@lapxo/bound 0.2.2 → 0.2.4

package/dist/host/root-clock-source.d.ts

@@ -0,0 +1,86 @@
+import { type PlaceReceipt, type ClockBudget } from '@lapxo/topos/core';
+import type { PlaceActBudget } from './ports/place-act.ts';
+export interface RootClockSourceSelection {
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly bootstrapCheckpoint: {
+        scope: string;
+        measure: string;
+    };
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+}
+export declare function rootClockSource(root: string, selected: RootClockSourceSelection): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+/** Source mapping is an explicit Root declaration; absence never means a zero
+ * clock or an inferred cursor. Existing legacy callers do not request it. */
+export declare function rootClockSelectionOf(live: readonly string[], anchor: import('@lapxo/topos/wire').Signer): RootClockSourceSelection;
+export declare function declaredRootClockSource(root: string): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+export declare function hasRootClockSource(root: string): boolean;
+export interface PortablePlaceContext {
+    readonly identity: string;
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly authority: {
+        anchor: import('@lapxo/topos/wire').Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+}
+/** Historical inspection ONLY. The expected acting Root anchor and resource
+ * selection come from the consumer's selected place, never from this packet.
+ * This function returns data and cannot construct a current command permit. */
+export declare function inspectPortablePlaceContexts(encoded: string, expectedAnchor: import('@lapxo/topos/wire').Signer, selected: RootClockSourceSelection): {
+    identity: string;
+    context: import("@lapxo/topos/core").PlaceAct;
+}[];
+/** Prospective configuration is checked as authenticated Root history, never
+ * against a prose birth condition. Initial heads are explicit typed selections;
+ * stored committed chains cannot disappear when a selection is activated or
+ * replaced. Preview reads only; the real admission repeats under its Root lock. */
+export declare function assertProspectiveRootClockSelection(root: string, signed: readonly string[]): void;

package/dist/host/root-clock-source.js

@@ -6,7 +6,7 @@ import { committedLocalActs, actLines } from "./ports/local-act.js";
 import { verifiedLegacyActResult } from "../cli/act-result.js";
 import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
 import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
 import { fieldOf, foldClaims, isConfig, selfName } from "../fold/claims.js";
 import { authenticatedRootStanding } from "./admitted-place.js";
 import { verifiesOwnerLine } from "../land/sign.js";
@@ -158,11 +158,11 @@ export function rootClockSource(root, selected) {
 }
 /** Source mapping is an explicit Root declaration; absence never means a zero
  * clock or an inferred cursor. Existing legacy callers do not request it. */
-export function declaredRootClockSource(root) {
-    const live = authenticatedRootStanding(root), rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
+export function rootClockSelectionOf(live, anchor) {
+    const rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
     if (rows.length !== 1)
         fail('requires one admitted source mapping');
-    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live).admitted;
+    const line = rows[0], algorithms = eraOf(live).admitted;
     if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
         fail('mapping is not Root signed');
     const about = fieldOf(line, 'about');
@@ -175,8 +175,10 @@ export function declaredRootClockSource(root) {
     }
     if (!value || Object.keys(value).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || value.profile !== 'place-act-context@1' || JSON.stringify(value) !== about)
         fail('unknown/noncanonical mapping');
-    return rootClockSource(root, value);
+    sourceSelection(value);
+    return value;
 }
+export function declaredRootClockSource(root) { return rootClockSource(root, rootClockSelectionOf(authenticatedRootStanding(root), admissionAnchor(root))); }
 export function hasRootClockSource(root) { return authenticatedRootStanding(root).some(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw'); }
 /** Historical inspection ONLY. The expected acting Root anchor and resource
  * selection come from the consumer's selected place, never from this packet.

package/dist/host/signature-era.js

@@ -0,0 +1,12 @@
+import { wireLine } from "../fold/wire.js";
+import { fieldOf } from "../fold/claims.js";
+/** Pure signature vocabulary; no instrument discovery for diagnostics. */
+export function signatureEraOf(standing) {
+    const said = wireLine(standing, 'signature-algorithms');
+    const admitted = (said === undefined ? [] : fieldOf(said, 'value').split('|')).filter(Boolean);
+    const current = wireLine(standing, 'era');
+    const era = (current === undefined ? undefined : admitted.find((one) => one.endsWith(`:${fieldOf(current, 'value')}`))) ?? admitted.find((one) => one.includes(':'));
+    if (era === undefined)
+        throw new Error(`REFUSE·runtime the lock names no signature algorithm by digest: nothing can be signed here`);
+    return { admitted, era };
+}

package/dist/host/signing.js

@@ -40,7 +40,7 @@ export function signerFor(lines, keyId, selected, keyFile, injected) {
     if (injected) {
         if (injected.name !== declaration.name || keyFile)
             throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
-        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes });
+        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes }, injected.signal);
     }
     const mechanism = binding(declaration.name, keyFile);
     const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };

package/dist/host/source-content.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "./call-context.js";
 import { transportBytes } from "./ports/transport.js";
 import { contentStore, verifiedContent } from "./content-store.js";
 import { ContentNeeded } from "./content-needed.js";
@@ -91,7 +92,7 @@ export async function resolveSources(standing, requested) {
         fetch: async (url, digest) => transportBytes(url, digest, [...ownLock(), ...standing]),
     }, requested);
     for (const digest of received)
-        process.stdout.write(`FETCHED  ${digest} · verified\n`);
+        hostOutput('out', `FETCHED  ${digest} · verified\n`);
 }
 /** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
 export async function resolveRequested(resolve, fold) {

package/dist/host/standing-carrier.js

@@ -0,0 +1,18 @@
+import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
+import { foldClaims, fieldOf } from "../fold/claims.js";
+/** Projection only, after the caller authenticates the complete carrier. The
+ * CLI and in-process reader use this same fold and output shape. */
+export function projectContextualStanding(root, legacy, contexts, decoded) {
+    const groups = new Map();
+    for (const act of contexts) {
+        const context = decoded.find(one => one.identity === act.identity).context;
+        for (const p of context.places) {
+            const key = JSON.stringify([context.root.namespace, p.place]), group = groups.get(key) ?? { namespace: context.root.namespace, place: p.place, lines: [], contexts: [] };
+            group.lines.push(...p.records);
+            group.contexts.push({ identity: act.identity, context: act.context, receipts: act.receipts });
+            groups.set(key, group);
+        }
+    }
+    const legacyPlaces = legacy.map(place => ({ namespace: 'legacy-global', place: place.place, standing: foldClaims(place.history).standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history: place.history }));
+    return { profile: PLACE_ACT_CONTEXT, root, legacyPlaces, contexts, places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+}

package/dist/host/standing-projection.js

@@ -0,0 +1,50 @@
+import { viewsOf } from "../fold/views.js";
+import { BoundRefusal } from "./refusals.js";
+import { authorityFor } from "../fold/signers.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
+import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+/** Project the supplied signed history against the host's original trust anchor.
+ * No current-root selection, storage access, effects or retained authority.
+ * The file host and the in-process host use this same admission-snapshot fold. */
+export function projectAuthenticatedStanding(history, anchor) {
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            // This invocation has freshly read the complete signed inventory. Derive
+            // the same historical cutoff without reopening it for every epoch; the
+            // next invocation still rereads every authority input.
+            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => {
+                const scope = fieldOf(record, 'scope');
+                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
+            });
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    return [...standing];
+}
+/** One check shared by the CLI and the read-only native host. */
+export function assertStandingView(lines) {
+    const view = viewsOf(lines).get('standing');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
+        throw new BoundRefusal('standing/view', 'REFUSE·view standing requires a declared standing view');
+}
+export function publicStandingProjection(history, anchor) {
+    return publishedStandingLines(projectAuthenticatedStanding(history, anchor));
+}
+export function publishedStandingLines(standing) {
+    return standing.filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+}

package/dist/land/act.js

@@ -1,9 +1,32 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
-import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync } from "../host/io.js";
+import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync, realpathSync, resolve } from "../host/io.js";
+import { BoundRefusal } from "../host/refusals.js";
 import { selfName } from "../fold/claims.js";
 import { placesIn } from "../fold/places.js";
 import { coordinatesUnder, observeText } from "../observe/files.js";
+const hostContext = new AsyncLocalStorage();
+export const withActHost = (host, run) => hostContext.run(host, run);
+const actName = () => hostContext.getStore()?.name ?? selfName();
+const report = (text) => { const host = hostContext.getStore(); if (host)
+    host.report(text);
+else
+    process.stderr.write(text); };
+const checkCancellation = () => { if (hostContext.getStore()?.signal?.aborted)
+    throw new BoundRefusal('host/cancelled', 'REFUSE·host/cancelled'); };
+/** Resolve aliases before acquiring the same native lock protocol as the CLI. */
+export function canonicalActStore(store) {
+    let at = resolve(store);
+    const tail = [];
+    while (!existsSync(at)) {
+        const parent = dirname(at);
+        if (parent === at)
+            break;
+        tail.unshift(basename(at));
+        at = parent;
+    }
+    return join(realpathSync(at), ...tail);
+}
 const context = new AsyncLocalStorage();
 const held = new Map();
 const pauseFor = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
@@ -20,8 +43,8 @@ function overAMinute(at, began, holder) {
     if (Date.now() - began < MINUTE)
         return;
     const who = holder === undefined ? 'a process' : `${holder.pid} · ${holder.what} since ${holder.since}`;
-    process.stderr.write(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
-    throw new Error(`${selfName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
+    report(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
+    throw new Error(`${actName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
 }
 const alive = (pid) => {
     if (!Number.isSafeInteger(pid) || pid <= 0)
@@ -37,7 +60,7 @@ const alive = (pid) => {
 const regionAt = (store, region) => {
     const coordinate = region.replace(/\/+$/, '');
     if ((coordinate && coordinate.split('/').some((step) => step === '..' || step === '.' || step === '')) || coordinate.startsWith('/'))
-        throw new Error(`${selfName()}: REFUSE·lock invalid region coordinate`);
+        throw new Error(`${actName()}: REFUSE·lock invalid region coordinate`);
     return join(store, 'locks', coordinate ? encodeURIComponent(coordinate).replace(/^\./, '%2E').replace(/^_root$/, '%5Froot') : ROOT);
 };
 const coordinateOf = (file) => {
@@ -77,12 +100,13 @@ async function hold(at, what) {
         return;
     const frame = context.getStore();
     if (frame === undefined)
-        throw new Error(`${selfName()}: REFUSE·lock no act owns this request`);
+        throw new Error(`${actName()}: REFUSE·lock no act owns this request`);
     const began = Date.now();
     const token = randomUUID();
     let told = false;
     mkdirSync(dirname(at), { recursive: true });
     for (;;) {
+        checkCancellation();
         try {
             writeFileSync(at, `${process.pid} ${what.replace(/\s+/g, '_')} ${new Date().toISOString()} ${token}\n`, { flag: 'wx' });
             break;
@@ -97,17 +121,17 @@ async function hold(at, what) {
         const holder = holderOf(at);
         // Removing a dead owner's lock here would race with another process's recovery. Recovery is a separate host act.
         if (holder !== undefined && !alive(holder.pid)) {
-            throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+            throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
         }
         overAMinute(at, began, holder);
         if (!told && holder !== undefined) {
-            process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+            report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
             told = true;
         }
         await pauseFor(250);
     }
     if (told)
-        process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
+        report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
     held.set(at, token);
     frame.locks.set(at, token);
     if (!process.listeners('exit').includes(releaseAll))
@@ -125,16 +149,17 @@ function releaseAll() {
     for (const [at, token] of [...held])
         release(at, token);
 }
-process.once('SIGTERM', () => {
-    process.stderr.write(`${selfName()}: REFUSE·crash signal\n`);
-    releaseAll();
-    process.exit(1);
-});
+/** Only the CLI installs process termination behavior. Importing a host does not. */
+export function installActSignalHandler() {
+    process.once('SIGTERM', () => { report(`${actName()}: REFUSE·crash signal\n`); releaseAll(); process.exit(1); });
+}
 async function framed(takes, act) {
     const frame = { parent: context.getStore(), locks: new Map() };
     return context.run(frame, async () => {
         try {
+            checkCancellation();
             await takes();
+            checkCancellation();
             return await act();
         }
         finally {
@@ -149,14 +174,14 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
         const tree = treeAt(store);
         const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
         if (rootAuthority && (asked.includes('') || (ownsRegion(store) && !owns(tree) && !ownsAuthority(store))))
-            throw new Error(`${selfName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
+            throw new Error(`${actName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
         if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
             for (const region of asked)
                 await hold(regionAt(store, region), what);
             return;
         }
         if (ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock declare every region before entering an act`);
+            throw new Error(`${actName()}: REFUSE·lock declare every region before entering an act`);
         const already = owns(tree);
         // The tree lock is the acquisition gate. A whole-tree act cannot enter between checking it and taking regions.
         await hold(tree, what);
@@ -172,17 +197,18 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
                 const began = Date.now();
                 let told = false;
                 for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
+                    checkCancellation();
                     if (!alive(holder.pid))
-                        throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+                        throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
                     overAMinute(at, began, holder);
                     if (!told) {
-                        process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+                        report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
                         told = true;
                     }
                     await pauseFor(250);
                 }
                 if (told)
-                    process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
+                    report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
             }
             // Registered under the same acquisition gate as every legacy writer.
             // Root writes overlap all locks; siblings keep distinct region locks.
@@ -207,12 +233,14 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
     }, act);
 }
 export function underTheRegions(store, regions, what, act) {
+    store = canonicalActStore(store);
     return guardedRegions(store, regions, what, act, false);
 }
 /** Protect the root authority/policy read through child publication. This is
  * exclusion only: callers must authenticate contexts and compare prepared heads
  * while held. It creates no grant, clock advance, lease or automatic recovery. */
 export function underAuthorityRegions(store, regions, what, act) {
+    store = canonicalActStore(store);
     return guardedRegions(store, regions, what, act, true);
 }
 /** Protect an authority snapshot without taking a child region. The acquisition
@@ -220,12 +248,13 @@ export function underAuthorityRegions(store, regions, what, act) {
  * shared read; existing child acts continue independently. This is exclusion,
  * never authorization or a clock advance. */
 export function underRootAuthority(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         const tree = treeAt(store), root = regionAt(store, '');
         if (owns(tree) || owns(root) || ownsAuthority(store))
             return;
         if (ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
+            throw new Error(`${actName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
         await hold(tree, what);
         try {
             await hold(root, what);
@@ -246,49 +275,54 @@ export function underRootAuthority(store, what, act) {
 /** The fixed host may hand its child evidence of an actual held exclusion.
  * It is an operational envelope, not a grant, signer or receipt identity. */
 export function rootAuthorityProtection(store) {
+    store = canonicalActStore(store);
     const locks = [treeAt(store), regionAt(store, ''), ...held.keys()].filter(at => at === treeAt(store) || at === regionAt(store, '') || dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-'));
     const lock = locks.find(owns);
     if (lock === undefined)
-        throw Error(`${selfName()}: REFUSE·lock root authority is not protected`);
+        throw Error(`${actName()}: REFUSE·lock root authority is not protected`);
     const holder = holderOf(lock);
     if (holder?.pid !== process.pid || holder.token !== held.get(lock))
-        throw Error(`${selfName()}: REFUSE·lock authority protection changed`);
+        throw Error(`${actName()}: REFUSE·lock authority protection changed`);
     return Object.freeze({ store, lock, pid: holder.pid, token: holder.token });
 }
 /** expectedStore and expectedParent come from the fixed host's inheritance
  * channel, never from world data. Matching a live lock proves exclusion only;
  * signature, coverage and current context still require verification. */
 export function assertRootAuthorityProtection(proof, expectedStore, expectedParent) {
+    expectedStore = canonicalActStore(expectedStore);
     if (!proof || proof.store !== expectedStore || !Number.isSafeInteger(expectedParent) || expectedParent <= 0 || proof.pid !== expectedParent
         || typeof proof.lock !== 'string' || typeof proof.token !== 'string' || !proof.token
         || !(proof.lock === treeAt(expectedStore) || proof.lock === regionAt(expectedStore, '')
             || dirname(proof.lock) === join(expectedStore, 'locks') && basename(proof.lock).startsWith('@authority-'))) {
-        throw Error(`${selfName()}: REFUSE·lock invalid inherited authority protection`);
+        throw Error(`${actName()}: REFUSE·lock invalid inherited authority protection`);
     }
     const holder = holderOf(proof.lock);
     if (!alive(expectedParent) || holder?.pid !== proof.pid || holder.token !== proof.token)
-        throw Error(`${selfName()}: REFUSE·lock inherited authority protection ended`);
+        throw Error(`${actName()}: REFUSE·lock inherited authority protection ended`);
 }
 /** A child can publish independently, but the joined root projection and its
  * derived ledger appends have one writer. Authority protection already excludes
  * root mutations, so this lock needs no acquisition-gate upgrade. */
 export function underRootProjection(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         if (owns(treeAt(store)) || owns(regionAt(store, '')))
             return;
         if (!ownsAuthority(store))
-            throw new Error(`${selfName()}: REFUSE·lock root projection requires authority protection`);
+            throw new Error(`${actName()}: REFUSE·lock root projection requires authority protection`);
         await hold(projectionAt(store), what);
     }, act);
 }
 export const holdRoot = async (store, what) => {
+    store = canonicalActStore(store);
     if (!owns(treeAt(store)))
         await hold(regionAt(store, ''), what);
 };
 export function underTheLock(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         if (!owns(treeAt(store)) && ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
+            throw new Error(`${actName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
         await hold(treeAt(store), what);
         const locks = join(store, 'locks');
         const active = lockFiles(locks);
@@ -299,4 +333,4 @@ export function underTheLock(store, what, act) {
         await hold(regionAt(store, ''), what);
     }, act);
 }
-export const holds = (store, region) => [treeAt(store), regionAt(store, region)].some(owns);
+export const holds = (store, region) => { store = canonicalActStore(store); return [treeAt(store), regionAt(store, region)].some(owns); };

package/dist/observe/run.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "../host/call-context.js";
 import { boundedProcess } from "../host/process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
@@ -31,7 +32,7 @@ export function runReader(module, root, inputs, limits) {
     if (ran.status !== 0)
         throw new Error(`${module}: reader exited ${ran.status ?? `with signal ${ran.signal}`}\n${ran.stderr ?? ''}${ran.stdout ?? ''}`);
     if (ran.stderr)
-        process.stderr.write(ran.stderr);
+        hostOutput('error', ran.stderr);
     return responsesOf(ran.stdout ?? '', inputs.length).map((answer) => {
         if (answer.kind !== 'fact')
             throw new Error(`REFUSE·reader ${module} · ${answer.why ?? 'no reading answered'}`);

package/dist/observe/runner.js

@@ -1,3 +1,4 @@
+import { hostInstrumentRuntime } from "../host/call-context.js";
 import { spawnSync } from 'node:child_process';
 import { sha } from "../host/hash.js";
 import { existsSync, mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
@@ -10,17 +11,21 @@ import { landBlob } from "../land/ledger.js";
 import { EXTENSION, LOCK, publicLock } from '@lapxo/topos/wire';
 import { foldClaims, isWire } from "../fold/claims.js";
 const self = () => process.argv[1] ?? '';
-const fromBlob = () => extname(existsSync(self()) ? realpathSync(self()) : self()) === '';
+const fromBlob = () => hostInstrumentRuntime() !== undefined ? false : extname(existsSync(self()) ? realpathSync(self()) : self()) === '';
 /**
  * Where the instrument lies and what it is run from: from source or compiled modules, bound is two steps above this runner module; as a blob, the command is a blob of the tree's store, named by the digest bound's own lock names for
  * it, and bound lies beside that store. Other processes use the same runtime directory and extension; only source readers receive source conditions. A name that resolves to no blob beside it is refused by name
  * before anything is started, never handed to the runtime as the store's own directory.
  */
 // Blob bundles have no module URL; source and compiled modules carry their own entry location.
-const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
-const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
-const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
-export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
+// Native library imports do not inspect the embedding application's argv.
+// The CLI discovers its default runtime only when a CLI operation requests it.
+const moduleAt = () => fromBlob() ? undefined : fileURLToPath(import.meta.url);
+const runtimeAt = () => { const explicit = hostInstrumentRuntime(); if (explicit)
+    return explicit.directory; const at = moduleAt(); return at === undefined ? '' : resolve(dirname(at), '..'); };
+const runtimeExtension = () => { const explicit = hostInstrumentRuntime(); if (explicit)
+    return explicit.extension; const at = moduleAt(); return at === undefined ? '' : extname(at); };
+export const ownRoot = () => hostInstrumentRuntime()?.root ?? (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt(), '..'));
 /** A published instrument carries its own content store even before any ledger
  * exists. Public-lock recognition grants no authority; legacy signed delivery
  * trees retain their historical colocated-ledger or sibling-store layout. */
@@ -34,6 +39,9 @@ export const ownStore = () => instrumentStoreAt(ownRoot());
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;
 export const ownLock = () => {
+    const explicit = hostInstrumentRuntime();
+    if (explicit)
+        return explicit.lock;
     if (instrumentLock !== undefined)
         return instrumentLock;
     const lines = (observeText(join(ownRoot(), LOCK)) ?? '').split('\n').filter(isWire);
@@ -43,10 +51,10 @@ export const ownLock = () => {
         : foldClaims(published).standing;
     return instrumentLock;
 };
-export const sourceOf = () => (fromBlob() ? join(ownRoot(), 'src', 'cli', 'verb.ts') : self());
+export const sourceOf = () => hostInstrumentRuntime()?.entry ?? (fromBlob() ? join(ownRoot(), 'src', 'cli', 'verb.ts') : self());
 export function processOf(name, folder) {
     if (!fromBlob())
-        return join(runtimeAt, folder ?? 'cli', `${name}${runtimeExtension}`);
+        return join(runtimeAt(), folder ?? 'cli', `${name}${runtimeExtension()}`);
     const named = ownLock().find((line) => fieldOf(line, 'scope') === `runner/${name}`);
     const blob = fieldOf(named ?? '', 'value').replace(/^[^:]*:/, '');
     if (!blob || !existsSync(join(dirname(self()), blob))) {
@@ -87,7 +95,7 @@ export function bundleOf(module) {
 }
 /** A reader run by a blob is a blob itself: its bundle, with everything it imports but the compiler. */
 export function readerOf(module) {
-    const source = { path: module, flags: runtimeExtension === '.ts' ? ['--disable-warning=ExperimentalWarning', '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON'] : [] };
+    const source = { path: module, flags: runtimeExtension() === '.ts' ? ['--disable-warning=ExperimentalWarning', '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON'] : [] };
     const hex = fromBlob() ? bundleOf(module) : undefined;
     return hex === undefined ? source : { path: join(ownStore(), 'cas', 'blobs', hex), flags: [] };
 }

package/docs/contracts/closure-delivery.md

@@ -0,0 +1,23 @@
+# Verified executable closure delivery
+
+Needs are arbitrary declared names, not a kernel profile enumeration.
+
+All requested entries share the existing moduleClosure traversal; no second walker, parser or algebra.
+
+Host requires already authenticated snapshot identities; a bundle digest establishes content identity, not authority or correctness.
+
+Delivery preserves each reached JS/JSON member and explicitly pinned notices byte for byte. Separate digests identify the closure manifest and the exact UTF-8 JSON container.
+
+Canonical delivery sorts needs, reached modules, library bindings and notices; duplicate needs do not duplicate code; unsupported executable forms refuse by name.
+
+Mandatory member, source byte and response byte budgets apply before delivery. Pre-aborted or observed cancellation refuses. Synchronous work is not a preemptible execution sandbox.
+
+Portable ESM delivery refuses host builtins, runtime loader access, CommonJS loads, calculated/escaped loader expressions and unsupported URL spellings before entry execution.
+
+Consumer verifies the expected container digest and repeats the same closure preflight over exactly the delivered members. Derived import maps are never trusted as authority.
+
+The host must verify actual mounted bytes again before execution; the test host demonstrates this but is not a public browser host.
+
+Existing native, program and worker custody remain unchanged. Acorn routes stay explicitly retained under A-F gate.
+
+No external fetch or general demand resolver is introduced. Missing bytes remain outside completed delivery and must be resolved by the existing host contract.

package/docs/contracts/closure-delivery.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/closure-delivery",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/closure-delivery.md",
+      "digest": "sha256:bdadeefcf8042749e642a453adc7d07944ceab3fbd62de46209ea3ed25d05c2e"
+    },
+    {
+      "role": "yes",
+      "path": "samples/module-delivery/inputs/delivery.json",
+      "digest": "sha256:a6df1d11537a0792c9772b1874c7e127e0fda22203f756d6f0eb104d072a9df1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/module-delivery.vector.json",
+      "digest": "sha256:3de9f160f89764e1153a2719ab04447142fe187bf476b3060d860e81e9c37c02"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/module-delivery/delivery.json",
+      "digest": "sha256:f95b1c3129896baaecb4ae7860afc11dcaaef0a2e47221b73044bc5a4681181f"
+    }
+  ]
+}

package/docs/contracts/native-host.md

@@ -0,0 +1,21 @@
+# Native in-process host
+
+The public `@lapxo/bound/host` entry offers authenticated Root and contextual standing reads, Root-lot and contextual-act admission, historical recovery, and explicit native instrument and receiver adapters. Node is required for this native host. The pure `/engine` and reference backends retain their separate contracts.
+
+## Classic Root lot
+
+`landRootLotInProcess(context, ports)` accepts LF-framed, canonical, unsigned target configuration records. The receiver supplies the admitted place, exact history snapshot, implementation runtime, reading identity, byte/record/time bounds, content port and canonical-line signer. The lot cannot choose those capabilities. It calls the same admission judges and atomic result implementation as the CLI; a signed line is not automatically an admitted line.
+
+The snapshot is checked before acquisition and before admission. Coverage is checked before invoking the signer. A change while signing refuses instead of rebasing. A fresh repeated held lot does not acquire another signature. `rootLotSnapshot` names complete admission history; it is not a signature or permission.
+
+## Effects and recovery
+
+Cancellation before visibility leaves no partial act. A publication error whose visibility is unknown returns `uncertain` with the native act identity. A failure after commit retains that identity and reports incomplete conformance, not rollback. `recoverRootActInProcess` authenticates the historical result without signing or reviving current grants. Root and contextual admission remain distinct operations; the latter consumes already signed contextual originals and acquires receiver receipts.
+
+The host selects context explicitly on every call. Calls do not interpret consumer argv or print to its console. Diagnostics are bounded returned data. Native storage shares the CLI exclusion protocol. Returned reading commitments are unsigned data and do not pay release demands.
+
+## Public quartet
+
+The two positive places are a seed accession library and a coastal tide survey. Each installs the public host boundary, bootstraps disposable fixture authority through the real CLI, admits a domain-specific Root lot, compares native result recovery and repeats the held lot without signing again. Negatives alter bytes, remove signer coverage, cancel before commit and offer a noncanonical lot; no negative may create a visible act. Test keys are created only for the disposable fixture, never shipped.
+
+The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Head, browser hosts, algebra, wire and ceilings are outside this change.