@lapxo/bound 0.2.4 → 0.2.6

package/docs/contracts/installed-package.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/installed-package",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/installed-package.md",
+      "digest": "sha256:b7fd04fc1318f405fce1c785047cf59a2185216452f83ea86774d7416b7b92b4"
+    },
+    {
+      "role": "yes",
+      "path": "samples/installed-package/yes.json",
+      "digest": "sha256:2563ba668607ea7166dcdcd7c8c5f0f61c981cf4c4bfbb45c701fd7a0ea62459"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/installed-package.vector.json",
+      "digest": "sha256:1c971130a6c718dbdbb023caada2623123ebcef7d364f18df3b36ed62bb6edad"
+    },
+    {
+      "role": "no",
+      "path": "samples/installed-package/no.json",
+      "digest": "sha256:de51ebb969b78bc278daf27443cf699a377e18a391bab248ce92f022f30a5606"
+    }
+  ]
+}

package/docs/contracts/materialized-leaf-sequence.md

@@ -0,0 +1,15 @@
+# Materialized leaf receipt sequence
+
+A consumer may admit a version or prose change, request only `fold --as receipts`, then request `fold --check`. Receipt-only rendering must not certify a previously rendered README or manifest against the newly admitted source. The existing native receipt renderer checks each required ordinary view against its current semantic render before issuing region counts and byte seals. A valid byte digest alone does not establish semantic freshness.
+
+The focal vector `test/materialized-leaf-sequence.test.ts` runs that exact sequence in two unrelated disposable places. It installs an actual content-addressed capsule that renders Markdown and a JSON manifest from admitted version and prose claims. Bootstrap and edits use the existing real file signing port with disposable fixture authority. No normal fold, fresh leaf renderer invocation, output copy or byte reseal is inserted between the admitted edit and the receipt-only/check sequence.
+
+The stale outputs remain unchanged during the receipt-only request, and the immediately following check refuses closure. A normal subsequent fold renders the updated leaves and recovers closure. An altered or absent README or manifest also cannot pass closure after a receipt-only request.
+
+The delivery scope is explicit. The default receipt guard requires all ordinary outputs declared for the source. A delivery explicitly selecting only README may omit an unrelated source-only manifest; absence never chooses that subset implicitly. Removing a selected README refuses the selected seal as well. The focal vector checks this binding once per place and leaves the broader delivery mutation matrix to the existing `pass-receipt-order` vector.
+
+This is a consumer conformance vector for the existing materialized-output guard. It adds no evaluator, rendering implementation, admission authority or runtime exemption. Passing the vector establishes the tested native behavior, not owner authorization, publication or final release closure.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/materialized-leaf-sequence.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/materialized-leaf-sequence.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/materialized-leaf-sequence",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/materialized-leaf-sequence.md",
+      "digest": "sha256:02cc03bb02c3f8d4f9ffabc1d18109fb1f05a65fecc613f75211a5a396f1d1fa"
+    },
+    {
+      "role": "yes",
+      "path": "samples/materialized-leaf-sequence/yes.json",
+      "digest": "sha256:7180af00a4df73b33edfe9a84a840916859dbf19226afbe156563ed16641f6e2"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/materialized-leaf-sequence.vector.json",
+      "digest": "sha256:64f8e08343b68d926d340058d41350a4d39396e5fb30ea1742655fa1911ca5c2"
+    },
+    {
+      "role": "no",
+      "path": "samples/materialized-leaf-sequence/no.json",
+      "digest": "sha256:3a487c275e646287ccab47a217ada65db7abc05c2e0b97af5d6d8ee87a70859f"
+    }
+  ]
+}

package/docs/contracts/module-inventory.md

@@ -0,0 +1,15 @@
+# Verified module inventory
+
+`moduleInventory` from `@lapxo/bound/closure/native` projects the already verified executable delivery through the existing closure verifier. Its unit is a module, not a symbol. It neither compiles nor executes the offered code and introduces no second traversal or dependency parser.
+
+The receiver supplies exact delivery bytes, their expected SHA-256 digest, the existing finite member/source/response-byte limits, declaration context (`scope`, `by`, `at`) and exactly one source/version declaration for each reached snapshot. Source and version are receiver declarations; the snapshot identifies bytes and does not authenticate a publisher's version claim.
+
+Each reached module becomes an existing canonical wire line. Its digest is `value`; `about` contains the `module-inventory-record/1` profile: `unit`, `source`, `version`, `snapshot`, `module`, `digest`, and `reachedFrom`. `reachedFrom` identifies the verified closure which reached the module, not an immediate importing module. The output also names the exact delivery and closure identities. No new wire fields or fixed application regions are introduced.
+
+An unreachable module does not enter the executable closure. A different source-envelope identity may change provenance and the inventory receipt even if the executable sources remain equal. Missing or altered module digests and changed carrier bytes refuse through the existing delivery verifier; they are integrity failures, not forks. Incomplete or duplicate source declarations refuse without a partial inventory.
+
+## Native quartet
+
+Two unrelated carriers, field notes and water levels, contain two reached modules and one excluded module. The native publication process vector imports the compiled public API, compares the exact canonical inventory with its captured `.bound` sample, verifies repetition and rejects changed carrier bytes, missing module digests and absent source declarations. Declared case inputs commit the positive carrier, expected inventory and negative carrier. The two cases run under the existing publication instrument and its unchanged budgets.
+
+The contract is rendered by the existing selected text renderer from a prospective public text declaration. Owner admission, final Root receipts, the release archive and another-machine portability remain separate obligations.

package/docs/contracts/module-inventory.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/module-inventory",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/module-inventory.md",
+      "digest": "sha256:78a59399c1cc34dde341a163db30341695c1a8a731a051ae8c9086549cf60c6c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/module-inventory/yes.json",
+      "digest": "sha256:fd65eb40a9478266afc4503dabb3cf9162791c6eb7576e4579ed86f29b41f41a"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/module-inventory.vector.json",
+      "digest": "sha256:b030fd7821ef69a3aa0cd36f15497074bbb55b6a614e27d5995ff20bb44922fe"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/module-inventory/no.json",
+      "digest": "sha256:530195b262a957949ed0b6448fbd962f03456eaa6851f130c15b657560060303"
+    }
+  ]
+}

package/docs/contracts/native-host.md

@@ -18,4 +18,32 @@ The host selects context explicitly on every call. Calls do not interpret consum
 
 The two positive places are a seed accession library and a coastal tide survey. Each installs the public host boundary, bootstraps disposable fixture authority through the real CLI, admits a domain-specific Root lot, compares native result recovery and repeats the held lot without signing again. Negatives alter bytes, remove signer coverage, cancel before commit and offer a noncanonical lot; no negative may create a visible act. Test keys are created only for the disposable fixture, never shipped.
 
-The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Head, browser hosts, algebra, wire and ceilings are outside this change.
+The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Algebra, wire and ceilings retain their existing contracts.
+
+## Consumer-owned persistent native host
+
+`await startNativeHost({place, instrument, expectedInstrument, limits, environment, signers?, scratchParent?})` starts one native dispatcher for one explicit place. `request({verb, args, signer?, inputs?}, signal?)` accepts `fold`, `sign` and `land`. It calls the same dispatcher, signer protocol, admission judges, exclusion and atomic publication as the CLI. A carrier never supplies a verifier, trust anchor or capability registry. `close()` aborts the active request and waits for cleanup. IPC disconnect also closes the host when the consumer dies; no daemon is installed.
+
+The queue is finite. `requestBytes` bounds the aggregate queued request data, `queuedRequests` bounds request count, `responseBytes` bounds each response and `timeoutMs` bounds startup and triggers request cancellation. `heapMiB` selects Node's old-generation heap limit; it is not a claim about total operating-system RSS. Native file, capture and execution bounds remain those already declared by the place. The host refuses another instance for the same canonical place in one consumer; every act retains the existing cross-process CLI exclusion protocol. Calls never change the consumer's environment, cwd, arguments, console or exit status.
+
+`nativeHostEnvironment` removes all `NODE_` and `UV_` controls from the explicitly supplied environment. The fixed memory flag and actual sanitized environment belong to reading identity. CLI comparisons use that same boundary, rather than pretending that different execution environments have one identity. The host starts once; a query does not start another dispatcher.
+
+An injected signer is selected by receiver key and declared mechanism name. Its callback remains in the consumer, receives only the canonical signing lot and cancellation signal, and uses the existing bounded signing port and signature verification. Signing never grants admission. Lost application responses are recovered by the original committed act identity; redelivery does not create another act.
+
+`inputs` contains uniquely named UTF-8 request files. Arguments name these files as `@input/<name>`. They are staged only in an owned request directory and removed after success, refusal or cancellation. Caller-owned places and arbitrary caller files are never deleted as scratch. Shutdown removes the owned host scratch directory. Before visibility, cancellation publishes no partial act; after visibility, the committed native identity remains historical evidence and is never represented as a rollback.
+
+The response retains raw stdout, stderr and exit status. Identity/text, signatures, refusal catalog records and recovered canonical act records are compared byte for byte with CLI vectors. Independently measured elapsed-time diagnostics are retained as operational evidence, not normalized or presented as byte-identical measurements. Fresh verification is proportional to consumed bytes. The separate consumer acceptance measurement reports 1x, 10x and 100x, ten samples plus one warm-up, real clock/load, elapsed milliseconds per decimal MB and persistent growth; no constant-time property is claimed.
+
+Every persistent request rereads current file and ledger bytes, including externally edited bytes with unchanged size and timestamps. The receiver-selected public instrument lock is checked again before dispatch; retained parsing never grants authority to a later request.
+
+## Installed pin, signer registry and foundation
+
+`installedHostInstrument(request, entry)` reuses `installedPackageIdentity` and returns the instrument with its installed-byte digest. Startup requires `expectedInstrument`, selected by the receiver from its admitted package pin. It verifies those bytes before and after child startup. Neither the archive digest nor a physical pathname substitutes for the installed identity; identical installations have the same digest.
+
+`signers` is a receiver-owned map indexed by key ID, with no fixed key count. Every signing request explicitly names its `signer`. The selected binding must match the lot key: a mismatch refuses with `host/signer-mismatch`, while a missing binding refuses with `host/unbound-signer`. Neither acquires another key or admits any record. The former single-binding option only registers that binding; it never selects a signer implicitly and does not limit the registry.
+
+Cross-process land semantics are `serialize`: admitted-place requests acquire the existing native tree exclusion before preparing a lot. Two consumer processes commit in that order with consecutive epochs. There is no automatic rebase or retry, and the CLI uses the same native exclusion protocol.
+
+A birth directory containing only its public birth lock may be founded through `land`, using the classic bootstrap implementation and injected signer. Other operations refuse with `host/foundation-required` until foundation. An existing empty or unauthenticated store refuses with `host/foundation-state`; it is never overwritten or founded again. The executable vectors use two unrelated disposable places and compare signatures, founder ledgers and subsequent native closure with the CLI.
+
+Act-cost accounting starts separately for each request and includes all work in that request. Client idle time and earlier requests do not accumulate into a later act; no declared execution or observation is omitted from its own accounting.

package/docs/contracts/native-host.publication.json

@@ -4,22 +4,22 @@
     {
       "role": "contract",
       "path": "docs/contracts/native-host.md",
-      "digest": "sha256:e7821cd2641caa4725aa20095027d903693756a8568a2163a79d7bb665b7643b"
+      "digest": "sha256:bb2aa48641c28e95d8dab39690ee6228ae6a2078e38e3a55add6a92a99958109"
     },
     {
       "role": "yes",
       "path": "samples/native-host/yes.json",
-      "digest": "sha256:6c02edaea00db315e20b15f96b281cf605db2c7499f3d1b9839096a704492c44"
+      "digest": "sha256:f8838fc73551746b71e3afa8fe3d25fb2a33ac20d163fd2b5024552209ec47eb"
     },
     {
       "role": "vector",
       "path": "vectors/native/native-host.vector.json",
-      "digest": "sha256:b62d77a3de11d960657fa9e7b58d4e88c68d0c389d683937bba4fa6c04a9d952"
+      "digest": "sha256:13d0d8a9f1cda39e861a36d835f5af683579c9d3a0b60eefe7fee71e3094ddc4"
     },
     {
       "role": "no",
       "path": "samples/native-host/no.json",
-      "digest": "sha256:27f323ca2a0d1547197e6beab3427bdcda45c0318fac52bc58b2b0164a2df38d"
+      "digest": "sha256:80c8d868158514e3e44273570dccb553c28daf591061f343c3c0b7e32352d49b"
     }
   ]
 }

package/docs/contracts/native-probes.md

@@ -0,0 +1,13 @@
+# Native probes
+
+`prepareNativeProbe` reads an explicit local `lines` or `evidence` form. Its result names the same identity and returns the same captured text as `prepareNativeViewIdentity`; it never falls back to folding an unsupported form. Expected identities use the existing native view identity contract. Foreign evidence without a transport snapshot refuses.
+
+The consumer supplies a port coordinate, finite `probes` and `responseBytes` limits, an optional cancellation signal, and a counter `{used: new Map()}`. The consumer owns that counter and keeps it for the entire operation, sharing it across calls on the same port. Different ports have independent counts. Bound persists no counter, receipt, cache, memo or other probe state. Resetting a counter begins a new consumer operation; the counter is operational accounting, not a grant of authority.
+
+Each attempted captured reading consumes one probe even if identity validation or response size later refuses. Invalid forms, invalid limits, exhausted counters and already cancelled calls consume none. The place's admitted `reading-identity/probes` limit further reduces each port's available probes; the existing admitted byte and file budgets constrain the capture. The response byte limit covers the complete JSON fact. Cancellation is checked before capture and before returning its result. Capture is synchronous; cancellation from another event-loop task cannot preempt a synchronous capture.
+
+Repeated probes with unchanged committed inputs preserve the native view identity and every persisted byte. A consumer can verify this without deriving another identity: compare the supplied public native identity before and after its operation, and compare persisted byte inventories. Newly admitted evidence remains subject to the existing identity contract.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/native-probes.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/native-probes.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/native-probes",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/native-probes.md",
+      "digest": "sha256:c2d62182203539ed42a5833fe6d528309f43207286600559a387eaec6cccf545"
+    },
+    {
+      "role": "yes",
+      "path": "samples/native-probes/yes.json",
+      "digest": "sha256:4d32c55b4d14a85b6231eb017fac96f95453db5b35bb1eaa4cb8213aa9744a09"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/native-probes.vector.json",
+      "digest": "sha256:14788a562ba51c8bfb3bfd3d2b9abfca67f4236f748ff724ad528917b77574ef"
+    },
+    {
+      "role": "no",
+      "path": "samples/native-probes/no.json",
+      "digest": "sha256:72ff9a3c323836e1fcb814afebe7dbb5d196db505138b2a80a0e9e34a8c3128f"
+    }
+  ]
+}

package/docs/contracts/native-publication.inventory.json

@@ -10,6 +10,15 @@
     "contract/published/refusals",
     "contract/published/host-ports",
     "contract/published/readme",
-    "contract/published/native-host"
+    "contract/published/native-host",
+    "contract/published/reading-identity",
+    "contract/published/module-inventory",
+    "contract/published/native-view-batch",
+    "contract/published/native-probes",
+    "contract/published/physical-lines",
+    "contract/published/profile-composition",
+    "contract/published/installed-package",
+    "contract/published/materialized-leaf-sequence",
+    "contract/published/authority-preflight"
   ]
 }

package/docs/contracts/native-view-batch.md

@@ -0,0 +1,17 @@
+# Native view identities in one observation
+
+`prepareNativeViewIdentities` from `@lapxo/bound/host` accepts an explicit place, receiver-selected native instrument, distinct supported view names and optional expected identities. It returns each view's identity and text together. The CLI exposes the same operation as `bound fold --as reading-identities@lines+evidence`.
+
+The native projections currently supported are `lines` and `evidence`. An empty, repeated or unsupported selection refuses by name. This is a finite implementation capability, not a list of possible application regions. Executable and foreign-transport views retain their separate contracts.
+
+Each identity names that view's consumed inputs, current committed inventory, selected implementation, instrument configuration, environment and day boundary. The existing `native-view-inputs@1` framing is retained. Request order and the presence of another selected view do not alter a view's identity. A different execution environment can produce a different identity even when the text is identical.
+
+Within one synchronous call, native preparations share captured source bytes and independently retain each view's input membership and admitted byte/file budgets. Every source is freshly verified before return. The admitted reading count bounds the selection. A batch does not persist a cache, execute an observed reader, call the general fold or acquire Root exclusion. Later calls capture their sources again.
+
+An unsupported selection, exceeded budget, changed input, changed committed inventory or mismatched expected identity returns one typed refusal and no partial view results. Identity and text belong to the same successful observation. Existing single-view host and CLI routes remain available.
+
+The native vector checks two unrelated admitted places, both public projections, request reordering, stable repetition, expected-identity refusal, source invalidation, writer exclusion and a complete persisted-byte inventory. A changed source during shared capture refuses before return. Performance is measured separately; this contract promises no constant-time query or unmeasured speed ratio.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/native-view-batch.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/native-view-batch.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/native-view-batch",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/native-view-batch.md",
+      "digest": "sha256:8ca692baadda00de217f8b8b0fc4f20d60fdc478ec6d330fdd8e22ca94e1b78d"
+    },
+    {
+      "role": "yes",
+      "path": "samples/native-view-batch/yes.json",
+      "digest": "sha256:608d00c4a39b987b435560dddf6aa8e72f69aedbd8541c6798913504b4be01d1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/native-view-batch.vector.json",
+      "digest": "sha256:bd5c598929ec1ed65d273f9ea1d271e79401fa7aea8467e48a7fc72de0bde381"
+    },
+    {
+      "role": "no",
+      "path": "samples/native-view-batch/no.json",
+      "digest": "sha256:6228f650501222593f46a9015a6e73908b3d302b8671348b54bd9c80f66c8bdc"
+    }
+  ]
+}

package/docs/contracts/optional-wasm-adapter.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/engine.md",
-      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+      "digest": "sha256:7097713afcfb5859850d96b66aced8ea6ea09f738b34f79a87bb77938fa1c6e6"
     },
     {
       "role": "yes",

package/docs/contracts/physical-lines.md

@@ -0,0 +1,19 @@
+# Physical lines and reading witnesses
+
+The host adapter `readPlacePhysicalLines` reads every regular file inside explicitly named inventory boundaries. It has no implicit exclusions. Files outside every selected region are returned by name in `stray`. Missing selectors remain unmeasured by scope and selector, including a missing selector beside another selector that matched. Links, special files, incomplete inventories and exhausted resources cannot produce a complete reading.
+
+Counts, selectors and finite region valuation delegate to Topos `readPhysicalLines`. Empty files contain zero physical lines. Blank and comment lines count; LF and CRLF delimit lines; an unterminated final line counts. Isolated carriage returns and invalid UTF-8 refuse. Overlapping regions retain Topos overlap evidence and are never certified disjoint by this adapter.
+
+`physicalLinesRegions` projects selectors from the consuming place's already admitted standing. A `core/lines` interval reads the `region/core` coordinates declaration. Other region names follow the same rule. No application or directory family is built into the adapter. The caller must choose and authorize the finite inventory boundaries and resource policy.
+
+`judgePhysicalLines` delegates interval thresholds to the existing Bound `foldCeilings` and policy widening to `widenedWithoutWitness`. It accepts `lines` and `file-lines`; file observations retain their actual coordinate. Over-ceiling observations or unauthenticated widening produce `BLOCK`. Missing selection or stray files produce `UNMEASURED`. No declared line ceiling produces `UNMEASURED`.
+
+Reading witness syntax is Topos `topos-reading-witness/1`. Every reading, model, input, selection, unit, scale, resolution, reader, implementation, context, run and result field must match this actual reading. Actual reading handles are immutable and local to the host process; parsing a serialized reading cannot recreate a trusted handle.
+
+The consuming host supplies `PhysicalLinesWitnessAuthority` from its admitted current producer policy and evidence verifier. Key evidence must match the declared key and coverage. CI evidence must match repository, commit, workflow, run and attempt before proof verification is invoked. The proof port must authenticate evidence over the exact Topos statement bytes. Neither a URL nor valid syntax establishes authority. The adapter supplies no default trust rule, key store, network provenance lookup, admission, persistence, signing or publication.
+
+After successful proof verification, `authenticatePhysicalLinesWitness` returns the exact `attest:sha256:...` coordinate that a proposed widening must name. A coordinate with the right prefix, without verified matching evidence, remains blocked. Integrating the adapter into an owner-authorized landing transaction remains the consuming host's responsibility; `READY` is a native judgment, not a persisted landing or admission.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/physical-lines-place.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/physical-lines.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/physical-lines",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/physical-lines.md",
+      "digest": "sha256:d0b780a4573cee69ec6f68305c2b196340aa73dbc48114af003816333fdffb1a"
+    },
+    {
+      "role": "yes",
+      "path": "samples/physical-lines/yes.json",
+      "digest": "sha256:3d54c37d2010cc3baf7f6eef0781b6b22eb004ecdccf9f91a59b354038151dd1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/physical-lines.vector.json",
+      "digest": "sha256:2626860abd968214a57f1ec54162c74890ea76476156984f8a5c7d6da90a8ffb"
+    },
+    {
+      "role": "no",
+      "path": "samples/physical-lines/no.json",
+      "digest": "sha256:faab4bdc0339583cab3b62e5ddb1d5a4c0b115df4bbd4455edb09cf878cd742b"
+    }
+  ]
+}

package/docs/contracts/profile-composition.md

@@ -0,0 +1,17 @@
+# Profile composition and release categories
+
+`composeProfile` prepares an authenticated lot without admission or persistence. It reads Topos `topos-profile-composition/1` records, resolves every parent from its exact SHA-256 digest and delegates form composition to Topos. The digest preimage is the canonical profile line followed by one newline.
+
+A parent record supplies declarations, never authority. Each inherited and local field requires exactly one original signed statement whose scope, role, form, measure and value match its selected binding and whose `restsOn` names the exact profile digest containing it. The current consumer lock supplies admitted signers, signature algorithms, windows and region coverage through Bound's existing authority evaluator. No parent can grant a signer coverage.
+
+Narrowing and additions require those signatures. Interval and alphabet widening use Bound's existing widening judge: the authorized statement must carry the witness-class `at` selected by the consumer's wire. A parsed Topos reading-witness record alone does not satisfy this rule. This is the existing admission witness convention, not independent verification of scientific provenance. Preparation does not pay inertness, observations, admission gates or owner receipts; ordinary admission remains required.
+
+`releaseCategoryPins` selects exact artifact lines by declared category, class, scope, role and digest measure. It accepts only alphabet digest bindings. It never selects a numeric code ceiling, and has no package-family prefix list. `composeProfile` selects category lines from the same authenticated statement set. Callers of the standalone selector must supply already authenticated standing. Dependency, vocabulary and source archive categories can each declare their own exact scopes.
+
+Missing and ambiguous categories refuse as `release/category-missing` and `release/category-ambiguous`; absent, ambiguous and mismatched artifact bindings refuse as `release/pin-missing`, `release/pin-ambiguous` and `release/pin-integrity`. A class mismatch refuses as `release/category-class`. Profile authority, widening and unresolved parents refuse as `profile/authority-required`, `profile/widening-witness-required` and `profile/missing-parent`. Topos record/integrity refusals preserve their existing named causes.
+
+The returned lines retain inherited evidence and local statements; they are a preparation result, not a claim that an authorized widening erased an ancestor's meet constraint. Topos' declared composition remains authoritative for the effective intersection. Applications that intend a revision must use the ordinary admission flow to revise standing explicitly.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/profile-composition.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/profile-composition.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/profile-composition",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/profile-composition.md",
+      "digest": "sha256:19b8a7d8b08590e39d23aa3775116e96c787d9bc22d9cd53b911b8f5a3c49314"
+    },
+    {
+      "role": "yes",
+      "path": "samples/profile-composition/yes.json",
+      "digest": "sha256:48a5524520182e7e64fb0aa3b27e7931f4a2a3dbe096589dbaa3caaa0dde556a"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/profile-composition.vector.json",
+      "digest": "sha256:ce43584069b3957fd6c2967975367cf398aa77e54b137c7ccb312fa5a5625252"
+    },
+    {
+      "role": "no",
+      "path": "samples/profile-composition/no.json",
+      "digest": "sha256:13b00555d7e00a1c2d05cae2aaa42e7c4301ca74cf60f9ca3428f623a1358948"
+    }
+  ]
+}

package/docs/contracts/profile-preparation-native-meaning.md

@@ -0,0 +1,9 @@
+# Profile preparation and native meaning
+
+A `prepared` profile is not a native act receipt. Its inherited and local statements remain evidence for composition. For a field declared with mode `meet`, the effective value is the selected Topos lattice meet of every inherited and local constraint.
+
+The installed native consumer vector checks this distinction for interval and alphabet fields in two unrelated places. Narrowing prepares and lands through the actual CLI. Witnessed widening also prepares and lands its authenticated statements, while the actual effective native standing remains the ancestor/local meet. In particular, a witnessed local interval `0..9` over an inherited `0..5` still composes to `0..5`; the witness does not erase the ancestor. Additions have no ancestor and receive their own actual act receipt.
+
+The vector compares both prepared composition and effective admitted standing with `composePolicy` and the selected lattice's `meet` and `leq` operations. It defines no alternative interval or alphabet arithmetic. Claims that a raw prepared lot necessarily forks were removed after the actual native implementation demonstrated compatible distributive composition. That test correction changes no runtime semantics.
+
+An application intending to revise an ancestor must explicitly withdraw or revise the prior native inscription under the existing admission rules. Returning `prepared`, accepting a witness-shaped context, and actually persisting an authorized revision are separate events and must be reported separately.

package/docs/contracts/publication.md

@@ -15,3 +15,15 @@ Each declared reading and each host invocation is measured separately. The total
 Full-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.
 
 File-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.
+
+## Current rendered leaves
+
+A native file receipt cannot certify an obsolete declared rendered output after its admitted source changes. Receipt projection uses the existing declared view renderer to compare each applicable non-receipt output with its current expected bytes. Until they agree, resolution 1 withholds both file-region counts and byte seals; the byte-only sealer cannot turn that incomplete semantic projection into a closed receipt. Receipt views do not recursively certify themselves.
+
+The normal render pass writes ordinary outputs before asking that same receipt renderer to seal them, including outputs prepared by workers. A receipt-only command may leave the region open; `fold --check` must refuse an obsolete output without repairing it. The next ordinary fold renders and closes it. This rule is shared by the native renderer and CLI, does not impose an external render-first workaround and does not authorize any write or admission. Two unrelated executable places cover admitted declaration changes, unchanged reuse, a clean public checkout and changed-input refusal.
+
+## Materialized delivery boundary
+
+A declared view is also a capability: its shape need not be materialized in every distribution. An ordinary place checks every applicable non-receipt rendered output. During a delivery projection only, the trusted formation recipe passes the manifest-selected coordinates captured before copying an already closed source to the existing native receipt renderer. The kernel does not parse the package manifest, infer selection from missing files or name application-specific regions. A carrier cannot choose this projection scope or change authority.
+
+The guard checks each selected output against the same view renderer. Missing or altered selected bytes withhold both region counts and byte seals. An omitted source-only output is not certified as present. With no explicit delivery scope, the original full-place rule applies. The source must close before forming a distribution, and the resulting public tree must pass native `fold --check` before packing.

package/docs/contracts/reading-identity.md

@@ -0,0 +1,61 @@
+# Public reading identity
+
+`prepareNativeReadingIdentity` from `@lapxo/bound/host` prepares the adopted input-projection readings of an authenticated place. `fold --as reading-identity` calls that same operation. This contract covers adopted input-projection readings; other reading forms refuse.
+
+The receiver supplies the place, explicit native instrument, optional adopted reader selector, finite resource limits and cancellation signal. The place must declare one interval `0..N` for each of `reading-identity/bytes`, `/files`, `/readings` and `/probes`. Caller limits can reduce these bounds. They count handed UTF-8 input bytes, handed files, projected reading plans and input-projection requests across the selected readers; native image, response and execution limits also remain in force. The projection request is a probe, even when its implementation reuses a valid result. It is separate from final reading execution.
+
+A fact contains preparations with ready reading identities or named unpaid receipt dependencies. Each ready entry gives its scope, canonical `reading-context@1` and digest. When a verified existing carrier is available it also gives the `reading-receipt@1` digest. A missing physical input produces `needs`; a dependent reading without its predecessor's verified receipt stays open. No complete digest is invented for an unpaid dependency. These names are supplied by the selected world's projection; application region names are not built into Bound.
+
+Preparation uses the same projection, dependency order, contextual framing, transitive instrument inputs, policy, effective environment and carrier verification as execution. It can run the declared input projection under its native port. It never runs the final reading, signs, admits an act, renders public receipts or renews a reading receipt. Operational image/cache maintenance is separate. A subsequent execution under identical inputs and context commits the same identity; preparation does not reserve that identity or authorize a future answer.
+
+Instrument, implementation, policy, transitive inputs and the actual environment participate under the existing Topos contracts. Current-answer authorization also retains the existing principal, grant, snapshot and freshness checks when that profile is selected. Retained evidence grants no current authority. Environment values are committed by digest, not exposed as secret strings. Receipt identity and typed-content identity remain distinct.
+
+Relevant input or dependency changes produce another identity. Unconsumed maintenance does not. Bytes stored under a digest must verify; altered selected bytes or carriers refuse rather than becoming an alternative identity. The existing execution path may recompute an invalid retained answer; public inspection refuses a corrupt carrier. Missing bytes and failed integrity are different outcomes.
+
+Refusals are typed data from the public API: `reading-identity/context`, `/budget`, `/selection`, `/projection`, `/integrity`, `/failed`, and the existing `host/context`, `/budget`, `/cancelled`. A non-projection reader is unsupported, not silently executed. Cancellation and handed-input budgets are checked before the projection; native process budgets remain authoritative during execution. Synchronous projection cannot observe a JavaScript abort callback while it occupies the host thread; its declared native timeout still bounds that work.
+
+## Quartet
+
+The native test forms two unrelated disposable admitted places, counts and catalogue. Counts reads a physical file. Catalogue adds a dependent aggregate. Both use receiver-selected native images and the real CLI; a separate consumer imports the compiled public `/host` export. Preparation leaves final reading receipts absent; execution commits the same identity; subsequent preparation verifies existing receipts without changing the public receipt file. Catalogue's aggregate is open until the leaf receipt exists.
+
+The negative places retain a receipt but withdraw the current native grant, and alter the archive bytes under their selected digest. Both refuse. Focused vectors also cover missing physical input, changed dependency, stale handed bytes, cancellation, resource exhaustion and unrelated maintenance. Existing environment, authority and descendant-receipt vectors remain applicable and are reused.
+
+Two local places do not establish cross-machine conformance. This quartet neither admits Root reader bindings nor certifies a complete release.
+
+## Native lines and evidence
+
+`prepareNativeViewIdentity({place, instrument, view, expectedIdentity?})` from `@lapxo/bound/host` prepares the local native `lines` or `evidence` projection. `fold --as reading-identity@lines` and `fold --as reading-identity@evidence` print its identity without the result text. `fold --as reading-identity@lines@<digest>` (or `reading-identity@evidence@<digest>`) returns JSON with `kind`, `view`, `identity` and `text`. The text and identity use the same captured inputs; an obsolete expected identity returns no result. Ordinary views keep their existing output and require no reading-identity budgets.
+
+This operation performs configuration authentication and projection, not the region fold, executable readings or source resolution. It takes no Root exclusion and performs no persistent writes. One synchronous committed-journal observation fixes native acts; selected legacy sources are captured by exact bytes and checked again. Changed committed inputs, selected bytes, effective environment or expiration day refuse rather than publishing a mixed result. No lease reserves a later answer: the caller supplies the expected identity when requesting the result.
+
+Identity commits the native view, local place, authenticated configuration, selected authority/evidence histories and source bytes (including selected receipt inputs), exact implementation closure and instrument lock, effective runtime/environment, and UTC expiration-policy day. Input names and values are framed; no consumer directory fingerprint is accepted. Unconsumed fold caches, stamp memos and exclusion bookkeeping do not participate. The local execution identity is distinct from portable semantic standing identity.
+
+### Writes and derived storage
+
+The following classification applies to the declared native `lines` and `evidence` views. A path is not an authority boundary: selected bytes still participate wherever they are stored.
+
+| Write | Participates in the next identity | Reason |
+| --- | --- | --- |
+| Admitted declarations and authority changes | Yes | Authentication and effective declarations consume them. |
+| Admitted evidence, including consumed receipt or blob bytes | Yes when consumed by the selected view | A new observation changes what that view reads. |
+| Unconsumed maintenance: `.bound/cas/memo/`, `.bound/ledger/fold.bound`, `.bound/locks/` | No | These are derived caches or exclusion bookkeeping, not selected inputs. |
+
+The CAS blob directory is not excluded as a whole. A selected blob or receipt must verify against its committed digest; corruption refuses. A probe that adds no evidence preserves identity. Executing a reading that admits evidence may change it. Consumers request the public identity instead of reconstructing it from this table or scanning directories.
+
+Identity inspection is not promised constant-time over arbitrary mutable storage. Its measurement separates process startup, authentication, input capture, identity framing and result projection; a reused identity must still verify the inputs committed by its contract.
+
+The existing admitted preparation limits remain required for identity requests; inputs and implementation sources count against their byte/file budgets. Preparation does not execute projection probes or final readings. Only unqualified local native lines and a single unshaped native evidence view are supported. Foreign evidence needing an asynchronous transport snapshot and unsupported views refuse by name. No fallback executes their fold.
+
+Existing catalog codes apply: `reading-identity/selection` for unsupported selections, `reading-identity/context` for changed or mismatched snapshots, `reading-identity/budget` for missing/exhausted limits, and `reading-identity/failed` for unavailable implementation inputs. Public CLI machine records carry those codes.
+
+Seven native vectors cover repeated identity, added evidence, changed configuration, unchanged fold maintenance, distinct places, unsupported selections and identity-to-result binding with a stale refusal. Both unrelated places also answer while a Root writer holds exclusion; complete store comparison verifies no writes. Existing view/landing behavior without identity budgets is retained. These vectors do not establish cross-machine conformance.
+
+## Repeated unchanged queries
+
+For the declared local native `lines` and `evidence` projections, repeated queries without changed consumed inputs preserve both identity and exact result text and write no persistent files or bytes. This includes the first query and every CAS/memo and ledger file, without exclusions, garbage collection or a consumer-maintained cache key. This guarantee does not cover final reading execution, other view forms or storage written by an embedding application. The consumer retains its own query counter.
+
+The executable protocol queries each view eight times in two unrelated admitted places, compares the complete persisted tree after every query and reports file/byte counts. A deliberately writing stub is rejected by the same tree comparison. The fixtures use disposable authority, and this protocol does not inspect unrelated consumer stores or claim to resolve their storage incidents. No GC, LRU, storage-size policy or constant-time claim is introduced.
+
+The quartet also checks that receipt-only projection and the byte-only sealer cannot close an obsolete declared output after an admitted source change. The normal native fold renders current bytes before sealing, as specified in the publication contract. This applies to every declared output shape, without application-specific selectors.
+
+The rendered-leaf vector also projects two manifest-selected public subsets. Each keeps the declared view capabilities while omitting one source-only output. The same native renderer accepts those subsets, refuses a missing or altered selected leaf and preserves the default full-place refusal. Selection is captured before copying a closed source; it is never inferred from file absence.

package/docs/contracts/reading-identity.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/reading-identity",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reading-identity.md",
+      "digest": "sha256:7a561c902daacc69beb256ed20b04e2b840b7af47c9e64596e1b8d1ebea06b1c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/reading-identity/yes.json",
+      "digest": "sha256:660c07bcca7237dcdec5c0db294e8d164c1ff89c0061a3b4c1f0c2d3813b2cc2"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/reading-identity.vector.json",
+      "digest": "sha256:e9a5f2b0318c1495e951edf05c99c7403f438e8b0bce66cc55749237fc2b4865"
+    },
+    {
+      "role": "no",
+      "path": "samples/reading-identity/no.json",
+      "digest": "sha256:1775647462c2a933173be57269cbf21a8ac33b54e579539536543386a085ecff"
+    }
+  ]
+}

package/docs/contracts/reading-witness-admission.md

@@ -0,0 +1,49 @@
+# Reading witness admission
+
+`readingWitnessAdmission(root, proposed, selectedStanding, vocabulary, place)` is an admission hook for explicitly selected reading-witness policy. It returns `allow` with verified evidence identities, `ask` with `reading-witness/<scope>` needs, or `refuse` with the public `reading-witness` code and a diagnostic cause. The shared native admission path consumes this result before its existing widening rule. The hook neither signs nor lands a lot.
+
+Selection is opt-in. The current admitted Root vocabulary selects `wire/reading-witness-admission = bound-reading-witness-admission@1`. Policy records have role `writes`, measure `reading-witness`, value `lock`, and canonical JSON in `about`. A policy has these fields:
+
+```json
+{
+  "profile": "bound-reading-witness-policy@1",
+  "scope": "core/lines",
+  "place": ".",
+  "unit": "physical-lines/utf8-lf@1",
+  "inventory": ["src"],
+  "selectors": ["src/*.txt"],
+  "producer": "device",
+  "port": "port/physical",
+  "readerMapping": "reader/capsule/physical/port",
+  "byteBudget": "65536",
+  "rowBudget": "65536",
+  "entryBudget": 32,
+  "evidenceBytes": 4194304,
+  "receiptRows": 512,
+  "authorityBytes": 1048576,
+  "authorityLines": 2048
+}
+```
+
+The scope, place, inventory, selectors, producer and port are declarations, not application names compiled into the runtime. `place` is `.` for Root or a relative child place. Shared admission supplies the actual selected place separately, so a Root `core/lines` policy cannot apply to a child merely because its local scope has the same spelling. Other readings and ceilings retain their existing rules. A matching policy never falls back to prefix-only witnessing.
+
+A selected widening names `at=witness:sha256:...`. The digest addresses a bounded local CAS blob containing canonical JSON followed by one LF:
+
+```json
+{
+  "profile": "bound-reading-witness-proof@1",
+  "witness": "topos-reading-witness/1 ...",
+  "authorization": "bound-lock/1 ...",
+  "receipts": ["bound-lock/1 ..."]
+}
+```
+
+The Topos witness uses `authentication=key-covered`. The authorization is an original signed Bound record at the policy scope, with role `writes`, form `alphabet`, measure `reading-witness`, value equal to the SHA-256 of `readingWitnessStatementBytes(witness)`, and `restsOn` equal to the digest of the canonical policy JSON plus LF. The witness evidence digest names the exact signed authorization line plus LF. Its coverage digest names the current producer's declared coverage array. Existing Bound authority evaluation verifies signature, admitted algorithm, window, scope coverage and current producer eligibility. No caller-supplied success callback establishes this authority.
+
+The current native port and signed reader mapping must remain admitted. Their selected archive and native member references must match the retained canonical reading context. Inline native receipt carriers are checked by the existing `verifiedReadingReceipts` path, including canonical `reading-context@1` identity and reading receipt identity. The witness `run` names that exact receipt unit scope. All file inputs must match the explicit inventory by name and digest.
+
+The physical reading is then made again from the declared local inventory by the existing Topos physical reader through Bound's adapter. The exact model, parameters, selection, unit, scale, resolution, reader, implementation, context, result and reading identities must agree with the signed witness. The native output must contain the same measured line count at the policy scope. Missing selectors, stray files, links, incomplete inventories, altered inputs, withdrawn ports, old mappings and invalid evidence cannot authorize widening. Proof processing reads only its declared local CAS blob and inventory; it does not resolve arbitrary foreign evidence paths or CI URLs.
+
+The native consumer vector first enables the optional selector and policy through an ordinary act on an existing native place. It records an actual over-ceiling physical reading, refuses absent and forged proof, then attempts a real widening transaction with a signed authorization and retained native evidence. The prior inscription is explicitly withdrawn in the same batch, so a successful act must leave exactly the new effective ceiling. This tests admission and its real act receipt, rather than interpreting a local judge result as a landing.
+
+The previous native preflight root-lock refusal remains preserved in the evidence packet. Native evidence inspection requires the existing Root authority lease; the shared prospective admission and authority-card paths acquire that real lease. This contract adds no bypass flag and does not weaken current protection.

package/docs/contracts/readme.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "README.md",
-      "digest": "sha256:bc8277eaef68f8ab8a049607003502a1979fb58a36f9468d6224ec14df7e131f"
+      "digest": "sha256:1ee7dba6bcdb7fad0280271ea8cf3657719b6aa88efcebe585f8ca9c76664a39"
     },
     {
       "role": "yes",