@lapxo/bound 0.2.3 → 0.2.4

package/dist/host/ports/place-act.d.ts

@@ -0,0 +1,49 @@
+import { type TrustedClockContract, type PlaceReceipt, type RootContext } from '@lapxo/topos/core';
+import { type PlaceActPersistence } from '../place-act-transaction.ts';
+import { type PublicationStorage } from './publication.ts';
+export interface PlaceActBudget {
+    readonly acts: number;
+    readonly bytes: number;
+}
+export interface PlaceActHead {
+    readonly place: string;
+    readonly identity: string;
+    readonly epoch: string;
+}
+export interface PlaceActSnapshot {
+    readonly root: RootContext;
+    readonly heads: readonly PlaceActHead[];
+}
+/** Fixed instrument construction, never supplied by world JSON. Historical
+ * authentication permits inspection only; current() is read under Root guards. */
+export interface PlaceActTrust {
+    readonly contract: TrustedClockContract;
+    readonly initialHeads: readonly PlaceActHead[];
+    readonly current: () => PlaceActSnapshot;
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+export interface PlaceActBundle {
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly originals: readonly (readonly string[])[];
+}
+/** Historical result reads never produce a current authorization permit. */
+export declare function placeActResult(store: string, id: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): PlaceActBundle | undefined;
+/** Each receiver chain advances independently. Initial heads are explicit,
+ * authenticated host inputs, not inferred zero or legacy global epochs. */
+export declare function placeActHeads(store: string, initial: readonly PlaceActHead[], trust: Pick<PlaceActTrust, 'historical' | 'contract'>, limits: PlaceActBudget): readonly PlaceActHead[];
+/** Context, exact original bytes and complete signed receipts have one visibility
+ * point. Real Root guard exclusion spans final authority/head comparison and
+ * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+export declare function nativePlaceActPersistence(store: string, storage?: PublicationStorage): PlaceActPersistence;
+export declare function commitPlaceAct(store: string, encoded: string, receipts: readonly PlaceReceipt[], trust: PlaceActTrust, limits: PlaceActBudget, storage?: PublicationStorage): Promise<PlaceActBundle & {
+    readonly kind: "landed" | "once";
+    readonly identity: string;
+}>;
+/** Enumerates only committed, historically authenticated carriers. Namespace
+ * projection is a caller's separate pure operation, never current permission. */
+export declare function committedPlaceActResults(store: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): readonly {
+    identity: string;
+    bundle: PlaceActBundle;
+}[];

package/dist/host/ports/place-act.js

@@ -1,13 +1,12 @@
 import { existsSync, readdirSync, statSync, openSync, fstatSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
-import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
+import { readPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
+import { transactPlaceAct } from "../place-act-transaction.js";
+import { canonicalActStore, underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
 import { requireEffects } from "../read-only.js";
+import { receiverClock } from "../host-controls.js";
 import { publishBundle, nativePublicationStorage } from "./publication.js";
 const fail = (why) => { throw Error('REFUSE·place act ' + why); };
-const clock = (n) => { if (!/^(0|[1-9][0-9]*)$/.test(n) || !Number.isSafeInteger(Number(n)))
-    fail('unknown receiver clock'); return Number(n); };
-const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
 const budget = (b) => { if (!b || !Number.isSafeInteger(b.acts) || b.acts < 1 || !Number.isSafeInteger(b.bytes) || b.bytes < 1)
     fail('missing storage budget'); };
 const base = (store) => join(store, 'ledger', 'place-acts');
@@ -86,7 +85,7 @@ export function placeActHeads(store, initial, trust, limits) {
     budget(limits);
     if (!initial.length || new Set(initial.map(h => h.place)).size !== initial.length)
         fail('missing/ambiguous initial heads');
-    const heads = new Map(initial.map(h => { clock(h.epoch); if (!h.identity)
+    const heads = new Map(initial.map(h => { receiverClock(h.epoch, fail); if (!h.identity)
         fail('missing initial head'); return [h.place, { ...h }]; }));
     if (!existsSync(base(store)))
         return [...heads.values()];
@@ -100,8 +99,8 @@ export function placeActHeads(store, initial, trust, limits) {
         const act = pending.splice(next, 1)[0];
         for (const p of act.context.places) {
             const prior = heads.get(p.place);
-            const epoch = clock(prior.epoch) + 1;
-            if (!Number.isSafeInteger(epoch) || clock(p.epoch) !== epoch)
+            const epoch = receiverClock(prior.epoch, fail) + 1;
+            if (!Number.isSafeInteger(epoch) || receiverClock(p.epoch, fail) !== epoch)
                 fail('receiver chain clock mismatch');
             heads.set(p.place, { place: p.place, identity: act.id, epoch: p.epoch });
         }
@@ -111,54 +110,20 @@ export function placeActHeads(store, initial, trust, limits) {
 /** Context, exact original bytes and complete signed receipts have one visibility
  * point. Real Root guard exclusion spans final authority/head comparison and
  * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+export function nativePlaceActPersistence(store, storage = nativePublicationStorage) {
+    store = canonicalActStore(store);
+    return {
+        exclusive: (regions, run) => { const enter = regions.includes('') ? underTheRegions : underAuthorityRegions; return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', run)); },
+        result: (identity, trust, limits) => placeActResult(store, identity, trust, limits),
+        inventory: limits => storedInventory(store, limits),
+        heads: (trust, limits) => placeActHeads(store, trust.initialHeads, trust, limits),
+        publish: (identity, files) => publishBundle(at(store, identity), files, storage),
+    };
+}
 export async function commitPlaceAct(store, encoded, receipts, trust, limits, storage = nativePublicationStorage) {
     requireEffects('place act commitment');
-    budget(limits);
-    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
-    const regions = decoded.places.map(p => { if (p.place === '.')
-        return ''; const parts = p.place.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
-        fail('unknown place namespace'); return parts.join('/'); });
-    const enter = regions.includes('') ? underTheRegions : underAuthorityRegions;
-    return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', () => {
-        const prior = placeActResult(store, id, trust, limits);
-        if (prior) {
-            if (prior.context !== encoded)
-                fail('replay bytes differ');
-            // Replay authenticates the supplied evidence too. Historical authentication
-            // grants no current authority and leaves the committed result unchanged.
-            placeActReceiptsOf(encoded, receipts, trust.historical(encoded));
-            return { ...prior, identity: id, kind: 'once' };
-        }
-        const verified = verifyPlaceActContext(encoded, trust.contract);
-        placeActReceiptsOf(encoded, receipts, trust.contract);
-        const originals = decoded.places.map(p => p.records), files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
-        const inventory = storedInventory(store, limits);
-        if (inventory.bytes + Object.values(files).reduce((n, v) => n + Buffer.byteLength(v), 0) > limits.bytes)
-            fail('publication byte budget');
-        if (inventory.names.length >= limits.acts)
-            fail('publication act budget');
-        const current = trust.current();
-        if (rootBytes(current.root) !== rootBytes(verified.dependencies))
-            fail('authority changed before publication');
-        if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
-            fail('ambiguous receiver heads');
-        const storedHeads = placeActHeads(store, trust.initialHeads, trust, limits);
-        for (const p of decoded.places) {
-            const actual = storedHeads.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
-            if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
-                fail('receiver snapshot is not committed head ' + p.place);
-        }
-        for (const p of decoded.places) {
-            const head = current.heads.find(h => h.place === p.place) ?? fail('missing receiver head ' + p.place);
-            if (head.identity !== p.previous)
-                fail('receiver head moved ' + p.place);
-            const next = clock(head.epoch) + 1;
-            if (!Number.isSafeInteger(next) || clock(p.epoch) !== next)
-                fail('receiver epoch not next ' + p.place);
-        }
-        publishBundle(at(store, id), files, storage);
-        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
-    }));
+    return transactPlaceAct(encoded, receipts, trust, limits, nativePlaceActPersistence(store, storage));
 }
 /** Enumerates only committed, historically authenticated carriers. Namespace
  * projection is a caller's separate pure operation, never current permission. */

package/dist/host/ports/publication.d.ts

@@ -0,0 +1,10 @@
+export interface PublicationStorage {
+    publish(staged: string, committed: string): void;
+}
+export declare const nativePublicationStorage: PublicationStorage;
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;

package/dist/host/root-clock-source.d.ts

@@ -0,0 +1,86 @@
+import { type PlaceReceipt, type ClockBudget } from '@lapxo/topos/core';
+import type { PlaceActBudget } from './ports/place-act.ts';
+export interface RootClockSourceSelection {
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly bootstrapCheckpoint: {
+        scope: string;
+        measure: string;
+    };
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+}
+export declare function rootClockSource(root: string, selected: RootClockSourceSelection): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+/** Source mapping is an explicit Root declaration; absence never means a zero
+ * clock or an inferred cursor. Existing legacy callers do not request it. */
+export declare function rootClockSelectionOf(live: readonly string[], anchor: import('@lapxo/topos/wire').Signer): RootClockSourceSelection;
+export declare function declaredRootClockSource(root: string): {
+    observation: Readonly<{
+        history: readonly string[];
+        anchor: import("@lapxo/topos/wire").Signer;
+        algorithms: readonly string[];
+    }>;
+    resources: Readonly<{
+        bytes: number;
+        lines: number;
+        places: number;
+        acts: number;
+    }>;
+    authority: (encoded: string) => {
+        anchor: import("@lapxo/topos/wire").Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: import("./ports/place-act.ts").PlaceActTrust;
+};
+export declare function hasRootClockSource(root: string): boolean;
+export interface PortablePlaceContext {
+    readonly identity: string;
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly authority: {
+        anchor: import('@lapxo/topos/wire').Signer;
+        history: readonly string[];
+        checkpoint: string;
+    };
+}
+/** Historical inspection ONLY. The expected acting Root anchor and resource
+ * selection come from the consumer's selected place, never from this packet.
+ * This function returns data and cannot construct a current command permit. */
+export declare function inspectPortablePlaceContexts(encoded: string, expectedAnchor: import('@lapxo/topos/wire').Signer, selected: RootClockSourceSelection): {
+    identity: string;
+    context: import("@lapxo/topos/core").PlaceAct;
+}[];
+/** Prospective configuration is checked as authenticated Root history, never
+ * against a prose birth condition. Initial heads are explicit typed selections;
+ * stored committed chains cannot disappear when a selection is activated or
+ * replaced. Preview reads only; the real admission repeats under its Root lock. */
+export declare function assertProspectiveRootClockSelection(root: string, signed: readonly string[]): void;

package/dist/host/root-clock-source.js

@@ -6,7 +6,7 @@ import { committedLocalActs, actLines } from "./ports/local-act.js";
 import { verifiedLegacyActResult } from "../cli/act-result.js";
 import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
 import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
 import { fieldOf, foldClaims, isConfig, selfName } from "../fold/claims.js";
 import { authenticatedRootStanding } from "./admitted-place.js";
 import { verifiesOwnerLine } from "../land/sign.js";
@@ -158,11 +158,11 @@ export function rootClockSource(root, selected) {
 }
 /** Source mapping is an explicit Root declaration; absence never means a zero
  * clock or an inferred cursor. Existing legacy callers do not request it. */
-export function declaredRootClockSource(root) {
-    const live = authenticatedRootStanding(root), rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
+export function rootClockSelectionOf(live, anchor) {
+    const rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
     if (rows.length !== 1)
         fail('requires one admitted source mapping');
-    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live).admitted;
+    const line = rows[0], algorithms = eraOf(live).admitted;
     if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
         fail('mapping is not Root signed');
     const about = fieldOf(line, 'about');
@@ -175,8 +175,10 @@ export function declaredRootClockSource(root) {
     }
     if (!value || Object.keys(value).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || value.profile !== 'place-act-context@1' || JSON.stringify(value) !== about)
         fail('unknown/noncanonical mapping');
-    return rootClockSource(root, value);
+    sourceSelection(value);
+    return value;
 }
+export function declaredRootClockSource(root) { return rootClockSource(root, rootClockSelectionOf(authenticatedRootStanding(root), admissionAnchor(root))); }
 export function hasRootClockSource(root) { return authenticatedRootStanding(root).some(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw'); }
 /** Historical inspection ONLY. The expected acting Root anchor and resource
  * selection come from the consumer's selected place, never from this packet.

package/dist/host/signature-era.js

@@ -0,0 +1,12 @@
+import { wireLine } from "../fold/wire.js";
+import { fieldOf } from "../fold/claims.js";
+/** Pure signature vocabulary; no instrument discovery for diagnostics. */
+export function signatureEraOf(standing) {
+    const said = wireLine(standing, 'signature-algorithms');
+    const admitted = (said === undefined ? [] : fieldOf(said, 'value').split('|')).filter(Boolean);
+    const current = wireLine(standing, 'era');
+    const era = (current === undefined ? undefined : admitted.find((one) => one.endsWith(`:${fieldOf(current, 'value')}`))) ?? admitted.find((one) => one.includes(':'));
+    if (era === undefined)
+        throw new Error(`REFUSE·runtime the lock names no signature algorithm by digest: nothing can be signed here`);
+    return { admitted, era };
+}

package/dist/host/signing.js

@@ -40,7 +40,7 @@ export function signerFor(lines, keyId, selected, keyFile, injected) {
     if (injected) {
         if (injected.name !== declaration.name || keyFile)
             throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
-        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes });
+        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes }, injected.signal);
     }
     const mechanism = binding(declaration.name, keyFile);
     const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };

package/dist/host/source-content.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "./call-context.js";
 import { transportBytes } from "./ports/transport.js";
 import { contentStore, verifiedContent } from "./content-store.js";
 import { ContentNeeded } from "./content-needed.js";
@@ -91,7 +92,7 @@ export async function resolveSources(standing, requested) {
         fetch: async (url, digest) => transportBytes(url, digest, [...ownLock(), ...standing]),
     }, requested);
     for (const digest of received)
-        process.stdout.write(`FETCHED  ${digest} · verified\n`);
+        hostOutput('out', `FETCHED  ${digest} · verified\n`);
 }
 /** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
 export async function resolveRequested(resolve, fold) {

package/dist/host/standing-carrier.js

@@ -0,0 +1,18 @@
+import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
+import { foldClaims, fieldOf } from "../fold/claims.js";
+/** Projection only, after the caller authenticates the complete carrier. The
+ * CLI and in-process reader use this same fold and output shape. */
+export function projectContextualStanding(root, legacy, contexts, decoded) {
+    const groups = new Map();
+    for (const act of contexts) {
+        const context = decoded.find(one => one.identity === act.identity).context;
+        for (const p of context.places) {
+            const key = JSON.stringify([context.root.namespace, p.place]), group = groups.get(key) ?? { namespace: context.root.namespace, place: p.place, lines: [], contexts: [] };
+            group.lines.push(...p.records);
+            group.contexts.push({ identity: act.identity, context: act.context, receipts: act.receipts });
+            groups.set(key, group);
+        }
+    }
+    const legacyPlaces = legacy.map(place => ({ namespace: 'legacy-global', place: place.place, standing: foldClaims(place.history).standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history: place.history }));
+    return { profile: PLACE_ACT_CONTEXT, root, legacyPlaces, contexts, places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+}

package/dist/host/standing-projection.js

@@ -0,0 +1,50 @@
+import { viewsOf } from "../fold/views.js";
+import { BoundRefusal } from "./refusals.js";
+import { authorityFor } from "../fold/signers.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
+import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
+import { foldedEvidence } from '@lapxo/topos/contract';
+/** Project the supplied signed history against the host's original trust anchor.
+ * No current-root selection, storage access, effects or retained authority.
+ * The file host and the in-process host use this same admission-snapshot fold. */
+export function projectAuthenticatedStanding(history, anchor) {
+    const snapshots = new Map();
+    const admitted = history.filter(line => {
+        const epoch = Number(fieldOf(line, 'epoch')) || 0;
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            // This invocation has freshly read the complete signed inventory. Derive
+            // the same historical cutoff without reopening it for every epoch; the
+            // next invocation still rereads every authority input.
+            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
+            // The signature vocabulary is configuration, not the as-yet
+            // unauthenticated evidence whose values are about to be folded.
+            const wire = snapshot.filter(record => {
+                const scope = fieldOf(record, 'scope');
+                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
+            });
+            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        return authority.of(line).kind === 'admitted';
+    });
+    // The host authenticates against historical authority; Topos projects the
+    // authenticated history using the instrument's existing fold.
+    const { standing } = foldedEvidence(admitted, {
+        classification: () => 'local',
+        fold: lines => foldClaims(lines).standing,
+    });
+    return [...standing];
+}
+/** One check shared by the CLI and the read-only native host. */
+export function assertStandingView(lines) {
+    const view = viewsOf(lines).get('standing');
+    if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
+        throw new BoundRefusal('standing/view', 'REFUSE·view standing requires a declared standing view');
+}
+export function publicStandingProjection(history, anchor) {
+    return publishedStandingLines(projectAuthenticatedStanding(history, anchor));
+}
+export function publishedStandingLines(standing) {
+    return standing.filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+}

package/dist/land/act.js

@@ -1,9 +1,32 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
-import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync } from "../host/io.js";
+import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync, realpathSync, resolve } from "../host/io.js";
+import { BoundRefusal } from "../host/refusals.js";
 import { selfName } from "../fold/claims.js";
 import { placesIn } from "../fold/places.js";
 import { coordinatesUnder, observeText } from "../observe/files.js";
+const hostContext = new AsyncLocalStorage();
+export const withActHost = (host, run) => hostContext.run(host, run);
+const actName = () => hostContext.getStore()?.name ?? selfName();
+const report = (text) => { const host = hostContext.getStore(); if (host)
+    host.report(text);
+else
+    process.stderr.write(text); };
+const checkCancellation = () => { if (hostContext.getStore()?.signal?.aborted)
+    throw new BoundRefusal('host/cancelled', 'REFUSE·host/cancelled'); };
+/** Resolve aliases before acquiring the same native lock protocol as the CLI. */
+export function canonicalActStore(store) {
+    let at = resolve(store);
+    const tail = [];
+    while (!existsSync(at)) {
+        const parent = dirname(at);
+        if (parent === at)
+            break;
+        tail.unshift(basename(at));
+        at = parent;
+    }
+    return join(realpathSync(at), ...tail);
+}
 const context = new AsyncLocalStorage();
 const held = new Map();
 const pauseFor = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
@@ -20,8 +43,8 @@ function overAMinute(at, began, holder) {
     if (Date.now() - began < MINUTE)
         return;
     const who = holder === undefined ? 'a process' : `${holder.pid} · ${holder.what} since ${holder.since}`;
-    process.stderr.write(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
-    throw new Error(`${selfName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
+    report(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
+    throw new Error(`${actName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
 }
 const alive = (pid) => {
     if (!Number.isSafeInteger(pid) || pid <= 0)
@@ -37,7 +60,7 @@ const alive = (pid) => {
 const regionAt = (store, region) => {
     const coordinate = region.replace(/\/+$/, '');
     if ((coordinate && coordinate.split('/').some((step) => step === '..' || step === '.' || step === '')) || coordinate.startsWith('/'))
-        throw new Error(`${selfName()}: REFUSE·lock invalid region coordinate`);
+        throw new Error(`${actName()}: REFUSE·lock invalid region coordinate`);
     return join(store, 'locks', coordinate ? encodeURIComponent(coordinate).replace(/^\./, '%2E').replace(/^_root$/, '%5Froot') : ROOT);
 };
 const coordinateOf = (file) => {
@@ -77,12 +100,13 @@ async function hold(at, what) {
         return;
     const frame = context.getStore();
     if (frame === undefined)
-        throw new Error(`${selfName()}: REFUSE·lock no act owns this request`);
+        throw new Error(`${actName()}: REFUSE·lock no act owns this request`);
     const began = Date.now();
     const token = randomUUID();
     let told = false;
     mkdirSync(dirname(at), { recursive: true });
     for (;;) {
+        checkCancellation();
         try {
             writeFileSync(at, `${process.pid} ${what.replace(/\s+/g, '_')} ${new Date().toISOString()} ${token}\n`, { flag: 'wx' });
             break;
@@ -97,17 +121,17 @@ async function hold(at, what) {
         const holder = holderOf(at);
         // Removing a dead owner's lock here would race with another process's recovery. Recovery is a separate host act.
         if (holder !== undefined && !alive(holder.pid)) {
-            throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+            throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
         }
         overAMinute(at, began, holder);
         if (!told && holder !== undefined) {
-            process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+            report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
             told = true;
         }
         await pauseFor(250);
     }
     if (told)
-        process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
+        report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
     held.set(at, token);
     frame.locks.set(at, token);
     if (!process.listeners('exit').includes(releaseAll))
@@ -125,16 +149,17 @@ function releaseAll() {
     for (const [at, token] of [...held])
         release(at, token);
 }
-process.once('SIGTERM', () => {
-    process.stderr.write(`${selfName()}: REFUSE·crash signal\n`);
-    releaseAll();
-    process.exit(1);
-});
+/** Only the CLI installs process termination behavior. Importing a host does not. */
+export function installActSignalHandler() {
+    process.once('SIGTERM', () => { report(`${actName()}: REFUSE·crash signal\n`); releaseAll(); process.exit(1); });
+}
 async function framed(takes, act) {
     const frame = { parent: context.getStore(), locks: new Map() };
     return context.run(frame, async () => {
         try {
+            checkCancellation();
             await takes();
+            checkCancellation();
             return await act();
         }
         finally {
@@ -149,14 +174,14 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
         const tree = treeAt(store);
         const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
         if (rootAuthority && (asked.includes('') || (ownsRegion(store) && !owns(tree) && !ownsAuthority(store))))
-            throw new Error(`${selfName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
+            throw new Error(`${actName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
         if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
             for (const region of asked)
                 await hold(regionAt(store, region), what);
             return;
         }
         if (ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock declare every region before entering an act`);
+            throw new Error(`${actName()}: REFUSE·lock declare every region before entering an act`);
         const already = owns(tree);
         // The tree lock is the acquisition gate. A whole-tree act cannot enter between checking it and taking regions.
         await hold(tree, what);
@@ -172,17 +197,18 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
                 const began = Date.now();
                 let told = false;
                 for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
+                    checkCancellation();
                     if (!alive(holder.pid))
-                        throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
+                        throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
                     overAMinute(at, began, holder);
                     if (!told) {
-                        process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+                        report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
                         told = true;
                     }
                     await pauseFor(250);
                 }
                 if (told)
-                    process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
+                    report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
             }
             // Registered under the same acquisition gate as every legacy writer.
             // Root writes overlap all locks; siblings keep distinct region locks.
@@ -207,12 +233,14 @@ function guardedRegions(store, regions, what, act, rootAuthority) {
     }, act);
 }
 export function underTheRegions(store, regions, what, act) {
+    store = canonicalActStore(store);
     return guardedRegions(store, regions, what, act, false);
 }
 /** Protect the root authority/policy read through child publication. This is
  * exclusion only: callers must authenticate contexts and compare prepared heads
  * while held. It creates no grant, clock advance, lease or automatic recovery. */
 export function underAuthorityRegions(store, regions, what, act) {
+    store = canonicalActStore(store);
     return guardedRegions(store, regions, what, act, true);
 }
 /** Protect an authority snapshot without taking a child region. The acquisition
@@ -220,12 +248,13 @@ export function underAuthorityRegions(store, regions, what, act) {
  * shared read; existing child acts continue independently. This is exclusion,
  * never authorization or a clock advance. */
 export function underRootAuthority(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         const tree = treeAt(store), root = regionAt(store, '');
         if (owns(tree) || owns(root) || ownsAuthority(store))
             return;
         if (ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
+            throw new Error(`${actName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
         await hold(tree, what);
         try {
             await hold(root, what);
@@ -246,49 +275,54 @@ export function underRootAuthority(store, what, act) {
 /** The fixed host may hand its child evidence of an actual held exclusion.
  * It is an operational envelope, not a grant, signer or receipt identity. */
 export function rootAuthorityProtection(store) {
+    store = canonicalActStore(store);
     const locks = [treeAt(store), regionAt(store, ''), ...held.keys()].filter(at => at === treeAt(store) || at === regionAt(store, '') || dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-'));
     const lock = locks.find(owns);
     if (lock === undefined)
-        throw Error(`${selfName()}: REFUSE·lock root authority is not protected`);
+        throw Error(`${actName()}: REFUSE·lock root authority is not protected`);
     const holder = holderOf(lock);
     if (holder?.pid !== process.pid || holder.token !== held.get(lock))
-        throw Error(`${selfName()}: REFUSE·lock authority protection changed`);
+        throw Error(`${actName()}: REFUSE·lock authority protection changed`);
     return Object.freeze({ store, lock, pid: holder.pid, token: holder.token });
 }
 /** expectedStore and expectedParent come from the fixed host's inheritance
  * channel, never from world data. Matching a live lock proves exclusion only;
  * signature, coverage and current context still require verification. */
 export function assertRootAuthorityProtection(proof, expectedStore, expectedParent) {
+    expectedStore = canonicalActStore(expectedStore);
     if (!proof || proof.store !== expectedStore || !Number.isSafeInteger(expectedParent) || expectedParent <= 0 || proof.pid !== expectedParent
         || typeof proof.lock !== 'string' || typeof proof.token !== 'string' || !proof.token
         || !(proof.lock === treeAt(expectedStore) || proof.lock === regionAt(expectedStore, '')
             || dirname(proof.lock) === join(expectedStore, 'locks') && basename(proof.lock).startsWith('@authority-'))) {
-        throw Error(`${selfName()}: REFUSE·lock invalid inherited authority protection`);
+        throw Error(`${actName()}: REFUSE·lock invalid inherited authority protection`);
     }
     const holder = holderOf(proof.lock);
     if (!alive(expectedParent) || holder?.pid !== proof.pid || holder.token !== proof.token)
-        throw Error(`${selfName()}: REFUSE·lock inherited authority protection ended`);
+        throw Error(`${actName()}: REFUSE·lock inherited authority protection ended`);
 }
 /** A child can publish independently, but the joined root projection and its
  * derived ledger appends have one writer. Authority protection already excludes
  * root mutations, so this lock needs no acquisition-gate upgrade. */
 export function underRootProjection(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         if (owns(treeAt(store)) || owns(regionAt(store, '')))
             return;
         if (!ownsAuthority(store))
-            throw new Error(`${selfName()}: REFUSE·lock root projection requires authority protection`);
+            throw new Error(`${actName()}: REFUSE·lock root projection requires authority protection`);
         await hold(projectionAt(store), what);
     }, act);
 }
 export const holdRoot = async (store, what) => {
+    store = canonicalActStore(store);
     if (!owns(treeAt(store)))
         await hold(regionAt(store, ''), what);
 };
 export function underTheLock(store, what, act) {
+    store = canonicalActStore(store);
     return framed(async () => {
         if (!owns(treeAt(store)) && ownsRegion(store))
-            throw new Error(`${selfName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
+            throw new Error(`${actName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
         await hold(treeAt(store), what);
         const locks = join(store, 'locks');
         const active = lockFiles(locks);
@@ -299,4 +333,4 @@ export function underTheLock(store, what, act) {
         await hold(regionAt(store, ''), what);
     }, act);
 }
-export const holds = (store, region) => [treeAt(store), regionAt(store, region)].some(owns);
+export const holds = (store, region) => { store = canonicalActStore(store); return [treeAt(store), regionAt(store, region)].some(owns); };