@lapxo/bound 0.1.8 → 0.2.0

package/dist/fold/closed.js

@@ -1,5 +1,8 @@
 import { actCosts } from "../host/act-cost.js";
 import { verifiedReadingReceipts } from "../host/reading-closures.js";
+import { readingProfile } from "../host/reading-context.js";
+import { currentReadingEnvironment } from "../host/native/receipt-environment.js";
+import { childFlags } from "../host/capsule.js";
 import { dirname, existsSync, join, mkdirSync, relative, resolve, statSync, writeFileSync } from "../host/io.js";
 import { byBytes, canonical, LOCK, parse, publicationOf, roleAt, roleClaimsOf } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, foldClaims, isConfig, isWire } from "./claims.js";
@@ -7,9 +10,10 @@ import { bytesDigest as hashBytes, fullDigest as hashFull } from "../host/digest
 import { mountedCoordinatesIn, worldAt } from "./places.js";
 import { ownLockOf } from "./signed.js";
 import { viewsOf } from "./views.js";
+import { keptPlace } from "./kept.js";
 import { storeAt, storeOf } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
-import { carriedFrom } from "./resolved.js";
+import { bytesOnly, carriedFrom } from "./resolved.js";
 import { takenFor } from "../fold/place-inputs.js";
 /** A region is closed when the digest of its bytes is the one its receipt names. Folding a closed region is idle: idleCount is how many were already closed, actSeconds the largest measured act or unpartitioned host work, receiptsSeen how many receipts were read and how long that took. */
 let idle = 0;
@@ -60,13 +64,21 @@ function filesOf(root, place, region, inputs) {
     return [...new Set([...owned, ...observed, ...own])].filter(rel => rel !== receipt && !rel.split('/').some(part => part === '.bound' || part === '.cache' || part === '.git'));
 }
 const rooted = new Map();
+let lastConfiguration;
 function publicConfiguration(lines) {
+    const input = lines.join('\n');
+    // Retain only this pure projection. Callers still read and hash the actual
+    // files; neither a timestamp nor a previous seal proves their current bytes.
+    if (lastConfiguration?.input === input)
+        return lastConfiguration.output;
     if (!lines.length || !lines.every(isConfig))
         return lines;
     const folded = foldClaims(lines);
     if (folded.forks.length)
         throw Error('REFUSE·receipt disputed configuration standing');
-    return publicationOf(folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'));
+    const output = publicationOf(folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'));
+    lastConfiguration = { input, output };
+    return output;
 }
 function rootLines(root, place) {
     const name = place.replace(/\/$/, '');
@@ -167,7 +179,7 @@ export async function closeReceipts(root, store, semantic) {
     return open;
 }
 /** One comparison. A place meets its receipt; the root meets when every receipt it names meets. */
-export function meets(root, store, place) {
+export function meets(root, store, place, current = true, active) {
     const name = place.replace(/\/$/, '');
     if (name === '') {
         const at = Date.now();
@@ -178,14 +190,31 @@ export function meets(root, store, place) {
         let closed = (own.length > 0 ? ownClosed : named.size > 0) && [...named].every(([one, expected]) => {
             const bytes = observeFile(join(root, one, RECEIPTS));
             const algorithm = expected.split(':')[0];
-            return bytes !== undefined && hashBytes(bytes, algorithm) === expected && meets(root, store, `${one}/`);
+            return bytes !== undefined && hashBytes(bytes, algorithm) === expected && meets(root, store, `${one}/`, current);
         });
         if (closed && carried) {
-            const algorithm = algorithmIn(own.join('\n'));
-            const readings = verifiedReadingReceipts(store, carried, text => hashFull(text, algorithm));
+            const algorithm = algorithmIn(own.join('\n')), hash = (text) => hashFull(text, algorithm);
+            const profile = readingProfile((observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire), fieldOf);
+            // History keeps its canonical identity and bytes. It does not become a
+            // current execution merely because it shares a public carrier with one.
+            const readings = verifiedReadingReceipts(store, carried, hash, undefined, profile);
             if (readings === undefined)
                 closed = false;
-            else if (readings)
+            else if (current && profile && readings) {
+                const stamp = instrumentKept(store);
+                const snapshot = active ?? (stamp ? keptPlace(store, undefined, stamp)?.observed : undefined);
+                if (snapshot === undefined)
+                    closed = false;
+                else {
+                    const units = snapshot.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'role') === 'writes');
+                    const supplied = new Set(carried);
+                    const present = units.length > 0 && units.every(line => supplied.has(line) || (fieldOf(line, 'measure') === 'observed' && supplied.has(bytesOnly(line))));
+                    const fresh = present ? verifiedReadingReceipts(store, snapshot, hash, currentReadingEnvironment(store, root, hash, childFlags()), profile) : undefined;
+                    if (!fresh)
+                        closed = false;
+                }
+            }
+            if (closed && readings)
                 process.stderr.write(`RECEIPTS ${readings} read · 0 opened · reading closures\n`);
         }
         seen = { count: named.size + (own.length > 0 ? 1 : 0), ms: Date.now() - at };

package/dist/fold/digests.d.ts

@@ -26,4 +26,4 @@ export declare function memoized(store: string, key: string, compute: () => stri
  */
 export declare function instrumentOf(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): string;
 export declare function instrumentDigest(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): string;
-export declare function instrumentCoordinates(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[]): ReadonlyMap<string, string>;
+export declare function instrumentCoordinates(store: string, entry: string, standing?: readonly string[], root?: string, releases?: readonly string[], fresh?: boolean): ReadonlyMap<string, string>;

package/dist/fold/digests.js

@@ -160,19 +160,21 @@ const importsOf = (store, at, digest) => {
  * A fold is a function of its points and the instrument is one of them, so a fold kept by another bound is another
  * origin's fold — readable as history, never as this instrument's own state.
  */
-export function instrumentOf(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
-    return instrumentDigest(store, entry, standing, root, releases).replace(/^[^:]*:/, '').slice(0, 12);
+export function instrumentOf(store, entry, standing = [], root, releases = []) {
+    const coordinate = root === undefined ? resolve(entry) : resolve(root, entry);
+    return instrumentDigest(store, coordinate, standing, root ?? dirname(coordinate), releases).replace(/^[^:]*:/, '').slice(0, 12);
 }
 export function instrumentDigest(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
     const seen = instrumentCoordinates(store, entry, standing, root, releases);
     return bytesDigest(store, new TextEncoder().encode([...seen.values()].sort().join('\n')));
 }
-export function instrumentCoordinates(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
+export function instrumentCoordinates(store, entry, standing = [], root = dirname(resolve(entry)), releases = [], fresh = false) {
     const seen = new Map();
     const walk = (at) => {
         if (seen.has(at))
             return;
-        const digest = coordinateDigest(store, at);
+        const bytes = fresh ? observeFile(at) : undefined;
+        const digest = fresh ? (bytes === undefined ? undefined : bytesDigest(store, bytes)) : coordinateDigest(store, at);
         if (digest === undefined)
             return;
         // The host loader resolves links before loading a module. Count that module

package/dist/fold/evidence.d.ts

@@ -22,7 +22,7 @@ export interface SnapshotInput {
     };
 }
 export declare function snapshotVerdict(input: SnapshotInput): {
-    verdict: "none" | "grey" | "agrees" | "forks" | "stale";
+    verdict: "none" | "grey" | "stale" | "agrees" | "forks";
     external: boolean;
     epoch: number;
 };

package/dist/fold/kept.js

@@ -1,3 +1,4 @@
+import { encodeUTF8 } from "../host/io.js";
 import { actLines, committedLocalActs } from "../host/ports/local-act.js";
 import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
@@ -10,7 +11,7 @@ import { keyFor, keyOf, lockSigners } from "./keys.js";
 import { sourceOf, vouching } from "../land/vouched.js";
 import { wordsOf } from "./wire.js";
 import { ownLock } from "../observe/runner.js";
-const text = (s) => new TextEncoder().encode(s);
+const text = encodeUTF8;
 const atOf = (line) => {
     if (line.includes(' about='))
         return fieldOf(line, 'at');

package/dist/fold/object.d.ts

@@ -1,17 +1,3 @@
-import type { Mark, Cell } from '@lapxo/obligations/views/field';
-import type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
-/** Projection dispatches admitted acts into Obligatory; it defines no meet or propagation. */
-export interface ObjectReading {
-    cell: string;
-    state: string;
-    parts: Cell<unknown>;
-    rest: readonly string[];
-    ownMarks: readonly (string | undefined)[];
-    ownClaims: readonly {
-        id: string | undefined;
-        origin: string;
-    }[];
-    marks: readonly Mark<unknown>[];
-    claims: readonly unknown[];
-}
-export declare function objectFold(records: readonly ObjectRecord[], context: ObjectContext): readonly ObjectReading[];
+/** Compatibility path; the engine owns the single object projection. */
+export { objectFold } from '../engine/index.ts';
+export type { ObjectReading } from '../engine/index.ts';

package/dist/fold/object.js

@@ -1,38 +1,2 @@
-import { cell, sign, join, require as requireFloor, observe, mark, parts, state, live, restOf } from '@lapxo/obligations/views/field';
-import { restCoordinates } from '@lapxo/topos/wire';
-export function objectFold(records, context) {
-    let world = new Map();
-    const definitions = new Map(records.filter(r => r.record === 'cell').map(r => [r.fields.scope, r]));
-    const codecs = new Map([...definitions].map(([name, c]) => [name, context.resolve(c)]));
-    const ids = new Map(records.map(r => [r.fields.id, r]));
-    for (const record of [...records].sort((a, b) => Number(a.fields.epoch) - Number(b.fields.epoch))) {
-        const f = record.fields, name = f.scope, at = Number(f.epoch);
-        if (record.record === 'cell') {
-            world = new Map([...world, [name, cell(name, at, [], restCoordinates(f.restsOn))]]);
-            continue;
-        }
-        const codec = codecs.get(name), L = codec.form.lattice(codec.params), held = world.get(name);
-        if (record.record === 'claim') {
-            const target = f.sign === '-1' ? ids.get(f.takes).fields : f;
-            const changed = observe(held, { id: f.id, at, origin: target.origin, span: codec.form.parse(codec.params, target.value), ...(f.takes ? { takes: f.takes } : {}) }, f.sign === '-1' ? -1 : 1);
-            const seen = [...changed.seen];
-            seen[seen.length - 1] = { ...seen.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, seen }]]);
-        }
-        else if (f.sign === '-1') {
-            const target = ids.get(f.takes).fields;
-            world = new Map([...world, [name, { ...held, marks: [...(held.marks ?? []), mark({ id: f.id, at, takes: f.takes, pole: target.pole, reach: 'local', span: codec.form.parse(codec.params, target.value) })] }]]);
-        }
-        else if (f.widens !== undefined) {
-            const changed = join(L, held, codec.form.parse(codec.params, f.value), f.widens, at);
-            const marks = [...(changed.marks ?? [])];
-            marks[marks.length - 1] = { ...marks.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, marks }]]);
-        }
-        else {
-            const span = codec.form.parse(codec.params, f.value);
-            world = f.pole === 'floor' ? requireFloor(L, world, name, span, { id: f.id, at }) : sign(L, world, name, span, { id: f.id, at });
-        }
-    }
-    return [...world].map(([name, c]) => { const codec = codecs.get(name), L = codec.form.lattice(codec.params); return { cell: name, state: state(L, c, world), parts: parts(L, c, world), rest: restOf(c, world), ownMarks: live(c.marks ?? []).map(m => m.id), ownClaims: live(c.seen).map(s => ({ id: s.id, origin: s.origin })), marks: live(c.marks ?? []), claims: live(c.seen) }; });
-}
+/** Compatibility path; the engine owns the single object projection. */
+export { objectFold } from "../engine/index.js";

package/dist/fold/observed.d.ts

@@ -30,5 +30,6 @@ export declare function observedClaims(root: string, store: string, options?: {
     readonly only?: string;
     readonly reach?: readonly string[];
     readonly answered?: Map<string, string>;
+    readonly selected?: string;
 }): readonly string[];
 export {};

package/dist/fold/observed.js

@@ -1,11 +1,17 @@
+import { authenticatedStanding } from "../host/admitted-place.js";
 import { actCosts } from "../host/act-cost.js";
 import { readingClosures } from "../host/reading-closures.js";
+import { readingExecution, readingProfile } from "../host/reading-context.js";
+import { withNativeReaderRoute } from "../host/native-reader-context.js";
+import { prepareNativeReaderRoute, assertNativeRouteCurrent, materializeNativeRoute } from "../host/native/route.js";
+import { verifiedContent } from "../host/content-store.js";
+import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
 import { readerLifetime, readerAllowsEmpty, assertReaderInputs, parse as parseLifetime } from '@lapxo/topos/wire';
 import { readOnly } from "../host/read-only.js";
-import { basename, dirname, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
+import { basename, dirname, relative, existsSync, mkdirSync, resolve, rmSync, spawn, statSync, writeFileSync } from "../host/io.js";
 import { bundleOf, processOf } from "../observe/runner.js";
 import { canonical, parse, PROTOCOL } from '@lapxo/topos/wire';
-import { bytesDigest, memoized } from "./digests.js";
+import { bytesDigest, memoized, instrumentCoordinates } from "./digests.js";
 import { land, landMemo, landShard, memoAt, shardLines, storeAt } from "../land/ledger.js";
 import { fieldOf, isWire } from "./claims.js";
 import { rolesOf } from "./roles.js";
@@ -154,8 +160,10 @@ function carried(store) {
     return carriedIn(store).flatMap((file) => (observeText(file) ?? '').split('\n'))
         .filter((line) => isWire(line) && speaker !== undefined && fieldOf(line, 'by').split(':')[0] === speaker);
 }
+const readerSelection = (reader) => reader.capsule?.selected?.selection === undefined ? undefined : 'sha256:' + sha(JSON.stringify([reader.capsule.selected.selection, reader.capsule.region, reader.module, reader.where, [...reader.capsule.globs]]));
+const readerScope = (reader) => reader.capsule?.selected?.selection === undefined ? `reader/${reader.module}` : `reader/${reader.module}/${sha(`${reader.capsule.selected.selection}\n${reader.capsule.region}`)}`;
 const lineagesOf = (store, speaker, readers, regions) => new Set(readers.flatMap((reader) => shardLines(store, speaker, regionIn(regions, reader.module))
-    .filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}` && /(?:^|\s)measure=(?:identity|extension)\s/.test(line)).map((line) => fieldOf(line, 'value'))));
+    .filter((line) => fieldOf(line, 'scope') === readerScope(reader) && /(?:^|\s)measure=(?:identity|extension)\s/.test(line)).map((line) => fieldOf(line, 'value'))));
 export function readerLines(store) {
     const readers = readersOf(store);
     const regions = [...new Set(readers.flatMap((reader) => reader.where.map(trimmed)))];
@@ -188,8 +196,28 @@ export function observedClaims(root, store, options = {}) {
     const standing = lockStanding(store);
     const lines = readersOf(store);
     const readers = [...lines, ...capsuleReadersOf(root, store, standing, lines)];
+    if (options.selected !== undefined) {
+        if (!/^sha256:[a-f0-9]{64}$/.test(options.selected) || options.only === undefined)
+            throw Error('REFUSE·reader invalid internal background selector');
+        if (readers.filter(reader => reader.module === options.only && readerSelection(reader) === options.selected).length !== 1)
+            throw Error('REFUSE·reader internal background selector is not uniquely adopted');
+    }
     if (!readers.length)
         return carried(store);
+    const modern = readingProfile(standing, fieldOf);
+    const implementation = modern ? instrumentCoordinates(store, processOf('verb'), [], ownRoot(), ownLock(), true) : undefined;
+    if (implementation)
+        for (const module of [processOf('host'), processOf('lifetime', 'host')])
+            for (const [coordinate, digest] of instrumentCoordinates(store, module, [], ownRoot(), ownLock(), true))
+                implementation.set(coordinate, digest);
+    const code = implementation ? bytesDigest(store, new TextEncoder().encode([...implementation.values()].sort().join('\n'))) : undefined;
+    const transitive = implementation ? [...implementation].map(([coordinate, digest]) => [relative(ownRoot(), coordinate), digest]) : [];
+    if (modern)
+        for (const line of ownLock().filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads' && fieldOf(line, 'value') !== 'withdraw')) {
+            const digest = fieldOf(line, 'value');
+            verifiedContent(digest, store, ownStore());
+            transitive.push([fieldOf(line, 'scope'), digest]);
+        }
     const speaker = keyFor(store, 'read');
     const regions = [...new Set(readers.flatMap((reader) => reader.where.map(trimmed)))];
     const whole = options.only === undefined && options.reach === undefined;
@@ -258,6 +286,8 @@ export function observedClaims(root, store, options = {}) {
     for (const reader of readers) {
         if (options.only !== undefined && reader.module !== options.only)
             continue;
+        if (options.selected !== undefined && readerSelection(reader) !== options.selected)
+            continue;
         if (!readerReaches(options.reach, reader.where))
             continue;
         const started = Date.now();
@@ -274,12 +304,23 @@ export function observedClaims(root, store, options = {}) {
             if (projection.length !== 1 || !asked)
                 throw Error('REFUSE·input projection is ambiguous ' + reader.module);
             const files = [...new Set(reader.where.flatMap(where => handedAt(root, reader, roleOf, look, where)))].sort().map(place => ({ place, text: observeText(resolve(root, place)) ?? '' }));
-            const result = readingClosures({ root, store, reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty: readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module), files, emit: line => process.stderr.write(line + '\n') });
+            const hash = (text) => bytesDigest(store, Buffer.from(text));
+            const allowsEmpty = readerAllowsEmpty(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module);
+            const native = prepareNativeReaderRoute(store, { id: reader.id, module: reader.module });
+            if (native && !modern)
+                throw Error('REFUSE·native reader requires complete reading identity ' + reader.module);
+            if (native && asked.digest !== native.profile.selection.archive)
+                throw Error('REFUSE·native reader implementation differs ' + reader.module);
+            const image = native ? materializeNativeRoute(native) : undefined;
+            const execution = modern ? readingExecution({ instrument: code, implementation: asked.digest, policy: hash(JSON.stringify([reader.id, reader.module, reader.kind, reader.shape, reader.where, lifetime ?? null, allowsEmpty])), inputs: [...transitive, ...(native?.inputs ?? []), ...(image ? [['native/mount', image.mountIdentity]] : [])] }, hash, { env: process.env, cwd: image?.cwd ?? root, flags: native ? [] : childFlags() }) : undefined;
+            const result = withNativeReaderRoute(native, () => readingClosures({ root, store, ...(execution ? { context: execution.context, execution } : {}), reader: reader.module, speaker, digest: text => bytesDigest(store, Buffer.from(text)), capsule: asked, ...(native ? { assertCurrent: () => assertNativeRouteCurrent(native) } : {}), region: reader.capsule.region, projection: fieldOf(projection[0], 'value'), livePlace: () => authenticatedStanding(root), readerReference: { id: reader.id, module: reader.module }, lifetime, allowsEmpty, files, emit: line => process.stderr.write(line + '\n') }));
             out.push(...result.lines);
             ran += result.executed;
             read += result.read - result.opened;
             return false;
         }
+        if (modern)
+            throw Error('REFUSE·reader ' + reader.module + ' complete reading identity requires a declared input projection');
         const endAct = actCosts.begin();
         try {
             const source = reader.capsule === undefined ? observeFile(module) : asked === undefined ? undefined : new Uint8Array();
@@ -287,9 +328,11 @@ export function observedClaims(root, store, options = {}) {
             const offered = offersOf(root, store, reader, roleOf, look, (where) => reached(trimmed(where)));
             assertReaderInputs(standing.flatMap(line => { const p = parseLifetime(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader.module, offered.length);
             const vectors = reader.capsule === undefined ? observeText(resolve(root, vectorsOf(reader.module, standing))) : undefined;
+            const selectedBy = reader.capsule?.selected?.selection === undefined ? undefined : sha(`${reader.capsule.selected.selection}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`);
             const kept = whole && legacy === undefined && answered === undefined && source ? sha([
                 speaker, reader.module, JSON.stringify(lifetime), reader.kind, reader.shape.join('|'), reader.where.join('|'), bundle, vectors === undefined ? 'no vectors' : sha(vectors),
                 reader.capsule === undefined ? '' : `${reader.capsule.selected?.selection ?? reader.capsule.digest} ${reader.capsule.region} ${reader.capsule.reads.join('|')} ${[...reader.capsule.globs].map(([place, globs]) => `${place}${globs.join('|')}`).join(' ')}`,
+                ...(selectedBy === undefined ? [] : [selectedBy]),
                 ...offered.map((offer) => `${offer.place} ${offer.digest?.() ?? bytesDigest(store, offer.bytes())}`),
             ].join('\n')) : undefined;
             const stored = kept === undefined ? undefined : observeText(memoAt(store, `observed/${kept}`));
@@ -301,10 +344,12 @@ export function observedClaims(root, store, options = {}) {
             }
             const mark = out.length;
             const home = regionIn(regions, reader.module);
-            const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === `reader/${reader.module}`);
-            const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value'));
+            const own = shardLines(store, speaker, home).filter((line) => fieldOf(line, 'scope') === readerScope(reader));
+            // Short selected-origin identities remain stored history; they cannot name
+            // an unambiguous current origin or supply its held observations.
+            const lineage = own.filter((line) => fieldOf(line, 'measure') === 'identity').map((line) => fieldOf(line, 'value')).filter(value => selectedBy === undefined || /^[a-f0-9]{64}$/.test(value));
             const sum = source && reader.capsule === undefined ? bytesDigest(store, new TextEncoder().encode(`${reader.module} ${bundle}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`)).replace(/^sha256:/, '').slice(0, 12) : 'none';
-            const measured = reader.capsule !== undefined ? { by: source ? sha(`${reader.capsule.selected?.selection ?? reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
+            const measured = reader.capsule !== undefined ? { by: source ? selectedBy ?? sha(`${reader.capsule.digest}\n${reader.capsule.region}${lifetime === undefined ? "" : "\n" + JSON.stringify(lifetime)}`).slice(0, 12) : 'none', lines: [] }
                 : source ? identityOf({ store, root, speaker, module: reader.module, kind: reader.kind, code: sum, lineage, lifetime, kept: own.filter((line) => /(?:^|\s)measure=(?:extension|emits)\s/.test(line)) })
                     : { by: 'none', lines: [] };
             const by = measured.by;
@@ -400,7 +445,7 @@ export function observedClaims(root, store, options = {}) {
                 const running = existsSync(marker) && Date.now() - statSync(marker).mtimeMs < 30 * 60 * 1000 && Number.isInteger(pid) && pid > 0 && alive(pid);
                 if (!running) {
                     mkdirSync(dirname(marker), { recursive: true });
-                    const child = spawn(process.execPath, [...childFlags(), processOf('observe'), root, reader.module], { cwd: root, detached: true, stdio: 'ignore' });
+                    const child = spawn(process.execPath, [...childFlags(), processOf('observe'), root, reader.module, ...(readerSelection(reader) === undefined ? [] : [readerSelection(reader)])], { cwd: root, detached: true, stdio: 'ignore' });
                     child.unref();
                     writeFileSync(marker, `${reader.module}\n${child.pid ?? ''}\n`);
                 }
@@ -455,7 +500,7 @@ export function observedClaims(root, store, options = {}) {
                 const over = bytesDigest(store, new TextEncoder().encode(due.map((d) => d.digest).sort().join('\n'))).replace(/^sha256:/, '');
                 level.push(canonical({ scope: `cost/reader/${reader.module}`, role: 'writes', form: 'interval', measure: 'ms', value: `${spent}..${spent}`, by: `${speaker}:${by}`, at: `place:${over}` }));
                 if (lineage.at(-1) !== by)
-                    level.push(canonical({ scope: `reader/${reader.module}`, role: 'writes', form: 'alphabet', measure: 'identity', value: by, by: `${speaker}:${by}`, at: `place:${by}` }));
+                    level.push(canonical({ scope: readerScope(reader), role: 'writes', form: 'alphabet', measure: 'identity', value: by, by: `${speaker}:${by}`, at: `place:${by}` }));
                 rmSync(storeAt(store, 'pending', by), { force: true });
             }
             for (const plan of plans.filter((one) => one.said !== undefined)) {

package/dist/fold/readers.d.ts

@@ -30,9 +30,10 @@ export type Look = {
 export declare function lookOf(root: string, roleOf: (coordinate: string) => CoordinateRole): Look;
 /**
  * The reader regions of the capsules a place can run, where the place's own lock offers them or, at a world, the wire's offers/world list does for a
- * region its own lock does not name: `region/<name>` under a measure the wire's region-measures list names gives the region and its coordinates, and the first capsule, pinned before carried, that writes the region
- * reads them, handed the coordinates it declares it reads among those the place offers. A capsule region takes over what a
- * place's declared region. A standing reader for that same provider and region keeps ownership, so nothing is read twice.
+ * region its own lock does not name: each selected capsule that writes a declared region reads the coordinates
+ * it declares among the place's offered coordinates. Selection identifies attribution, never independence.
+ * An existing reader suppresses only that same selected provider, region and place; an ambiguous legacy
+ * owner refuses instead of hiding another provider or invoking the same provider twice.
  * A newly declared region does not need a retired reader in private history to be observed.
  */
 export declare function capsuleReadersOf(root: string, store: string, standing: readonly string[], lines: readonly ReaderClaim[], resolve?: typeof capsulesFor): readonly ReaderClaim[];

package/dist/fold/readers.js

@@ -1,5 +1,5 @@
 import { resolve } from "../host/io.js";
-import { canonical, fields, matches } from '@lapxo/topos/wire';
+import { canonical, fields, matches, byBytes } from '@lapxo/topos/wire';
 import { namesAt, wordOn, wordsOf, wireLine } from "./wire.js";
 import { fits } from "../observe/match.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
@@ -36,13 +36,14 @@ const reachOfLine = (module, where) => {
 };
 /**
  * The reader regions of the capsules a place can run, where the place's own lock offers them or, at a world, the wire's offers/world list does for a
- * region its own lock does not name: `region/<name>` under a measure the wire's region-measures list names gives the region and its coordinates, and the first capsule, pinned before carried, that writes the region
- * reads them, handed the coordinates it declares it reads among those the place offers. A capsule region takes over what a
- * place's declared region. A standing reader for that same provider and region keeps ownership, so nothing is read twice.
+ * region its own lock does not name: each selected capsule that writes a declared region reads the coordinates
+ * it declares among the place's offered coordinates. Selection identifies attribution, never independence.
+ * An existing reader suppresses only that same selected provider, region and place; an ambiguous legacy
+ * owner refuses instead of hiding another provider or invoking the same provider twice.
  * A newly declared region does not need a retired reader in private history to be observed.
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
-    const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
+    const origin = (capsule) => capsule?.selected?.selection;
     const coordinateMeasure = wordOn(standing, 'region-coordinate', ownLock());
     const localMeasures = wordsOf(standing, 'region-measures');
     const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
@@ -59,16 +60,20 @@ export function capsuleReadersOf(root, store, standing, lines, resolve = capsule
         const capsules = resolve(standing, place, root);
         for (const line of offered) {
             const region = fieldOf(line, 'scope').slice('region/'.length);
-            const by = capsules.find(({ capsule }) => capsule.lines.some((one) => fieldOf(one, 'scope') === `region/${region}` && fieldOf(one, 'measure') === 'writes'));
-            const pkg = fieldOf(by?.offer ?? '', 'scope').split('/')[1] ?? '';
-            if (by === undefined || reaching.has(`${pkg} ${region} ${where || '/'}`))
-                continue;
-            const key = `${by.capsule.selection ?? by.capsule.digest} ${region}`;
-            const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), selected: by.capsule, region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
-            group.globs.set(where, fieldOf(line, 'value').split('|').filter(Boolean));
+            for (const by of capsules.filter(({ capsule }) => capsule.lines.some((one) => fieldOf(one, 'scope') === `region/${region}` && fieldOf(one, 'measure') === 'writes'))) {
+                const pkg = fieldOf(by.offer, 'scope').split('/')[1] ?? '';
+                const reaches = lines.filter(reader => reachOfLine(reader.module, reader.where).includes(`${pkg} ${region} ${where || '/'}`));
+                if (reaches.some(reader => origin(reader.capsule) === undefined))
+                    throw Error(`REFUSE·reader ${pkg}/${region} existing provider origin unmeasured at ${where || '/'}`);
+                if (by.capsule.selection !== undefined && lines.some(reader => origin(reader.capsule) === by.capsule.selection && reader.capsule?.region === region && reader.where.some(place => place.replace(/\/?$/, '/') === (where || '/'))))
+                    continue;
+                const key = `${by.capsule.selection ?? by.capsule.digest} ${region}`;
+                const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), selected: by.capsule, region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
+                group.globs.set(where, fieldOf(line, 'value').split('|').filter(Boolean));
+            }
         }
     }
-    return [...groups.values()].map((group) => ({ id: group.module, shape: ['run'], where: [...group.globs.keys()], module: group.module, kind: 'process',
+    return [...groups.entries()].sort(([a], [b]) => byBytes(a, b)).map(([, group]) => ({ id: group.module, shape: ['run'], where: [...group.globs.keys()], module: group.module, kind: 'process',
         capsule: { selected: group.selected, digest: group.digest, entry: group.entry, region: group.region, reads: group.reads, globs: group.globs } }));
 }
 export function handedAt(root, reader, roleOf, look, place) {

package/dist/fold/resolved.js

@@ -41,7 +41,17 @@ export function receiptsOf(fold) {
     const ran = [...new Set(fold.observed.filter((line) => fieldOf(line, 'measure') !== 'observed'
             && mine.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)))];
     const ranAt = new Set(ran.map((line) => `${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`));
-    const cones = new Set(fold.observed.filter((line) => fieldOf(line, 'measure') === 'observed' && own(fieldOf(line, 'scope')) && ranAt.has(`${fieldOf(line, 'by')} ${fieldOf(line, 'at')}`)).map(bytesOnly));
+    const cones = new Set(fold.observed.filter((line) => {
+        if (fieldOf(line, 'measure') !== 'observed')
+            return false;
+        const at = fieldOf(line, 'at'), by = fieldOf(line, 'by');
+        // A physical input witnesses an owned reading's base, without becoming
+        // another location of its result. Even a foreign input belongs in that
+        // reading's portable carrier; its own child place is not the reader.
+        if (at.startsWith('witness:'))
+            return ranAt.has(`${by} place:${at.slice('witness:'.length)}`);
+        return own(fieldOf(line, 'scope')) && ranAt.has(`${by} ${at}`);
+    }).map(bytesOnly));
     const paid = ledgerLines(fold.store, 'judge').filter((line) => fold.paid.some((demand) => fieldOf(demand, 'scope') === fieldOf(line, 'scope')
         && !(closed.length > 0 && fieldOf(demand, 'needs').split('|').filter(Boolean).length > 0
             && fieldOf(demand, 'needs').split('|').filter(Boolean).every((need) => closed.some((one) => need.startsWith(one))))));
@@ -50,7 +60,7 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+    const lines = [...new Set([...named, ...[...cones].sort(), ...[...ran].sort(), ...paid, ...(fold.receiptHistory ?? [])])]
         .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);

package/dist/fold/signers.js

@@ -1,7 +1,7 @@
 import { existsSync, join } from "../host/io.js";
-import { authorityOf, isKeyClaim, parse, signersOf } from '@lapxo/topos/wire';
+import { authorityOf, isKeyClaim, signersOf } from '@lapxo/topos/wire';
 import { verifiesFields } from "../land/sign.js";
-import { fieldOf, selfName } from "./claims.js";
+import { fieldOf, selfName, parsedLine as parse } from "./claims.js";
 import { keyFor, lockStanding } from "./keys.js";
 import { storeRoot } from "../host/ports/store.js";
 import { storeOf } from "../land/ledger.js";

package/dist/host/adapters/modules/javascript.d.ts

@@ -1 +1,3 @@
 export declare function moduleImports(source: string, coordinate: string): readonly string[];
+/** A JavaScript literal value; syntax inventory never executes it. */
+export declare const stringLiteral: (node: unknown) => string | undefined;

package/dist/host/adapters/modules/javascript.js

@@ -15,12 +15,7 @@ export function moduleImports(source, coordinate) {
         throw Error('REFUSE·source module syntax cannot be read: ' + coordinate);
     }
     const found = new Set();
-    const literal = (node) => {
-        if (!node || typeof node !== 'object')
-            return;
-        const n = node;
-        return n['type'] === 'Literal' && typeof n['value'] === 'string' ? n['value'] : undefined;
-    };
+    const literal = stringLiteral;
     const visit = (node) => {
         if (!node || typeof node !== 'object')
             return;
@@ -46,3 +41,10 @@ export function moduleImports(source, coordinate) {
     visit(tree);
     return [...found];
 }
+/** A JavaScript literal value; syntax inventory never executes it. */
+export const stringLiteral = (node) => {
+    if (!node || typeof node !== 'object')
+        return;
+    const n = node;
+    return n['type'] === 'Literal' && typeof n['value'] === 'string' ? n['value'] : undefined;
+};

package/dist/host/admitted-place.d.ts

@@ -0,0 +1,5 @@
+/** Existing admission-snapshot authentication and folded live projection.
+ * Consumer configuration evidence only; never a new authority lock. */
+export declare function authenticatedRootStanding(root: string): readonly string[];
+/** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
+export declare const authenticatedStanding: typeof authenticatedRootStanding;

package/dist/host/admitted-place.js

@@ -0,0 +1,57 @@
+import { hashText } from "./hash.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authorityFor } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+import { createHash } from 'node:crypto';
+// One bounded historical projection, never a current authority/lease verdict.
+// Its complete inputs are reread before lookup, including original signatures.
+let historicalProjection;
+function historicalIdentity(history, anchor) {
+    const hash = createHash('sha256'), text = hashText.bind(undefined, hash);
+    text('authenticated-root-history/1');
+    text(String(history.length));
+    for (const line of history)
+        text(line);
+    text(JSON.stringify(anchor));
+    return hash.digest('hex');
+}
+/** Existing admission-snapshot authentication and folded live projection.
+ * Consumer configuration evidence only; never a new authority lock. */
+export function authenticatedRootStanding(root) {
+    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), anchor = admissionAnchor(root);
+    const identity = historicalIdentity(history, anchor);
+    if (historicalProjection?.identity === identity)
+        return [...historicalProjection.standing];
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            // This invocation has freshly read the complete signed inventory. Derive
+            // the same historical cutoff without reopening it for every epoch; the
+            // next invocation still rereads every authority input.
+            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => {
+                const scope = fieldOf(record, 'scope');
+                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
+            });
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    historicalProjection = { identity, standing: Object.freeze([...standing]) };
+    return [...standing];
+}
+/** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
+export const authenticatedStanding = authenticatedRootStanding;

package/dist/host/capsule-process.d.ts

@@ -18,4 +18,4 @@ export declare class CapsuleProcessError extends Error {
 }
 export declare function validResponse(value: unknown, request: Request): value is Response;
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>, lifetime?: ReaderLifetime): readonly Response[];
+export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer' | 'env' | 'cwd'>, lifetime?: ReaderLifetime): readonly Response[];

package/dist/host/capsule-process.js

@@ -1,4 +1,5 @@
 import { actCosts } from "./act-cost.js";
+import { fileURLToPath } from 'node:url';
 import { boundedProcess } from "./process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { PROTOCOL } from '@lapxo/topos/wire';
@@ -35,7 +36,9 @@ export function validResponse(value, request) {
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
 export function executeCapsule(command, args, requests, limits = {}, lifetime) {
     return actCosts.measure(() => {
-        const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime);
+        const cwd = limits.cwd;
+        const directory = cwd === undefined ? undefined : typeof cwd === 'string' ? cwd : fileURLToPath(cwd);
+        const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime, directory, limits.env);
         if ('error' in run && run.error)
             throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
         if (run.signal !== null || run.status !== 0)