@lapxo/bound 0.2.5 → 0.2.6

package/dist/wasm/adapter.d.ts

@@ -1 +1 @@
-export {public6_WasmLimits as WasmLimits,public6_WasmRequest as WasmRequest,public6_WasmResult as WasmResult,public6_WasmTrust as WasmTrust,public6_WorkerPort as WorkerPort,public6_digest as digest,public6_evaluateWasm as evaluateWasm,public6_preflight as preflight,public6_runWasmRequest as runWasmRequest} from "../public-types.js";
+export {public9_WasmLimits as WasmLimits,public9_WasmRequest as WasmRequest,public9_WasmResult as WasmResult,public9_WasmTrust as WasmTrust,public9_WorkerPort as WorkerPort,public9_digest as digest,public9_evaluateWasm as evaluateWasm,public9_preflight as preflight,public9_runWasmRequest as runWasmRequest} from "../public-types.js";

package/docs/contracts/authenticated-reference.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/reference-port.md",
-      "digest": "sha256:d6198b9ab177086cb334e9e9cd7adb5c67b0af7165a79d23812aa2496d17674c"
+      "digest": "sha256:7fe99f71468a800f88d64104710b8b877d874f3415b9f4480eee5d30a9d871ae"
     },
     {
       "role": "yes",

package/docs/contracts/authority-preflight.md

@@ -0,0 +1,17 @@
+# Authority card view
+
+`await prepareNativeAuthorityCard(context)` produces a read-only native preflight for exact requested configuration records. `record-coverage` checks current signer eligibility, coordinate coverage and the existing widening witness rule. `admission` additionally invokes the same structured wire, standing-pin, same-lot withdrawal, destination ownership, fork, alias, existing-reading, withdrawn-coordinate and demand checks used by the native admission path. Root and child destinations use their actual authenticated standing. An `allow` covers only this named configuration preflight; the eventual act still verifies its actual signatures, current authority and commit conditions. It never signs, commits, publishes or runs a requested action.
+
+The receiver supplies the Root location and native instrument. Both public operations are asynchronous and retain the existing native Root authority protection while inspecting evidence. The protection is released before the promise settles, including refusals, and nested protected calls reuse their real held protection. Prospective child inspection preserves the caller's preview state and keeps nested Root previews separate. Every call supplies an explicit authority epoch and `{name, unit, now}` clock. Current Root history is freshly authenticated from the original bootstrap anchor; grant digests supplied in request JSON establish nothing. Root history and selected lock bytes must remain unchanged throughout preparation. Operational elapsed-time measurements in existing demand/fold code continue using the actual host clock. They are not substituted for card freshness and are not frozen to the supplied semantic time.
+
+The `catalog` and `standingContract` fields are the exact digests of the shipped refusal catalog and standing contract, read by the existing installed-contract helper. Policy, coverage, budget and judgment digests commit semantic context; they do not name invented files. The card uses the Topos authority-card format and `authorityCardAnswer`. Its coverage commitment binds the real Root location, selected place, key, authenticated current grants and exact action identities. Its snapshot binds the selected lock bytes. Answering reruns the native checks and verifies the reconstructed statement and evidence; it accepts no consumer-provided judgment callback. Grant retirement invalidates a card even when child lock bytes remain unchanged. An expired or obsolete card returns `card-stale`; an action absent from the card returns `not-in-card`. Parsed card shape alone cannot establish authority.
+
+`allow`, `ask` and `deny` preserve the existing check outcomes. `ask` names the missing signatures, widening witnesses, existing readings or unpaid demands. Named native authority, wire, pin, placement, fork, withdrawal and demand refusals produce `deny`. Missing bounded admission evidence remains `ask` with its exact request identity. New demands remain owed until their native judgment is paid. A declared reading-witness policy uses the same witness-admission hook for the view and the act; legacy witnessing remains unchanged when no such policy is selected. Typed-object admission, execution and unrelated aggregate actions are outside this configuration contract and refuse explicitly.
+
+## Request selection
+
+`fold --as authority-card@<scope>` selects exactly one currently admitted Root record at `<scope>` with `form=alphabet`, `role=writes`, `measure=authority-card-request` and a SHA-256 digest in `value`. Two admitted interval records `<scope>/bytes` and `<scope>/items`, each `role=writes` and `value=0..N`, bound the request. The receiver reads local CAS bytes with the declared byte bound before decoding or hashing, verifies the selected digest, and calls `parseNativeAuthorityCardRequest`. It never resolves or executes an offered provider for this view.
+
+The request document contains exactly `profile`, `place`, `key`, `authorityEpoch`, `clock`, `horizon`, `limits` and `actions`. The profile is `native-authority-card-request/1`. `place` is `.` or a declared relative child. `limits` contains positive finite `bytes` and `items`, neither larger than the admitted request policy. Every action contains exactly `kind` (`record-coverage` or `admission`) and `records` (wire-line strings). Clock contains exactly `name`, `unit` and `now`; horizon contains exactly `clock`, `unit`, `from` and `through`. Requested key names, record signatures and clocks are data checked against the current receiver context. The request cannot supply a Root path, store, instrument, trust anchor or private key. Extra `root` or `instrument` fields, unsupported actions, invalid clocks, unbounded input and digest mismatches refuse.
+
+`await answerNativeAuthorityCard(card, requestIdentity, context)` uses the same trusted receiver inputs and fresh explicit request snapshot. Consumers use `nativeAuthorityRequestIdentity(action)` to name an exact action; they do not reconstruct grants or infer permission from a card's shape. All byte/item limits are finite, and preparation persists no admission result or proof cache.

package/docs/contracts/authority-preflight.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/authority-preflight",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/authority-preflight.md",
+      "digest": "sha256:5befc60061e202b1db514a1d591fd193276e3d158b26860ebe534d5d7eef4d64"
+    },
+    {
+      "role": "yes",
+      "path": "samples/authority-preflight/yes.json",
+      "digest": "sha256:4cc9fb389fad93be81262c450a279f5c7545a0c14e35360fdf046ed7895b66aa"
+    },
+    {
+      "role": "no",
+      "path": "samples/authority-preflight/no.json",
+      "digest": "sha256:803eeb7b829c32e05dbee392e249e3c304eb77f5f7876982e64eed1bf4533c78"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/authority-preflight.vector.json",
+      "digest": "sha256:87c018d8997e83ef7cf618c7b239552fdb8ef392f9ef9d0678914752fd6a28d4"
+    }
+  ]
+}

package/docs/contracts/installed-package.md

@@ -0,0 +1,21 @@
+# Installed package identity
+
+`installedPackageIdentity` reads a selected installed package directory. Its caller supplies the receiving instrument's admitted `pin-shape` value, a complete authenticated regular-file inventory, explicit package export selectors, authenticated dependency snapshots and bounded resources. As in the existing provider, the manifest is `<shape>.json`; an admitted shape of `package` selects `package.json`.
+
+This is a content identity and a preparation result. Caller-supplied inventories and pins establish no authority by themselves. The API neither discovers a publisher nor admits a dependency, signs a lot, executes package code or pays an owner receipt.
+
+Every regular file must occur once in the expected inventory with its exact SHA-256 digest. Missing, changed and extra files refuse. Symbolic links, special files and members outside the selected physical directory refuse. Empty directories, timestamps, filesystem locations, ownership and archive headers do not contribute bytes. Package names and versions come from exact manifest bytes; portable module delivery currently requires an ESM manifest and its existing supported member/edge forms.
+
+The implementation reuses Topos `topos-inventory/1` to prove explicitly selected package exports, then Bound's existing `deliverModuleClosure` and `moduleInventory` to verify reached modules and consumed dependency pins. `parent: "self"` names the installed root snapshot in a dependency binding; other parents use exact authenticated snapshot identities. Unknown bare imports and computed or unsupported edges retain the existing closure refusals. A snapshot's expected identity is supplied by its authenticated host; this API does not create that authentication.
+
+Module reachability is file reachability. A reached module retains all its bytes, including unused symbols. An unreachable local module is absent from the reached module inventory but remains part of the complete installed file identity. Altering that local file changes the installed identity when a correspondingly revised inventory is supplied. Unconsumed dependency pins cannot add modules or alter the consumed closure.
+
+The returned `snapshot` hashes the existing canonical wire file-digest inventory, sorted by coordinate and terminated by newlines. The returned installed `digest` hashes sorted canonical wire lines followed by a final newline: the `installed/profile` id `bound-installed-package@1`, `installed/manifest` exact digest and declared shape/name/version, every `file/<coordinate>` digest, the canonical Topos export-inventory digest, the verified closure and delivery digests, and each consumed dependency binding's parent/specifier, snapshot and entry. All lines use the existing canonical wire encoder and shared host SHA-256 implementation. The complete preimage is returned as `lines` for review and independent comparison.
+
+These identities name different bytes: a compressed `.tgz` digest commits the exact compressed archive; a tar digest commits the exact uncompressed tar representation; the installed digest commits the canonical installed-byte evidence above. Repacking identical files may change either archive digest while the installed identity stays equal. An installed directory cannot recover or certify the original `.tgz` digest. The result intentionally contains no `archiveDigest` claim.
+
+Local stable refusals include `installed/resources`, `installed/cancelled`, `installed/inventory`, `installed/missing-member`, `installed/member-integrity`, `installed/uninventoried-member`, `installed/external-member`, `installed/manifest`, `installed/text-member`, `installed/export` and `installed/pin`. Existing module/export verifiers retain their named diagnostic causes. No observations, writes, compilation, installation or admission occur during this reading.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/installed-package.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/installed-package.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/installed-package",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/installed-package.md",
+      "digest": "sha256:b7fd04fc1318f405fce1c785047cf59a2185216452f83ea86774d7416b7b92b4"
+    },
+    {
+      "role": "yes",
+      "path": "samples/installed-package/yes.json",
+      "digest": "sha256:2563ba668607ea7166dcdcd7c8c5f0f61c981cf4c4bfbb45c701fd7a0ea62459"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/installed-package.vector.json",
+      "digest": "sha256:1c971130a6c718dbdbb023caada2623123ebcef7d364f18df3b36ed62bb6edad"
+    },
+    {
+      "role": "no",
+      "path": "samples/installed-package/no.json",
+      "digest": "sha256:de51ebb969b78bc278daf27443cf699a377e18a391bab248ce92f022f30a5606"
+    }
+  ]
+}

package/docs/contracts/materialized-leaf-sequence.md

@@ -0,0 +1,15 @@
+# Materialized leaf receipt sequence
+
+A consumer may admit a version or prose change, request only `fold --as receipts`, then request `fold --check`. Receipt-only rendering must not certify a previously rendered README or manifest against the newly admitted source. The existing native receipt renderer checks each required ordinary view against its current semantic render before issuing region counts and byte seals. A valid byte digest alone does not establish semantic freshness.
+
+The focal vector `test/materialized-leaf-sequence.test.ts` runs that exact sequence in two unrelated disposable places. It installs an actual content-addressed capsule that renders Markdown and a JSON manifest from admitted version and prose claims. Bootstrap and edits use the existing real file signing port with disposable fixture authority. No normal fold, fresh leaf renderer invocation, output copy or byte reseal is inserted between the admitted edit and the receipt-only/check sequence.
+
+The stale outputs remain unchanged during the receipt-only request, and the immediately following check refuses closure. A normal subsequent fold renders the updated leaves and recovers closure. An altered or absent README or manifest also cannot pass closure after a receipt-only request.
+
+The delivery scope is explicit. The default receipt guard requires all ordinary outputs declared for the source. A delivery explicitly selecting only README may omit an unrelated source-only manifest; absence never chooses that subset implicitly. Removing a selected README refuses the selected seal as well. The focal vector checks this binding once per place and leaves the broader delivery mutation matrix to the existing `pass-receipt-order` vector.
+
+This is a consumer conformance vector for the existing materialized-output guard. It adds no evaluator, rendering implementation, admission authority or runtime exemption. Passing the vector establishes the tested native behavior, not owner authorization, publication or final release closure.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/materialized-leaf-sequence.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/materialized-leaf-sequence.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/materialized-leaf-sequence",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/materialized-leaf-sequence.md",
+      "digest": "sha256:02cc03bb02c3f8d4f9ffabc1d18109fb1f05a65fecc613f75211a5a396f1d1fa"
+    },
+    {
+      "role": "yes",
+      "path": "samples/materialized-leaf-sequence/yes.json",
+      "digest": "sha256:7180af00a4df73b33edfe9a84a840916859dbf19226afbe156563ed16641f6e2"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/materialized-leaf-sequence.vector.json",
+      "digest": "sha256:64f8e08343b68d926d340058d41350a4d39396e5fb30ea1742655fa1911ca5c2"
+    },
+    {
+      "role": "no",
+      "path": "samples/materialized-leaf-sequence/no.json",
+      "digest": "sha256:3a487c275e646287ccab47a217ada65db7abc05c2e0b97af5d6d8ee87a70859f"
+    }
+  ]
+}

package/docs/contracts/module-inventory.md

@@ -0,0 +1,15 @@
+# Verified module inventory
+
+`moduleInventory` from `@lapxo/bound/closure/native` projects the already verified executable delivery through the existing closure verifier. Its unit is a module, not a symbol. It neither compiles nor executes the offered code and introduces no second traversal or dependency parser.
+
+The receiver supplies exact delivery bytes, their expected SHA-256 digest, the existing finite member/source/response-byte limits, declaration context (`scope`, `by`, `at`) and exactly one source/version declaration for each reached snapshot. Source and version are receiver declarations; the snapshot identifies bytes and does not authenticate a publisher's version claim.
+
+Each reached module becomes an existing canonical wire line. Its digest is `value`; `about` contains the `module-inventory-record/1` profile: `unit`, `source`, `version`, `snapshot`, `module`, `digest`, and `reachedFrom`. `reachedFrom` identifies the verified closure which reached the module, not an immediate importing module. The output also names the exact delivery and closure identities. No new wire fields or fixed application regions are introduced.
+
+An unreachable module does not enter the executable closure. A different source-envelope identity may change provenance and the inventory receipt even if the executable sources remain equal. Missing or altered module digests and changed carrier bytes refuse through the existing delivery verifier; they are integrity failures, not forks. Incomplete or duplicate source declarations refuse without a partial inventory.
+
+## Native quartet
+
+Two unrelated carriers, field notes and water levels, contain two reached modules and one excluded module. The native publication process vector imports the compiled public API, compares the exact canonical inventory with its captured `.bound` sample, verifies repetition and rejects changed carrier bytes, missing module digests and absent source declarations. Declared case inputs commit the positive carrier, expected inventory and negative carrier. The two cases run under the existing publication instrument and its unchanged budgets.
+
+The contract is rendered by the existing selected text renderer from a prospective public text declaration. Owner admission, final Root receipts, the release archive and another-machine portability remain separate obligations.

package/docs/contracts/module-inventory.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/module-inventory",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/module-inventory.md",
+      "digest": "sha256:78a59399c1cc34dde341a163db30341695c1a8a731a051ae8c9086549cf60c6c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/module-inventory/yes.json",
+      "digest": "sha256:fd65eb40a9478266afc4503dabb3cf9162791c6eb7576e4579ed86f29b41f41a"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/module-inventory.vector.json",
+      "digest": "sha256:b030fd7821ef69a3aa0cd36f15497074bbb55b6a614e27d5995ff20bb44922fe"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/module-inventory/no.json",
+      "digest": "sha256:530195b262a957949ed0b6448fbd962f03456eaa6851f130c15b657560060303"
+    }
+  ]
+}

package/docs/contracts/native-host.md

@@ -18,4 +18,32 @@ The host selects context explicitly on every call. Calls do not interpret consum
 
 The two positive places are a seed accession library and a coastal tide survey. Each installs the public host boundary, bootstraps disposable fixture authority through the real CLI, admits a domain-specific Root lot, compares native result recovery and repeats the held lot without signing again. Negatives alter bytes, remove signer coverage, cancel before commit and offer a noncanonical lot; no negative may create a visible act. Test keys are created only for the disposable fixture, never shipped.
 
-The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Head, browser hosts, algebra, wire and ceilings are outside this change.
+The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Algebra, wire and ceilings retain their existing contracts.
+
+## Consumer-owned persistent native host
+
+`await startNativeHost({place, instrument, expectedInstrument, limits, environment, signers?, scratchParent?})` starts one native dispatcher for one explicit place. `request({verb, args, signer?, inputs?}, signal?)` accepts `fold`, `sign` and `land`. It calls the same dispatcher, signer protocol, admission judges, exclusion and atomic publication as the CLI. A carrier never supplies a verifier, trust anchor or capability registry. `close()` aborts the active request and waits for cleanup. IPC disconnect also closes the host when the consumer dies; no daemon is installed.
+
+The queue is finite. `requestBytes` bounds the aggregate queued request data, `queuedRequests` bounds request count, `responseBytes` bounds each response and `timeoutMs` bounds startup and triggers request cancellation. `heapMiB` selects Node's old-generation heap limit; it is not a claim about total operating-system RSS. Native file, capture and execution bounds remain those already declared by the place. The host refuses another instance for the same canonical place in one consumer; every act retains the existing cross-process CLI exclusion protocol. Calls never change the consumer's environment, cwd, arguments, console or exit status.
+
+`nativeHostEnvironment` removes all `NODE_` and `UV_` controls from the explicitly supplied environment. The fixed memory flag and actual sanitized environment belong to reading identity. CLI comparisons use that same boundary, rather than pretending that different execution environments have one identity. The host starts once; a query does not start another dispatcher.
+
+An injected signer is selected by receiver key and declared mechanism name. Its callback remains in the consumer, receives only the canonical signing lot and cancellation signal, and uses the existing bounded signing port and signature verification. Signing never grants admission. Lost application responses are recovered by the original committed act identity; redelivery does not create another act.
+
+`inputs` contains uniquely named UTF-8 request files. Arguments name these files as `@input/<name>`. They are staged only in an owned request directory and removed after success, refusal or cancellation. Caller-owned places and arbitrary caller files are never deleted as scratch. Shutdown removes the owned host scratch directory. Before visibility, cancellation publishes no partial act; after visibility, the committed native identity remains historical evidence and is never represented as a rollback.
+
+The response retains raw stdout, stderr and exit status. Identity/text, signatures, refusal catalog records and recovered canonical act records are compared byte for byte with CLI vectors. Independently measured elapsed-time diagnostics are retained as operational evidence, not normalized or presented as byte-identical measurements. Fresh verification is proportional to consumed bytes. The separate consumer acceptance measurement reports 1x, 10x and 100x, ten samples plus one warm-up, real clock/load, elapsed milliseconds per decimal MB and persistent growth; no constant-time property is claimed.
+
+Every persistent request rereads current file and ledger bytes, including externally edited bytes with unchanged size and timestamps. The receiver-selected public instrument lock is checked again before dispatch; retained parsing never grants authority to a later request.
+
+## Installed pin, signer registry and foundation
+
+`installedHostInstrument(request, entry)` reuses `installedPackageIdentity` and returns the instrument with its installed-byte digest. Startup requires `expectedInstrument`, selected by the receiver from its admitted package pin. It verifies those bytes before and after child startup. Neither the archive digest nor a physical pathname substitutes for the installed identity; identical installations have the same digest.
+
+`signers` is a receiver-owned map indexed by key ID, with no fixed key count. Every signing request explicitly names its `signer`. The selected binding must match the lot key: a mismatch refuses with `host/signer-mismatch`, while a missing binding refuses with `host/unbound-signer`. Neither acquires another key or admits any record. The former single-binding option only registers that binding; it never selects a signer implicitly and does not limit the registry.
+
+Cross-process land semantics are `serialize`: admitted-place requests acquire the existing native tree exclusion before preparing a lot. Two consumer processes commit in that order with consecutive epochs. There is no automatic rebase or retry, and the CLI uses the same native exclusion protocol.
+
+A birth directory containing only its public birth lock may be founded through `land`, using the classic bootstrap implementation and injected signer. Other operations refuse with `host/foundation-required` until foundation. An existing empty or unauthenticated store refuses with `host/foundation-state`; it is never overwritten or founded again. The executable vectors use two unrelated disposable places and compare signatures, founder ledgers and subsequent native closure with the CLI.
+
+Act-cost accounting starts separately for each request and includes all work in that request. Client idle time and earlier requests do not accumulate into a later act; no declared execution or observation is omitted from its own accounting.

package/docs/contracts/native-host.publication.json

@@ -4,22 +4,22 @@
     {
       "role": "contract",
       "path": "docs/contracts/native-host.md",
-      "digest": "sha256:e7821cd2641caa4725aa20095027d903693756a8568a2163a79d7bb665b7643b"
+      "digest": "sha256:bb2aa48641c28e95d8dab39690ee6228ae6a2078e38e3a55add6a92a99958109"
     },
     {
       "role": "yes",
       "path": "samples/native-host/yes.json",
-      "digest": "sha256:6c02edaea00db315e20b15f96b281cf605db2c7499f3d1b9839096a704492c44"
+      "digest": "sha256:f8838fc73551746b71e3afa8fe3d25fb2a33ac20d163fd2b5024552209ec47eb"
     },
     {
       "role": "vector",
       "path": "vectors/native/native-host.vector.json",
-      "digest": "sha256:b62d77a3de11d960657fa9e7b58d4e88c68d0c389d683937bba4fa6c04a9d952"
+      "digest": "sha256:13d0d8a9f1cda39e861a36d835f5af683579c9d3a0b60eefe7fee71e3094ddc4"
     },
     {
       "role": "no",
       "path": "samples/native-host/no.json",
-      "digest": "sha256:27f323ca2a0d1547197e6beab3427bdcda45c0318fac52bc58b2b0164a2df38d"
+      "digest": "sha256:80c8d868158514e3e44273570dccb553c28daf591061f343c3c0b7e32352d49b"
     }
   ]
 }

package/docs/contracts/native-probes.md

@@ -0,0 +1,13 @@
+# Native probes
+
+`prepareNativeProbe` reads an explicit local `lines` or `evidence` form. Its result names the same identity and returns the same captured text as `prepareNativeViewIdentity`; it never falls back to folding an unsupported form. Expected identities use the existing native view identity contract. Foreign evidence without a transport snapshot refuses.
+
+The consumer supplies a port coordinate, finite `probes` and `responseBytes` limits, an optional cancellation signal, and a counter `{used: new Map()}`. The consumer owns that counter and keeps it for the entire operation, sharing it across calls on the same port. Different ports have independent counts. Bound persists no counter, receipt, cache, memo or other probe state. Resetting a counter begins a new consumer operation; the counter is operational accounting, not a grant of authority.
+
+Each attempted captured reading consumes one probe even if identity validation or response size later refuses. Invalid forms, invalid limits, exhausted counters and already cancelled calls consume none. The place's admitted `reading-identity/probes` limit further reduces each port's available probes; the existing admitted byte and file budgets constrain the capture. The response byte limit covers the complete JSON fact. Cancellation is checked before capture and before returning its result. Capture is synchronous; cancellation from another event-loop task cannot preempt a synchronous capture.
+
+Repeated probes with unchanged committed inputs preserve the native view identity and every persisted byte. A consumer can verify this without deriving another identity: compare the supplied public native identity before and after its operation, and compare persisted byte inventories. Newly admitted evidence remains subject to the existing identity contract.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/native-probes.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/native-probes.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/native-probes",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/native-probes.md",
+      "digest": "sha256:c2d62182203539ed42a5833fe6d528309f43207286600559a387eaec6cccf545"
+    },
+    {
+      "role": "yes",
+      "path": "samples/native-probes/yes.json",
+      "digest": "sha256:4d32c55b4d14a85b6231eb017fac96f95453db5b35bb1eaa4cb8213aa9744a09"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/native-probes.vector.json",
+      "digest": "sha256:14788a562ba51c8bfb3bfd3d2b9abfca67f4236f748ff724ad528917b77574ef"
+    },
+    {
+      "role": "no",
+      "path": "samples/native-probes/no.json",
+      "digest": "sha256:72ff9a3c323836e1fcb814afebe7dbb5d196db505138b2a80a0e9e34a8c3128f"
+    }
+  ]
+}

package/docs/contracts/native-publication.inventory.json

@@ -11,6 +11,14 @@
     "contract/published/host-ports",
     "contract/published/readme",
     "contract/published/native-host",
-    "contract/published/reading-identity"
+    "contract/published/reading-identity",
+    "contract/published/module-inventory",
+    "contract/published/native-view-batch",
+    "contract/published/native-probes",
+    "contract/published/physical-lines",
+    "contract/published/profile-composition",
+    "contract/published/installed-package",
+    "contract/published/materialized-leaf-sequence",
+    "contract/published/authority-preflight"
   ]
 }

package/docs/contracts/native-view-batch.md

@@ -0,0 +1,17 @@
+# Native view identities in one observation
+
+`prepareNativeViewIdentities` from `@lapxo/bound/host` accepts an explicit place, receiver-selected native instrument, distinct supported view names and optional expected identities. It returns each view's identity and text together. The CLI exposes the same operation as `bound fold --as reading-identities@lines+evidence`.
+
+The native projections currently supported are `lines` and `evidence`. An empty, repeated or unsupported selection refuses by name. This is a finite implementation capability, not a list of possible application regions. Executable and foreign-transport views retain their separate contracts.
+
+Each identity names that view's consumed inputs, current committed inventory, selected implementation, instrument configuration, environment and day boundary. The existing `native-view-inputs@1` framing is retained. Request order and the presence of another selected view do not alter a view's identity. A different execution environment can produce a different identity even when the text is identical.
+
+Within one synchronous call, native preparations share captured source bytes and independently retain each view's input membership and admitted byte/file budgets. Every source is freshly verified before return. The admitted reading count bounds the selection. A batch does not persist a cache, execute an observed reader, call the general fold or acquire Root exclusion. Later calls capture their sources again.
+
+An unsupported selection, exceeded budget, changed input, changed committed inventory or mismatched expected identity returns one typed refusal and no partial view results. Identity and text belong to the same successful observation. Existing single-view host and CLI routes remain available.
+
+The native vector checks two unrelated admitted places, both public projections, request reordering, stable repetition, expected-identity refusal, source invalidation, writer exclusion and a complete persisted-byte inventory. A changed source during shared capture refuses before return. Performance is measured separately; this contract promises no constant-time query or unmeasured speed ratio.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/native-view-batch.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/native-view-batch.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/native-view-batch",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/native-view-batch.md",
+      "digest": "sha256:8ca692baadda00de217f8b8b0fc4f20d60fdc478ec6d330fdd8e22ca94e1b78d"
+    },
+    {
+      "role": "yes",
+      "path": "samples/native-view-batch/yes.json",
+      "digest": "sha256:608d00c4a39b987b435560dddf6aa8e72f69aedbd8541c6798913504b4be01d1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/native-view-batch.vector.json",
+      "digest": "sha256:bd5c598929ec1ed65d273f9ea1d271e79401fa7aea8467e48a7fc72de0bde381"
+    },
+    {
+      "role": "no",
+      "path": "samples/native-view-batch/no.json",
+      "digest": "sha256:6228f650501222593f46a9015a6e73908b3d302b8671348b54bd9c80f66c8bdc"
+    }
+  ]
+}

package/docs/contracts/physical-lines.md

@@ -0,0 +1,19 @@
+# Physical lines and reading witnesses
+
+The host adapter `readPlacePhysicalLines` reads every regular file inside explicitly named inventory boundaries. It has no implicit exclusions. Files outside every selected region are returned by name in `stray`. Missing selectors remain unmeasured by scope and selector, including a missing selector beside another selector that matched. Links, special files, incomplete inventories and exhausted resources cannot produce a complete reading.
+
+Counts, selectors and finite region valuation delegate to Topos `readPhysicalLines`. Empty files contain zero physical lines. Blank and comment lines count; LF and CRLF delimit lines; an unterminated final line counts. Isolated carriage returns and invalid UTF-8 refuse. Overlapping regions retain Topos overlap evidence and are never certified disjoint by this adapter.
+
+`physicalLinesRegions` projects selectors from the consuming place's already admitted standing. A `core/lines` interval reads the `region/core` coordinates declaration. Other region names follow the same rule. No application or directory family is built into the adapter. The caller must choose and authorize the finite inventory boundaries and resource policy.
+
+`judgePhysicalLines` delegates interval thresholds to the existing Bound `foldCeilings` and policy widening to `widenedWithoutWitness`. It accepts `lines` and `file-lines`; file observations retain their actual coordinate. Over-ceiling observations or unauthenticated widening produce `BLOCK`. Missing selection or stray files produce `UNMEASURED`. No declared line ceiling produces `UNMEASURED`.
+
+Reading witness syntax is Topos `topos-reading-witness/1`. Every reading, model, input, selection, unit, scale, resolution, reader, implementation, context, run and result field must match this actual reading. Actual reading handles are immutable and local to the host process; parsing a serialized reading cannot recreate a trusted handle.
+
+The consuming host supplies `PhysicalLinesWitnessAuthority` from its admitted current producer policy and evidence verifier. Key evidence must match the declared key and coverage. CI evidence must match repository, commit, workflow, run and attempt before proof verification is invoked. The proof port must authenticate evidence over the exact Topos statement bytes. Neither a URL nor valid syntax establishes authority. The adapter supplies no default trust rule, key store, network provenance lookup, admission, persistence, signing or publication.
+
+After successful proof verification, `authenticatePhysicalLinesWitness` returns the exact `attest:sha256:...` coordinate that a proposed widening must name. A coordinate with the right prefix, without verified matching evidence, remains blocked. Integrating the adapter into an owner-authorized landing transaction remains the consuming host's responsibility; `READY` is a native judgment, not a persisted landing or admission.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/physical-lines-place.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/physical-lines.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/physical-lines",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/physical-lines.md",
+      "digest": "sha256:d0b780a4573cee69ec6f68305c2b196340aa73dbc48114af003816333fdffb1a"
+    },
+    {
+      "role": "yes",
+      "path": "samples/physical-lines/yes.json",
+      "digest": "sha256:3d54c37d2010cc3baf7f6eef0781b6b22eb004ecdccf9f91a59b354038151dd1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/physical-lines.vector.json",
+      "digest": "sha256:2626860abd968214a57f1ec54162c74890ea76476156984f8a5c7d6da90a8ffb"
+    },
+    {
+      "role": "no",
+      "path": "samples/physical-lines/no.json",
+      "digest": "sha256:faab4bdc0339583cab3b62e5ddb1d5a4c0b115df4bbd4455edb09cf878cd742b"
+    }
+  ]
+}

package/docs/contracts/profile-composition.md

@@ -0,0 +1,17 @@
+# Profile composition and release categories
+
+`composeProfile` prepares an authenticated lot without admission or persistence. It reads Topos `topos-profile-composition/1` records, resolves every parent from its exact SHA-256 digest and delegates form composition to Topos. The digest preimage is the canonical profile line followed by one newline.
+
+A parent record supplies declarations, never authority. Each inherited and local field requires exactly one original signed statement whose scope, role, form, measure and value match its selected binding and whose `restsOn` names the exact profile digest containing it. The current consumer lock supplies admitted signers, signature algorithms, windows and region coverage through Bound's existing authority evaluator. No parent can grant a signer coverage.
+
+Narrowing and additions require those signatures. Interval and alphabet widening use Bound's existing widening judge: the authorized statement must carry the witness-class `at` selected by the consumer's wire. A parsed Topos reading-witness record alone does not satisfy this rule. This is the existing admission witness convention, not independent verification of scientific provenance. Preparation does not pay inertness, observations, admission gates or owner receipts; ordinary admission remains required.
+
+`releaseCategoryPins` selects exact artifact lines by declared category, class, scope, role and digest measure. It accepts only alphabet digest bindings. It never selects a numeric code ceiling, and has no package-family prefix list. `composeProfile` selects category lines from the same authenticated statement set. Callers of the standalone selector must supply already authenticated standing. Dependency, vocabulary and source archive categories can each declare their own exact scopes.
+
+Missing and ambiguous categories refuse as `release/category-missing` and `release/category-ambiguous`; absent, ambiguous and mismatched artifact bindings refuse as `release/pin-missing`, `release/pin-ambiguous` and `release/pin-integrity`. A class mismatch refuses as `release/category-class`. Profile authority, widening and unresolved parents refuse as `profile/authority-required`, `profile/widening-witness-required` and `profile/missing-parent`. Topos record/integrity refusals preserve their existing named causes.
+
+The returned lines retain inherited evidence and local statements; they are a preparation result, not a claim that an authorized widening erased an ancestor's meet constraint. Topos' declared composition remains authoritative for the effective intersection. Applications that intend a revision must use the ordinary admission flow to revise standing explicitly.
+
+## Declared native case inputs and outputs
+
+The published yes/no JSON files are actual parameters read by `test/profile-composition.test.ts`. Each native procedure retains its semantic assertions and unrelated disposable places. The vector invokes that procedure through the existing Node test reader. The input JSON declares exact case source strings and negative argument values; generated source, output and receipt bytes are read and checked by that same procedure. These public parameter fixtures contain no retained private authority history. Passing test output is not a real Root receipt or permission to admit a lot.

package/docs/contracts/profile-composition.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/profile-composition",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/profile-composition.md",
+      "digest": "sha256:19b8a7d8b08590e39d23aa3775116e96c787d9bc22d9cd53b911b8f5a3c49314"
+    },
+    {
+      "role": "yes",
+      "path": "samples/profile-composition/yes.json",
+      "digest": "sha256:48a5524520182e7e64fb0aa3b27e7931f4a2a3dbe096589dbaa3caaa0dde556a"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/profile-composition.vector.json",
+      "digest": "sha256:ce43584069b3957fd6c2967975367cf398aa77e54b137c7ccb312fa5a5625252"
+    },
+    {
+      "role": "no",
+      "path": "samples/profile-composition/no.json",
+      "digest": "sha256:13b00555d7e00a1c2d05cae2aaa42e7c4301ca74cf60f9ca3428f623a1358948"
+    }
+  ]
+}

package/docs/contracts/profile-preparation-native-meaning.md

@@ -0,0 +1,9 @@
+# Profile preparation and native meaning
+
+A `prepared` profile is not a native act receipt. Its inherited and local statements remain evidence for composition. For a field declared with mode `meet`, the effective value is the selected Topos lattice meet of every inherited and local constraint.
+
+The installed native consumer vector checks this distinction for interval and alphabet fields in two unrelated places. Narrowing prepares and lands through the actual CLI. Witnessed widening also prepares and lands its authenticated statements, while the actual effective native standing remains the ancestor/local meet. In particular, a witnessed local interval `0..9` over an inherited `0..5` still composes to `0..5`; the witness does not erase the ancestor. Additions have no ancestor and receive their own actual act receipt.
+
+The vector compares both prepared composition and effective admitted standing with `composePolicy` and the selected lattice's `meet` and `leq` operations. It defines no alternative interval or alphabet arithmetic. Claims that a raw prepared lot necessarily forks were removed after the actual native implementation demonstrated compatible distributive composition. That test correction changes no runtime semantics.
+
+An application intending to revise an ancestor must explicitly withdraw or revise the prior native inscription under the existing admission rules. Returning `prepared`, accepting a witness-shaped context, and actually persisting an authorized revision are separate events and must be reported separately.

package/docs/contracts/publication.md

@@ -15,3 +15,15 @@ Each declared reading and each host invocation is measured separately. The total
 Full-resolution native reading receipts carry the verified canonical UTF-8 input closure in the bytes row and the verified output in the count row, through the wire’s existing about field. Count, digest and measured duration keep their existing meanings. The host verifies the supplied bytes against those digests before reuse; an altered supplied carrier is not replaced by a cached copy. Historical local-only receipts still require their authentic CAS bytes. No private ledger or store is needed to verify a complete public receipt.
 
 File-region seals hash configuration through Topos’s existing publication projection. Admission envelopes and retired history stay in the authority ledger; live declarations and ordinary file bytes remain inputs. Object history uses its own contract. A public checkout must carry receipts made for its actual files and compiled reader, not seals copied from a different tree. Verification does not run readers, fetch dependencies, refresh receipts or grant authority.
+
+## Current rendered leaves
+
+A native file receipt cannot certify an obsolete declared rendered output after its admitted source changes. Receipt projection uses the existing declared view renderer to compare each applicable non-receipt output with its current expected bytes. Until they agree, resolution 1 withholds both file-region counts and byte seals; the byte-only sealer cannot turn that incomplete semantic projection into a closed receipt. Receipt views do not recursively certify themselves.
+
+The normal render pass writes ordinary outputs before asking that same receipt renderer to seal them, including outputs prepared by workers. A receipt-only command may leave the region open; `fold --check` must refuse an obsolete output without repairing it. The next ordinary fold renders and closes it. This rule is shared by the native renderer and CLI, does not impose an external render-first workaround and does not authorize any write or admission. Two unrelated executable places cover admitted declaration changes, unchanged reuse, a clean public checkout and changed-input refusal.
+
+## Materialized delivery boundary
+
+A declared view is also a capability: its shape need not be materialized in every distribution. An ordinary place checks every applicable non-receipt rendered output. During a delivery projection only, the trusted formation recipe passes the manifest-selected coordinates captured before copying an already closed source to the existing native receipt renderer. The kernel does not parse the package manifest, infer selection from missing files or name application-specific regions. A carrier cannot choose this projection scope or change authority.
+
+The guard checks each selected output against the same view renderer. Missing or altered selected bytes withhold both region counts and byte seals. An omitted source-only output is not certified as present. With no explicit delivery scope, the original full-place rule applies. The source must close before forming a distribution, and the resulting public tree must pass native `fold --check` before packing.

package/docs/contracts/reading-identity.md

@@ -20,7 +20,7 @@ The native test forms two unrelated disposable admitted places, counts and catal
 
 The negative places retain a receipt but withdraw the current native grant, and alter the archive bytes under their selected digest. Both refuse. Focused vectors also cover missing physical input, changed dependency, stale handed bytes, cancellation, resource exhaustion and unrelated maintenance. Existing environment, authority and descendant-receipt vectors remain applicable and are reused.
 
-Two places on this Mac do not establish another-machine portability. L6 stays pending. This quartet neither admits Root's new reader bindings nor certifies the full 0.2.5 release.
+Two local places do not establish cross-machine conformance. This quartet neither admits Root reader bindings nor certifies a complete release.
 
 ## Native lines and evidence
 
@@ -30,8 +30,32 @@ This operation performs configuration authentication and projection, not the reg
 
 Identity commits the native view, local place, authenticated configuration, selected authority/evidence histories and source bytes (including selected receipt inputs), exact implementation closure and instrument lock, effective runtime/environment, and UTC expiration-policy day. Input names and values are framed; no consumer directory fingerprint is accepted. Unconsumed fold caches, stamp memos and exclusion bookkeeping do not participate. The local execution identity is distinct from portable semantic standing identity.
 
+### Writes and derived storage
+
+The following classification applies to the declared native `lines` and `evidence` views. A path is not an authority boundary: selected bytes still participate wherever they are stored.
+
+| Write | Participates in the next identity | Reason |
+| --- | --- | --- |
+| Admitted declarations and authority changes | Yes | Authentication and effective declarations consume them. |
+| Admitted evidence, including consumed receipt or blob bytes | Yes when consumed by the selected view | A new observation changes what that view reads. |
+| Unconsumed maintenance: `.bound/cas/memo/`, `.bound/ledger/fold.bound`, `.bound/locks/` | No | These are derived caches or exclusion bookkeeping, not selected inputs. |
+
+The CAS blob directory is not excluded as a whole. A selected blob or receipt must verify against its committed digest; corruption refuses. A probe that adds no evidence preserves identity. Executing a reading that admits evidence may change it. Consumers request the public identity instead of reconstructing it from this table or scanning directories.
+
+Identity inspection is not promised constant-time over arbitrary mutable storage. Its measurement separates process startup, authentication, input capture, identity framing and result projection; a reused identity must still verify the inputs committed by its contract.
+
 The existing admitted preparation limits remain required for identity requests; inputs and implementation sources count against their byte/file budgets. Preparation does not execute projection probes or final readings. Only unqualified local native lines and a single unshaped native evidence view are supported. Foreign evidence needing an asynchronous transport snapshot and unsupported views refuse by name. No fallback executes their fold.
 
 Existing catalog codes apply: `reading-identity/selection` for unsupported selections, `reading-identity/context` for changed or mismatched snapshots, `reading-identity/budget` for missing/exhausted limits, and `reading-identity/failed` for unavailable implementation inputs. Public CLI machine records carry those codes.
 
-Seven native vectors cover repeated identity, added evidence, changed configuration, unchanged fold maintenance, distinct places, unsupported selections and identity-to-result binding with a stale refusal. Both unrelated places also answer while a Root writer holds exclusion; complete store comparison verifies no writes. Existing view/landing behavior without identity budgets is retained. These vectors do not establish L6.
+Seven native vectors cover repeated identity, added evidence, changed configuration, unchanged fold maintenance, distinct places, unsupported selections and identity-to-result binding with a stale refusal. Both unrelated places also answer while a Root writer holds exclusion; complete store comparison verifies no writes. Existing view/landing behavior without identity budgets is retained. These vectors do not establish cross-machine conformance.
+
+## Repeated unchanged queries
+
+For the declared local native `lines` and `evidence` projections, repeated queries without changed consumed inputs preserve both identity and exact result text and write no persistent files or bytes. This includes the first query and every CAS/memo and ledger file, without exclusions, garbage collection or a consumer-maintained cache key. This guarantee does not cover final reading execution, other view forms or storage written by an embedding application. The consumer retains its own query counter.
+
+The executable protocol queries each view eight times in two unrelated admitted places, compares the complete persisted tree after every query and reports file/byte counts. A deliberately writing stub is rejected by the same tree comparison. The fixtures use disposable authority, and this protocol does not inspect unrelated consumer stores or claim to resolve their storage incidents. No GC, LRU, storage-size policy or constant-time claim is introduced.
+
+The quartet also checks that receipt-only projection and the byte-only sealer cannot close an obsolete declared output after an admitted source change. The normal native fold renders current bytes before sealing, as specified in the publication contract. This applies to every declared output shape, without application-specific selectors.
+
+The rendered-leaf vector also projects two manifest-selected public subsets. Each keeps the declared view capabilities while omitting one source-only output. The same native renderer accepts those subsets, refuses a missing or altered selected leaf and preserves the default full-place refusal. Selection is captured before copying a closed source; it is never inferred from file absence.

package/docs/contracts/reading-identity.publication.json

@@ -4,22 +4,22 @@
     {
       "role": "contract",
       "path": "docs/contracts/reading-identity.md",
-      "digest": "sha256:0db77ff0553ea92ed4f47f587f1a026a59279c3a4abb00a662eefd5952e6de1c"
+      "digest": "sha256:7a561c902daacc69beb256ed20b04e2b840b7af47c9e64596e1b8d1ebea06b1c"
     },
     {
       "role": "yes",
       "path": "samples/reading-identity/yes.json",
-      "digest": "sha256:5b40b3546e99bf7c646a15fc04241400199b6130b5ff35c142d70a4f68bf12fb"
+      "digest": "sha256:660c07bcca7237dcdec5c0db294e8d164c1ff89c0061a3b4c1f0c2d3813b2cc2"
     },
     {
       "role": "vector",
       "path": "vectors/native/reading-identity.vector.json",
-      "digest": "sha256:42bac03e64bd525398e9843cb8e8a256c46041a0c22e0d6774f523b1b283cb9d"
+      "digest": "sha256:e9a5f2b0318c1495e951edf05c99c7403f438e8b0bce66cc55749237fc2b4865"
     },
     {
       "role": "no",
       "path": "samples/reading-identity/no.json",
-      "digest": "sha256:77b63c1eb80a98e66d38cf357698166b178ae1d344939ec2bcaf74e5a2fd96c4"
+      "digest": "sha256:1775647462c2a933173be57269cbf21a8ac33b54e579539536543386a085ecff"
     }
   ]
 }