@lapxo/bound 0.2.3 → 0.2.4

package/dist/fold/claims.d.ts

@@ -0,0 +1,29 @@
+import { parse } from '@lapxo/topos/wire';
+export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
+/** Pure syntax is retained by the exact record bytes, never by a path, epoch or
+ * claimed digest. This does not retain admission, coverage or current grants. */
+export declare function parsedLine(line: string): ReturnType<typeof parse>;
+export declare const fieldOf: (line: string, name: string) => string;
+export declare const fieldsOf: (line: string) => Record<string, string>;
+export declare function selfName(): string;
+export declare function isWire(line: string): boolean;
+export declare const wireLinesOf: (text: string | undefined) => readonly string[];
+export declare const isConfig: (line: string) => boolean;
+export declare const sayingOf: (line: string) => string;
+/** One key per claim: scope, role and measure; what a line says, its envelope set aside, is one however often it landed. */
+export declare function claimKey(line: string): string;
+export interface Fork {
+    readonly key: string;
+    readonly lines: readonly string[];
+    readonly state?: string;
+}
+export declare function foldClaims(lines: readonly string[], receipts?: readonly {
+    readonly scope: string;
+    readonly moved: readonly string[];
+}[], _placed?: boolean): {
+    readonly standing: readonly string[];
+    readonly superseded: readonly string[];
+    readonly retracted: readonly string[];
+    readonly forks: readonly Fork[];
+    readonly vacuous: readonly string[];
+};

package/dist/fold/claims.js

@@ -3,6 +3,7 @@ import { contracts, exclusive, point, region } from '@lapxo/obligations/field';
 import { ENVELOPE, PROTOCOL, recordKind, signedBytes, parse } from '@lapxo/topos/wire';
 export { CAPSULE, EXTENSION, LOCK, RECEIPTS } from '@lapxo/topos/wire';
 import { ownRoot } from "../observe/runner.js";
+import { hostInstrumentName } from "../host/call-context.js";
 const decoded = new Map();
 const parsed = new Map();
 const kinds = new Map();
@@ -35,7 +36,7 @@ function wireFields(line) {
 }
 export const fieldOf = (line, name) => wireFields(line)[name] ?? '';
 export const fieldsOf = (line) => ({ ...wireFields(line) });
-export function selfName() { return basename(ownRoot()); }
+export function selfName() { return hostInstrumentName() ?? basename(ownRoot()); }
 export function isWire(line) { return line.startsWith(PROTOCOL); }
 export const wireLinesOf = (text) => (text ?? '').split('\n').filter(isWire);
 export const isConfig = (line) => { const held = kinds.get(line); if (held !== undefined)

package/dist/fold/closed.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "../host/call-context.js";
 import { actCosts } from "../host/act-cost.js";
 import { verifiedReadingReceipts } from "../host/reading-closures.js";
 import { readingProfile } from "../host/reading-context.js";
@@ -215,7 +216,7 @@ export function meets(root, store, place, current = true, active) {
                 }
             }
             if (closed && readings)
-                process.stderr.write(`RECEIPTS ${readings} read · 0 opened · reading closures\n`);
+                hostOutput('error', `RECEIPTS ${readings} read · 0 opened · reading closures\n`);
         }
         seen = { count: named.size + (own.length > 0 ? 1 : 0), ms: Date.now() - at };
         return closed;

package/dist/fold/digests.js

@@ -1,3 +1,4 @@
+import { signatureEraOf } from "../host/signature-era.js";
 import { ledgerLines, ledgerWriters } from "../land/ledger.js";
 import { readOnly } from "../host/read-only.js";
 import { appendFileSync, dirname, join, mkdirSync, readdirSync, realpathSync, relative, resolve } from "../host/io.js";
@@ -93,13 +94,12 @@ export function signaturesOf(store, told = []) {
     return eraOf(foldClaims([...signedLockLines(store, told), ...told]).standing);
 }
 export function eraOf(standing) {
-    const said = wireLine(standing, 'signature-algorithms');
-    const admitted = (said === undefined ? [] : fieldOf(said, 'value').split('|')).filter(Boolean);
-    const current = wireLine(standing, 'era');
-    const era = (current === undefined ? undefined : admitted.find((one) => one.endsWith(`:${fieldOf(current, 'value')}`))) ?? admitted.find((one) => one.includes(':'));
-    if (era === undefined)
-        throw new Error(`${selfName()}: REFUSE·runtime the lock names no signature algorithm by digest: nothing can be signed here`);
-    return { admitted, era };
+    try {
+        return signatureEraOf(standing);
+    }
+    catch (error) {
+        throw new Error(`${selfName()}: ${error instanceof Error ? error.message : String(error)}`);
+    }
 }
 export const bytesDigest = (store, bytes) => bytesWith(bytes, algorithmOf(store));
 export const fullDigest = (store, input) => fullWith(input, algorithmOf(store));

package/dist/host/admitted-place.js

@@ -1,9 +1,6 @@
 import { hashText } from "./hash.js";
 import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
-import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
-import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
-import { foldedEvidence } from '@lapxo/topos/contract';
+import { projectAuthenticatedStanding, publishedStandingLines } from "./standing-projection.js";
 import { createHash } from 'node:crypto';
 // One bounded historical projection, never a current authority/lease verdict.
 // Its complete inputs are reread before lookup, including original signatures.
@@ -24,32 +21,7 @@ export function authenticatedRootStanding(root) {
     const identity = historicalIdentity(history, anchor);
     if (historicalProjection?.identity === identity)
         return [...historicalProjection.standing];
-    const snapshots = new Map();
-    const admitted = history.filter(line => {
-        const epoch = Number(fieldOf(line, 'epoch')) || 0;
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            // This invocation has freshly read the complete signed inventory. Derive
-            // the same historical cutoff without reopening it for every epoch; the
-            // next invocation still rereads every authority input.
-            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
-            // The signature vocabulary is configuration, not the as-yet
-            // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => {
-                const scope = fieldOf(record, 'scope');
-                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
-            });
-            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        return authority.of(line).kind === 'admitted';
-    });
-    // The host authenticates against historical authority; Topos projects the
-    // authenticated history using the instrument's existing fold.
-    const { standing } = foldedEvidence(admitted, {
-        classification: () => 'local',
-        fold: lines => foldClaims(lines).standing,
-    });
+    const standing = projectAuthenticatedStanding(history, anchor);
     historicalProjection = { identity, standing: Object.freeze([...standing]) };
     return [...standing];
 }
@@ -59,5 +31,5 @@ export const authenticatedStanding = authenticatedRootStanding;
  * remains intact for the existing typed-object projection. Internal readers keep
  * authenticatedStanding, including its historical markers. */
 export function publicStandingLines(root) {
-    return authenticatedRootStanding(root).filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+    return publishedStandingLines(authenticatedRootStanding(root));
 }

package/dist/host/call-context.d.ts

@@ -0,0 +1,20 @@
+/** Native operational selection from the receiver, never the offered content. */
+export interface HostInstrumentRuntime {
+    readonly root: string;
+    readonly entry: string;
+    readonly directory: string;
+    readonly extension: '.ts' | '.js';
+    readonly lock: readonly string[];
+}
+interface HostCall {
+    readonly instrumentName: string;
+    readonly runtime?: HostInstrumentRuntime;
+    readonly output?: (stream: 'out' | 'error', text: string) => void;
+}
+export declare const hostInstrumentName: () => string | undefined;
+export declare const hostInstrumentRuntime: () => HostInstrumentRuntime | undefined;
+export declare const withHostInstrument: <T>(instrumentName: string, run: () => T) => T;
+export declare const withHostCall: <T>(call: HostCall, run: () => T) => T;
+/** No stream monkey-patching: diagnostics follow only this asynchronous call. */
+export declare function hostOutput(stream: 'out' | 'error', text: string): void;
+export {};

package/dist/host/call-context.js

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const calls = new AsyncLocalStorage();
+export const hostInstrumentName = () => calls.getStore()?.instrumentName;
+export const hostInstrumentRuntime = () => calls.getStore()?.runtime;
+export const withHostInstrument = (instrumentName, run) => calls.run({ ...calls.getStore(), instrumentName }, run);
+export const withHostCall = (call, run) => calls.run(call, run);
+/** No stream monkey-patching: diagnostics follow only this asynchronous call. */
+export function hostOutput(stream, text) {
+    const output = calls.getStore()?.output;
+    if (output)
+        output(stream, text);
+    else
+        (stream === 'out' ? process.stdout : process.stderr).write(text);
+}

package/dist/host/capsule-process.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "./call-context.js";
 import { actCosts } from "./act-cost.js";
 import { fileURLToPath } from 'node:url';
 import { boundedProcess } from "./process-lifetime.js";
@@ -55,7 +56,7 @@ export function executeCapsule(command, args, requests, limits = {}, lifetime) {
             throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
         }
         if (run.stderr)
-            process.stderr.write(run.stderr);
+            hostOutput('error', run.stderr);
         return values;
     });
 }

package/dist/host/capsule.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "./call-context.js";
 import { readerLifetime, parse } from '@lapxo/topos/wire';
 import { contentStore, verifiedContent, contentPolicy } from "./content-store.js";
 import { readOnly } from "./read-only.js";
@@ -21,8 +22,8 @@ import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
 import { said } from "../fold/wire.js";
 const declared = new Map();
 const laid = new Map();
-process.on('exit', () => { for (const at of laid.values())
-    rmSync(at, { recursive: true, force: true }); });
+const releaseLaid = () => { for (const at of laid.values())
+    rmSync(at, { recursive: true, force: true }); };
 /** A blob is unpacked once in a process, where every run of it the process asks for reads it. */
 function unpacked(digest, bytes) {
     const held = laid.get(digest);
@@ -37,6 +38,8 @@ function unpacked(digest, bytes) {
         throw error;
     }
     laid.set(digest, at);
+    if (!process.listeners('exit').includes(releaseLaid))
+        process.once('exit', releaseLaid);
     return at;
 }
 /**
@@ -99,7 +102,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     }
     const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
     if (!child.length) {
-        process.stderr.write(`LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
+        hostOutput('error', `LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
@@ -124,7 +127,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     if (missing.length && readOnly())
         throw Error(`REFUSE·preview capsule ${digest} has no verified answer for the proposed inputs; fold the declared inputs first`);
     if (missing.length)
-        process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
+        hostOutput('error', `CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
     if (native && !lifetime)
         throw Error('REFUSE·native reader missing declared lifetime');

package/dist/host/commit-result.d.ts

@@ -0,0 +1,6 @@
+import { BoundRefusal } from './refusals.ts';
+/** Visibility may precede a failed publication response; never asserts rollback. */
+export declare class ActCommitUnknown extends BoundRefusal {
+    readonly identity: string;
+    constructor(identity: string, cause: unknown);
+}

package/dist/host/commit-result.js

@@ -0,0 +1,5 @@
+import { BoundRefusal } from "./refusals.js";
+/** Visibility may precede a failed publication response; never asserts rollback. */
+export class ActCommitUnknown extends BoundRefusal {
+    constructor(identity, cause) { super('host/commit-unknown', `REFUSE·act publication uncertain · ${cause instanceof Error ? cause.message : 'storage failure'}`); this.identity = identity; }
+}

package/dist/host/contextual-place.js

@@ -6,7 +6,8 @@ import { placesIn } from "../fold/places.js";
 import { appliedHistoryIn } from "../fold/signed.js";
 import { storeOf } from "../land/ledger.js";
 import { publicStandingLines } from "./admitted-place.js";
-import { foldClaims, fieldOf } from "../fold/claims.js";
+import { projectContextualStanding } from "./standing-carrier.js";
+import { admissionHistoryAt } from "../fold/admission-history.js";
 const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
 function read(path, limit) {
     const fd = openSync(path, 'r');
@@ -60,18 +61,12 @@ export function contextualAct(root, identity) {
 }
 /** Carriers retain exact originals and authenticated context/receipts. Each
  * namespace folds independently; labels assert no statistical independence. */
-export function contextualStanding(root) {
+/** Native snapshot collection preserves every existing authentication boundary. */
+export function contextualStandingSnapshot(root) {
     const selected = declaredRootClockSource(root), acts = committedPlaceActResults(storeOf(root), selected.trust, selected.selection.storageBudget);
-    const groups = new Map();
-    for (const act of acts) {
-        const decoded = readPlaceActContext(act.bundle.context, selected.selection.budget);
-        for (const p of decoded.places) {
-            const key = JSON.stringify([decoded.root.namespace, p.place]), group = groups.get(key) ?? { namespace: decoded.root.namespace, place: p.place, lines: [], contexts: [] };
-            group.lines.push(...p.records);
-            group.contexts.push({ identity: act.identity, context: act.bundle.context, receipts: act.bundle.receipts });
-            groups.set(key, group);
-        }
-    }
-    const legacyPlaces = placesIn(root).map(place => { const history = appliedHistoryIn(root, place), folded = foldClaims(history); return { namespace: 'legacy-global', place: [place, 'TARGET.bound'].join('/'), standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history }; });
-    return { profile: PLACE_ACT_CONTEXT, root: publicStandingLines(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+    return { rootHistory: admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), legacyPlaces: placesIn(root).map(place => ({ place: [place, 'TARGET.bound'].join('/'), history: appliedHistoryIn(root, place) })), contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })) };
+}
+export function contextualStanding(root) {
+    const snapshot = contextualStandingSnapshot(root), selected = declaredRootClockSource(root);
+    return projectContextualStanding(publicStandingLines(root), snapshot.legacyPlaces, snapshot.contexts, snapshot.contexts.map(a => ({ identity: a.identity, context: readPlaceActContext(a.context, selected.selection.budget) })));
 }

package/dist/host/host-controls.js

@@ -0,0 +1,19 @@
+import { LOCK } from '@lapxo/topos/wire';
+import { BoundRefusal } from "./refusals.js";
+/** Shared host refusals preserve the public code and diagnostic at every port. */
+export function refuseHost(code) {
+    throw new BoundRefusal('host/' + code, 'REFUSE·host/' + code);
+}
+export function assertHostNotCancelled(signal) {
+    if (signal?.aborted)
+        refuseHost('cancelled');
+}
+/** Clock validation is shared; each boundary keeps its own refusal producer. */
+export function receiverClock(text, refuse) {
+    if (!/^(0|[1-9][0-9]*)$/.test(text) || !Number.isSafeInteger(Number(text)))
+        refuse('unknown receiver clock');
+    return Number(text);
+}
+/** Coordinates use the wire's lock name, never a second spelling in a host. */
+export const isPlaceLockCoordinate = (coordinate) => typeof coordinate === 'string' && coordinate.endsWith('/' + LOCK) && !coordinate.startsWith('/') && !coordinate.split('/').some(part => !part || part === '.' || part === '..');
+export const placeRegionOf = (coordinate) => coordinate === '.' ? '' : coordinate.slice(0, -(LOCK.length + 1));

package/dist/host/in-process-act.d.ts

@@ -0,0 +1,82 @@
+import { type ReadingIdentityContext } from '@lapxo/topos/contract';
+import { type ContentReadPort, type SigningPort, type PortLimits } from '../engine/ports.ts';
+import { type PlaceActPersistence } from './place-act-transaction.ts';
+import type { PlaceActTrust, PlaceActBudget } from './ports/place-act.ts';
+export interface PlaceActHostContext {
+    readonly place: string;
+    readonly source: string;
+    readonly identity: string;
+    readonly rootSnapshot: string;
+    readonly reading: ReadingIdentityContext;
+    readonly algorithm: string;
+    readonly contentLimits: PortLimits;
+    readonly signingLimits: PortLimits;
+    readonly storageLimits: PlaceActBudget;
+    readonly signal?: AbortSignal;
+}
+/** These are receiver-selected host ports, not carrier fields or an offered
+ * verifier. Trust must be constructed from the authenticated receiver snapshot. */
+export interface PlaceActHostPorts {
+    readonly instrumentName: string;
+    readonly read: ContentReadPort;
+    readonly sign: SigningPort;
+    readonly trust: () => PlaceActTrust;
+    readonly persistence: PlaceActPersistence;
+    readonly limits: {
+        readonly storage: PlaceActBudget;
+        readonly signing: PortLimits;
+        readonly content: PortLimits;
+    };
+}
+/** Signs receiver receipts through the bounded existing signer protocol. Exact
+ * original declarations/proofs remain unchanged. Replay is historical recovery,
+ * never a new permission. A refusal after visibility is not a rollback claim. */
+export declare function landPlaceActInProcess(context: PlaceActHostContext, ports: PlaceActHostPorts): Promise<{
+    kind: "fact";
+    value: {
+        place: string;
+        act: import("./ports/place-act.ts").PlaceActBundle & {
+            readonly kind: "landed" | "once";
+            readonly identity: string;
+        };
+        reading: string;
+        result: string;
+        commitment: string;
+    };
+    identity?: undefined;
+    code?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "uncertain";
+    identity: string;
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+    identity?: undefined;
+}>;
+/** Historical recovery after a lost response. No signer, current authorization
+ * or publication callback is invoked and the result grants no new act. */
+export declare function recoverPlaceActInProcess(context: Pick<PlaceActHostContext, 'place' | 'identity' | 'reading' | 'storageLimits' | 'signal'>, ports: Pick<PlaceActHostPorts, 'instrumentName' | 'trust' | 'persistence' | 'limits'>): {
+    kind: "fact";
+    value: {
+        place: string;
+        identity: string;
+        act: import("./ports/place-act.ts").PlaceActBundle;
+        historical: true;
+        reading: string;
+        result: string;
+        commitment: string;
+    };
+    code?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+};

package/dist/host/in-process-act.js

@@ -0,0 +1,84 @@
+import { authorityAtEpoch } from '@lapxo/topos/wire';
+import { placeReceiptBytes, readPlaceActContext } from '@lapxo/topos/core';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent, invokeFrameSigningPort } from "../engine/ports.js";
+import { transactPlaceAct, PlaceActCommitUnknown } from "./place-act-transaction.js";
+import { withActHost } from "../land/act.js";
+import { sha256, isSha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as fail } from "./host-controls.js";
+import { withHostInstrument } from "./call-context.js";
+import { requireEffects } from "./read-only.js";
+/** Signs receiver receipts through the bounded existing signer protocol. Exact
+ * original declarations/proofs remain unchanged. Replay is historical recovery,
+ * never a new permission. A refusal after visibility is not a rollback claim. */
+export async function landPlaceActInProcess(context, ports) {
+    return withHostInstrument(ports.instrumentName, () => withActHost({ name: ports.instrumentName, report: () => { }, signal: context.signal }, async () => {
+        try {
+            requireEffects('contextual host admission');
+            const { place, source, identity, rootSnapshot, algorithm, signal } = context, reading = structuredClone(context.reading), contentLimits = { ...context.contentLimits }, signingLimits = { ...context.signingLimits }, storageLimits = { ...context.storageLimits };
+            if (typeof ports.instrumentName !== 'string' || !ports.instrumentName || !/[a-zA-Z0-9]/.test(ports.instrumentName) || !/^[a-zA-Z0-9._-]+$/.test(ports.instrumentName) || typeof place !== 'string' || !place || typeof source !== 'string' || !source || typeof algorithm !== 'string' || !algorithm)
+                fail('context');
+            if (storageLimits.acts > ports.limits.storage.acts || storageLimits.bytes > ports.limits.storage.bytes || signingLimits.timeoutMs > ports.limits.signing.timeoutMs || signingLimits.maxBytes > ports.limits.signing.maxBytes || contentLimits.timeoutMs > ports.limits.content.timeoutMs || contentLimits.maxBytes > ports.limits.content.maxBytes)
+                fail('budget');
+            const key = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/snapshot', rootSnapshot], ['host/act', identity], ['host/operation', sha256(JSON.stringify([algorithm, contentLimits, signingLimits, storageLimits]))]] }, sha256);
+            const trust = ports.trust();
+            if (trust.contract.root.snapshot !== rootSnapshot)
+                fail('stale');
+            if (contentLimits.maxBytes > trust.contract.budget.bytes)
+                fail('budget');
+            const bytes = await readContent(source, identity, { read: ports.read, digestBytes: sha256 }, contentLimits, signal);
+            let encoded;
+            try {
+                encoded = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            }
+            catch {
+                return fail('snapshot-format');
+            }
+            const decoded = readPlaceActContext(encoded, trust.contract.budget);
+            if (trust.contract.digest(encoded) !== identity)
+                fail('integrity');
+            const acquire = async () => {
+                const by = trust.contract.receiptSigner, signer = trust.contract.signers.find(s => s.id === by);
+                if (!signer || authorityAtEpoch({ scope: trust.contract.receiptScope, by }, signer, Number(trust.contract.root.epoch), trust.contract.receiptScope, 'authority').kind !== 'admitted')
+                    fail('receiver-authority');
+                const signed = await invokeFrameSigningPort({ keyId: by, algorithm, bytes: decoded.places.map(p => placeReceiptBytes(identity, p, decoded.root, by, trust.contract.receiptScope, trust.contract.budget)) }, ports.sign, signingLimits, signal);
+                return decoded.places.map((p, i) => ({ place: p.place, by, signature: signed[i].signature }));
+            };
+            const act = await transactPlaceAct(encoded, acquire, trust, storageLimits, ports.persistence, signal);
+            const result = sha256(JSON.stringify(act) + '\n');
+            return { kind: 'fact', value: { place, act, reading: key, result, commitment: readingReceiptIdentity(key, result, sha256) } };
+        }
+        catch (error) {
+            if (error instanceof PlaceActCommitUnknown)
+                return { kind: 'uncertain', identity: error.identity, code: error.code, diagnostic: error.message };
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+        }
+        ;
+    }));
+}
+/** Historical recovery after a lost response. No signer, current authorization
+ * or publication callback is invoked and the result grants no new act. */
+export function recoverPlaceActInProcess(context, ports) {
+    return withHostInstrument(ports.instrumentName, () => withActHost({ name: ports.instrumentName, report: () => { }, signal: context.signal }, () => {
+        try {
+            if (context.signal?.aborted)
+                fail('cancelled');
+            if (!context.place || !isSha256(context.identity))
+                fail('context');
+            const limits = { ...context.storageLimits };
+            if (limits.acts > ports.limits.storage.acts || limits.bytes > ports.limits.storage.bytes)
+                fail('budget');
+            const reading = readingIdentity({ ...structuredClone(context.reading), inputs: [...context.reading.inputs, ['host/place', sha256(context.place)], ['host/act', context.identity], ['host/operation', sha256('historical-recovery')]] }, sha256);
+            const act = ports.persistence.result(context.identity, ports.trust(), limits);
+            if (!act)
+                fail('act-unavailable');
+            const result = sha256(JSON.stringify(act) + '\n');
+            return { kind: 'fact', value: { place: context.place, identity: context.identity, act, historical: true, reading, result, commitment: readingReceiptIdentity(reading, result, sha256) } };
+        }
+        catch (error) {
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+        }
+        ;
+    }));
+}

package/dist/host/in-process-context.d.ts

@@ -0,0 +1,46 @@
+import type { ContentReadPort } from '../engine/ports.ts';
+import type { RootStandingHostContext } from './in-process.ts';
+/** Full contextual carrier, authenticated against receiver inputs only. It is a
+ * data projection, not a current admission permit or a signed receipt. */
+export declare function readContextualStandingInProcess(context: RootStandingHostContext, ports: {
+    readonly read: ContentReadPort;
+}): Promise<{
+    kind: "fact";
+    value: {
+        place: string;
+        standing: {
+            profile: string;
+            root: readonly string[];
+            legacyPlaces: {
+                namespace: string;
+                place: string;
+                standing: string[];
+                history: readonly string[];
+            }[];
+            contexts: readonly import("./root-clock-source.ts").PortablePlaceContext[];
+            places: {
+                namespace: string;
+                place: string;
+                standing: string[];
+                retracted: readonly string[];
+                superseded: readonly string[];
+                forks: readonly import("../fold/claims.ts").Fork[];
+                contexts: {
+                    identity: string;
+                    context: string;
+                    receipts: readonly import("@lapxo/topos/wire").PlaceReceipt[];
+                }[];
+            }[];
+        };
+        reading: string;
+        result: string;
+        commitment: string;
+    };
+    code?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+}>;

package/dist/host/in-process-context.js

@@ -0,0 +1,91 @@
+import { parse } from '@lapxo/topos/wire';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent } from "../engine/ports.js";
+import { sha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as fail, isPlaceLockCoordinate, placeRegionOf } from "./host-controls.js";
+import { publicStandingProjection, assertStandingView } from "./standing-projection.js";
+import { rootClockSelectionOf, inspectPortablePlaceContexts } from "./root-clock-source.js";
+import { projectContextualStanding } from "./standing-carrier.js";
+import { authorityFor } from "../fold/signers.js";
+import { ownRecordAdmitted } from "../fold/signed.js";
+import { wordsOf } from "../fold/wire.js";
+import { fieldOf, isConfig } from "../fold/claims.js";
+import { signatureEraOf } from "./signature-era.js";
+function authenticatedCarrier(snapshot, anchor, records) {
+    if (!snapshot || Object.keys(snapshot).sort().join(',') !== 'contexts,legacyPlaces,rootHistory' || !Array.isArray(snapshot.rootHistory) || !Array.isArray(snapshot.legacyPlaces) || !Array.isArray(snapshot.contexts))
+        fail('snapshot-format');
+    let count = snapshot.rootHistory.length;
+    if (count > records)
+        fail('budget');
+    const validLine = (line) => typeof line === 'string' && parse(line).kind === 'fact';
+    if (!snapshot.rootHistory.length || snapshot.rootHistory.some(l => !validLine(l)))
+        fail('snapshot-format');
+    const root = publicStandingProjection(snapshot.rootHistory, anchor), families = wordsOf(root, 'families');
+    // Unsupported vocabulary resolution must not discover a provider in the CLI host.
+    if (families.length && !families.includes('view'))
+        fail('vocabulary-unavailable');
+    assertStandingView(root);
+    const selection = rootClockSelectionOf(root, anchor), algorithms = signatureEraOf(root).admitted;
+    if (snapshot.legacyPlaces.length > selection.resources.places || snapshot.contexts.length > selection.resources.acts)
+        fail('budget');
+    const signers = authorityFor(snapshot.rootHistory, anchor, algorithms).admitted;
+    if (signers.some(s => !s.coverage.includes('*')) && !families.includes('region'))
+        fail('vocabulary-unavailable');
+    const names = new Set();
+    for (const place of snapshot.legacyPlaces) {
+        if (!place || !isPlaceLockCoordinate(place.place) || names.has(place.place) || !Array.isArray(place.history))
+            fail('snapshot-format');
+        names.add(place.place);
+        count += place.history.length;
+        if (count > records)
+            fail('budget');
+        const path = placeRegionOf(place.place);
+        if (place.history.some((l) => !validLine(l) || !ownRecordAdmitted(l, path, 'region', signers, algorithms)))
+            fail('legacy-authority');
+    }
+    for (const row of snapshot.contexts) {
+        if (!row || !row.authority || !Array.isArray(row.authority.history))
+            fail('snapshot-format');
+        count += row.authority.history.length;
+        if (count > records)
+            fail('budget');
+        // Historical authority must belong to this exact Root history, not a second
+        // signed Root fork silently substituted in the carrier.
+        const epoch = fieldOf(row.authority.checkpoint, 'epoch');
+        const expected = snapshot.rootHistory.filter(l => !isConfig(l) || Number(fieldOf(l, 'epoch')) <= Number(epoch));
+        if (JSON.stringify(expected) !== JSON.stringify(row.authority.history))
+            fail('historical-snapshot');
+    }
+    const decoded = inspectPortablePlaceContexts(JSON.stringify(snapshot.contexts), anchor, selection);
+    return projectContextualStanding(root, snapshot.legacyPlaces, snapshot.contexts, decoded);
+}
+/** Full contextual carrier, authenticated against receiver inputs only. It is a
+ * data projection, not a current admission permit or a signed receipt. */
+export async function readContextualStandingInProcess(context, ports) {
+    try {
+        const { place, source, snapshot, signal } = context, anchor = structuredClone(context.anchor), reading = structuredClone(context.reading), limits = { ...context.limits };
+        if (!place || typeof place !== 'string' || !source || typeof source !== 'string' || !Number.isSafeInteger(limits.records) || limits.records < 1)
+            fail('context');
+        const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/snapshot', snapshot]] }, sha256);
+        const bytes = await readContent(source, snapshot, { read: ports.read, digestBytes: sha256 }, limits, signal);
+        let text, value;
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            value = JSON.parse(text);
+        }
+        catch {
+            return fail('snapshot-format');
+        }
+        if (JSON.stringify(value) + '\n' !== text)
+            fail('snapshot-format');
+        if (signal?.aborted)
+            fail('cancelled');
+        const standing = authenticatedCarrier(value, anchor, limits.records), result = sha256(JSON.stringify(standing) + '\n');
+        return { kind: 'fact', value: { place, standing, reading: identity, result, commitment: readingReceiptIdentity(identity, result, sha256) } };
+    }
+    catch (error) {
+        return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+    }
+    ;
+}