@lapxo/bound 0.2.3 → 0.2.4

package/dist/host/in-process-root.d.ts

@@ -0,0 +1,117 @@
+import { type ReadingIdentityContext } from '@lapxo/topos/contract';
+import { type ContentReadPort, type SigningPort, type PortLimits } from '../engine/ports.ts';
+import { type HostInstrumentRuntime } from './call-context.ts';
+import type { LocalActBundle } from './ports/local-act.ts';
+import type { PublicationStorage } from './ports/publication.ts';
+export interface RootLotContext {
+    readonly place: string;
+    readonly snapshot: string;
+    readonly source: string;
+    readonly digest: string;
+    readonly reading: ReadingIdentityContext;
+    readonly limits: PortLimits & {
+        readonly records: number;
+    };
+    readonly signal?: AbortSignal;
+}
+/** The receiver selects the actual native place, instrument and signer. The lot
+ * supplies only canonical unsigned Root configuration, never host capabilities. */
+export interface RootLotPorts {
+    readonly root: string;
+    readonly instrumentName: string;
+    readonly runtime: HostInstrumentRuntime;
+    readonly read: ContentReadPort;
+    readonly signer: {
+        readonly keyId: string;
+        readonly name: string;
+        readonly sign: SigningPort;
+    };
+    readonly storage?: PublicationStorage;
+    readonly prepared?: (identity: string) => void;
+    readonly limits: RootLotContext['limits'] & {
+        readonly diagnostics: number;
+    };
+}
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+export declare const rootLotSnapshot: (root: string) => string;
+export declare function landRootLotInProcess(context: RootLotContext, ports: RootLotPorts): Promise<{
+    kind: "refuse";
+    code: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+    identity?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "fact";
+    value: {
+        result: string;
+        commitment: string;
+        conformance: "refused" | "complete";
+        reading: string;
+        identity?: string | undefined;
+        act?: import("@lapxo/topos/wire").ActResult | undefined;
+        place: string;
+        status: "once" | "landed" | "already-held";
+    };
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    code?: undefined;
+    identity?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "uncertain";
+    identity: string;
+    code: string;
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+} | {
+    kind: "fact";
+    value: {
+        place: string;
+        status: "once" | "landed";
+        identity: string;
+        conformance: "incomplete";
+    };
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    code?: undefined;
+    identity?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+    identity?: undefined;
+}>;
+/** Authenticated historical query only; never revives authority or signs. */
+export declare function recoverRootActInProcess(identity: string, ports: Pick<RootLotPorts, 'root' | 'instrumentName' | 'runtime'>): {
+    kind: "fact";
+    value: {
+        historical: true;
+        act: import("@lapxo/topos/wire").ActResult;
+        bundle: LocalActBundle;
+    };
+    code?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+};

package/dist/host/in-process-root.js

@@ -0,0 +1,84 @@
+import { canonical, parse } from '@lapxo/topos/wire';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent } from "../engine/ports.js";
+import { acceptRootRecords } from "../cli/accept.js";
+import { verifiedLegacyActResult } from "../cli/act-result.js";
+import { admissionHistoryAt, admissionAnchor } from "../fold/admission-history.js";
+import { isConfig } from "../fold/claims.js";
+import { sha256, isSha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as fail } from "./host-controls.js";
+import { ActCommitUnknown } from "./commit-result.js";
+import { requireEffects } from "./read-only.js";
+import { withHostCall } from "./call-context.js";
+import { withActHost } from "../land/act.js";
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+export const rootLotSnapshot = (root) => sha256(admissionHistoryAt(root, Number.MAX_SAFE_INTEGER).join('\n') + '\n');
+export async function landRootLotInProcess(context, ports) {
+    const diagnostics = [];
+    let size = 0;
+    let committed;
+    const runtime = structuredClone(ports.runtime), limits = { ...context.limits };
+    return withHostCall({ instrumentName: ports.instrumentName, runtime, output: (stream, text) => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
+            fail('budget'); diagnostics.push({ stream, text }); } }, () => withActHost({ name: ports.instrumentName, report: text => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
+            fail('budget'); diagnostics.push({ stream: 'error', text }); }, signal: context.signal }, async () => {
+        try {
+            requireEffects('Root lot admission');
+            if (!context.place || !ports.root || !ports.instrumentName || !runtime.root || !runtime.entry || !runtime.directory || !['.ts', '.js'].includes(runtime.extension) || !Array.isArray(runtime.lock) || !runtime.lock.length)
+                fail('context');
+            if (limits.records > ports.limits.records || limits.maxBytes > ports.limits.maxBytes || limits.timeoutMs > ports.limits.timeoutMs || !Number.isSafeInteger(limits.records) || limits.records < 1 || !Number.isSafeInteger(ports.limits.diagnostics) || ports.limits.diagnostics < 1)
+                fail('budget');
+            const { place, snapshot, source, digest, signal } = context, reading = structuredClone(context.reading);
+            if (!isSha256(snapshot) || rootLotSnapshot(ports.root) !== snapshot)
+                fail('stale');
+            const anchor = admissionAnchor(ports.root);
+            const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/snapshot', snapshot], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/draft', digest], ['host/principal', sha256(ports.signer.keyId)], ['host/operation', sha256(JSON.stringify(['root-lot', limits]))]] }, sha256);
+            const bytes = await readContent(source, digest, { read: ports.read, digestBytes: sha256 }, limits, signal);
+            let text;
+            try {
+                text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            }
+            catch {
+                return fail('snapshot-format');
+            }
+            const records = text.endsWith('\n') ? text.slice(0, -1).split('\n') : [];
+            if (!records.length || records.length > limits.records)
+                fail('budget');
+            for (const line of records) {
+                const parsed = parse(line);
+                if (parsed.kind !== 'fact' || canonical(parsed.value.fields, parsed.value.version) !== line || !isConfig(line) || parsed.value.fields.by !== 'target' || parsed.value.fields.epoch !== undefined || parsed.value.fields.sig !== undefined)
+                    fail('root-lot-format');
+            }
+            if (rootLotSnapshot(ports.root) !== snapshot)
+                fail('stale');
+            const code = await acceptRootRecords(ports.root, { records, keyId: ports.signer.keyId, signer: { name: ports.signer.name, sign: ports.signer.sign, signal }, signal, storage: ports.storage, prepared: ports.prepared, committed: (identity, bundle, status) => { committed = { identity, bundle, status }; } });
+            if (code !== 0 && !committed)
+                return { kind: 'refuse', code: 'host/act', diagnostics };
+            const value = { place, status: committed?.status ?? 'already-held', ...(committed ? { identity: committed.identity, act: verifiedLegacyActResult(ports.root, committed.identity).result } : {}), conformance: code === 0 ? 'complete' : 'refused', reading: identity };
+            const result = sha256(JSON.stringify(value) + '\n');
+            return { kind: 'fact', value: { ...value, result, commitment: readingReceiptIdentity(identity, result, sha256) }, diagnostics };
+        }
+        catch (error) {
+            if (error instanceof ActCommitUnknown)
+                return { kind: 'uncertain', identity: error.identity, code: error.code, diagnostic: error.message, diagnostics };
+            if (committed)
+                return { kind: 'fact', value: { place: context.place, status: committed.status, identity: committed.identity, conformance: 'incomplete' }, diagnostic: error instanceof Error ? error.message : 'post-commit failure', diagnostics };
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed', diagnostics };
+        }
+    }));
+}
+/** Authenticated historical query only; never revives authority or signs. */
+export function recoverRootActInProcess(identity, ports) {
+    return withHostCall({ instrumentName: ports.instrumentName, runtime: structuredClone(ports.runtime), output: () => { } }, () => {
+        try {
+            if (!isSha256(identity))
+                fail('context');
+            const recovered = verifiedLegacyActResult(ports.root, identity);
+            return { kind: 'fact', value: { historical: true, act: recovered.result, bundle: recovered.bundle } };
+        }
+        catch (error) {
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+        }
+        ;
+    });
+}

package/dist/host/in-process.d.ts

@@ -0,0 +1,41 @@
+import type { Signer } from '@lapxo/topos/wire';
+import type { ReadingIdentityContext } from '@lapxo/topos/contract';
+import type { ContentReadPort, PortLimits } from '../engine/ports.ts';
+/** Initial read-only host slice. The receiver supplies the original anchor and
+ * verified implementation/policy references; the offered bytes choose none of them.
+ * Context references commit identity, not authority or conformance certification.
+ */
+export interface RootStandingHostContext {
+    readonly place: string;
+    readonly source: string;
+    readonly snapshot: string;
+    readonly anchor: Signer;
+    readonly reading: ReadingIdentityContext;
+    readonly limits: PortLimits & {
+        readonly records: number;
+    };
+    readonly signal?: AbortSignal;
+}
+export type RootStandingHostResult = {
+    readonly kind: 'fact';
+    readonly value: {
+        readonly place: string;
+        readonly rootStanding: readonly string[];
+        readonly reading: string;
+        readonly result: string;
+        readonly commitment: string;
+    };
+} | {
+    readonly kind: 'refuse';
+    readonly code: string;
+    readonly diagnostic: string;
+};
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+export declare function readRootStandingInProcess(context: RootStandingHostContext, ports: {
+    readonly read: ContentReadPort;
+}): Promise<RootStandingHostResult>;

package/dist/host/in-process.js

@@ -0,0 +1,55 @@
+import { parse } from '@lapxo/topos/wire';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent } from "../engine/ports.js";
+import { sha256, isSha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as refuse } from "./host-controls.js";
+import { assertStandingView, publicStandingProjection } from "./standing-projection.js";
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+export async function readRootStandingInProcess(context, ports) {
+    try {
+        if (!context || typeof context.place !== 'string' || !context.place || typeof context.source !== 'string' || !context.source || !isSha256(context.snapshot))
+            refuse('context');
+        if (context.signal?.aborted)
+            refuse('cancelled');
+        const { place, source, snapshot, signal } = context, limits = { ...context.limits };
+        if (!Number.isSafeInteger(limits.records) || limits.records < 1)
+            refuse('budget');
+        const anchor = structuredClone(context.anchor), reading = structuredClone(context.reading);
+        if (!anchor || anchor.keyClass !== 'authorize' || !anchor.id || !anchor.publicKey || !Array.isArray(anchor.coverage) || !anchor.coverage.length)
+            refuse('context');
+        // Validate the complete declared environment before invoking a host port.
+        readingIdentity(reading, sha256);
+        const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/snapshot', snapshot]] }, sha256);
+        const bytes = await readContent(source, snapshot, { read: ports.read, digestBytes: sha256 }, limits, signal);
+        let text;
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch {
+            return refuse('snapshot-format');
+        }
+        const history = text.split('\n').filter(line => line.length > 0);
+        if (history.length > limits.records)
+            refuse('budget');
+        if (!history.length || history.some(line => parse(line).kind !== 'fact'))
+            refuse('snapshot-format');
+        if (signal?.aborted)
+            refuse('cancelled');
+        const standing = publicStandingProjection(history, anchor);
+        assertStandingView(standing);
+        if (signal?.aborted)
+            refuse('cancelled');
+        const result = sha256(standing.join('\n') + (standing.length ? '\n' : ''));
+        return { kind: 'fact', value: { place, rootStanding: standing, reading: identity, result, commitment: readingReceiptIdentity(identity, result, sha256) } };
+    }
+    catch (error) {
+        return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+    }
+    ;
+}

package/dist/host/index.d.ts

@@ -0,0 +1,15 @@
+/** Native host boundary. Uses the same admission and projection as the CLI. */
+export { readRootStandingInProcess } from './in-process.ts';
+export type { RootStandingHostContext, RootStandingHostResult } from './in-process.ts';
+export { readContextualStandingInProcess } from './in-process-context.ts';
+export { landPlaceActInProcess, recoverPlaceActInProcess } from './in-process-act.ts';
+export type { PlaceActHostContext, PlaceActHostPorts } from './in-process-act.ts';
+export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from './in-process-root.ts';
+export type { RootLotContext, RootLotPorts } from './in-process-root.ts';
+export { nativeHostInstrument, nativePlaceActReceiver } from './native-receiver.ts';
+export type { NativeHostInstrument } from './native-receiver.ts';
+export type { HostInstrumentRuntime } from './call-context.ts';
+export { nativePlaceActPersistence } from './ports/place-act.ts';
+export type { PlaceActTrust, PlaceActBudget } from './ports/place-act.ts';
+export type { PlaceActPersistence } from './place-act-transaction.ts';
+export type { PublicationStorage } from './ports/publication.ts';

package/dist/host/index.js

@@ -0,0 +1,7 @@
+/** Native host boundary. Uses the same admission and projection as the CLI. */
+export { readRootStandingInProcess } from "./in-process.js";
+export { readContextualStandingInProcess } from "./in-process-context.js";
+export { landPlaceActInProcess, recoverPlaceActInProcess } from "./in-process-act.js";
+export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from "./in-process-root.js";
+export { nativeHostInstrument, nativePlaceActReceiver } from "./native-receiver.js";
+export { nativePlaceActPersistence } from "./ports/place-act.js";

package/dist/host/native-receiver.d.ts

@@ -0,0 +1,19 @@
+import { type HostInstrumentRuntime } from './call-context.ts';
+export interface NativeHostInstrument {
+    readonly name: string;
+    readonly runtime: HostInstrumentRuntime;
+}
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+export declare function nativeHostInstrument(root: string, entry: string): NativeHostInstrument;
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+export declare function nativePlaceActReceiver(root: string, instrument: NativeHostInstrument): {
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: {
+        current: () => import("./ports/place-act.ts").PlaceActSnapshot;
+        historical: (encoded: string) => import("@lapxo/topos/wire").TrustedClockContract;
+        contract: import("@lapxo/topos/wire").TrustedClockContract;
+        initialHeads: readonly import("./ports/place-act.ts").PlaceActHead[];
+    };
+};

package/dist/host/native-receiver.js

@@ -0,0 +1,25 @@
+import { readFileSync, realpathSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative } from 'node:path';
+import { publicLock } from '@lapxo/topos/wire';
+import { foldClaims, wireLinesOf } from "../fold/claims.js";
+import { declaredRootClockSource } from "./root-clock-source.js";
+import { withHostCall } from "./call-context.js";
+import { BoundRefusal } from "./refusals.js";
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+export function nativeHostInstrument(root, entry) {
+    const at = realpathSync(root), file = realpathSync(entry), inside = relative(at, file), extension = extname(file);
+    if (!isAbsolute(root) || !isAbsolute(entry) || inside.startsWith('..') || isAbsolute(inside) || !['.ts', '.js'].includes(extension))
+        throw new BoundRefusal('host/context', 'REFUSE·host/context');
+    const published = publicLock(wireLinesOf(readFileSync(join(at, 'TARGET.bound'), 'utf8')));
+    if (!published)
+        throw new BoundRefusal('host/context', 'REFUSE·host requires a public instrument lock');
+    return { name: basename(at), runtime: { root: at, entry: file, directory: dirname(dirname(file)), extension: extension, lock: foldClaims(published).standing } };
+}
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+export function nativePlaceActReceiver(root, instrument) {
+    const call = { instrumentName: instrument.name, runtime: structuredClone(instrument.runtime), output: () => { } };
+    const selected = withHostCall(call, () => declaredRootClockSource(root)), original = selected.trust;
+    return { selection: selected.selection, trust: { ...original, current: () => withHostCall(call, () => original.current()), historical: (encoded) => withHostCall(call, () => original.historical(encoded)) } };
+}

package/dist/host/place-act-transaction.d.ts

@@ -0,0 +1,24 @@
+import { type PlaceReceipt } from '@lapxo/topos/core';
+import type { PlaceActTrust, PlaceActBudget, PlaceActBundle, PlaceActHead } from './ports/place-act.ts';
+export { ActCommitUnknown as PlaceActCommitUnknown } from './commit-result.ts';
+/** Host-selected persistence, never supplied by offered content. exclusive must
+ * share the CLI's region/authority/projection protocol. publish is synchronous
+ * with exactly one atomic visibility point; a thrown reply may follow commit. */
+export interface PlaceActPersistence {
+    readonly exclusive: <T>(regions: readonly string[], run: () => Promise<T>) => Promise<T>;
+    readonly result: (identity: string, trust: PlaceActTrust, limits: PlaceActBudget) => PlaceActBundle | undefined;
+    readonly inventory: (limits: PlaceActBudget) => {
+        readonly names: readonly string[];
+        readonly bytes: number;
+    };
+    readonly heads: (trust: PlaceActTrust, limits: PlaceActBudget) => readonly PlaceActHead[];
+    readonly publish: (identity: string, files: Readonly<Record<string, string>>) => void;
+}
+export type PlaceActReceiptSource = readonly PlaceReceipt[] | (() => Promise<readonly PlaceReceipt[]>);
+/** Shared transaction, including historical replay, current authorization and
+ * atomic publication. Signing may await; current Root and receiver heads are
+ * checked again afterwards while the same exclusion remains held. */
+export declare function transactPlaceAct(encoded: string, source: PlaceActReceiptSource, trust: PlaceActTrust, limits: PlaceActBudget, persistence: PlaceActPersistence, signal?: AbortSignal): Promise<PlaceActBundle & {
+    readonly kind: 'landed' | 'once';
+    readonly identity: string;
+}>;

package/dist/host/place-act-transaction.js

@@ -0,0 +1,78 @@
+import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
+import { requireEffects } from "./read-only.js";
+import { BoundRefusal } from "./refusals.js";
+import { ActCommitUnknown } from "./commit-result.js";
+import { assertHostNotCancelled as cancelled, receiverClock, placeRegionOf } from "./host-controls.js";
+export { ActCommitUnknown as PlaceActCommitUnknown } from "./commit-result.js";
+/** The visibility point may have happened. Only an authenticated result query
+ * or replay can resolve this; the error never asserts rollback. */
+const fail = (why) => { throw new BoundRefusal('host/act', 'REFUSE·place act ' + why); };
+const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
+/** Shared transaction, including historical replay, current authorization and
+ * atomic publication. Signing may await; current Root and receiver heads are
+ * checked again afterwards while the same exclusion remains held. */
+export async function transactPlaceAct(encoded, source, trust, limits, persistence, signal) {
+    requireEffects('place act commitment');
+    cancelled(signal);
+    if (!limits || !Number.isSafeInteger(limits.acts) || limits.acts < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1)
+        fail('missing storage budget');
+    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
+    const regions = decoded.places.map(p => placeRegionOf(p.place));
+    return persistence.exclusive(regions, async () => {
+        cancelled(signal);
+        const prior = persistence.result(id, trust, limits);
+        if (prior) {
+            if (prior.context !== encoded)
+                fail('replay bytes differ');
+            // A signing callback is never invoked for a historically authenticated replay.
+            if (typeof source !== 'function')
+                placeActReceiptsOf(encoded, source, trust.historical(encoded));
+            return { ...prior, identity: id, kind: 'once' };
+        }
+        const verified = verifyPlaceActContext(encoded, trust.contract);
+        const originals = decoded.places.map(p => p.records);
+        const capacity = (size) => {
+            const inventory = persistence.inventory(limits);
+            if (inventory.bytes + size > limits.bytes)
+                fail('publication byte budget');
+            if (inventory.names.length >= limits.acts)
+                fail('publication act budget');
+        };
+        const sizeOf = (files) => Object.values(files).reduce((n, v) => n + new TextEncoder().encode(v).length, 0);
+        capacity(sizeOf({ 'context.json': encoded, 'originals.json': JSON.stringify(originals) + '\n' }));
+        const assertCurrent = () => {
+            const current = trust.current();
+            if (rootBytes(current.root) !== rootBytes(verified.dependencies))
+                fail('authority changed before publication');
+            if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
+                fail('ambiguous receiver heads');
+            const stored = persistence.heads(trust, limits);
+            for (const p of decoded.places) {
+                const actual = stored.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
+                if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
+                    fail('receiver snapshot is not committed head ' + p.place);
+                if (selected.identity !== p.previous)
+                    fail('receiver head moved ' + p.place);
+                const next = receiverClock(selected.epoch, fail) + 1;
+                if (!Number.isSafeInteger(next) || receiverClock(p.epoch, fail) !== next)
+                    fail('receiver epoch not next ' + p.place);
+            }
+        };
+        assertCurrent();
+        cancelled(signal);
+        const receipts = structuredClone(typeof source === 'function' ? await source() : source);
+        cancelled(signal);
+        placeActReceiptsOf(encoded, receipts, trust.contract);
+        const files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
+        capacity(sizeOf(files));
+        assertCurrent();
+        cancelled(signal);
+        try {
+            persistence.publish(id, files);
+        }
+        catch (error) {
+            throw new ActCommitUnknown(id, error);
+        }
+        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
+    });
+}

package/dist/host/place-clock-selection.d.ts

@@ -0,0 +1,55 @@
+import { PLACE_ACT_CONTEXT, type ClockBudget, type TrustedClockContract } from '@lapxo/topos/core';
+import { type Signer } from '@lapxo/topos/wire';
+import { type PlaceActTrust, type PlaceActBudget, type PlaceActHead } from './ports/place-act.ts';
+export interface HostClockSelection {
+    readonly profile: typeof PLACE_ACT_CONTEXT;
+    readonly namespace: string;
+    readonly regionFamily: string;
+    readonly receiptSigner: string;
+    readonly receiptScope: string;
+    readonly digestAlgorithm: 'sha256';
+    readonly budget: ClockBudget;
+    readonly storageBudget: PlaceActBudget;
+    readonly initial: readonly {
+        place: string;
+        receiver: {
+            identity: string;
+            epoch: string;
+        };
+        origin: {
+            prefix: string;
+            epoch: string;
+        };
+    }[];
+}
+export interface HostClockInput {
+    readonly store: string;
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly history: readonly string[];
+    readonly anchor: Signer;
+    readonly algorithms: readonly string[];
+    readonly legacyOriginals: readonly string[];
+    /** Actual protected Root authority cursor: an authenticated signed Root config
+     * checkpoint, never a sibling receipt/evidence max epoch. */
+    readonly authorityCheckpoint: string;
+    /** Fixed host historical predecessor proof, never taken from a packet. */
+    readonly authenticatedReceiverHeads?: readonly PlaceActHead[];
+    readonly readCurrent: () => Pick<HostClockInput, 'history' | 'anchor' | 'algorithms' | 'legacyOriginals' | 'authorityCheckpoint'>;
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+/** Root chooses selector and anchors/resources from its authenticated standing.
+ * Selection must be ROOT signed; a world's signature grants no host capability. */
+export declare function hostClockSelection(input: HostClockInput): {
+    selection: HostClockSelection;
+    trust: PlaceActTrust;
+};

package/dist/host/place-clock-selection.js

@@ -4,7 +4,7 @@ import { createHash } from 'node:crypto';
 import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
 import { canonical, signedBytes, wireAt } from '@lapxo/topos/wire';
 import { foldClaims, isConfig, fieldOf, parsedLine as parse } from "../fold/claims.js";
-import { eraOf } from "../fold/digests.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
 import { authorityFor } from "../fold/signers.js";
 import { verifyBytes } from "./adapters/keys/ed25519.js";
 import { verifiesOwnerLine } from "../land/sign.js";

package/dist/host/ports/local-act.d.ts

@@ -0,0 +1,44 @@
+import type { PublicationStorage } from './publication.ts';
+/** Prepared and verified by the selected Topos admission/result contract. */
+export interface LocalActBundle {
+    readonly records: string;
+    readonly receipt: string;
+    readonly placements?: readonly {
+        place: string;
+        records: string;
+    }[];
+}
+export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
+export declare const actLines: (bytes: string) => readonly string[];
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Internal integrity key only, not an act identity or a wire profile. */
+export declare function committedInventoryFingerprint(rows: readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[]): string;
+/** Committed segments are part of this ledger, not a second authority source. */
+export declare function committedLocalActs(store: string): readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[];
+/** Fixed host observation only: one synchronous, coherent committed inventory.
+ * It supplies no authority, verifier or async lifetime. Each outer invocation
+ * rereads exact bodies before entering; current authorization still runs inside.
+ */
+export declare function withCommittedLocalActObservation<T>(store: string, body: () => T): T;
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage, signal?: AbortSignal): Promise<LocalActBundle & {
+    readonly kind: 'landed' | 'once';
+}>;

package/dist/host/ports/local-act.js

@@ -1,4 +1,6 @@
 import { hashText } from "../hash.js";
+import { ActCommitUnknown } from "../commit-result.js";
+import { assertHostNotCancelled } from "../host-controls.js";
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -154,19 +156,28 @@ export function localActResult(store, identity, verify) {
  * The caller must also integrate this boundary into admission-history readers;
  * this storage port alone does not activate a grammar or land authority.
  */
-export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
+export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage, signal) {
     requireEffects('local act commitment');
+    assertHostNotCancelled(signal);
     return underTheRegions(store, regions, 'land', async () => {
+        assertHostNotCancelled(signal);
         const prior = localActResult(store, identity, verify);
         if (prior)
             return { kind: 'once', ...prior };
         const bundle = await prepare();
+        assertHostNotCancelled(signal);
         if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
             throw Error('REFUSE·act prepared result does not verify');
         const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
         for (const p of bundle.placements ?? [])
             files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
-        publishBundle(atOf(store, identity), files, storage);
+        assertHostNotCancelled(signal);
+        try {
+            publishBundle(atOf(store, identity), files, storage);
+        }
+        catch (error) {
+            throw new ActCommitUnknown(identity, error);
+        }
         return { kind: 'landed', ...bundle };
     });
 }