@lapxo/bound 0.1.8 → 0.2.0

package/dist/cli/custodian.js

@@ -0,0 +1,29 @@
+/** Fixed sync-to-async transport executable. It never resets producer counters
+ * or grants. Its stdin budget comes from the fixed host argv before reading.
+ */
+import { createConnection } from 'node:net';
+import { scheduleDeadline } from "../host/native/deadline.js";
+const cap = Number(process.argv[2]);
+if (!Number.isSafeInteger(cap) || cap < 1)
+    throw Error('REFUSE·producer sync client input resources');
+const chunks = [];
+let size = 0;
+for await (const chunk of process.stdin) {
+    const raw = Buffer.from(chunk);
+    size += raw.length;
+    if (size > cap)
+        throw Error('REFUSE·producer sync client input bytes');
+    chunks.push(raw);
+}
+const { endpoint, frame } = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+if (!endpoint || typeof endpoint.socket !== 'string' || !Number.isSafeInteger(endpoint.timeoutMs) || endpoint.timeoutMs < 1 || !Number.isSafeInteger(endpoint.responseBytes) || endpoint.responseBytes < 1 || typeof frame !== 'string' || Buffer.byteLength(frame) > endpoint.responseBytes)
+    throw Error('REFUSE·producer sync client binding');
+const socket = createConnection(endpoint.socket), remaining = Math.max(1, Math.min(endpoint.timeoutMs, endpoint.deadlineMs - Date.now())), cancel = scheduleDeadline(process.hrtime.bigint() + BigInt(remaining) * 1000000n, () => socket.destroy(Error('REFUSE·producer IPC timeout')));
+let bytes = 0;
+socket.once('connect', () => socket.write(frame + '\n'));
+socket.on('data', chunk => { bytes += chunk.length; if (bytes > endpoint.responseBytes)
+    socket.destroy(Error('REFUSE·producer IPC response bytes'));
+else
+    process.stdout.write(chunk); });
+socket.once('error', error => { process.stderr.write(error.message); process.exitCode = 1; });
+socket.once('close', cancel);

package/dist/cli/native-descendant.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/native-descendant.js

@@ -0,0 +1,19 @@
+/** Fixed descendant entry. The caller supplies only a sealed operational envelope;
+ * actual grants/counters live in the retained Root producer service.
+ */
+import { createHash } from 'node:crypto';
+import { readBoundedFile } from "../host/native/bounded-file.js";
+import { installDescendantBoundary } from "../host/native/descendants.js";
+import { protectNativeLoaderRegistration } from "../host/native/loader.js";
+import { assertNativeRuntime } from "../host/native/runtime.js";
+const url = new URL(import.meta.url), path = url.searchParams.get('config'), cap = Number(url.searchParams.get('bytes')), expected = url.searchParams.get('digest');
+if (!path || !expected || !Number.isSafeInteger(cap) || cap < 1)
+    throw Error('REFUSE·native descendant inherited envelope absent');
+assertNativeRuntime(process.env, []);
+const raw = readBoundedFile(path, cap, 'descendant host envelope');
+if ('sha256:' + createHash('sha256').update(raw).digest('hex') !== expected)
+    throw Error('REFUSE·native descendant envelope changed');
+const config = JSON.parse(raw.toString('utf8'));
+config.custodian.preload = url.href;
+installDescendantBoundary(config);
+protectNativeLoaderRegistration();

package/dist/cli/native.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/native.js

@@ -0,0 +1,60 @@
+import { sha256 as hash } from "../host/hash.js";
+/** Fixed instrument child. Root authority and reading identity arrive through the
+ * inherited supervisor argv; request JSON supplies neither verifier nor grant.
+ */
+import { realpathSync } from 'node:fs';
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+import { readBoundedBatch } from "../host/native/bounded-file.js";
+import { inheritedNativeGuard, inheritedNativeRoot } from "../host/native/root.js";
+import { authenticateNativeProfile, loadSignedNativeReading, answerNativeReading } from "../host/native/reading.js";
+import { readingEnvironment } from "../host/reading-context.js";
+import { assertNativeRuntime } from "../host/native/runtime.js";
+import { nativeReferenceInputs } from "../host/native/references.js";
+const fail = (why) => { throw Error('REFUSE·native dispatcher ' + why); };
+const ordered = (value) => [...value].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+async function run() {
+    const inherited = { store: process.argv[2], parent: Number(process.argv[8]), expected: JSON.parse(process.argv[4]) }, coordinate = process.argv[3], inputLimit = Number(process.argv[6]), phase = process.argv[7], execution = JSON.parse(process.argv[9]);
+    if (phase !== 'act')
+        fail('effects forbidden during ' + phase);
+    if (!Number.isSafeInteger(inputLimit) || inputLimit < 1)
+        fail('missing inherited input limit');
+    if (!execution?.context || !execution.env || !Array.isArray(execution.flags) || !execution.cwd)
+        fail('missing complete inherited reading identity');
+    assertNativeRuntime(process.env, process.execArgv);
+    const identity = hash(readingIdentityBytes(execution.context));
+    if (JSON.stringify(ordered(readingEnvironment(hash, execution.env, execution.cwd, execution.flags))) !== JSON.stringify(ordered(execution.context.environment)))
+        fail('inherited execution differs from context');
+    if (JSON.stringify(ordered(readingEnvironment(hash))) !== JSON.stringify(ordered(execution.context.environment)))
+        fail('actual child environment differs from inherited identity');
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of process.stdin) {
+        const got = Buffer.from(chunk);
+        bytes += got.length;
+        if (bytes > inputLimit)
+            fail('input bytes exceeded');
+        chunks.push(got);
+    }
+    const frame = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    const current = inheritedNativeRoot(inherited, frame.proof), guard = inheritedNativeGuard(inherited, frame.proof), authenticated = authenticateNativeProfile(current, coordinate), profile = authenticated.profile;
+    const selected = authenticated.selection;
+    if (execution.context.implementation !== profile.selection.archive)
+        fail('reading implementation differs from selected archive');
+    if (!Array.isArray(frame.locations) || frame.locations.length !== profile.selection.members.length || frame.locations.length > profile.selection.budget.members)
+        fail('image member budget/count');
+    const runtime = frame.locations.find((location) => location.member === profile.selection.runtime);
+    if (!runtime || realpathSync(runtime.path) !== realpathSync(process.execPath))
+        fail('runtime differs from executing interpreter');
+    nativeReferenceInputs(execution.context.inputs, profile.selection.members.map(member => ['native/' + member.coordinate, member.digest]));
+    const imagePaths = profile.selection.members.map(member => { const rows = frame.locations.filter((location) => location.member === member.coordinate); if (rows.length !== 1)
+        return fail('missing/ambiguous actual member ' + member.coordinate); return { path: rows[0].path, coordinate: member.coordinate }; });
+    const raw = readBoundedBatch([...imagePaths, { path: frame.archive, coordinate: 'implementation archive' }], profile.selection.budget.bytes), archive = raw.at(-1), members = profile.selection.members.map((member, index) => ({ ...member, bytes: new Uint8Array(raw[index]) }));
+    if (hash(archive) !== profile.selection.archive)
+        fail('implementation archive differs');
+    const handoff = { place: inherited.expected.namespace, instrument: execution.context.instrument, policy: execution.context.policy, authoritySnapshot: identity, budget: profile.selection.budget, members, bindings: profile.selection.bindings, loads: profile.selection.loads };
+    const image = { cwd: execution.cwd, locations: frame.locations, runtime: profile.selection.runtime, preload: profile.selection.preload ?? undefined, nativePreloadMembers: profile.selection.nativePreloadMembers, condition: profile.selection.condition, commandPort: profile.port };
+    const handle = await loadSignedNativeReading(selected, { profile, handoff, image, archive }, guard);
+    const results = await answerNativeReading(handle, frame.requests, profile.selection.reader, { phase: 'act', guard });
+    process.stdout.write(JSON.stringify(results) + '\n');
+}
+run().catch(error => { process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n'); process.exitCode = 1; });

package/dist/cli/observe.js

@@ -1,6 +1,13 @@
 import { resolve } from 'node:path';
 import { observedClaims } from "../fold/observed.js";
 import { storeOf } from "../land/ledger.js";
+import { withContentStore } from "../host/content-store.js";
+import { lockStanding } from "../fold/keys.js";
+import { underRootAuthority } from "../land/act.js";
 /** One reader, run to the end behind a fold that did not wait for it: what it lands, the next fold reads. */
-const [root = '.', only] = process.argv.slice(2);
-observedClaims(resolve(root), storeOf(resolve(root)), { wait: true, ...(only === undefined ? {} : { only }) });
+const args = process.argv.slice(2);
+if (args.length > 3 || (args[2] !== undefined && (args[1] === undefined || !/^sha256:[a-f0-9]{64}$/.test(args[2]))))
+    throw Error('REFUSE·reader invalid internal background arguments');
+const [root = '.', only, selected] = args;
+const place = resolve(root), store = storeOf(place);
+await underRootAuthority(store, 'reader authority', () => withContentStore(store, () => observedClaims(place, store, { wait: true, ...(only === undefined ? {} : { only }), ...(selected === undefined ? {} : { selected }) }), () => lockStanding(store)));

package/dist/cli/pass.js

@@ -1,5 +1,5 @@
 import { mkdirSync, rmSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { Worker } from 'node:worker_threads';
 import { ENVELOPE, canonical, parse } from '@lapxo/topos/wire';
 import { foldPlace, standingOf } from "./place.js";
@@ -25,6 +25,7 @@ import { carriedFrom } from "../fold/resolved.js";
 import { wireLine } from "../fold/wire.js";
 import { isWire, RECEIPTS } from "../fold/claims.js";
 import { withoutEffects } from "../host/read-only.js";
+import { assertNativeReaderGrantsCurrent } from "../host/native/route.js";
 /**
  * The pass of a place, in one process: the releases its instrument names are laid out first, its readers observe
  * once, each place a view writes in is folded once, the places before the root whose door reads them, and every coordinate a
@@ -43,7 +44,7 @@ import { withoutEffects } from "../host/read-only.js";
 async function checked(root, entry, under) {
     const started = Date.now();
     const store = storeOf(root);
-    if (!meets(root, store, under ?? '')) {
+    if (!meets(root, store, under ?? '', false)) {
         process.stderr.write(`${selfName()}: REFUSE·check receipts are open; a fold must close them\n`);
         return 1;
     }
@@ -56,7 +57,7 @@ async function checked(root, entry, under) {
         return 1;
     }
     const standing = emptyLedger(store) ? ownLockOf(root, under?.replace(/\/$/, '') ?? '') : standingOf(root).standing;
-    const instrument = sealed === undefined ? instrumentOf(store, entry, standing, root, ownLock()) : instrumentDigest(store, entry, [], ownRoot(), ownLock());
+    const instrument = sealed === undefined ? instrumentOf(store, entry, standing, root, ownLock()) : instrumentDigest(store, resolve(root, entry), [], ownRoot(), ownLock());
     if (expectedInstrument !== instrument) {
         process.stderr.write(`${selfName()}: REFUSE·check receipt instrument differs; a fold must close it\n`);
         return 1;
@@ -89,10 +90,10 @@ export async function pass(root, entry, under, check) {
         // Byte seals describe the completed render pass, not its intermediate outputs.
         if (!swept.written.length)
             await closeReceipts(root, storeOf(root));
-        const closed = meets(root, storeOf(root), under ?? '') && !swept.written.length;
         // Sealed files do not imply an empty reading. If a retained fold is stale,
         // foldPlace must reload its evidence; a valid retained fold still costs no read.
         const fold = foldPlace(root, entry, under, false, { standing: swept.standingAt.get(under ?? '') ?? standingOf(root, under), ...(swept.settled ? {} : { observed: swept.observed.length ? swept.observed : observedClaims(root, storeOf(root), { wait: false }) }), free: !swept.settled });
+        const closed = meets(root, storeOf(root), under ?? '', true, fold.observed) && !swept.written.length;
         for (const line of releasePolicyLines(fold.release))
             process.stdout.write(`${line}\n`);
         if (closed) {
@@ -132,6 +133,10 @@ async function sweep(root, entry, under, check, told, journal, given, keep, reac
     };
     const settled = met && sameInstrument && !missingView();
     if (settled) {
+        // File and receipt seals authenticate retained evidence. A normal quiet
+        // fold also needs today's acting Root grant; --check uses checked() above
+        // and intentionally performs historical inspection without fresh effects.
+        assertNativeReaderGrantsCurrent(store);
         const ms = Date.now() - digestAt;
         const read = receiptsSeen();
         const lock = algorithmCost();

package/dist/cli/place.d.ts

@@ -28,6 +28,7 @@ export interface PlaceFold {
     readonly missing: readonly string[];
     readonly history: readonly string[];
     readonly observed: readonly string[];
+    readonly receiptHistory?: readonly string[];
     readonly ceilings: {
         readonly read: number;
         readonly total: number;
@@ -63,6 +64,7 @@ export declare function standingOf(root: string, under?: string, told?: readonly
 export declare function coneOf(root: string, entry: string, ceilings: readonly string[], descent?: readonly string[]): {
     readonly standing: readonly string[];
     readonly observed: readonly string[];
+    readonly receiptHistory?: readonly string[];
     readonly own: Readonly<Record<string, number>>;
     readonly kept: boolean;
 };

package/dist/cli/place.js

@@ -20,7 +20,7 @@ import { canonical, LOCK, parse } from '@lapxo/topos/wire';
 import { classDefaults, kindsOf, placesIn, spoken } from "../fold/places.js";
 import { isCeiling } from "../fold/configures.js";
 import { observedClaims, placedReadings } from "../fold/observed.js";
-import { capsuleReadingsOver } from "../observe/regions.js";
+import { capsuleReadingsOver, currentReceiptObservations, retiredReceiptHistory } from "../observe/regions.js";
 import { costReadings, ownReadings } from "../fold/own.js";
 import { paidOf } from "../fold/paid.js";
 import { rolesOf } from "../fold/roles.js";
@@ -175,7 +175,8 @@ export function coneOf(root, entry, ceilings, descent) {
     const named = regionsNamed(standing);
     const reach = descent !== undefined && descent.length ? [...descent] : [...new Set(ceilings.map((line) => boundOf(named, line).region))];
     const read = observedClaims(root, store, { wait: false, ...(reach.includes('') ? {} : { reach }) });
-    const observed = [...read, ...capsuleReadingsOver({ root, store, standing, observed: read })];
+    const current = currentReceiptObservations({ root, store, standing, observed: read });
+    const observed = [...current, ...capsuleReadingsOver({ root, store, standing, observed: read })];
     const own = {
         ...ownReadings({ root, store, entry, roleOf: rolesOf(store), standing, observed, unadmitted: rendered.grey.length + rendered.refused.length, orphans: 0 }),
         ...costReadings(store, standing),
@@ -213,7 +214,8 @@ export function foldPlace(root, entry, under, look = true, given) {
     const spent = [];
     const took = timing(spent);
     const read = given?.observed ?? (under ? took('observe', () => observedClaims(root, store, { wait: look })) : reached);
-    const everywhere = [...read, ...took('capsules', () => capsuleReadingsOver({ root, store, ...(under ? { under } : {}), standing, observed: read }))];
+    const current = currentReceiptObservations({ root, store, ...(under ? { under } : {}), standing, observed: read });
+    const everywhere = [...current, ...took('capsules', () => capsuleReadingsOver({ root, store, ...(under ? { under } : {}), standing, observed: read }))];
     const points = foldPoints(store, standing, under, folder, self, reached, root, answered, reads);
     const taken = bytesDigest(store, new TextEncoder().encode(points.join('\n'))).replace(/^sha256:/, '');
     const observed = everywhere.filter((line) => !/ measure=observed /.test(line) || inside(fieldOf(line, 'scope')));
@@ -241,6 +243,7 @@ export function foldPlace(root, entry, under, look = true, given) {
         demands, paid, missing,
         history: live.history.filter((line) => fieldOf(line, 'needs').split('|').filter(Boolean).some(inside)),
         observed,
+        receiptHistory: retiredReceiptHistory({ root, store, ...(under ? { under } : {}), standing, observed: read }),
         ceilings: {
             read: folded.read.length,
             total: ceilings.length,
@@ -290,7 +293,7 @@ export function foldPlace(root, entry, under, look = true, given) {
             over: listed(again.over.filter((o) => o.side === 'over')),
         },
     };
-    if (folder !== undefined && closed)
+    if (folder !== undefined && meets(root, store, under ?? '', true, whole.observed))
         took('keep', () => keepFold(store, taken, whole, points, self));
     process.stderr.write(`SPENT    fold ${spent.join(' ms · ')} ms\n`);
     return whole;

package/dist/cli/standing-result.js

@@ -1,11 +1,8 @@
+import { hasContextualPlace, contextualStanding } from "../host/contextual-place.js";
+import { authenticatedStanding } from "../host/admitted-place.js";
 import { viewsOf } from "../fold/views.js";
 import { lockStanding } from "../fold/keys.js";
-import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
-import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
-import { fieldOf, foldClaims } from "../fold/claims.js";
 import { storeOf } from "../land/ledger.js";
-import { foldedEvidence } from '@lapxo/topos/contract';
 /** An evidence projection, never a new authority lock. Authentication uses
  * the admission snapshot at each local epoch; the existing fold applies
  * supersessions and withdrawals across all declared classes. Storage layout
@@ -14,26 +11,10 @@ export function printStandingResult(root) {
     const store = storeOf(root), view = viewsOf(lockStanding(store)).get('standing');
     if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
         throw Error('REFUSE·view standing requires a declared standing view');
-    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
-    const snapshots = new Map();
-    const admitted = history.filter(line => {
-        const epoch = Number(fieldOf(line, 'epoch')) || 0;
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            const snapshot = admissionHistoryAt(root, epoch);
-            // The signature vocabulary is configuration, not the as-yet
-            // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
-            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        return authority.of(line).kind === 'admitted';
-    });
-    // The host authenticates against historical authority; Topos projects the
-    // authenticated history using the instrument's existing fold.
-    const { standing } = foldedEvidence(admitted, {
-        classification: () => 'local',
-        fold: lines => foldClaims(lines).standing,
-    });
+    if (hasContextualPlace(root)) {
+        process.stdout.write(JSON.stringify(contextualStanding(root)) + '\n');
+        return;
+    }
+    const standing = authenticatedStanding(root);
     process.stdout.write(standing.length ? standing.join('\n') + '\n' : '');
 }

package/dist/cli/verb.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { printReleaseApproval } from "./release-result.js";
+import { inspectReference } from "../host/reference.js";
+import { authenticatedReferenceSelected, openAuthenticatedReference } from "../host/reference-native.js";
 import { printActResult } from "./act-result.js";
 import { printStandingResult } from "./standing-result.js";
 import { withContentStore } from "../host/content-store.js";
@@ -10,7 +12,8 @@ import { cellsWithReceipts } from "../host/cell-receipts.js";
 import { renderCells } from '@lapxo/topos/cells-view';
 import { releasePolicyLines } from "../fold/release-policy.js";
 import { admittedObjects } from "../host/objects.js";
-import { objectFold } from "../fold/object.js";
+import { objectFold } from "../engine/index.js";
+import { foldObjectsWithWasm, usesWasmObject } from "../wasm/object.js";
 import { OBJECT_VIEW } from '@lapxo/topos/wire';
 import { toposStanding } from '@lapxo/topos/standing';
 import { wireAt, parse as parseWire } from '@lapxo/topos/wire';
@@ -42,9 +45,9 @@ import { placesIn } from "../fold/places.js";
 import { isCeiling } from "../fold/configures.js";
 import { readingsIn } from "../land/inert.js";
 import { pass } from "./pass.js";
-import { underTheLock, underTheRegions } from "../land/act.js";
+import { underTheLock, underTheRegions, underRootAuthority } from "../land/act.js";
 import { ownerOf, renderInto, signedDemands, targetFile } from "./owner.js";
-import { claimLinesIn, entryOf, namedPlaces, positionalsOf, valueOf } from "./args.js";
+import { claimLinesIn, entryOf, namedPlaces, positionalIndexes, positionalsOf, valueOf } from "./args.js";
 import { EXIT, FLAGS, NAMED_VIEWS, helpLines } from "./names.js";
 import { accept, signedBatch } from "./accept.js";
 import { renderWalk, landWalk, foreignWalkLines } from "../host/walk.js";
@@ -182,12 +185,18 @@ function beat(root, fold, ms) {
  * as if the batch had landed: the batch is signed and folded, never landed, and nothing is written — `--as rank <batch>`
  * is what a batch would move, read before land.
  */
-async function view(root, under, asked, told = [], coord, key, includePolicy = true) {
+async function view(root, under, asked, told = [], coord, key, includePolicy = true, authorityHeld = false) {
     const [name = asked, depth] = asked.split('@');
     if (name === NAMED_VIEWS.help) {
         process.stdout.write(`${helpLines().join('\n')}\n`);
         return EXIT.closed;
     }
+    // A declared executable reader holds the acting Root's authority throughout
+    // observation and publication. This predicate acquires exclusion only; the
+    // native route authenticates the actual declaration before use.
+    if (!authorityHeld && !told.length && !readOnly() && lockStanding(storeOf(root)).some(line => /^reader\/.+\/port$/.test(fieldOf(line, 'scope')) && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') !== 'withdraw')) {
+        return underRootAuthority(storeOf(root), 'view reader authority', () => view(root, under, asked, told, coord, key, includePolicy, true));
+    }
     if (!lockLines(storeOf(root)).length) {
         process.stderr.write(`${selfName()}: the owner ledger is empty; land it before rendering a view\n`);
         return EXIT.refuse;
@@ -440,6 +449,28 @@ function foldFile(at) {
     return EXIT.closed;
 }
 function foldVerb(root, rest) {
+    const references = positionalsOf(rest).filter(one => /^#bound(?::|$)/.test(one));
+    if (references.length) {
+        if (references.length !== 1 || positionalsOf(rest).length !== 1 || rest.some(one => one.startsWith('--')))
+            throw Error('REFUSE·reference name one reference without view, check or signing options');
+        if (authenticatedReferenceSelected(standingOf(root).standing))
+            return openAuthenticatedReference(root, references[0]).then(result => {
+                process.stdout.write(`SOURCE   ${result.reference.source}\n`);
+                for (const line of result.semanticStanding.split('\n').filter(Boolean))
+                    process.stdout.write(`TOPOS ${line}\n`);
+                for (const cell of result.readings)
+                    process.stdout.write('CELL ' + JSON.stringify(cell) + '\n');
+                process.stdout.write(`AUTHENTICATED standing ${result.semanticIdentity} · authority ${result.authorityContextIdentity} · no effects committed\n`);
+                return EXIT.closed;
+            });
+        return inspectReference(references[0], standingOf(root).standing).then(result => {
+            process.stdout.write(`SOURCE   ${result.reference.source}\n`);
+            for (const line of result.lines)
+                process.stdout.write(`TOPOS ${line}\n`);
+            process.stdout.write(`INSPECT  standing sha256:${result.reference.digest} · blob ${result.reference.blob} · no encounters computed · unauthenticated\n`);
+            return EXIT.closed;
+        });
+    }
     const files = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory() && one.endsWith(EXTENSION));
     const places = positionalsOf(rest).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (files.length === 1 && !places.length && valueOf(rest, FLAGS.as) === undefined) {
@@ -495,9 +526,21 @@ async function foldResolved(root, under, argv) {
             throw Error('REFUSE·object one history snapshot per fold');
         const history = inputs.length ? claimLinesIn(inputs[0]) : signedOwnerLines(storeOf(root));
         const held = await admittedObjects(root, history, text => process.stdout.write(text + '\n'));
-        const cells = objectFold(held.records, held.context);
-        for (const c of cells)
-            process.stdout.write('CELL ' + JSON.stringify(c) + '\n');
+        let cells;
+        if (usesWasmObject(held.configuration)) {
+            const cancellation = new AbortController(), interrupt = () => cancellation.abort();
+            process.once('SIGINT', interrupt);
+            try {
+                cells = await foldObjectsWithWasm(root, held.records, held.context, held.configuration, cancellation.signal);
+            }
+            finally {
+                process.removeListener('SIGINT', interrupt);
+            }
+        }
+        else
+            cells = objectFold(held.records, held.context);
+        for (const cell of cells)
+            process.stdout.write('CELL ' + JSON.stringify(cell) + '\n');
         process.stdout.write(`FACT     object fold ${cells.length} cells\n`);
         return EXIT.closed;
     }
@@ -565,8 +608,21 @@ function main(argv) {
     const run = verb in VERBS ? VERBS[verb] : undefined;
     const places = positionalsOf(run === undefined ? argv : argv.slice(1)).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());
     if (run !== undefined) {
-        const root = resolve(places[0] ?? '.');
-        return withContentStore(storeOf(root), () => run(root, argv.slice(1), argv));
+        const rest = argv.slice(1);
+        const roots = positionalIndexes(rest).filter(index => {
+            const path = resolve(rest[index]);
+            return existsSync(path) && lstatSync(path).isDirectory();
+        });
+        if (roots.length > 1) {
+            process.stderr.write(`${selfName()}: REFUSE·root name one acting directory\n`);
+            return EXIT.usage;
+        }
+        const selected = roots[0];
+        const root = resolve(selected === undefined ? '.' : rest[selected]);
+        const normalized = selected === undefined ? rest : rest.filter((_, index) => index !== selected);
+        return withContentStore(storeOf(root), () => verb === 'fold' && selected !== undefined && !positionalsOf(normalized).some(one => /^#bound(?::|$)/.test(one))
+            ? foldAt(root, undefined, normalized)
+            : run(root, normalized, [verb, ...normalized]), () => standingOf(root).standing);
     }
     const under = argv[0] ?? '';
     if (under && !under.startsWith('-') && places.includes(under)) {

package/dist/engine/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Pure projection of already admitted typed-object records.
+ * Input is the effective history already admitted by the host, preserving cell
+ * declarations before uses within each epoch and a deterministic selected context.
+ * This API performs no admission,
+ * signature verification, storage, transport, clock selection or execution.
+ * Object operations delegate to the existing Obligations implementation.
+ */
+export { objectFold } from './object.ts';
+export type { ObjectReading } from './object.ts';
+export type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';

package/dist/engine/index.js

@@ -0,0 +1,9 @@
+/**
+ * Pure projection of already admitted typed-object records.
+ * Input is the effective history already admitted by the host, preserving cell
+ * declarations before uses within each epoch and a deterministic selected context.
+ * This API performs no admission,
+ * signature verification, storage, transport, clock selection or execution.
+ * Object operations delegate to the existing Obligations implementation.
+ */
+export { objectFold } from "./object.js";

package/dist/engine/object.d.ts

@@ -0,0 +1,17 @@
+import type { Mark, Cell } from '@lapxo/obligations/views/field';
+import type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
+/** Projection dispatches admitted acts into Obligatory; it defines no meet or propagation. */
+export interface ObjectReading {
+    cell: string;
+    state: string;
+    parts: Cell<unknown>;
+    rest: readonly string[];
+    ownMarks: readonly (string | undefined)[];
+    ownClaims: readonly {
+        id: string | undefined;
+        origin: string;
+    }[];
+    marks: readonly Mark<unknown>[];
+    claims: readonly unknown[];
+}
+export declare function objectFold(records: readonly ObjectRecord[], context: ObjectContext): readonly ObjectReading[];

package/dist/engine/object.js

@@ -0,0 +1,38 @@
+import { cell, sign, join, require as requireFloor, observe, mark, parts, state, live, restOf } from '@lapxo/obligations/views/field';
+import { restCoordinates } from '@lapxo/topos/wire';
+export function objectFold(records, context) {
+    let world = new Map();
+    const definitions = new Map(records.filter(r => r.record === 'cell').map(r => [r.fields.scope, r]));
+    const codecs = new Map([...definitions].map(([name, c]) => [name, context.resolve(c)]));
+    const ids = new Map(records.map(r => [r.fields.id, r]));
+    for (const record of [...records].sort((a, b) => Number(a.fields.epoch) - Number(b.fields.epoch))) {
+        const f = record.fields, name = f.scope, at = Number(f.epoch);
+        if (record.record === 'cell') {
+            world = new Map([...world, [name, cell(name, at, [], restCoordinates(f.restsOn))]]);
+            continue;
+        }
+        const codec = codecs.get(name), L = codec.form.lattice(codec.params), held = world.get(name);
+        if (record.record === 'claim') {
+            const target = f.sign === '-1' ? ids.get(f.takes).fields : f;
+            const changed = observe(held, { id: f.id, at, origin: target.origin, span: codec.form.parse(codec.params, target.value), ...(f.takes ? { takes: f.takes } : {}) }, f.sign === '-1' ? -1 : 1);
+            const seen = [...changed.seen];
+            seen[seen.length - 1] = { ...seen.at(-1), id: f.id };
+            world = new Map([...world, [name, { ...changed, seen }]]);
+        }
+        else if (f.sign === '-1') {
+            const target = ids.get(f.takes).fields;
+            world = new Map([...world, [name, { ...held, marks: [...(held.marks ?? []), mark({ id: f.id, at, takes: f.takes, pole: target.pole, reach: 'local', span: codec.form.parse(codec.params, target.value) })] }]]);
+        }
+        else if (f.widens !== undefined) {
+            const changed = join(L, held, codec.form.parse(codec.params, f.value), f.widens, at);
+            const marks = [...(changed.marks ?? [])];
+            marks[marks.length - 1] = { ...marks.at(-1), id: f.id };
+            world = new Map([...world, [name, { ...changed, marks }]]);
+        }
+        else {
+            const span = codec.form.parse(codec.params, f.value);
+            world = f.pole === 'floor' ? requireFloor(L, world, name, span, { id: f.id, at }) : sign(L, world, name, span, { id: f.id, at });
+        }
+    }
+    return [...world].map(([name, c]) => { const codec = codecs.get(name), L = codec.form.lattice(codec.params); return { cell: name, state: state(L, c, world), parts: parts(L, c, world), rest: restOf(c, world), ownMarks: live(c.marks ?? []).map(m => m.id), ownClaims: live(c.seen).map(s => ({ id: s.id, origin: s.origin })), marks: live(c.marks ?? []), claims: live(c.seen) }; });
+}

package/dist/fold/admission-history.js

@@ -1,12 +1,12 @@
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
-import { ledgerLines, ledgerWriters, storeOf } from "../land/ledger.js";
+import { rootLedgerLines, storeOf } from "../land/ledger.js";
 import { fieldOf, isConfig, selfName } from "./claims.js";
 /** Local admission history only. Foreign ingress is evidence, never coverage.
  * The clock cutoff is meaningful for configuration; object clocks stay intact. */
 export function admissionHistoryAt(root, epoch) {
     const store = storeOf(root);
-    return [...new Set(ledgerWriters(store).flatMap(writer => ledgerLines(store, writer)))]
+    return [...new Set(rootLedgerLines(store))]
         .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
 }
 /** The existing bootstrap's public root of trust, not today's key selection. */

package/dist/fold/claims.d.ts

@@ -1,4 +1,8 @@
+import { parse } from '@lapxo/topos/wire';
 export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
+/** Pure syntax is retained by the exact record bytes, never by a path, epoch or
+ * claimed digest. This does not retain admission, coverage or current grants. */
+export declare function parsedLine(line: string): ReturnType<typeof parse>;
 export declare const fieldOf: (line: string, name: string) => string;
 export declare const fieldsOf: (line: string) => Record<string, string>;
 export declare function selfName(): string;

package/dist/fold/claims.js

@@ -4,12 +4,31 @@ import { ENVELOPE, PROTOCOL, recordKind, signedBytes, parse } from '@lapxo/topos
 export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
 import { ownRoot } from "../observe/runner.js";
 const decoded = new Map();
+const parsed = new Map();
+const kinds = new Map();
+/** Pure syntax is retained by the exact record bytes, never by a path, epoch or
+ * claimed digest. This does not retain admission, coverage or current grants. */
+export function parsedLine(line) {
+    const held = parsed.get(line);
+    if (held !== undefined)
+        return held;
+    const got = parse(line);
+    if (got.kind === 'fact') {
+        Object.freeze(got.value.fields);
+        if (got.value.keys)
+            Object.freeze(got.value.keys);
+        Object.freeze(got.value);
+    }
+    Object.freeze(got);
+    parsed.set(line, got);
+    return got;
+}
 /** Field access uses the Topos wire parser; decoding is shared for this CLI process. */
 function wireFields(line) {
     const held = decoded.get(line);
     if (held !== undefined)
         return held;
-    const got = parse(line);
+    const got = parsedLine(line);
     const fields = got.kind === 'fact' ? got.value.fields : {};
     decoded.set(line, fields);
     return fields;
@@ -19,8 +38,9 @@ export const fieldsOf = (line) => ({ ...wireFields(line) });
 export function selfName() { return basename(ownRoot()); }
 export function isWire(line) { return line.startsWith(PROTOCOL); }
 export const wireLinesOf = (text) => (text ?? '').split('\n').filter(isWire);
-export const isConfig = (line) => { const k = recordKind(line); return k.kind === 'fact' && k.value === 'config'; };
-export const sayingOf = (line) => !isConfig(line) ? ((p) => p.kind === 'fact' ? signedBytes(p.value.fields) : line)(parse(line)) : Object.entries(fieldsOf(line)).filter(([k]) => !ENVELOPE.has(k)).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => `${k}=${v}`).join(' ');
+export const isConfig = (line) => { const held = kinds.get(line); if (held !== undefined)
+    return held; const k = recordKind(line), value = k.kind === 'fact' && k.value === 'config'; kinds.set(line, value); return value; };
+export const sayingOf = (line) => !isConfig(line) ? ((p) => p.kind === 'fact' ? signedBytes(p.value.fields) : line)(parsedLine(line)) : Object.entries(fieldsOf(line)).filter(([k]) => !ENVELOPE.has(k)).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => `${k}=${v}`).join(' ');
 /** One key per claim: scope, role and measure; what a line says, its envelope set aside, is one however often it landed. */
 export function claimKey(line) {
     const f = fieldsOf(line);

package/dist/fold/closed.d.ts

@@ -12,4 +12,4 @@ export declare function instrumentKeep(store: string, id: string): void;
 export declare function receiptPlaces(root: string, store: string): readonly string[];
 export declare function closeReceipts(root: string, store: string, semantic?: ReadonlyMap<string, string>): Promise<readonly string[]>;
 /** One comparison. A place meets its receipt; the root meets when every receipt it names meets. */
-export declare function meets(root: string, store: string, place: string): boolean;
+export declare function meets(root: string, store: string, place: string, current?: boolean, active?: readonly string[]): boolean;