used = typeof initializedMemory === 'object' && initializedMemory !== null ? initializedMemory.memory_used_size : undefined;
+        if (typeof used !== 'number' || !Number.isSafeInteger(used) || used < 0)
+            refuse('initialized memory measurement unavailable');
+        if (used > limits.memoryBytes)
+            refuse('initialized memory ' + used + ' exceeds declared memory ' + limits.memoryBytes);
+        const initializedMs = performance.now() - started;
+        rt.setMemoryLimit(limits.memoryBytes);
+        rt.setMaxStackSize(limits.stackBytes);
+        const start = performance.now();
+        rt.setInterruptHandler(() => performance.now() - start > limits.executionMs);
+        rt.setModuleLoader(id => { if (!owns(sources, id))
+            refuse('undeclared import ' + id); return sources[id]; }, (parent, name) => { if (owns(aliases, name))
+            return aliases[name]; if (name.startsWith('.'))
+            return new URL(name, new URL(parent, 'file:///')).pathname; if (owns(sources, name))
+            return name; refuse('undeclared import ' + name); });
+        const result = context.evalCode(sources[entry], entry, { type: 'module' });
+        if (result.error) {
+            const e = context.dump(result.error);
+            result.error.dispose();
+            refuse('guest ' + JSON.stringify(e));
+        }
+        result.value.dispose();
+        const value = context.evalCode('globalThis.result');
+        if (value.error) {
+            const e = context.dump(value.error);
+            value.error.dispose();
+            refuse('result ' + JSON.stringify(e));
+        }
+        const output = context.dump(value.value);
+        value.value.dispose();
+        if (typeof output !== 'string')
+            refuse('result must be declared text');
+        return { output, initializedMs, executionMs: performance.now() - start };
+    }
+    finally {
+        context?.dispose();
+        rt.dispose();
+    }
+}
+function bytesBase64(bytes) { let binary = ''; for (const b of bytes)
+    binary += String.fromCharCode(b); return btoa(binary); }
+// A separate worker makes external abort possible while synchronous WASM executes.
+export async function evaluateWasm(request, { workerFactory = () => new Worker(new URL('./worker.js', import.meta.url), { type: 'module' }), signal, lifetimeMs }) {
+    if (!Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0)
+        refuse('worker lifetime');
+    if (signal?.aborted)
+        refuse('cancelled');
+    preflight(request);
+    return new Promise((resolve, reject) => { const worker = workerFactory(); let done = false; const finish = (error, value) => { if (done)
+        return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); worker.terminate(); error ? reject(error) : resolve(value); }; const abort = () => finish(Error('REFUSE·wasm cancelled')); const timer = setTimeout(() => finish(Error('REFUSE·wasm worker lifetime')), lifetimeMs); signal?.addEventListener('abort', abort, { once: true }); const message = (raw) => { const data = raw; if (!data || typeof data !== 'object' || typeof data.ok !== 'boolean') {
+        finish(Error('REFUSE·wasm malformed worker result'));
+        return;
+    } if (data.ok) {
+        if (!data.result || typeof data.result.output !== 'string') {
+            finish(Error('REFUSE·wasm malformed worker output'));
+            return;
+        }
+        finish(null, data.result);
+    }
+    else
+        finish(Error(typeof data.error === 'string' ? data.error : 'REFUSE·wasm worker failure')); }; if (typeof worker.addEventListener === 'function') {
+        worker.addEventListener('message', e => message(e.data));
+        worker.addEventListener('error', e => finish(Error('REFUSE·wasm worker ' + e.message)));
+    }
+    else {
+        if (!worker.on) {
+            finish(Error('REFUSE·wasm worker event port'));
+            return;
+        }
+        worker.on('message', message);
+        worker.on('error', e => finish(e instanceof Error ? e : Error(String(e))));
+    } if (signal?.aborted) {
+        abort();
+        return;
+    } try {
+        worker.postMessage(request);
+    }
+    catch {
+        finish(Error('REFUSE·wasm request is not cloneable'));
+    } });
+}

package/dist/wasm/node-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/wasm/node-worker.js

@@ -0,0 +1,13 @@
+import { parentPort } from 'node:worker_threads';
+import { runWasmRequest } from "./adapter.js";
+if (!parentPort)
+    throw Error('REFUSE·wasm worker port missing');
+const port = parentPort;
+port.once('message', async (request) => {
+    try {
+        port.postMessage({ ok: true, result: await runWasmRequest(request) });
+    }
+    catch (error) {
+        port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+});

package/dist/wasm/object.d.ts

@@ -0,0 +1,8 @@
+import type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
+import type { ObjectReading } from '../engine/index.ts';
+type Fields = Readonly<Record<string, string>>;
+/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
+export declare function usesWasmObject(configuration: readonly Fields[]): boolean;
+/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
+export declare function foldObjectsWithWasm(root: string, records: readonly ObjectRecord[], context: ObjectContext, configuration: readonly Fields[], signal?: AbortSignal): Promise<readonly ObjectReading[]>;
+export {};

package/dist/wasm/object.js

@@ -0,0 +1,76 @@
+import { readFileSync } from 'node:fs';
+import { Worker } from 'node:worker_threads';
+import { sha256 } from "../host/hash.js";
+import { toposAt } from "../host/selected-topos.js";
+import { storeOf } from "../land/ledger.js";
+import { evaluateWasm } from "./adapter.js";
+function refuse(cause) { throw Error('REFUSE·wasm object ' + cause); }
+/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
+export function usesWasmObject(configuration) {
+    const rows = configuration.filter(f => f.scope === 'engine/object' && f.value !== 'withdraw');
+    if (!rows.length)
+        return false;
+    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || rows[0].value !== 'wasm@1')
+        refuse('unique declared backend required');
+    return true;
+}
+function limit(configuration, name, measure) {
+    const rows = configuration.filter(f => f.scope === 'engine/wasm/' + name && f.value !== 'withdraw');
+    if (rows.length !== 1 || rows[0].form !== 'interval' || rows[0].measure !== measure || rows[0].role !== 'writes')
+        refuse('missing or ambiguous ' + name + ' limit');
+    const span = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(rows[0].value ?? '');
+    if (!span || !Number.isSafeInteger(Number(span[1])) || !Number.isSafeInteger(Number(span[2])) || Number(span[1]) > Number(span[2]) || Number(span[2]) < 1)
+        refuse('invalid ' + name + ' limit');
+    return Number(span[2]);
+}
+/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
+export async function foldObjectsWithWasm(root, records, context, configuration, signal) {
+    if (!usesWasmObject(configuration))
+        refuse('backend not selected');
+    const limits = { memoryBytes: limit(configuration, 'memory', 'bytes'), stackBytes: limit(configuration, 'stack', 'bytes'), executionMs: limit(configuration, 'execution', 'milliseconds') }, lifetimeMs = limit(configuration, 'worker-lifetime', 'milliseconds'), responseBytes = limit(configuration, 'response', 'bytes');
+    const assets = new URL('../../assets/wasm/', import.meta.url), manifest = JSON.parse(readFileSync(new URL('manifest.json', assets), 'utf8'));
+    if (!manifest.forms)
+        refuse('installed form closure missing');
+    const codecs = {};
+    for (const record of records.filter(r => r.record === 'cell')) {
+        const pin = record.fields.topos, binding = manifest.forms[pin];
+        if (!binding || !['intervalForm', 'alphabetOfForm'].includes(binding.export) || binding.form !== record.fields.form)
+            refuse('unsupported form standing ' + pin);
+        const standing = toposAt(pin, storeOf(root)), selector = standing.parts.filter(f => f.scope === 'wire/topos/context-view');
+        if (selector.length !== 1)
+            refuse('context selection ' + pin);
+        const offers = standing.parts.filter(f => f.kind === 'check' && f.view === selector[0].value);
+        if (offers.length !== 1 || offers[0].value !== binding.contextArtifact || !(offers[0].restsOn ?? '').split('|').includes(binding.contextArtifact))
+            refuse('context implementation differs ' + pin);
+        const selected = context.resolve(record);
+        if (selected.digest !== pin || selected.form.id !== binding.form)
+            refuse('prepared form differs ' + record.fields.scope);
+        codecs[record.fields.scope] = { digest: pin, export: binding.export, params: selected.params };
+    }
+    const guestNames = Object.keys(manifest.modules);
+    if (guestNames.length !== 1)
+        refuse('installed guest module map');
+    const guestName = guestNames[0];
+    let program;
+    try {
+        program = `import{objectFold,intervalForm,alphabetOfForm}from${JSON.stringify(guestName)};const forms={intervalForm,alphabetOfForm},codecs=${JSON.stringify(codecs)},records=${JSON.stringify(records)};const context={resolve:cell=>{const c=codecs[cell.fields.scope];if(!c)throw Error('REFUSE unknown prepared cell');return{digest:c.digest,form:forms[c.export],params:c.params}}};globalThis.result=JSON.stringify(objectFold(records,context));`;
+    }
+    catch {
+        return refuse('context is not serializable');
+    }
+    const entry = guestName + '.entry', programDigest = sha256(program);
+    const guest = readFileSync(new URL('guest.js', assets), 'utf8'), modules = { [guestName]: guest, [entry]: program }, request = { trusted: { ...manifest, modules: { ...manifest.modules, [entry]: programDigest }, entry, aliases: {}, limits, byteLengths: { ...manifest.byteLengths, modules: { ...manifest.byteLengths.modules, [entry]: Buffer.byteLength(program) } } }, assets: { runtime: new Uint8Array(readFileSync(new URL('runtime.js', assets))), wasm: new Uint8Array(readFileSync(new URL('runtime.wasm', assets))) }, modules, entry, aliases: {}, limits };
+    const result = await evaluateWasm(request, { workerFactory: () => new Worker(new URL('./node-worker.js', import.meta.url)), lifetimeMs, ...(signal ? { signal } : {}) });
+    if (Buffer.byteLength(result.output) > responseBytes)
+        refuse('response bytes limit');
+    let readings;
+    try {
+        readings = JSON.parse(result.output);
+    }
+    catch {
+        return refuse('invalid projection text');
+    }
+    if (!Array.isArray(readings) || readings.some(r => !r || typeof r.cell !== 'string' || typeof r.state !== 'string'))
+        refuse('invalid projection shape');
+    return readings;
+}

package/dist/wasm/worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/wasm/worker.js

@@ -0,0 +1,7 @@
+import { runWasmRequest } from "./adapter.js";
+self.onmessage = async ({ data }) => { try {
+    self.postMessage({ ok: true, result: await runWasmRequest(data) });
+}
+catch (error) {
+    self.postMessage({ ok: false, error: String(error) });
+} };

package/docs/contracts/authenticated-reference.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/authenticated-reference",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reference-port.md",
+      "digest": "sha256:ae500aaec7e94dc9bc7c4d45e3294b212b0ad5ade7647e3ce24807ca7a0ea7cc"
+    },
+    {
+      "role": "yes",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/yes.json",
+      "digest": "sha256:f285a014cc9e9453aebd4c4ed94354fba5cac55c05929f4ad7cdd1b3348a9717"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/authenticated-reference.vector.json",
+      "digest": "sha256:297c4942a847c42eb9d2cf000ab38d8a5f38b64e2e4a469919f0dfc88c9d8bd1"
+    },
+    {
+      "role": "no",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/signature.json",
+      "digest": "sha256:2049bbbf88077727911a0cfec3193ab6ce7bccb8d4e3bb22fc537c59f5addf58"
+    }
+  ]
+}

package/docs/contracts/cli.md

@@ -25,3 +25,16 @@ The query verifies the record signatures and coverage against the authority snap
 ## Standing admission
 
 A uses/ selection admits canonical standing bytes, never an archive. The bytes must already be held under their verified digest or in the single local coordinate explicitly named by needs. Admission checks identity and canonical form without fetching, executing or writing the content store. Missing or corrupt bytes refuse the whole lot. A corrupt held copy cannot be hidden by another source. Archives remain separate dependency declarations.
+
+
+## Declared reading identity
+
+A place selects both `wire/reading-context value=reading-context@1` and `wire/reading-receipt value=reading-receipt@1`. Partial or conflicting selections refuse. Every reader under this profile declares an input projection; a legacy reader is refused by name instead of receiving a new identity without its closure.
+
+The host commits the full instrument reference, the verified capsule implementation, effective reader policy, declared transitive references, each input's actual bytes and dependent receipt identities. The process environment is captured explicitly: inherited variable values (hashed, never printed), the place working directory, child flags, runtime bytes and platform conditions. The same captured boundary is handed to execution and keys the capsule cache. These references grant neither authority nor independence and cannot prove undeclared inputs absent.
+
+An unchanged cross-process fold reads retained receipts with zero opened readings. Changed input reopens that reading and its dependents; changing shared implementation, policy or execution conditions invalidates the readings that depend on them. The semantic receipt names the reading and result together; elapsed time and signature envelopes remain separate. Old receipts are not promoted.
+
+Retained evidence may be inspected without asserting a current response. Reusing a current response also requires the existing snapshot-access contract: matching principal, authorization, request, implementation and snapshot, declared freshness, and both inspection and reuse permission. Unknown or expired freshness, withdrawn permission or changed context refuse before running a provider. A new observation needs its own admitted act.
+
+`fold --check` verifies the retained published evidence and instrument. It opens no reader and grants no permission to assert an old response today. A live fold additionally compares the current captured execution boundary.

package/docs/contracts/engine-object-projection.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/engine-object-projection",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/engine.md",
+      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+    },
+    {
+      "role": "yes",
+      "path": "samples/engine-interval/inputs/sample.json",
+      "digest": "sha256:ef476bda8c15b4967a88dc27a188ab25cfac42bdf381fb82f4e57a482d2fd27d"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/engine-order/inputs/sample.json",
+      "digest": "sha256:f2104a661541baf7f8e6d9224590210b272e24519dafce94ca7c588e5a78a20d"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/engine-object.cli.json",
+      "digest": "sha256:191920f597e2d8bafc9aeeff13934645c64a790dcad94b22c562b30c5fe6baa0"
+    }
+  ]
+}