@lapxo/bound 0.2.3 → 0.2.5

package/docs/contracts/native-publication.inventory.json

@@ -9,6 +9,8 @@
     "contract/published/standing",
     "contract/published/refusals",
     "contract/published/host-ports",
-    "contract/published/readme"
+    "contract/published/readme",
+    "contract/published/native-host",
+    "contract/published/reading-identity"
   ]
 }

package/docs/contracts/optional-wasm-adapter.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/engine.md",
-      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+      "digest": "sha256:7097713afcfb5859850d96b66aced8ea6ea09f738b34f79a87bb77938fa1c6e6"
     },
     {
       "role": "yes",

package/docs/contracts/publication.inventory.json

@@ -0,0 +1,29 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published",
+  "surface": [
+    "contract/published/attest-evidence-view",
+    "contract/published/cli/fold",
+    "contract/published/cli/land",
+    "contract/published/cli/sign",
+    "contract/published/pipeline/archive",
+    "contract/published/typed-object-sample",
+    "contract/published/view/card",
+    "contract/published/view/citation-file",
+    "contract/published/view/explanation",
+    "contract/published/view/guide",
+    "contract/published/view/help",
+    "contract/published/view/lines",
+    "contract/published/view/manifest-render",
+    "contract/published/view/programs",
+    "contract/published/view/readme-historical",
+    "contract/published/view/receipts",
+    "contract/published/view/reference",
+    "contract/published/view/release-workflow-render",
+    "contract/published/view/tsconfig",
+    "contract/published/view/usage-profile",
+    "contract/published/view/walk",
+    "contract/published/view/why"
+  ],
+  "note": "Explicit public-surface inventory. A selected coordinate without a descriptor is unpaid. Outstanding capability demands are not advertised implementations."
+}

package/docs/contracts/reading-identity.md

@@ -0,0 +1,37 @@
+# Public reading identity
+
+`prepareNativeReadingIdentity` from `@lapxo/bound/host` prepares the adopted input-projection readings of an authenticated place. `fold --as reading-identity` calls that same operation. This contract covers adopted input-projection readings; other reading forms refuse.
+
+The receiver supplies the place, explicit native instrument, optional adopted reader selector, finite resource limits and cancellation signal. The place must declare one interval `0..N` for each of `reading-identity/bytes`, `/files`, `/readings` and `/probes`. Caller limits can reduce these bounds. They count handed UTF-8 input bytes, handed files, projected reading plans and input-projection requests across the selected readers; native image, response and execution limits also remain in force. The projection request is a probe, even when its implementation reuses a valid result. It is separate from final reading execution.
+
+A fact contains preparations with ready reading identities or named unpaid receipt dependencies. Each ready entry gives its scope, canonical `reading-context@1` and digest. When a verified existing carrier is available it also gives the `reading-receipt@1` digest. A missing physical input produces `needs`; a dependent reading without its predecessor's verified receipt stays open. No complete digest is invented for an unpaid dependency. These names are supplied by the selected world's projection; application region names are not built into Bound.
+
+Preparation uses the same projection, dependency order, contextual framing, transitive instrument inputs, policy, effective environment and carrier verification as execution. It can run the declared input projection under its native port. It never runs the final reading, signs, admits an act, renders public receipts or renews a reading receipt. Operational image/cache maintenance is separate. A subsequent execution under identical inputs and context commits the same identity; preparation does not reserve that identity or authorize a future answer.
+
+Instrument, implementation, policy, transitive inputs and the actual environment participate under the existing Topos contracts. Current-answer authorization also retains the existing principal, grant, snapshot and freshness checks when that profile is selected. Retained evidence grants no current authority. Environment values are committed by digest, not exposed as secret strings. Receipt identity and typed-content identity remain distinct.
+
+Relevant input or dependency changes produce another identity. Unconsumed maintenance does not. Bytes stored under a digest must verify; altered selected bytes or carriers refuse rather than becoming an alternative identity. The existing execution path may recompute an invalid retained answer; public inspection refuses a corrupt carrier. Missing bytes and failed integrity are different outcomes.
+
+Refusals are typed data from the public API: `reading-identity/context`, `/budget`, `/selection`, `/projection`, `/integrity`, `/failed`, and the existing `host/context`, `/budget`, `/cancelled`. A non-projection reader is unsupported, not silently executed. Cancellation and handed-input budgets are checked before the projection; native process budgets remain authoritative during execution. Synchronous projection cannot observe a JavaScript abort callback while it occupies the host thread; its declared native timeout still bounds that work.
+
+## Quartet
+
+The native test forms two unrelated disposable admitted places, counts and catalogue. Counts reads a physical file. Catalogue adds a dependent aggregate. Both use receiver-selected native images and the real CLI; a separate consumer imports the compiled public `/host` export. Preparation leaves final reading receipts absent; execution commits the same identity; subsequent preparation verifies existing receipts without changing the public receipt file. Catalogue's aggregate is open until the leaf receipt exists.
+
+The negative places retain a receipt but withdraw the current native grant, and alter the archive bytes under their selected digest. Both refuse. Focused vectors also cover missing physical input, changed dependency, stale handed bytes, cancellation, resource exhaustion and unrelated maintenance. Existing environment, authority and descendant-receipt vectors remain applicable and are reused.
+
+Two places on this Mac do not establish another-machine portability. L6 stays pending. This quartet neither admits Root's new reader bindings nor certifies the full 0.2.5 release.
+
+## Native lines and evidence
+
+`prepareNativeViewIdentity({place, instrument, view, expectedIdentity?})` from `@lapxo/bound/host` prepares the local native `lines` or `evidence` projection. `fold --as reading-identity@lines` and `fold --as reading-identity@evidence` print its identity without the result text. `fold --as reading-identity@lines@<digest>` (or `reading-identity@evidence@<digest>`) returns JSON with `kind`, `view`, `identity` and `text`. The text and identity use the same captured inputs; an obsolete expected identity returns no result. Ordinary views keep their existing output and require no reading-identity budgets.
+
+This operation performs configuration authentication and projection, not the region fold, executable readings or source resolution. It takes no Root exclusion and performs no persistent writes. One synchronous committed-journal observation fixes native acts; selected legacy sources are captured by exact bytes and checked again. Changed committed inputs, selected bytes, effective environment or expiration day refuse rather than publishing a mixed result. No lease reserves a later answer: the caller supplies the expected identity when requesting the result.
+
+Identity commits the native view, local place, authenticated configuration, selected authority/evidence histories and source bytes (including selected receipt inputs), exact implementation closure and instrument lock, effective runtime/environment, and UTC expiration-policy day. Input names and values are framed; no consumer directory fingerprint is accepted. Unconsumed fold caches, stamp memos and exclusion bookkeeping do not participate. The local execution identity is distinct from portable semantic standing identity.
+
+The existing admitted preparation limits remain required for identity requests; inputs and implementation sources count against their byte/file budgets. Preparation does not execute projection probes or final readings. Only unqualified local native lines and a single unshaped native evidence view are supported. Foreign evidence needing an asynchronous transport snapshot and unsupported views refuse by name. No fallback executes their fold.
+
+Existing catalog codes apply: `reading-identity/selection` for unsupported selections, `reading-identity/context` for changed or mismatched snapshots, `reading-identity/budget` for missing/exhausted limits, and `reading-identity/failed` for unavailable implementation inputs. Public CLI machine records carry those codes.
+
+Seven native vectors cover repeated identity, added evidence, changed configuration, unchanged fold maintenance, distinct places, unsupported selections and identity-to-result binding with a stale refusal. Both unrelated places also answer while a Root writer holds exclusion; complete store comparison verifies no writes. Existing view/landing behavior without identity budgets is retained. These vectors do not establish L6.

package/docs/contracts/reading-identity.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/reading-identity",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reading-identity.md",
+      "digest": "sha256:0db77ff0553ea92ed4f47f587f1a026a59279c3a4abb00a662eefd5952e6de1c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/reading-identity/yes.json",
+      "digest": "sha256:5b40b3546e99bf7c646a15fc04241400199b6130b5ff35c142d70a4f68bf12fb"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/reading-identity.vector.json",
+      "digest": "sha256:42bac03e64bd525398e9843cb8e8a256c46041a0c22e0d6774f523b1b283cb9d"
+    },
+    {
+      "role": "no",
+      "path": "samples/reading-identity/no.json",
+      "digest": "sha256:77b63c1eb80a98e66d38cf357698166b178ae1d344939ec2bcaf74e5a2fd96c4"
+    }
+  ]
+}

package/docs/contracts/refusals.bound

@@ -92,3 +92,54 @@ bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=next rol
 bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=code role=writes scope=refusal/host-port/response value=host-port/response
 bound-lock/1 about="A host response has an unsupported shape or shared mutable bytes." at=policy:bound-host-ports by=target form=alphabet measure=class role=writes scope=refusal/host-port/response value=host
 bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=next role=writes scope=refusal/host-port/response value=inspect-host-port
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/context value=reading-identity/context
+bound-lock/1 about="The reading lacks its complete declared execution context." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/context value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/context value=inspect-reading-context
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/budget value=reading-identity/budget
+bound-lock/1 about="The place lacks one finite declared preparation limit." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/budget value=resource
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/budget value=inspect-resource-lines
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/selection value=reading-identity/selection
+bound-lock/1 about="The requested reader is not adopted by this place." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/selection value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/selection value=inspect-reader-selection
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/projection value=reading-identity/projection
+bound-lock/1 about="The adopted reader has no supported input projection." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/projection value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/projection value=declare-input-projection
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/integrity value=reading-identity/integrity
+bound-lock/1 about="Current input or retained carrier bytes differ from their committed bytes." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/integrity value=input
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/integrity value=resolve-verified-bytes
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/failed value=reading-identity/failed
+bound-lock/1 about="The existing native preparation boundary refused; the diagnostic retains its cause." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/failed value=operation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/failed value=inspect-native-diagnostic
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/engine/input value=engine/input
+bound-lock/1 about="The object byte request is not a supported canonical profile." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/engine/input value=input
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/engine/input value=inspect-request
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/engine/context value=engine/context
+bound-lock/1 about="The receiver-selected context does not admit the requested object history." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/engine/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/engine/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/context value=computation/context
+bound-lock/1 about="The question, implementation, policy, input or result does not match the receiver-selected computation context." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/budget value=computation/budget
+bound-lock/1 about="The computation lacks or exceeds its declared byte or execution budget." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/budget value=resource
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/budget value=inspect-resource-lines
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/signature value=computation/signature
+bound-lock/1 about="The computation signature does not verify with the receiver-selected signer." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/signature value=authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/signature value=inspect-signer
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/authority value=computation/authority
+bound-lock/1 about="The selected computation signer is absent, retired or outside coverage." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/authority value=authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/authority value=inspect-authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/context value=conformance/context
+bound-lock/1 about="The receiver supplied missing or invalid suite, implementation or contract identities." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/budget value=conformance/budget
+bound-lock/1 about="The suite exceeds its declared byte or case budget." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/budget value=resource
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/budget value=inspect-resource-lines
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/coverage value=conformance/coverage
+bound-lock/1 about="The suite omits a required rule or refusal, or names undeclared coverage." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/coverage value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/coverage value=complete-suite
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/integrity value=conformance/integrity
+bound-lock/1 about="The supplied suite bytes do not match the digest chosen by the receiver." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/integrity value=integrity
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/integrity value=verify-suite-bytes
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/suite value=conformance/suite
+bound-lock/1 about="The suite is malformed, empty, duplicated or uses an unsupported byte profile." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/suite value=input
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/suite value=inspect-suite

package/docs/contracts/refusals.md

@@ -37,11 +37,26 @@ Source of truth: `refusals.bound` (`bound-refusals@1`), read through the existin
 | host-port/failed | host | A declared host callback failed; no successful result is returned. | inspect-host-port |
 | host-port/integrity | integrity | Content bytes differ from the requested SHA-256 identity. | resolve-exact-bytes |
 | host-port/response | host | A host response has an unsupported shape or shared mutable bytes. | inspect-host-port |
-
-Native quartet: `refusals.publication.json`. `vectors/native/refusals.vector.json` checks the wire catalog, its derived page, duplicate/missing records, and real export/inspection refusals in two places. No failed operation becomes a successful receipt. The captured semantic marker is:
+| reading-identity/context | interpretation | The reading lacks its complete declared execution context. | inspect-reading-context |
+| reading-identity/budget | resource | The place lacks one finite declared preparation limit. | inspect-resource-lines |
+| reading-identity/selection | interpretation | The requested reader is not adopted by this place. | inspect-reader-selection |
+| reading-identity/projection | interpretation | The adopted reader has no supported input projection. | declare-input-projection |
+| reading-identity/integrity | input | Current input or retained carrier bytes differ from their committed bytes. | resolve-verified-bytes |
+| reading-identity/failed | operation | The existing native preparation boundary refused; the diagnostic retains its cause. | inspect-native-diagnostic |
+| engine/input | input | The object byte request is not a supported canonical profile. | inspect-request |
+| engine/context | interpretation | The receiver-selected context does not admit the requested object history. | inspect-context |
+| computation/context | interpretation | The question, implementation, policy, input or result does not match the receiver-selected computation context. | inspect-context |
+| computation/budget | resource | The computation lacks or exceeds its declared byte or execution budget. | inspect-resource-lines |
+| computation/signature | authority | The computation signature does not verify with the receiver-selected signer. | inspect-signer |
+| computation/authority | authority | The selected computation signer is absent, retired or outside coverage. | inspect-authority |
+| conformance/context | interpretation | The receiver supplied missing or invalid suite, implementation or contract identities. | inspect-context |
+| conformance/budget | resource | The suite exceeds its declared byte or case budget. | inspect-resource-lines |
+| conformance/coverage | interpretation | The suite omits a required rule or refusal, or names undeclared coverage. | complete-suite |
+| conformance/integrity | integrity | The supplied suite bytes do not match the digest chosen by the receiver. | verify-suite-bytes |
+| conformance/suite | input | The suite is malformed, empty, duplicated or uses an unsupported byte profile. | inspect-suite |
 
 ```text
 REFUSALS lines · unique codes · exact metadata · duplicate refused
 ```
 
-Specific producers cover reference syntax, standing query/view, native export usage/source/context/budget/authority/signer/history, and authenticated inspection context/budget/transport/integrity/framing/wire/authority/history/object-context/identity. Numeric CLI usage and uncoded legacy failures use the explicitly generic codes above; diagnostics remain unclassified. B2/B5 may add codes only by changing these versioned contract bytes and their vectors.
+Specific producers cover reference syntax, standing query/view, native export usage/source/context/budget/authority/signer/history, and authenticated inspection context/budget/transport/integrity/framing/wire/authority/history/object-context/identity. Numeric CLI usage and uncoded legacy failures use the explicitly generic codes above; diagnostics remain unclassified. Additional public operations may add codes only by changing these versioned contract bytes and their vectors.

package/docs/contracts/refusals.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/refusals.md",
-      "digest": "sha256:ed549322f385e184b0defe705eac62cf546b8617ecb7f9fbe3f727431820f10c"
+      "digest": "sha256:2255340c9bad55a9c6b97542840d0efee0f9cecc9d032a0e810b96e5f891c38e"
     },
     {
       "role": "yes",
@@ -14,7 +14,7 @@
     {
       "role": "vector",
       "path": "vectors/native/refusals.vector.json",
-      "digest": "sha256:2e2833bc6388784e030b50232bd99f84ccb05b0fd6ed86f6db0a5a0b1dc38e05"
+      "digest": "sha256:957f2b4a8e97a2dd851c7cdb210579cc9d3ab0822efa9bf18c3a676b92636663"
     },
     {
       "role": "no",

package/docs/contracts/views.md

@@ -27,3 +27,11 @@ The programs view asks the selected Topos demand-status projection at resolution
 # Demand card
 
 The declared card view asks the selected Topos demand-card projection at resolution 8. It reads the selected demand coordinates, their explicit dependencies and the handed evidence region under selectors declared by that Topos. It does not infer progress from files or convert a declaration into proof. A requirement without evidence is unread; an unpaid predecessor blocks its dependant. The next coordinate is an unblocked unpaid demand. Deadline is unread when no elapsed receipt is handed; absence is not zero. These labels describe program evidence, not Obligations cell states. The sample pins the implementation member from the published Topos SDK, folds two unrelated places twice with equal stdout and refuses a declared dependency cycle. This sample intentionally has no evidence to close either program; it certifies the projection of absence and order, not stage acceptance.
+
+## Computation statements
+
+`fold --as computation --key <key> [--key-file <host-file>]` computes the existing authenticated object projection. It requires an admitted `view/computation=computation@1`, one digest each for `computation/contract` and `computation/numeric-policy`, and explicit `0..N` limits for `computation/bytes` and `computation/milliseconds`. The key must be current and cover `computation`. No implicit key or delivery approval is used.
+
+The CLI uses the same `executeComputation` operation exported by `/engine`. Its signer is the existing host-selected file or command mechanism; the original signed history is not modified. The returned `bound-computation-delivery@1` contains the public context, request bytes, signed statement and result bytes. Relevant environment values are committed as digests. Verification must use an independently chosen context and public key, not trust the supplied context merely because it was delivered.
+
+The implementation identity covers the native instrument closure and, when selected, the WASM assets. The selected form standings and their executable closures are transitive inputs. A statement names what ran; its signature authenticates that observation, not mathematical correctness, independence, a Root admission or permission to publish.

package/docs/guide.md

@@ -0,0 +1,10 @@
+## First session
+
+1. fold --as readme --check prints SAME when that page's cone did not move.
+2. the digest at zero
+3. fold --as help prints the three verbs and no fourth.
+4. Land the batch with the key that covers it.
+5. Write the line as by=target.
+6. the lines at eight
+7. Preview with fold --as before it lands.
+8. the regions at one

package/docs/reference.md

@@ -0,0 +1,40 @@
+**line** — the lock a place is bound by, and the fold that reads it
+
+| | |
+|---|---|
+| pin | closure-delivery |
+| pin | ep-closure-reader |
+| pin | native-publication |
+| pin | process-readings |
+| pin | programs |
+| pin | prose-render |
+| pin | publication-additions |
+| pin | publication-readings |
+| pin | published-dependencies |
+| pin | rendering |
+| pin | source-readings |
+| pin | wire |
+
+- [closure-delivery](contracts/closure-delivery.md)
+- [archive](contracts/archive.md)
+- [cli](contracts/cli.md)
+- [documents](contracts/documents.md)
+- [engine](contracts/engine.md)
+- [evidence-view](contracts/evidence-view.md)
+- [host-ports](contracts/host-ports.md)
+- [reading-identity](contracts/reading-identity.md)
+- [reference-backend](contracts/reference-backend.md)
+- [reference-export](contracts/reference-export.md)
+- [refusals](contracts/refusals.md)
+- [standing](contracts/standing.md)
+- [typed-object](contracts/typed-object.md)
+- [views](contracts/views.md)
+- [view-walk](contracts/view-walk.md)
+- [why](why.md)
+- [guide](guide.md)
+- [native-host](contracts/native-host.md)
+- [publication](contracts/publication.md)
+- [README](../README.md)
+- [reference](reference.md)
+- [reference-port](contracts/reference-port.md)
+- [usage](usage.md)

package/docs/why.md

@@ -0,0 +1,109 @@
+## How Bound reads a project
+
+Bound reads a project's admitted statements and observations through its selected Topos, then renders the declared views and records their inputs in receipts. The example below explains the object; a file-fold alone does not calculate its intervals.
+
+## Use Bound in a project
+
+From a project with an admitted lock and selected views, inspect its standing, ask for its evidence, then verify the committed outputs:
+
+```sh
+npx @lapxo/bound@0.1.8 fold --as lines
+npx @lapxo/bound@0.1.8 fold --as receipts@1
+npx @lapxo/bound@0.1.8 fold --check
+```
+
+Use this flow to review a project change or check a dependency's declared contract. `--check` verifies existing evidence; it does not execute a missing reading. A file fold names readings and explicitly says that it computed no encounters.
+
+Independent observations are judged through the declared typed cells view. The selected topos supplies the form, origin evidence and bounds. Bound keeps attribution and exact-ID withdrawals through the fold.
+
+A selected form can instead describe a set of artifacts, a delivery interval or another domain's values. The project declares the form, origin evidence and views; Bound does not infer them from filenames or units.
+
+
+## A meeting everyone can understand
+
+Ana is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.
+
+With an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.
+
+The same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.
+
+## See how information holds together
+
+![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)
+
+A travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.
+
+| State | Meaning |
+| --- | --- |
+| REQUIRED | Compatible bounds, fewer than two independent origins. |
+| FREE | Independent origins meet and their encounter fits the bounds. |
+| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |
+| FORBIDDEN | An inhabited encounter does not fit the bounds. |
+
+Bounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.
+
+## Change a project without erasing evidence
+
+Work in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.
+
+```sh
+export BOUND_KEY_ID='your-admitted-key-id'
+export BOUND_KEY_FILE="$HOME/Private/keys/your-device.pem"
+lot_dir="$(mktemp -d)"
+```
+
+Have the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.
+
+```sh
+npx @lapxo/bound@0.1.8 sign "$lot_dir/proposal.bound" \
+  --key "$BOUND_KEY_ID" --key-file "$BOUND_KEY_FILE" \
+  > "$lot_dir/signed.bound" &&
+npx @lapxo/bound@0.1.8 land "$lot_dir/signed.bound" &&
+npx @lapxo/bound@0.1.8 fold
+```
+
+`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.
+
+For typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.
+
+[Authority, withdrawals, receipts and PR review](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).
+
+## Select a topos by what it declares
+
+`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.
+
+`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.
+
+| Responsibility | Owner |
+| --- | --- |
+| Meet, state, live acts and rest | Obligations |
+| Wire, forms, classes, views and offer contracts | Topos |
+| Admission, folding and evidence | Bound |
+| Domain measurement and representation | Selected topos |
+| Storage, transport and execution | Host |
+
+Cell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.
+
+## Repository rules
+
+Commit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.
+
+The lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.
+
+A PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).
+
+## An atlas you can question
+
+Information can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.
+
+This makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.
+
+A pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.
+
+Use Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.
+
+[Contribute a counterexample or a proposed lot](CONTRIBUTING.md).
+
+## Foundations and related libraries
+
+The two-sided constraint object is described in Nahum Ochoa's [Two-Sided Constraints on a Valued Lattice](https://doi.org/10.5281/zenodo.21858428), DOI `10.5281/zenodo.21858428`. Bound uses the object through [Obligations](https://github.com/Lapxo/obligations); [Topos](https://github.com/Lapxo/topos) supplies the wire and contracts for forms, views and selected worlds. Bound admits, folds and retains evidence across those declared boundaries. A digest identifies bytes; it does not certify that an observation is true.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -32,13 +32,20 @@
     "./closure/native": {
       "types": "./dist/host/native/module-delivery.d.ts",
       "default": "./dist/host/native/module-delivery.js"
-    }
+    },
+    "./host": {
+      "types": "./dist/host/index.d.ts",
+      "default": "./dist/host/index.js"
+    },
+    "./conformance": "./docs/contracts/conformance.json",
+    "./determinism": "./docs/contracts/determinism.bound"
   },
   "scripts": {
     "test": "node --import ./test/setup.ts --test --test-concurrency=2 test/*.test.ts",
     "clean": "rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo",
     "build": "node --experimental-strip-types tools/build.ts",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "compact-archive": "node --experimental-strip-types tools/compact-archive.ts"
   },
   "files": [
     "LICENSE",
@@ -47,13 +54,8 @@
     "dist/**/*.js",
     "dist/cli/verb.d.ts",
     "dist/engine/index.d.ts",
-    "dist/engine/object.d.ts",
     "dist/host/reference-authenticated.d.ts",
-    "dist/host/reference-export.d.ts",
     "dist/host/reference-native-api.d.ts",
-    "dist/host/reference-native.d.ts",
-    "dist/host/reference-profile.d.ts",
-    "dist/host/refusals.d.ts",
     "dist/wasm/adapter.d.ts",
     "TARGET.bound",
     "receipts.bound",
@@ -158,7 +160,6 @@
     "samples/reference-backend/world-fixture.json",
     "vectors/native/reference-backend.vector.json",
     "samples/authenticated-reference/compatibility.json",
-    "dist/engine/ports.d.ts",
     "docs/contracts/host-ports.publication.json",
     "samples/host-ports/yes.json",
     "samples/host-ports/no.json",
@@ -169,23 +170,41 @@
     "vectors/native/readme.vector.json",
     "samples/engine-place/inputs/closure.json",
     "dist/host/native/module-delivery.d.ts",
-    "dist/host/native/module-closure.d.ts",
     "docs/contracts/closure-delivery.md",
     "docs/contracts/closure-delivery.publication.json",
     "samples/module-delivery/inputs/delivery.json",
     "samples/no/module-delivery/delivery.json",
-    "vectors/native/module-delivery.vector.json"
+    "vectors/native/module-delivery.vector.json",
+    "dist/host/index.d.ts",
+    "docs/contracts/native-host.publication.json",
+    "samples/native-host/yes.json",
+    "samples/native-host/no.json",
+    "vectors/native/native-host.vector.json",
+    "CITATION.cff",
+    "docs/contracts/publication.inventory.json",
+    "docs/guide.md",
+    "docs/reference.md",
+    "docs/why.md",
+    "docs/contracts/reading-identity.publication.json",
+    "samples/reading-identity/yes.json",
+    "samples/reading-identity/no.json",
+    "vectors/native/reading-identity.vector.json",
+    "dist/vendor/",
+    "vendor/syntax/parser.js",
+    "vendor/syntax/LICENSE.md",
+    "dist/public-types.d.ts",
+    "docs/contracts/conformance.json",
+    "docs/contracts/determinism.bound"
   ],
   "author": "Lapxo",
   "license": "MIT",
-  "dependencies": {
-    "@lapxo/obligations": "0.4.3",
-    "@lapxo/topos": "^0.2.1",
-    "acorn": "8.19.0"
-  },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "20.19.43",
+    "typescript": "5.9.3",
+    "@lapxo/topos": "0.2.1",
+    "@lapxo/obligations": "0.4.4",
+    "esbuild": "0.28.2",
+    "dts-bundle-generator": "9.5.1"
   },
   "sideEffects": false,
   "engines": {