@lapxo/head 0.1.4 → 0.1.5

package/TARGET.bound

@@ -1,5 +1,5 @@
 bound-lock/1 about="# Connect any API\n\nhead reads an API by the document its provider already publishes, at the address you give it. head names no provider and connects none of its own: what is connected is what you hand it. Here is one way for each level of access, with an API of each kind.\n\n### No access: a document that says nothing about it\n\nTake an API whose document lists its operations and states nothing about access. head does not guess what that means: it tries a read once with nothing attached, and keeps what it saw (`access/<source>/<operation>/observed anonymous`) as a receipt its own key signs. Nothing but a read is ever tried this way.\n\nConnect the document by its address, `https://<provider>/openapi.yaml`, by the site that publishes it, or by a folder holding it, as `forecast`, then read one of its operations. With no place yet, one yes founds your place in `~/place`, connects the document there and lets head read `forecast` for the next 90 days. A document that names several servers asks once which one. The answer comes back typed by what the document declares, one value a line, with a signed receipt of the read (abridged):\n\n```text\nanswer/<request>/current/temperature   number  …\nanswer/<request>/current_units/temperature   text    …\nread/forecast/<operation>/<request>    digest  sha256:… signed by head\n```\n\nAn overlay can still say what the provider says on its own site, so the place states it rather than observes it:\n\n```yaml\noverlay: 1.0.0\ninfo: { title: the forecast, read without a key, version: '1' }\nactions:\n  - target: \"$.paths['/forecast'].get\"\n    description: the provider says this read needs no key\n    update: { security: [] }\n```\n\nWhatever API you connect, its terms are the provider's: read them before you connect it, and say where an answer came from when they ask you to.\n\n### A declared flow: OAuth 2.0\n\nTake an API whose document declares OAuth 2.0 with an authorization code. head compiles it into the two steps it takes, the provider's page with PKCE and then the token exchange, and nobody writes a line of it. What it needs is yours: the client id of an app you registered with the provider, signed into the place as `keys/access/<source>/<flow> client <id>`. Until then head says so and calls nothing.\n\n### A secret entered by hand\n\nWhen a document declares a bearer token or an API key and no way to obtain one, the key is a secret input. head asks for it on its own one-time page, never through the model, and only when the place's root allows a secret with `access/secret-inputs`. It is kept in the keychain, never in a file.\n\n### When the document says too little\n\nA login of its own (an email, a one-time code, a choice of account) is written once as an `x-access` flow, an Arazzo profile in an overlay, and every API of the same issuer refers to it with one `$ref`. The profile and its vectors are on topos-openapi's own page, `docs/x-access.md` in `@lapxo/topos-openapi`. Every API connected this way is read the same way afterwards: one access per issuer, each answer typed and kept.\n" at=policy:head/connect/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api shape=docs/connect-any-api.md value=lock
-bound-lock/1 about="# head\n\nAn API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility.\n\n## Install\n\n- **As an extension:** download `head-<version>-<digest>.mcpb` from the [latest release](https://github.com/Lapxo/head/releases/latest) and open it. Its digest is in the release notes.\n- **By command:** `npx -y @lapxo/head@0.1.4`, for an assistant that starts its servers by command.\n\nhead runs on macOS for now. Its keys live in your keychain, never in a file.\n\n## The first minute\n\nhead connects nothing when it is installed, and names no provider: what it reads is the API you hand it.\n\n1. Ask your assistant something. With no place yet, head says so, and asks for the address of the document of an API that answers it.\n2. Give that address and say yes once. head founds your place in `~/place`, connects the API from its document, pinned by the digest of what it read, and lets head read it for the next 90 days.\n3. Your assistant asks again by itself, and the answer comes back typed, with the source it came from and a receipt signed by head's key.\n" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/readme shape=README.md value=lock
+bound-lock/1 about="# head\n\nAn API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility.\n\n## Install\n\n- **As an extension:** download `head-<version>-<digest>.mcpb` from the [latest release](https://github.com/Lapxo/head/releases/latest) and open it. Its digest is in the release notes.\n- **By command:** `npx -y @lapxo/head@0.1.5`, for an assistant that starts its servers by command.\n\nhead runs on macOS for now. Its keys live in your keychain, never in a file.\n\n## The first minute\n\nhead connects nothing when it is installed, and names no provider: what it reads is the API you hand it.\n\n1. Ask your assistant something. With no place yet, head says so, and asks for the address of the document of an API that answers it.\n2. Give that address and say yes once. head founds your place in `~/place`, connects the API from its document, pinned by the digest of what it read, and lets head read it for the next 90 days.\n3. Your assistant asks again by itself, and the answer comes back typed, with the source it came from and a receipt signed by head's key.\n" at=policy:head/version/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/readme shape=README.md value=lock
 bound-lock/1 about="A lot is drafted lines, one a line, each by=target and unsigned: nothing was asked." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/bad-lot value=lock
 bound-lock/1 about="A place is founded in an absolute folder: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-absolute value=lock
 bound-lock/1 about="A source the place compiles, by the name the place gives it: alone, its region, what it offers; with an operation, one read of it." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/source value=string
@@ -18,10 +18,11 @@ bound-lock/1 about="An intent an earlier act left open, by the scope it was name
 bound-lock/1 about="An intent an earlier act left open, by the scope it was named under: once this read lands, it closes that intent with the read-s digest. Look at what the act would have changed." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/closes value=string
 bound-lock/1 about="An overlay for the document, the same way; optional." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/connect/overlay value=string
 bound-lock/1 about="Answer latency depends on reuse of valid readings and an in-process Bound host; the declared answer ceiling remains unchanged." at=policy:head/release-checks/0.1.4 by=target form=alphabet measure=id role=writes scope=answer/seconds/rests-on value=bound/read-reuse|bound/in-process-host
+bound-lock/1 about="Answer the person in their words. Never show them a coordinate, a digest, a pin or a ledger epoch a cell carries — those are for you to act on — unless they ask why, or share a place, whose digest is what they send. Use claim only with the person-s exact words, never with a conclusion of yours." at=policy:head/claims/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/instructions value=lock
 bound-lock/1 about="Answered from the receipt {scope} ({digest}), as the source answered it at {at}, within the reuse the place allows: nothing was called; nothing typed was kept of it, so the fold typed it again." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/reread value=lock
 bound-lock/1 about="Answered from what was kept for {scope} ({digest}), as the source answered it at {at}, within the reuse the place allows: nothing was called and nothing folded." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/reused value=lock
 bound-lock/1 about="Any API, read by its document" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=docs/tagline value=lock
-bound-lock/1 about="Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask value=place|source|operation|args|view|card|key|lines|why|history|closes
+bound-lock/1 about="Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/ask value=place|source|operation|args|view|card|key|lines|why|history|closes|sources
 bound-lock/1 about="Ask me before {operation} on {source} is called, every time. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/text value=lock
 bound-lock/1 about="Ask the person before an offer is called, every time." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask value=source|operation
 bound-lock/1 about="Call one offer that is not of class read, only as far as the person allowed it and after their yes when they asked to be asked. The intent lands before the call and the receipt after; a call that never answered stays open until a look closes it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act value=place|source|operation|args
@@ -32,7 +33,7 @@ bound-lock/1 about="Connect a source to a place, once the person says yes: its d
 bound-lock/1 about="Connect any API" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api/heading value=lock
 bound-lock/1 about="Connect {source} to the place {place} from {document} with the connect tool, then show me what it offers." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/text value=lock
 bound-lock/1 about="Connected to {place} from the package {package}: {sources} — every document and every pin as it names them. Nothing was granted with them: access is asked here, issuer by issuer." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/received value=lock
-bound-lock/1 about="Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, or call an offer that is not a read. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do value=action|card|place|dir|name|key|coverage|lot|to|urls|who|source|operation|args
+bound-lock/1 about="Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, call an offer that is not a read, or keep what the person states as theirs. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/do value=action|card|place|dir|name|key|coverage|lot|to|urls|who|source|operation|args|said|withdraw
 bound-lock/1 about="Drafted lines, one a line, each by=target and unsigned: shown to the person and, on their yes to exactly those, signed by their key and folded as if landed. Nothing lands; the answer names the lot do lands." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/lines value=string
 bound-lock/1 about="Earlier, {source} answered the same request at {at}, under receipt {digest}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-earlier value=lock
 bound-lock/1 about="For access and act: a source the place compiles." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/source value=string
@@ -40,6 +41,8 @@ bound-lock/1 about="For act, the operation, by the id the source offers it under
 bound-lock/1 about="For act: the parameters by name, and body for what the operation is sent." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/args value=object
 bound-lock/1 about="For admit: the lines the other device-s key action answered, or the line holding its public key." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/key value=string
 bound-lock/1 about="For admit: what it may sign there, as scopes joined by |; without it, what a member may." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/coverage value=string
+bound-lock/1 about="For claim: take back what was kept of these words." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/do/withdraw value=boolean
+bound-lock/1 about="For claim: what the person stated, in their words, as they said it; never what you concluded from them." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/do/said value=string
 bound-lock/1 about="For key: head, for the key that signs what head read and did; person, for the key that signs what the person allows. Without one, head." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/who value=string
 bound-lock/1 about="For land: the lot ask answered for the drafted lines." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/lot value=string
 bound-lock/1 about="For place, the name it is known by, without one the folder-s; for admit, the name the place knows that device by." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/name value=string
@@ -56,16 +59,22 @@ bound-lock/1 about="How {source} proves access, the most trusted first: {flows}.
 bound-lock/1 about="I allow {operation} on {source} up to {times} times. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/text value=lock
 bound-lock/1 about="Its document: an https address or a file." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/document value=string
 bound-lock/1 about="Its document: an https address, read with nothing attached and, named by its digest, followed wherever it moves to the bytes that digest names; or an absolute file inside the place or a folder the client shares; or a package-s lock, from either, with its digest. Or a site alone, such as api.example.com, its document found where the site publishes its catalog or at the paths head-s lock names; or a folder the client shares, its document found inside it at those names. A site or folder names the source when none is given." at=policy:head/connect/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/document value=string
+bound-lock/1 about="Its link is {link}. Publish {document} at {at} exactly as it is: the link names that document-s bytes, never the package-s files, which still go apart with its digest." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-link value=lock
 bound-lock/1 about="Keep a source read-only: whatever it offers beyond reads is never called, whatever else is allowed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly value=source
+bound-lock/1 about="Keep what the person states in this conversation as theirs, signed by their own key: their words exactly as they said them, never what you concluded from them. The first time in a conversation they are asked once; each statement is said back as it goes in. With withdraw, the same words are taken back." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/claim value=place|said|withdraw
 bound-lock/1 about="Keep {source} read-only. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly/text value=lock
+bound-lock/1 about="Kept as yours in {place}: {said}" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claimed value=lock
 bound-lock/1 about="Land a lot plan signed, by its digest, while the place still stands on the base it was planned against." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/land value=lot
 bound-lock/1 about="No answer of {operation} on {source} is held for this request: there is no line to say why. A read of it, at 8, lands the receipt that would." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/why-none value=lock
 bound-lock/1 about="No intent {intent} stands open for this source: nothing was closed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/nothing-open value=lock
+bound-lock/1 about="No link: a link needs the address where its bytes are published. {document} is ready to publish as it is; share again with that address, or send the package-s digest apart as before." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-unlinked value=lock
 bound-lock/1 about="No place stands yet, and head connects no API of its own: connecting {source} by the address of its document founds your place at {dir}, on one yes, and {operation} is asked again with {args}." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unborn value=lock
 bound-lock/1 about="No place was named and the client shares no root: name the folder of a place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-place value=lock
 bound-lock/1 about="No place {place} is in head-s index on this device: a place is founded with the place tool, and then it is listed here." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/places-none value=lock
 bound-lock/1 about="No retained read of {operation} on {source} is held here for whom it would be read as. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-none value=lock
 bound-lock/1 about="No world typed that answer, so nothing of it was kept to show; the receipt stands as evidence of the read." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-untyped value=lock
+bound-lock/1 about="Not kept: you said no to keeping what you state in {place} in this conversation. {said} was not kept." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-declined value=lock
+bound-lock/1 about="Nothing kept in {place} is {said}: nothing was taken back." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claim-none value=lock
 bound-lock/1 about="Nothing was admitted: hand the lines the other device-s key tool answered, and a name." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-key value=lock
 bound-lock/1 about="One place by its folder, absolute; without one, every place." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/places/place value=string
 bound-lock/1 about="One view of a place as bound folds it, for a client to hold beside the conversation." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=resource/view value=bound://view/{view}{?place,at}
@@ -81,11 +90,16 @@ bound-lock/1 about="Prove access to {source} in {place} with the do tool, as its
 bound-lock/1 about="Read one view of a place as bound folds it, at the resolution ask reads it at; or what a source offers, as typed lines: at 0 where it is reached and the class of each offer, past it their forms and how access is proven; or, with an operation of class read, that operation once: the response comes back with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. Nothing else is ever called." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/look value=place|view|source|operation|args|closes|history|why
 bound-lock/1 about="Receive a package another place shared: from a file or an address, by the digest its sender sent apart from it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive value=package|digest|place
 bound-lock/1 about="Receive the package {package} into the place {place} with the connect tool: its lock as the document, named by the digest {digest}. Ask me before you do, and tell me which sources it connected and that access is asked here again." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/text value=lock
+bound-lock/1 about="Reuse only the native lines/evidence identities returned by the installed Bound CLI; request result text under that expected identity. If identity is unavailable, read fresh without cache. No filesystem fingerprint or maintenance exclusion is an authority." at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=reading/use value=bound-view-identity
+bound-lock/1 about="Several sources, joined by |, asked the same operation with the same arguments: what they agree on is marked by who says it, and what they differ on is shown from each." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/ask/sources value=string
 bound-lock/1 about="Share a place with someone: its sources, as a package they connect by its digest." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share value=place|who
 bound-lock/1 about="Share the place {place} with {who}: pack it with the do tool, as its share action, into a folder I share, show me the package-s digest, and tell me to send {who} the folder — or the addresses it is published at — and the digest apart from it, over a private channel." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/share/text value=lock
 bound-lock/1 about="Sign exactly these lines" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit/yes value=lock
 bound-lock/1 about="Signed by who configures the place — its root where this keychain holds it, else the person-s key; nothing landed. Lot {lot}, made against base {base}. What bound printed, folding it as if it landed:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/planned value=lock
 bound-lock/1 about="Start here: any API, by the address of its document." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/welcome value=
+bound-lock/1 about="Take back what was kept of these words." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/claim/withdraw value=boolean
+bound-lock/1 about="Taken back from {place}: {said}" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unclaimed value=lock
+bound-lock/1 about="The bytes the link names did not arrive from {source}: {place} owes them until they do, by this link or another channel." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-owed value=lock
 bound-lock/1 about="The card of {place} is {card}, valid from this {from}: do acts there on it while nothing else lands." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card value=lock
 bound-lock/1 about="The card the last answer about the place ended with, or the one ask answers asked with card: an action on a place that moved since is refused, and nothing is done." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/card value=string
 bound-lock/1 about="The digest its sender sent apart from it, sha256 and its hex." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/digest value=string
@@ -106,14 +120,17 @@ bound-lock/1 about="The folder of the place, absolute; without one, the first ro
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/place value=string
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/place value=string
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/place value=string
+bound-lock/1 about="The folder of the place, absolute; without one, the person-s place." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/claim/place value=string
 bound-lock/1 about="The folder of the place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access/place value=string
 bound-lock/1 about="The folder of the place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/place value=string
 bound-lock/1 about="The folder the package is written into, absolute, inside the place or a folder the client shares: never the place itself, its connected documents, a folder head or bound keeps, or a folder holding a lock that is no package." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/to value=string
 bound-lock/1 about="The folder, absolute." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/place/dir value=string
+bound-lock/1 about="The grant under which {operation} on {source} was read at {at} had to be given again, so what was kept of it stands no longer: it was read again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-withdrawn value=lock
 bound-lock/1 about="The key whose cells are asked; without one, every open cell." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/card/key value=string
 bound-lock/1 about="The keychain keeps a root for a place named {name} already: name this one otherwise." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-taken value=lock
 bound-lock/1 about="The lines that admit a key of this device in a place: its public key, its class, what it may sign and how deep. The key is made once in the keychain and never shown." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/key value=who
 bound-lock/1 about="The lines the other device-s key tool answered, or the line holding its public key." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit/key value=string
+bound-lock/1 about="The link names {sources}, as standing {digest} published at {source}: inspected, not authenticated, and nothing was connected or granted. To receive it, connect the package its sharer sent you by the digest they told you apart." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/inspected value=lock
 bound-lock/1 about="The media type to ask the document as, where its address answers several; optional." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/accept value=string
 bound-lock/1 about="The name it is known by." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/place/name value=string
 bound-lock/1 about="The name it is known by; without one, the folder-s." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/place/name value=string
@@ -160,18 +177,22 @@ bound-lock/1 about="What do I have in head? List my places and the sources each
 bound-lock/1 about="What do I have: my places and the sources each one holds." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have value=
 bound-lock/1 about="What happened: what head read and did in my place." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened value=
 bound-lock/1 about="What has head read and done in my place? List each read and each act, newest first, with when it happened." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened/text value=lock
-bound-lock/1 about="What is done: place founds one, admit lets another device in, land lands a lot ask planned, share packs a place, key makes this device-s key, access proves access to a source, act calls an offer that is not a read." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/action value=string
+bound-lock/1 about="What is done: place founds one, admit lets another device in, land lands a lot ask planned, share packs a place, key makes this device-s key, access proves access to a source, act calls an offer that is not a read, claim keeps what the person states as theirs, in their words, or takes it back." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/do/action value=string
 bound-lock/1 about="What is open for a key: each cell no reading has answered, its ceiling, its origins and the states it may take, in the order bound ranks them." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/card value=place|key
 bound-lock/1 about="What is open in the place, and the card do needs to act there." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/card value=boolean
 bound-lock/1 about="What it may sign there, as scopes joined by |; without it, what a member may." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit/coverage value=string
 bound-lock/1 about="What next: the next step my place names." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-next value=
 bound-lock/1 about="What should I do next in head? Read my place and tell me the next step it names, and why." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-next/text value=lock
 bound-lock/1 about="What the fold typed of that answer is no longer held here; the receipt stands as evidence of the read." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-gone value=lock
+bound-lock/1 about="What the person stated, in their words, as they said it." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/claim/said value=string
 bound-lock/1 about="What this device has connected: every place head-s index names, the sources each pinned, the grants that stand today and the last read it kept a receipt of — read off each place-s lines as bound folds them. Nothing is asked, called or signed." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/places value=place
+bound-lock/1 about="What was kept of {operation} on {source} at {at} is older than the place allows reusing, so it was read again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-expired value=lock
+bound-lock/1 about="What you state in this conversation will be kept as yours in {place}, signed, until you close it. Keep what you state as yours?" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/elicit-claims value=lock
 bound-lock/1 about="What {source} carries for this offer is not one request: nothing was called. An overlay that makes it one pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/carry-unsettled value=lock
 bound-lock/1 about="What {source} would have the person enter would go to another origin than {source} itself: refused, nothing was sent and nothing was called. An overlay whose steps stay on {source}-s own origin pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/cross-origin value=lock
 bound-lock/1 about="Where the package-s bytes are also published, as a JSON object from each path the package names to an encrypted address, signed or expiring as it may be; optional. A receiver then connects the lock from its own address, by its digest." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/share/urls value=string
 bound-lock/1 about="Who receives it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share/who value=string
+bound-lock/1 about="Who shared it is not shown: the link is not authenticated." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/sharer-unverified value=lock
 bound-lock/1 about="Why an answer stands: who said it, when, and what it rests on." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why value=source|operation
 bound-lock/1 about="Why does the newest answer of {operation} from {source} stand? Tell me who said it, when, and what it rests on." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/text value=lock
 bound-lock/1 about="Why head" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/idea/heading value=lock
@@ -180,6 +201,7 @@ bound-lock/1 about="With an operation and its parameters: what was retained of t
 bound-lock/1 about="With an operation and its parameters: why its newest answer stands — who said it and when, its receipt digest, and the pins it rests on, read off the place-s evidence and lines. Nothing is called." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/look/why value=boolean
 bound-lock/1 about="With card: the key whose cells are asked; without one, every open cell." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/key value=string
 bound-lock/1 about="a client that asks, or head-s page opened" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/cannot-ask/next value=none
+bound-lock/1 about="a count of the readings made ahead of a question apart from those a question made, so a read ahead never spends what a question needs; until then head marks its reads ahead itself" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/probes value=probes@1
 bound-lock/1 about="a device key attests; it never admits another key" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/class value=attest
 bound-lock/1 about="a device key attests; it never admits another key" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/person/class value=attest
 bound-lock/1 about="a document compiled once into a standing a place pins from its own store, and the demands a later document pays: split from the sources when connect reached its ceiling, never raised" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/compile value=src/compile/**
@@ -189,12 +211,14 @@ bound-lock/1 about="a document the person names" at=policy:head/shape/0.1.2 by=t
 bound-lock/1 about="a folder apart from the place-s own" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/share-to/next value=none
 bound-lock/1 about="a host head runs on" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/platform/next value=none
 bound-lock/1 about="a keychain head reaches" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-keychain/next value=none
+bound-lock/1 about="a link whose location is optional, as the plan of topos names it: until then share prints no link without an address, and the digest goes apart" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/reference-location value=reference-location@1
 bound-lock/1 about="a lot of drafted lines, one a line, by=target and unsigned" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/bad-lot/next value=none
 bound-lock/1 about="a lot planned first" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-lot/next value=none
 bound-lock/1 about="a package as it is shared" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/package-line/next value=none
 bound-lock/1 about="a package shared from a head at this release" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/package-pin/next value=none
 bound-lock/1 about="a package shared from a head that pins the same world" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/package-world/next value=none
 bound-lock/1 about="a page of head: connecting a public API at each level of access, every example run against the real API" at=policy:head/docs by=target form=alphabet measure=id role=writes scope=docs/page/connect-any-api value=docs/connect-any-api.md
+bound-lock/1 about="a place is born admitting content to be read by its digest, one request at a time" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=birth/wire/transport value=content-request/1
 bound-lock/1 about="a place is born closing its receipts: the readings its views open are rendered into receipts.bound beside its lock — observations at 8, so a copy without the private store verifies them — and a fold by bound alone checks them" at=policy:head/birth/0.1.2 by=target form=alphabet measure=id role=demands scope=birth/view/receipts shape=receipts.bound value=receipts@8|receipts@0|receipts@1
 bound-lock/1 about="a place is born letting a kept answer stand in for its source as long as a read grant lasts — 90 days, as access/period — so the same question twice calls nothing the second time; a line of the person-s for a source narrows or widens it" at=policy:head/birth/0.1.1g by=target form=interval measure=seconds role=writes scope=birth/allow/reuse value=0..7776000
 bound-lock/1 about="a question answered before is answered from what was kept, in no whole second: nothing is called and nothing folded" at=policy:head/ceilings by=target form=interval measure=seconds role=reads scope=answer/kept value=0..0
@@ -216,8 +240,10 @@ bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust-secret/next value=none
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust/next value=none
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/visit/next value=none
+bound-lock/1 about="a release category that admits the lines a release pins by (dep/* package digests, uses/* pins, sources/* tarballs) as what the release checks. On 0.2.5, release/category/pins pointed at uses/**|dep/**|sources/** resolves no pin: uses/** and dep/** name no obligation, and sources/** selects only sources/lines, a code ceiling. Until bound pays it, the category stands as it is and the pins are read in the lock" at=policy:head/release/pins/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/release-pins value=release-pins@1
 bound-lock/1 about="a signer over an encrypted file, for hosts with no keychain: only where a place declares it and every line it signs is marked so; never a default" at=policy:head/platform by=target form=alphabet measure=id role=demands scope=signer/encrypted-file value=declared|marked
 bound-lock/1 about="a source reached at the document-s origin" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-cross-origin/next value=none
+bound-lock/1 about="a source-s own mark, and the mark of one that is the same source in another form or shares a declared lineage" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/mark value=●|○
 bound-lock/1 about="a view explained: the lines it stands on with the readings of their ceilings; read for a person, a view is read with no resolution, at its own" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/view/why value=1
 bound-lock/1 about="a view is lines of text" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=resource/view/mime value=text/plain
 bound-lock/1 about="a view of cells the place signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-cells/next value=none
@@ -242,6 +268,8 @@ bound-lock/1 about="an overlay that settles it" at=policy:head/shape/0.1.2 by=ta
 bound-lock/1 about="an overlay that states it" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-unstated/next value=none
 bound-lock/1 about="an overlay whose flow asks the person" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/host-input/next value=none
 bound-lock/1 about="an overlay whose flow goes on" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/step-unanswered/next value=none
+bound-lock/1 about="and reading it from an https address, by the mechanism bound has for it" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=birth/transport/https value=fetch
+bound-lock/1 about="and taking at most this many bytes of it" at=policy:head/link/0.1.5 by=target form=interval measure=bytes role=writes scope=birth/transport/response-bytes value=0..1048576
 bound-lock/1 about="another name" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-taken/next value=none
 bound-lock/1 about="another name, or the old admission withdrawn" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/key-taken/next value=none
 bound-lock/1 about="answering a question takes at most this; slower reads red with its coordinate" at=policy:head/ceilings by=target form=interval measure=seconds role=reads scope=answer/seconds value=0..2
@@ -261,6 +289,7 @@ bound-lock/1 about="composing policies is bound-s" at=policy:head/shape/0.1.2 by
 bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=id needs=docs/connect-any-api.md role=demands scope=view/docs-connect-any-api shape=docs/connect-any-api.md value=text
 bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=region/docs-connect-any-api value=lock
 bound-lock/1 about="connecting a source, from the ask to the pin, takes at most this; slower reads red with its coordinate" at=policy:head/ceilings by=target form=interval measure=seconds role=reads scope=connect/seconds value=0..10
+bound-lock/1 about="counted in whole seconds, the part of a second dropped" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/seconds/params value=whole-seconds
 bound-lock/1 about="do changes the place, and with act the world outside it" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/hints value=destructive|openWorld
 bound-lock/1 about="do knows no action {action}: it does one of {actions}." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action value=lock
 bound-lock/1 about="every file between head and what it does not own — each adapter of access or transport, each port, the protocol binding — measured alone" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/ports value=src/ports/**|src/index.ts|src/signer.ts
@@ -304,14 +333,17 @@ bound-lock/1 about="how many tools may configure a place: what asks never config
 bound-lock/1 about="how to contribute, from this lock" at=policy:head/docs by=target form=alphabet measure=id role=demands scope=view/guide shape=CONTRIBUTING.md value=guide-at-zero
 bound-lock/1 about="its encrypted address" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/insecure-origin/next value=none
 bound-lock/1 about="look reads and never writes; asked twice of the same place it answers the same" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/hints value=readOnly|idempotent
-bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  workflow_dispatch:\nconcurrency: release-delivery\njobs:\n  approve:\n    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.judge.outputs.tag }}\n      digest: ${{ steps.judge.outputs.digest }}\n      archive: ${{ steps.judge.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --prefix .instrument --no-save --ignore-scripts @lapxo/bound@0.2.1\n      - name: Prepare release\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          TAG=\"v$(node -p \"require('./package.json').version\")\"\n          printf 'TAG=%s\\n' \"$TAG\" >> \"$GITHUB_ENV\"\n          git fetch origin \"refs/tags/$TAG:refs/tags/$TAG\"\n          gh api --paginate \"repos/$GITHUB_REPOSITORY/releases\" --jq '.[].tag_name' > \"$RUNNER_TEMP/release-tags\"\n          if grep -Fxq \"$TAG\" \"$RUNNER_TEMP/release-tags\"; then\n            printf 'RELEASE %s · exists\\n' \"$TAG\"\n          else\n            gh release create \"$TAG\" --verify-tag --draft --title \"$TAG\" --generate-notes\n            printf 'RELEASE %s · draft created · awaiting signed assets\\n' \"$TAG\"\n          fi\n      - name: Read owner approval\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --pattern approval-signed --dir .release\n          node .instrument/node_modules/@lapxo/bound/dist/cli/verb.js fold --as release .release/approval-signed > .release/verdict\n          cat .release/verdict\n      - name: Judge the approved release archive\n        id: judge\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          read -r status digest archive source extra < .release/verdict\n          test \"$status\" = READY\n          test -z \"$extra\"\n          gh release download \"$TAG\" --pattern \"$archive\" --dir .release\n          printf '%s  %s\\n' \"${digest#sha256:}\" \".release/$archive\" | sha256sum -c -\n          expected=\"$(node -p \"require('./package.json').name+'@'+require('./package.json').version\")\"\n          actual=\"$(tar -xOf \".release/$archive\" package/package.json | node -p \"const p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.name+'@'+p.version\")\"\n          test \"$actual\" = \"$expected\"\n          printf 'SOURCE release/%s/%s · %s · declared %s\\n' \"$TAG\" \"$archive\" \"$digest\" \"$source\"\n          printf 'tag=%s\\ndigest=%s\\narchive=%s\\n' \"$TAG\" \"$digest\" \"$archive\" >> \"$GITHUB_OUTPUT\"\n  bundle:\n    needs: approve\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Make the Desktop Extension from the approved archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          mkdir -p \"$RUNNER_TEMP/release\"\n          gh release download \"$TAG\" --pattern \"$ARCHIVE\" --dir \"$RUNNER_TEMP/release\"\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \"$RUNNER_TEMP/release/$ARCHIVE\" | shasum -a 256 -c -\n          test \"v$(node -p \"require('./manifest.json').version\")\" = \"$TAG\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$RUNNER_TEMP/release/$ARCHIVE\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          test \"$one\" = \"$two\"\n          bundle=\"head-${TAG#v}-${one:0:16}.mcpb\"\n          cp \"$RUNNER_TEMP/head-1.mcpb\" \"$RUNNER_TEMP/$bundle\"\n          printf 'BUNDLE=%s\\nMADE=sha256:%s\\n' \"$bundle\" \"$one\" >> \"$GITHUB_ENV\"\n          printf 'BUNDLE %s · sha256:%s · made twice · from %s\\n' \"$bundle\" \"$one\" \"$DIGEST\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/$BUNDLE\" node --test test/bundle.test.ts\n      - name: Attach it to the release, its digest in the notes\n        run: |\n          set -euo pipefail\n          gh release view \"$TAG\" --json body --jq .body > \"$RUNNER_TEMP/notes.md\"\n          if grep -q 'The Desktop Extension `head-' \"$RUNNER_TEMP/notes.md\"; then\n            grep -Fq \"$MADE\" \"$RUNNER_TEMP/notes.md\" || { printf 'REFUSE·bundle the release names another digest than %s\\n' \"$MADE\"; exit 1; }\n          else\n            printf '\\n\\nThe signature covers `%s` (`%s`). The Desktop Extension `%s` (`%s`) is made by this workflow from that archive, packed by mcpb and repacked with fixed times, modes and order; made again, it gives the same digest.\\n' \"$ARCHIVE\" \"$DIGEST\" \"$BUNDLE\" \"$MADE\" >> \"$RUNNER_TEMP/notes.md\"\n            gh release edit \"$TAG\" --notes-file \"$RUNNER_TEMP/notes.md\"\n          fi\n          gh release upload \"$TAG\" \"$RUNNER_TEMP/$BUNDLE\" --clobber\n          mkdir -p \"$RUNNER_TEMP/back\"\n          gh release download \"$TAG\" --pattern \"$BUNDLE\" --dir \"$RUNNER_TEMP/back\"\n          printf '%s  %s\\n' \"${MADE#sha256:}\" \"$RUNNER_TEMP/back/$BUNDLE\" | shasum -a 256 -c -\n  publish:\n    needs: [approve, bundle]\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      id-token: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0' --ignore-scripts\n      - name: Stage the approved release archive\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --pattern \"$ARCHIVE\" --dir .release\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \".release/$ARCHIVE\" | sha256sum -c -\n          gh release edit \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --draft=false\n          printf 'RELEASE %s · published · %s\\n' \"$TAG\" \"$DIGEST\"\n          npm stage publish \".release/$ARCHIVE\" --access public --ignore-scripts\n          printf 'STAGED %s · %s · owner approval pending\\n' \"$ARCHIVE\" \"$DIGEST\"\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/release shape=.github/workflows/release.yml value=lock
+bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  workflow_dispatch:\nconcurrency: release-delivery\njobs:\n  approve:\n    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.judge.outputs.tag }}\n      digest: ${{ steps.judge.outputs.digest }}\n      archive: ${{ steps.judge.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --prefix .instrument --no-save --ignore-scripts @lapxo/bound@0.2.5\n      - name: Prepare release\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          TAG=\"v$(node -p \"require('./package.json').version\")\"\n          printf 'TAG=%s\\n' \"$TAG\" >> \"$GITHUB_ENV\"\n          git fetch origin \"refs/tags/$TAG:refs/tags/$TAG\"\n          gh api --paginate \"repos/$GITHUB_REPOSITORY/releases\" --jq '.[].tag_name' > \"$RUNNER_TEMP/release-tags\"\n          if grep -Fxq \"$TAG\" \"$RUNNER_TEMP/release-tags\"; then\n            printf 'RELEASE %s · exists\\n' \"$TAG\"\n          else\n            gh release create \"$TAG\" --verify-tag --draft --title \"$TAG\" --generate-notes\n            printf 'RELEASE %s · draft created · awaiting signed assets\\n' \"$TAG\"\n          fi\n      - name: Read owner approval\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --pattern approval-signed --dir .release\n          node .instrument/node_modules/@lapxo/bound/dist/cli/verb.js fold --as release .release/approval-signed > .release/verdict\n          cat .release/verdict\n      - name: Judge the approved release archive\n        id: judge\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          read -r status digest archive source extra < .release/verdict\n          test \"$status\" = READY\n          test -z \"$extra\"\n          gh release download \"$TAG\" --pattern \"$archive\" --dir .release\n          printf '%s  %s\\n' \"${digest#sha256:}\" \".release/$archive\" | sha256sum -c -\n          expected=\"$(node -p \"require('./package.json').name+'@'+require('./package.json').version\")\"\n          actual=\"$(tar -xOf \".release/$archive\" package/package.json | node -p \"const p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.name+'@'+p.version\")\"\n          test \"$actual\" = \"$expected\"\n          printf 'SOURCE release/%s/%s · %s · declared %s\\n' \"$TAG\" \"$archive\" \"$digest\" \"$source\"\n          printf 'tag=%s\\ndigest=%s\\narchive=%s\\n' \"$TAG\" \"$digest\" \"$archive\" >> \"$GITHUB_OUTPUT\"\n  bundle:\n    needs: approve\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Make the Desktop Extension from the approved archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          mkdir -p \"$RUNNER_TEMP/release\"\n          gh release download \"$TAG\" --pattern \"$ARCHIVE\" --dir \"$RUNNER_TEMP/release\"\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \"$RUNNER_TEMP/release/$ARCHIVE\" | shasum -a 256 -c -\n          test \"v$(node -p \"require('./manifest.json').version\")\" = \"$TAG\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$RUNNER_TEMP/release/$ARCHIVE\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          test \"$one\" = \"$two\"\n          bundle=\"head-${TAG#v}-${one:0:16}.mcpb\"\n          cp \"$RUNNER_TEMP/head-1.mcpb\" \"$RUNNER_TEMP/$bundle\"\n          printf 'BUNDLE=%s\\nMADE=sha256:%s\\n' \"$bundle\" \"$one\" >> \"$GITHUB_ENV\"\n          printf 'BUNDLE %s · sha256:%s · made twice · from %s\\n' \"$bundle\" \"$one\" \"$DIGEST\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/$BUNDLE\" node --test test/bundle.test.ts\n      - name: Attach it to the release, its digest in the notes\n        run: |\n          set -euo pipefail\n          gh release view \"$TAG\" --json body --jq .body > \"$RUNNER_TEMP/notes.md\"\n          if grep -q 'The Desktop Extension `head-' \"$RUNNER_TEMP/notes.md\"; then\n            grep -Fq \"$MADE\" \"$RUNNER_TEMP/notes.md\" || { printf 'REFUSE·bundle the release names another digest than %s\\n' \"$MADE\"; exit 1; }\n          else\n            printf '\\n\\nThe signature covers `%s` (`%s`). The Desktop Extension `%s` (`%s`) is made by this workflow from that archive, packed by mcpb and repacked with fixed times, modes and order; made again, it gives the same digest.\\n' \"$ARCHIVE\" \"$DIGEST\" \"$BUNDLE\" \"$MADE\" >> \"$RUNNER_TEMP/notes.md\"\n            gh release edit \"$TAG\" --notes-file \"$RUNNER_TEMP/notes.md\"\n          fi\n          gh release upload \"$TAG\" \"$RUNNER_TEMP/$BUNDLE\" --clobber\n          mkdir -p \"$RUNNER_TEMP/back\"\n          gh release download \"$TAG\" --pattern \"$BUNDLE\" --dir \"$RUNNER_TEMP/back\"\n          printf '%s  %s\\n' \"${MADE#sha256:}\" \"$RUNNER_TEMP/back/$BUNDLE\" | shasum -a 256 -c -\n  publish:\n    needs: [approve, bundle]\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      id-token: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0' --ignore-scripts\n      - name: Stage the approved release archive\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --pattern \"$ARCHIVE\" --dir .release\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \".release/$ARCHIVE\" | sha256sum -c -\n          gh release edit \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --draft=false\n          printf 'RELEASE %s · published · %s\\n' \"$TAG\" \"$DIGEST\"\n          npm stage publish \".release/$ARCHIVE\" --access public --ignore-scripts\n          printf 'STAGED %s · %s · owner approval pending\\n' \"$ARCHIVE\" \"$DIGEST\"\n" at=policy:head/forge/0.2.5 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/release shape=.github/workflows/release.yml value=lock
 bound-lock/1 about="name: suite-map\non:\n  push:\n    branches: ['suite-map/**']\npermissions:\n  contents: read\njobs:\n  map:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n          fetch-depth: 0\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Run each test file alone, three at a time, its processes measured, keeping only what of head they ran\n        run: |\n          set -uo pipefail\n          map=\"$RUNNER_TEMP/suite-map\"\n          mkdir -p \"$map\"\n          measure() {\n            out=\"$1/$(basename \"$2\")\"\n            mkdir -p \"$out\"\n            NODE_V8_COVERAGE=\"$out\" node --test \"$2\" > \"$out.log\" 2>&1 || echo \"FAILED $2\" >> \"$out.log\"\n            grep -L -F \"$GITHUB_WORKSPACE/src/\" \"$out\"/*.json 2>/dev/null | xargs rm -f\n          }\n          export -f measure\n          ls test/*.test.ts | xargs -P 3 -I{} bash -c 'measure \"$0\" \"$1\"' \"$map\" {}\n          git log --format='%H %s' origin/main..HEAD > \"$map/commits.txt\"\n          cat \"$map\"/*.log | grep -E '^(FAILED|ℹ (pass|fail))' || true\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: suite-map\n          path: ${{ runner.temp }}/suite-map/\n          if-no-files-found: error\n" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/suite-map shape=.github/workflows/suite-map.yml value=lock
 bound-lock/1 about="name: tag\non:\n  workflow_run:\n    workflows: [test]\n    types: [completed]\njobs:\n  tag:\n    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha }}\n          fetch-depth: 0\n      - run: |\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          git tag --list \"$version\" | grep -q . && exit 0\n          git tag \"$version\" && git push origin \"$version\"\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/tag shape=.github/workflows/tag.yml value=lock
-bound-lock/1 about="name: test\non:\n  push:\n    branches: [main]\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 3\n        run: |\n          set -euo pipefail\n          node --test --test-shard=${{ matrix.shard }}/3 test/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: ${{ runner.temp }}/head-tests.log\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Measure a new person's first minute against an API on this machine\n        run: |\n          set -euo pipefail\n          HEAD_ONBOARDING=1 node --test test/onboarding.test.ts 2>&1 | tee -a \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n" at=policy:head/release-checks/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
+bound-lock/1 about="name: test\non:\n  push:\n    branches: [main, 'measure/**']\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 3\n        run: |\n          set -euo pipefail\n          node --test --test-shard=${{ matrix.shard }}/3 test/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: ${{ runner.temp }}/head-tests.log\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Measure a new person's first minute against an API on this machine\n        run: |\n          set -euo pipefail\n          HEAD_ONBOARDING=1 node --test test/onboarding.test.ts 2>&1 | tee -a \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n" at=policy:head/forge/measure/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
 bound-lock/1 about="no answer of head carries a secret: only public halves and lines leave" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/secrets-out value=0..0
 bound-lock/1 about="no world typed the answer" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/untyped/next value=none
+bound-lock/1 about="nothing arrived yet" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-owed/next value=none
+bound-lock/1 about="nothing is measured to answer it yet" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unmeasured/next value=none
 bound-lock/1 about="nothing more is declared to explain it" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared/next value=none
 bound-lock/1 about="nothing stands open" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/nothing-open/next value=none
+bound-lock/1 about="of what the questions leave of a place-s rate, the most its reads ahead may spend: a read ahead never takes what the question it reads for needs" at=policy:head/ahead/0.1.5 by=target form=interval measure=percent role=writes scope=ahead/share value=0..50
 bound-lock/1 about="one document a source" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-collision/next value=none
 bound-lock/1 about="one of the actions do names" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action/next value=none
 bound-lock/1 about="open: no world reads {kind}. {document} was laid and taken back; nothing was connected. The line that pays it:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-world value=lock
@@ -322,22 +354,25 @@ bound-lock/1 about="questions the person answers before it: the place, the origi
 bound-lock/1 about="read/rate is spent for {source} this hour: nothing was called. The next hour pays it, or a wider read/rate the place-s root signs." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/rate value=lock
 bound-lock/1 about="red: {coordinate} took {seconds} s, over {scope} {ceiling}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/red value=lock
 bound-lock/1 about="steps to the first real answer: install, connect, ask — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=count role=writes scope=baseline/onboarding/steps value=3..3
+bound-lock/1 about="structural numbers shown only where why is asked: a ledger epoch anywhere else is red" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/structural/why value=epoch|pinned
 bound-lock/1 about="temporary: head-s own checks said as not in the card, until topos and bound publish the authority-card view that folds what a key may do (demand-authority-card.md)" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=do/not-in-card/head value=not-covered|not-allowed|secret-unallowed|access-unstated
 bound-lock/1 about="the APIs head-s own lock names for a person to connect: none; head connects only what a person hands it, by the address of its document" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=first-minute/connects value=0..0
-bound-lock/1 about="the SDK head reads lines through, as published" at=policy:head/pins/0.2.0 by=target form=alphabet measure=digest needs=node_modules/@lapxo/topos role=reads scope=dep/topos shape=package value=sha256:fd7fb3783cad1919a7b0236df096c6b4c0d71d5a2f81fb14532779e1e83da261
+bound-lock/1 about="the SDK head reads lines through, as published" at=policy:head/pins/topos/0.2.1 by=target form=alphabet measure=digest needs=node_modules/@lapxo/topos role=reads scope=dep/topos shape=package value=sha256:50086958553b9376d600583f7dff354196bfeb41170fc6d1482ca7bea7c493e2
 bound-lock/1 about="the Secret Service of a Linux session, through libsecret-s secret-tool" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/linux/store value=secret-tool
 bound-lock/1 about="the Windows Credential Manager, through Windows PowerShell-s password vault" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/store value=credential-manager
-bound-lock/1 about="the actions do carries out, each by the catalogue tool of its name" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=do/actions value=place|admit|land|share|key|access|act
+bound-lock/1 about="the actions do carries out, each by the catalogue tool of its name" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=do/actions value=place|admit|land|share|key|access|act|claim
 bound-lock/1 about="the authenticated histories a place received, each with its origin" at=policy:head/walk by=target form=alphabet measure=id role=demands scope=birth/view/evidence value=evidence
 bound-lock/1 about="the bytes it waits on, then the package connected again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open/next value=none
 bound-lock/1 about="the bytes the digest names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-digest/next value=none
 bound-lock/1 about="the calls a new person gives something to, to the first answer: install aside, a call made from a cell-s next alone is the model-s" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=onboarding/steps value=0..3
+bound-lock/1 about="the carrier a statement names when the client says nothing of itself: head is told the client, never the model" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/via-unknown value=client
 bound-lock/1 about="the catalogue tools ask answers by: a view or a source by look, drafted lines by plan, the card by card, anything else by places" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=ask/questions value=look|places|card|plan
 bound-lock/1 about="the ceiling it ran past" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/red/next value=none
 bound-lock/1 about="the ceiling, in the place-s lock and signed by its root, of how many secrets a flow may ask the person on head-s page; without it, none" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/secrets value=access/secret-inputs
 bound-lock/1 about="the check on every push and every proposal: the suite in shards on each node the place names, the timed tests alone, and the Desktop Extension made twice from the archive npm would publish" at=policy:head/forge by=target form=alphabet measure=id needs=.github/workflows/test.yml role=demands scope=view/pipeline-test shape=.github/workflows/test.yml value=text
 bound-lock/1 about="the check on every push and every proposal: the suite in shards on each node the place names, the timed tests alone, and the Desktop Extension made twice from the archive npm would publish" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=region/pipeline-test value=lock
 bound-lock/1 about="the class a receipt-s at names, followed by when it was read" at=policy:head/receipts by=target form=alphabet measure=id role=writes scope=receipt/at value=receipt
+bound-lock/1 about="the class of what a link names and the algorithm it names it by" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/reference value=standing|sha256
 bound-lock/1 about="the command that opens this device-s browser at head-s page when the client cannot send the person an address; started directly, never through a shell" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/darwin/browser value=open
 bound-lock/1 about="the compiled standing at {file} no longer hashes to the digest the place pins:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/compiled-moved value=lock
 bound-lock/1 about="the coordinates a reader is given when only the view of answers reads its region: what a call answered" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answers/coordinates value=.answers/**
@@ -346,10 +381,12 @@ bound-lock/1 about="the core: what answers every question — knows no source an
 bound-lock/1 about="the days one signed sentence lets head read the sources of a place, before the person is asked again" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/period value=90
 bound-lock/1 about="the depth of scopes the owner-s key reaches (value read from Lapxo/topos)" at=policy:world/founding by=target form=interval measure=resolution role=reads scope=keys/owner value=1..16
 bound-lock/1 about="the document mended" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-unparsed/next value=none
+bound-lock/1 about="the document share lays in a package-s folder to be published as it is: the package-s lines as one standing, the bytes its link names" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/document value=standing.json
 bound-lock/1 about="the document that declares it, connected" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unresolved/next value=none
 bound-lock/1 about="the document-s digest named" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-redirect/next value=none
 bound-lock/1 about="the end an intent gets when a look closes it instead of its receipt" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=act/closed value=closed
 bound-lock/1 about="the families of lines this place names, as topos declares them; its receipts are of the reader family (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/families value=audit|beat|block|cites|comments|concept|cost|dep|effect|fold|hazard|keys|law|license|lines|literal|offers|question|reader|region|render|roles|sample|session|take|test|tree|vector|view|write
+bound-lock/1 about="the family a place declares a source-s lineage under, signed by its person or root: the sources it shares lineage with, or none" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/shares value=shares
 bound-lock/1 about="the family a place demands a reading in: needs/<kind>, paid once a world it adopts reads that kind into the place view" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/needs value=needs
 bound-lock/1 about="the family a read is kept under: read/<source>/<operation>/<request>" at=policy:head/receipts by=target form=alphabet measure=id role=writes scope=receipt/family value=read
 bound-lock/1 about="the family a typed answer is kept under: kept/<source>/<operation>/<request>/<basis>, the digest of the lines the fold typed, kept while the place stands on that basis" at=policy:head/receipts by=target form=alphabet measure=id role=writes scope=receipt/kept value=kept
@@ -358,18 +395,28 @@ bound-lock/1 about="the family access is kept under: access/<flow>/obtained|rene
 bound-lock/1 about="the family an act is kept under: act/<source>/<operation>/<request>, its intent, and /done, its receipt" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=act/family value=act
 bound-lock/1 about="the family of what a person allows: allow/<source>/<operation> times, allow/<source> a cap over all" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=allow/family value=allow
 bound-lock/1 about="the family of what a person wants to be asked before" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=ask/family value=ask
+bound-lock/1 about="the family what a person states is kept under in a place, one line a statement, by the digest of its words and when it was stated" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/family value=claim
+bound-lock/1 about="the field a statement of the person carries who brought it here: the person is its origin, the one who carried it its witness, as places already admit it" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/via value=witness
 bound-lock/1 about="the field a widening its root signs names who said yes in, by the key the place knows them by: the policy is the place-s, the witness is named" at=policy:head/places by=target form=alphabet measure=id role=writes scope=widening/witness value=witness
 bound-lock/1 about="the fields a line of this place may carry (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/fields value=scope|role|form|measure|value|by|at|needs|sig|epoch|shape|restsOn|condition|about|kind|view
 bound-lock/1 about="the fields a place-s native receipts project, as topos declares them, so bound renders its receipts with no other world" at=policy:head/birth/0.1.2 by=target form=alphabet measure=id role=writes scope=birth/audit/wire/receipt-fields value=scope|role|measure|form|value|at
 bound-lock/1 about="the fields a walked line may carry: a world-s blob is pinned with its shape, and a grant the person witnessed names its witness; a field the contract omits makes the place unwalkable" at=policy:head/walk/0.1.1 by=target form=alphabet measure=id role=writes scope=birth/wire/walk/fields value=scope|role|form|measure|value|by|at|epoch|condition|needs|shape|witness
 bound-lock/1 about="the fields this place-s native receipts project, as topos declares them, so bound renders receipts.bound with no other world (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/receipt-fields value=scope|role|measure|form|value|at
+bound-lock/1 about="the first cell of a new-with-source question, after the pause a person types, by the client-s clock: the worst of two runs, Node 24, attempt 1, load 22.9, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-with-source/typed value=0..3670
+bound-lock/1 about="the first cell of a new-with-source question, chained as a model asks, by the client-s clock: the worst of two runs, Node 24, attempt 2, load 29.5, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-with-source/chained value=0..4220
+bound-lock/1 about="the first cell of a new-without-source question, after the pause a person types, by the client-s clock: the worst of two runs, Node 22, attempt 3, load 15.7, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-without-source/typed value=0..2520
+bound-lock/1 about="the first cell of a new-without-source question, chained as a model asks, by the client-s clock: the worst of two runs, Node 22, attempt 3, load 15.7, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-without-source/chained value=0..5070
+bound-lock/1 about="the first cell of a repeated-with-receipt question, after the pause a person types, by the client-s clock: the worst of two runs, Node 24, attempt 1, load 22.9, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/repeated-with-receipt/typed value=0..90
+bound-lock/1 about="the first cell of a repeated-with-receipt question, chained as a model asks, by the client-s clock: the worst of two runs, Node 24, attempt 2, load 29.5, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/repeated-with-receipt/chained value=0..2320
 bound-lock/1 about="the first read-s own seconds, red against answer/seconds 0..2 — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=seconds role=writes scope=baseline/answer/seconds value=3..3
 bound-lock/1 about="the folder a person-s first place is founded in, under their own home, when they connect a source naming no place: named for what it holds, theirs to rename by founding another" at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=first-run/folder value=place
 bound-lock/1 about="the folder of a place a body is laid in while bound reads it, and taken from once it has" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answers value=.answers
 bound-lock/1 about="the folder of a place everything connected is laid in, whatever its kind: the fold decides which world reads it" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/connected value=connected
+bound-lock/1 about="the form of that document, as bound reads a standing by it" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/profile value=semantic-standing@1
 bound-lock/1 about="the forms its values are read through (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/forms value=interval|alphabet|ladder
 bound-lock/1 about="the hosts head keeps keys on, each in its own secret store and opening its one-time page with its own opener; on any other host every call is refused by name" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/supported value=darwin|linux|win32
-bound-lock/1 about="the instrument head runs, as published" at=policy:head/pins/0.2.1 by=target form=alphabet measure=digest needs=node_modules/@lapxo/bound role=reads scope=dep/bound shape=package value=sha256:f232bcd244be5f98e7c5bff6061273e220545e4a70abc2dbcfce0cb20be891f8
+bound-lock/1 about="the identity of a reading of a place, given without folding it, so what head folded before is kept under bound-s own identity and not a superset of it; until then head keys it by every file the place holds" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/reading-identity value=reading-identity@1
+bound-lock/1 about="the instrument head runs, as published" at=policy:head/pins/0.2.5 by=target form=alphabet measure=digest needs=node_modules/@lapxo/bound role=reads scope=dep/bound shape=package value=sha256:e0765eeb54fcfec1c9c89a67094641957efead062ffd8a45900f2a3e3d56696b
 bound-lock/1 about="the instrument head starts as a process for every fold, sign and land; nothing of it is imported" at=policy:project by=target form=alphabet measure=id role=writes scope=runs value=@lapxo/bound
 bound-lock/1 about="the key a place head founds is rooted in: made in the keychain under the place-s name, never a file, never the owner-s" at=policy:head/founding by=target form=alphabet measure=id role=writes scope=founding/root value=keys/root
 bound-lock/1 about="the keychain entry a source-s secret is kept under, one per place and source; a line names it, never holds it" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/account value=place/{place}/api/{source}
@@ -380,12 +427,19 @@ bound-lock/1 about="the language head's pages are said in" at=policy:head/docs b
 bound-lock/1 about="the ledger a place-s history is said to come from, named by the place" at=policy:head/walk by=target form=alphabet measure=id role=writes scope=birth/walk/origin value={place}-ledger
 bound-lock/1 about="the line a place declares its act result by; head lands nothing where land would print none" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/profile value=wire/act-result
 bound-lock/1 about="the line that follows" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-world/next value=none
+bound-lock/1 about="the lines a place admits a content transport by, the first the one a link is inspected only where it stands" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/transport value=wire/transport|transport/https|transport/timeout|transport/response-bytes
+bound-lock/1 about="the lines of all of head-s source, together, read by head-s suite: what the regions hold and what the seven regions of 0.1.5 need; a new region-s folder is paid from it, never raised" at=policy:head/ceilings/0.1.5 by=target form=interval measure=source-lines role=writes scope=source/lines value=0..2600
 bound-lock/1 about="the lines of each file of the onboard region, read by head-s suite: split from the sources that connect, never raised; a region ceiling landed after founding has no reading of bound-s, so bound holds it as data" at=policy:head/ceilings/0.1.2 by=target form=interval measure=file-lines role=writes scope=onboard/lines value=0..40
 bound-lock/1 about="the lines of each file of the ports region, alone" at=policy:head/ceilings by=target form=interval measure=file-lines role=reads scope=ports/lines value=0..120
 bound-lock/1 about="the lines of the access region, together" at=policy:head/ceilings by=target form=interval measure=access-lines role=reads scope=access/lines value=0..100
 bound-lock/1 about="the lines of the adopt region, together" at=policy:head/ceilings by=target form=interval measure=adopt-lines role=reads scope=adopt/lines value=0..60
+bound-lock/1 about="the lines of the ahead region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=ahead-lines role=writes scope=ahead/lines value=0..60
+bound-lock/1 about="the lines of the claims region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=claims-lines role=writes scope=claims/lines value=0..40
 bound-lock/1 about="the lines of the compile region, together" at=policy:head/ceilings by=target form=interval measure=compile-lines role=reads scope=compile/lines value=0..80
 bound-lock/1 about="the lines of the core region, together" at=policy:head/ceilings by=target form=interval measure=core-lines role=reads scope=core/lines value=0..800
+bound-lock/1 about="the lines of the kept region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=kept-lines role=writes scope=kept/lines value=0..40
+bound-lock/1 about="the lines of the links region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=links-lines role=writes scope=links/lines value=0..60
+bound-lock/1 about="the lines of the marks region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=marks-lines role=writes scope=marks/lines value=0..60
 bound-lock/1 about="the lines of the places region, together: split from the places that also connected, never raised" at=policy:head/ceilings by=target form=interval measure=places-lines role=reads scope=places/lines value=0..90
 bound-lock/1 about="the lines of the sources region, together: split from the places that also founded, never raised" at=policy:head/ceilings by=target form=interval measure=sources-lines role=reads scope=sources/lines value=0..150
 bound-lock/1 about="the lines of the verbs region, together, read by head-s suite; a region ceiling landed after founding has no reading of bound-s, so bound holds it as data" at=policy:head/ceilings/0.1.4 by=target form=interval measure=verbs-lines role=writes scope=verbs/lines value=0..80
@@ -395,27 +449,36 @@ bound-lock/1 about="the longest head waits on bound; a view that has not answere
 bound-lock/1 about="the longest head-s one-time page waits for the person; a wait that runs out closes it with nothing, and nothing is called" at=policy:head/access by=target form=interval measure=milliseconds role=writes scope=access/wait value=0..120000
 bound-lock/1 about="the longest one request may take, its headers and its body; past it the request is stopped, its connection released, and nothing it sent back is read" at=policy:head/transport by=target form=interval measure=milliseconds role=writes scope=adapter/request/wait value=0..30000
 bound-lock/1 about="the macOS keychain, through the security command" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/darwin/store value=keychain
+bound-lock/1 about="the machine-s clock, from a call to its answer" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/seconds/model value=clock
 bound-lock/1 about="the manifest of the Desktop Extension, rendered from the lock and never written by hand" at=policy:head/forge by=target form=alphabet measure=role role=reads scope=leaf-role/manifest.json value=derived
 bound-lock/1 about="the manifest of the Desktop Extension: what a host starts and the tools the lock offers" at=policy:head/forge by=target form=alphabet measure=id needs=manifest.json role=demands scope=view/bundle-manifest shape=manifest.json value=text
 bound-lock/1 about="the manifest of the Desktop Extension: what a host starts and the tools the lock offers" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=region/bundle-manifest value=lock
+bound-lock/1 about="the marks an answer carries that rest on no receipt of a read, read by head-s suite: none" at=policy:head/ceilings/0.1.5 by=target form=interval measure=count role=writes scope=marks-without-evidence value=0..0
+bound-lock/1 about="the measure a source-s region names its document by, by digest: two sources of one document are one source" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=vocab/documents value=documents
 bound-lock/1 about="the measure that names what kinds of input an access flow asks" at=policy:head/vocabulary/0.1.1 by=target form=alphabet measure=id role=writes scope=vocab/asks value=asks
 bound-lock/1 about="the most bytes head reads of a document it connects from an address" at=policy:head/transport/0.1.1 by=target form=interval measure=bytes role=writes scope=adapter/request/document-bytes value=0..16777216
 bound-lock/1 about="the most bytes head reads of what one bound process prints; past it the process is stopped, and what it printed is no reading" at=policy:head/bound by=target form=interval measure=bytes role=writes scope=bound/printed value=0..16777216
 bound-lock/1 about="the most head reads of a world-s standing to learn its readers" at=policy:head/ceilings by=target form=interval measure=bytes role=reads scope=world/standing-bytes value=0..1048576
 bound-lock/1 about="the next hour, or a wider read/rate the root signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/rate/next value=none
+bound-lock/1 about="the numbers a cell shows that are exact by construction — epochs, counts and caps, pins, digests, the times lines carry: no model, kind structural" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/structural value=ceiling|offers|reads|count|allowed|done|epoch|pinned|digest|card|pin|at|until
+bound-lock/1 about="the numbers a cell shows that head measured: each names its model and the params it was measured with" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/measured value=seconds
 bound-lock/1 about="the one adapter access runs by, whatever the kind: the steps a scheme-s flow declares, the inputs it asks as it declares them, the token it keeps and how it rides a request" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/adapter value=flow
 bound-lock/1 about="the one class of offer head reads; every other class is listed, never called" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/callable value=read
 bound-lock/1 about="the only files a kind of source, a scheme or a platform-s secret store is named in: one adapter each" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/adapters value=src/ports/adapters/**|src/ports/access/**|src/ports/stores/**|src/ports/keychain.ts
+bound-lock/1 about="the only forms whose words may ask to show a person a structural number: why, which explains, and share, whose digest is what is shared" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=writes scope=person-words/shown value=why|share
 bound-lock/1 about="the package digest, sent apart" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/shared/next value=none
 bound-lock/1 about="the page a repository and a registry show first, rendered from the lock and never written by hand" at=policy:head/docs/0.1.4 by=target form=alphabet measure=role role=reads scope=leaf-role/README.md value=derived
 bound-lock/1 about="the pages of head, rendered from the lock and never written by hand" at=policy:head/docs/0.1.4 by=target form=alphabet measure=role role=reads scope=leaf-role/docs value=derived
 bound-lock/1 about="the parameter it names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/missing-param/next value=none
 bound-lock/1 about="the paths an origin-s document is looked for at when its catalog names none, in this order: the first a world compiles is connected" at=policy:head/use/0.1.1g by=target form=alphabet measure=id role=writes scope=use/documents value=/openapi.json|/openapi.yaml|/.well-known/openapi.json|/.well-known/openapi.yaml|/swagger.json|/v3/api-docs
+bound-lock/1 about="the pause a person takes before a question, as the harness declares it: the first minute is measured with it and without it, chained as a model asks, and both go to the receipt" at=policy:head/ahead/0.1.5 by=target form=interval measure=milliseconds role=writes scope=onboarding/pause value=0..2000
+bound-lock/1 about="the person answers" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/elicit-claims/next value=none
 bound-lock/1 about="the person picks one origin" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/pick-origin/next value=none
 bound-lock/1 about="the person said no" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-yes/next value=none
 bound-lock/1 about="the person signs these lines in their place and lands them" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/sign-yourself/next value=none
 bound-lock/1 about="the person-s key on this device: it signs what the person allows and when they must be asked, and nothing else" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/person/account value=person
 bound-lock/1 about="the place vocabulary head reads a source in: where it is reached, how access is proven, what it offers; no word of a kind of source" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/offers value=offers
+bound-lock/1 about="the policy a statement of the person is kept at" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/at value=policy:person/said
 bound-lock/1 about="the profile of the record bound prints after the diagnostic of a refusal, from 0.2.1: head reads it apart, and the diagnostic stays what the refusal says" at=policy:head/bound/0.2.1 by=target form=alphabet measure=id role=writes scope=bound/refusal value=bound-refusal@1
 bound-lock/1 about="the protocol handler Windows opens an address with, started directly, never through cmd" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/browser value=rundll32|url.dll,FileProtocolHandler
 bound-lock/1 about="the protocol head answers through, imported by one file only" at=policy:head/pins by=target form=alphabet measure=digest needs=node_modules/@modelcontextprotocol/sdk role=reads scope=dep/sdk shape=package value=sha256:63a3962282ff29d2ce532945c2edefd9b7c7195b8ec20c027e120e4498b0cb19
@@ -439,6 +502,7 @@ bound-lock/1 about="the sentence a person signs once per place and period: allow
 bound-lock/1 about="the session-s opener, started directly, never through a shell" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/linux/browser value=xdg-open
 bound-lock/1 about="the signer name a place declares for this key; the host binds it to head-s signer program" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/signer value=keychain
 bound-lock/1 about="the signer name a place declares for this key; the host binds it to head-s signer program" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/person/signer value=keychain
+bound-lock/1 about="the signers that sign what a place compiles of every source alike, so they say nothing of where a source comes from" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/own-signers value=target|root|head|person
 bound-lock/1 about="the source answering" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unreachable-source/next value=none
 bound-lock/1 about="the source connected again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/compiled-moved/next value=none
 bound-lock/1 about="the states a cell of head-s answers is in: done, refused, open (something owed is named), red (a ceiling ran past, for the cell it measured), asked (a question the person reads)" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=shape/states value=done|refused|open|red|asked
@@ -461,32 +525,51 @@ bound-lock/1 about="the view bound renders a place-s receipts by, beside its loc
 bound-lock/1 about="the view of a place-s authenticated history: head reads its own receipts there, and the person-s attestations" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/evidence value=evidence
 bound-lock/1 about="the worlds every place adopts when it connects; topos-mcp is pinned beside them for the tests and the offline vector, and adopted once bound composes readings (0.1.7), in head 0.1.1" at=policy:head/worlds by=target form=alphabet measure=id role=writes scope=world/adopts value=topos-openapi
 bound-lock/1 about="unencrypted transport, which the adapter sends only to this device" at=policy:head/transport by=target form=alphabet measure=id role=writes scope=adapter/http value=request
+bound-lock/1 about="waiting at most this long for it" at=policy:head/link/0.1.5 by=target form=interval measure=milliseconds role=writes scope=birth/transport/timeout value=0..10000
 bound-lock/1 about="what a clone runs: it installs, and every vector of head runs against bound as published" at=policy:head/docs by=target form=alphabet measure=id role=writes scope=check value="npm ci && npm test"
 bound-lock/1 about="what a device a place admits covers unless whoever admits it says otherwise: it asks, keeps what it read and proves access; it widens nothing and calls nothing that changes the world" at=policy:head/places by=target form=alphabet measure=id role=writes scope=member/coverage value=read/**|kept/**|access/**
+bound-lock/1 about="what a document connected is when it is a link to a standing, not a document of a source" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/prefix value=#bound:
+bound-lock/1 about="what a first cell past its ceiling rests on: reading a place without a bound process each time, and its identity without folding it" at=policy:head/ceilings/0.1.5 by=target form=alphabet measure=id role=writes scope=seconds/first-cell/rests-on value=bound/read-reuse|bound/in-process-host|bound/reading-identity
+bound-lock/1 about="what a lineage line says when nobody declared that the source shares lineage: never that it is independent" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/undeclared value=none
 bound-lock/1 about="what a place adopts: every world head carries; a lock as its parent is refused by name, its composition being bound-s; split from the compile region at its ceiling, never raised" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/adopt value=src/adopt/**
 bound-lock/1 about="what a place allows is its root-s to change" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card/next value=none
 bound-lock/1 about="what a place allows of answering a present read from a retained one: allow/reuse/<source> in seconds, the longest a retained answer may stand in for the source; without it every read calls" at=policy:head/access by=target form=alphabet measure=id role=writes scope=reuse/family value=allow/reuse
 bound-lock/1 about="what a place allows of inspecting retained reads: allow/history/<source> present; history is evidence of the read it came from, never a current answer" at=policy:head/access by=target form=alphabet measure=id role=writes scope=history/family value=allow/history
+bound-lock/1 about="what a place is shared and looked at by: the link a package is published under, and the inspection a link is connected by" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/links value=src/links/**
 bound-lock/1 about="what a place offers a peer it walks with: its policy and what it pins, never an identity" at=policy:head/walk by=target form=alphabet measure=id needs=allow/**|uses/**|dep/**|access/** role=demands scope=birth/view/walk value=walk@*
 bound-lock/1 about="what a place reads: a source connected and compiled once, access to it obtained" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/sources value=src/sources/**
 bound-lock/1 about="what a place-s walk context holds: the keys a peer authenticates it by, its wire and its origin" at=policy:head/walk by=target form=alphabet measure=id role=writes scope=walk/context/reads value=keys/**|wire/**|walk/origin
+bound-lock/1 about="what a question asked again adds to the model-s context, its content beside its cells, by utf8-bytes/4: nothing, since the conversation holds it" at=policy:head/ceilings/0.1.5 by=target form=interval measure=tokens role=writes scope=tokens/answer/repeated value=0..0
+bound-lock/1 about="what a question of a founded place, read fresh adds to the model-s context, its content beside its cells, by utf8-bytes/4: 240 in all four measures of CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=tokens role=writes scope=tokens/answer/new-with-source value=0..240
+bound-lock/1 about="what a question read before is answered from: kept while its receipt and its context stand, read again and said why once either moved" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/kept value=src/kept/**
+bound-lock/1 about="what a read made ahead of its question is marked by, beside its receipt and under the receipt-s own at, so the place-s rate counts what reads ahead spent apart from what questions spent, each read once" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=writes scope=ahead/mark value=ahead
 bound-lock/1 about="what a region of the place is measured by, as obligations reads it: its coordinates and the leaves it writes" at=policy:head/forge by=target form=alphabet measure=id role=reads scope=audit/wire/region-measures value=coordinates|leaves
 bound-lock/1 about="what a source offers, as a person reads it: where it is reached and the class of each offer" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/person value=0
 bound-lock/1 about="what a source offers, explained: each offer-s forms and how access is proven, in the order of trust" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/why value=1
+bound-lock/1 about="what a source said, relayed with who said it and when: never head-s measure, and never a success by itself" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/reported value=status
+bound-lock/1 about="what a statement taken back is attested by, beside it: what a person attests stands for good, so taking it back is attesting that" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/withdrawn value=withdrawn
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-landed/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unfolded/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unsettled/next value=none
 bound-lock/1 about="what bound prints before the result of an act it committed: then the records it admitted, then its receipt" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/act value="ACT "
+bound-lock/1 about="what bound says when the bytes a link names did not arrive, as against bytes that are not what it names" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/unarrived value=REFUSE·transport
+bound-lock/1 about="what claim needs: the person-s words" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/claim/required value=said
 bound-lock/1 about="what connect needs: a document, or a package-s lock, which names its sources" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/required value=document
+bound-lock/1 about="what head folds before it is asked: a place-s fold kept for the conversation under what its reading reads, and the read a known next asks for, read ahead" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/ahead value=src/ahead/**
 bound-lock/1 about="what head hands a flow that asks its host for the name it registers a client under ($host.client-name); a world never names its host, and a flow asking the host for anything else head does not declare is refused by name" at=policy:head/access by=target form=alphabet measure=id role=writes scope=host/client-name value=head
 bound-lock/1 about="what head is, how it is installed and the first minute with it" at=policy:head/docs/0.1.4 by=target form=alphabet measure=id needs=README.md role=demands scope=view/readme shape=README.md value=text
 bound-lock/1 about="what head is, how it is installed and the first minute with it" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=region/readme value=lock
+bound-lock/1 about="what is not measured between sources that differ" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/loss value="the loss between"
 bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=id needs=.github/workflows/suite-map.yml role=demands scope=view/pipeline-suite-map shape=.github/workflows/suite-map.yml value=text
 bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=region/pipeline-suite-map value=lock
+bound-lock/1 about="what one question asked of several sources is answered with: the fields they agree on, marked by who says them, and the ones they differ on, each shown" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/marks value=src/marks/**
 bound-lock/1 about="what share needs: the folder it writes" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/required value=to
+bound-lock/1 about="what that loss waits on" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/loss-needs value=topos-origin
 bound-lock/1 about="what the first resolution shows of a source: where it is reached and the class of each offer" at=policy:head/look by=target form=alphabet measure=id role=writes scope=look/first value=origins|origin|class|tags
 bound-lock/1 about="what the forge runs, rendered from the lock and never written by hand" at=policy:head/forge by=target form=alphabet measure=role role=reads scope=leaf-role/.github value=derived
+bound-lock/1 about="what the person states, kept as theirs: their own key signs it, their words as given, and only when they said so" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/claims value=src/claims/**
+bound-lock/1 about="what the question with no place, its connect and the answer the ready cell names adds to the model-s context, its content beside its cells, by utf8-bytes/4: 362 in all four measures of CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=tokens role=writes scope=tokens/answer/new-without-source value=0..362
 bound-lock/1 about="where a person starts: the first place, founded with the first source they connect when they name none, and nothing else head needs to begin" at=policy:project/0.1.2 by=target form=alphabet measure=coordinates role=reads scope=region/onboard value=src/onboard/**
 bound-lock/1 about="where a place born before 0.1.0 kept a lock it adopted as its parent: a uses/<name> pinned from here makes head refuse the place by name" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/adopted value=.head/adopted
 bound-lock/1 about="where a place head founds for an origin lives: a folder named by the origin, beside head-s own" at=policy:head/use/0.1.1g by=target form=alphabet measure=id role=writes scope=use/folder value={home}-places
@@ -494,18 +577,18 @@ bound-lock/1 about="where a place keeps each source compiled into a standing of
 bound-lock/1 about="where a place keeps its own walk context, laid beside its lock and pinned by walk/context; a place born before 0.1.2 keeps its own where it was laid" at=policy:head/walk/0.1.2 by=target form=alphabet measure=id role=writes scope=walk/context/file value=walk/context.bound
 bound-lock/1 about="where a place keeps the standing of each world it adopts, laid beside its lock as fetched and checked against the pin, so bound admits the pin on bytes the place holds: a folder named for what it holds" at=policy:head/vocabulary/0.2.0 by=target form=alphabet measure=id role=writes scope=place/worlds value=worlds
 bound-lock/1 about="where an origin publishes the catalog of its documents (RFC 9727), read with nothing attached" at=policy:head/use/0.1.1g by=target form=alphabet measure=id role=writes scope=use/catalog value=/.well-known/api-catalog
-bound-lock/1 about="where the bound package head pins is fetched from, verified by its digest" at=policy:head/pins/0.2.1 by=target form=alphabet measure=id role=writes scope=sources/bound value=https://registry.npmjs.org/@lapxo/bound/-/bound-0.2.1.tgz
+bound-lock/1 about="where the bound package head pins is fetched from, verified by its digest" at=policy:head/pins/0.2.5 by=target form=alphabet measure=id role=writes scope=sources/bound value=https://registry.npmjs.org/@lapxo/bound/-/bound-0.2.5.tgz
 bound-lock/1 about="where the sdk package head pins is fetched from, verified by its digest" at=policy:head/pins by=target form=alphabet measure=id role=writes scope=sources/sdk value=https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz
-bound-lock/1 about="where the topos package head pins is fetched from, verified by its digest" at=policy:head/pins/0.2.0 by=target form=alphabet measure=id role=writes scope=sources/topos value=https://registry.npmjs.org/@lapxo/topos/-/topos-0.2.0.tgz
+bound-lock/1 about="where the topos package head pins is fetched from, verified by its digest" at=policy:head/pins/topos/0.2.1 by=target form=alphabet measure=id role=writes scope=sources/topos value=https://registry.npmjs.org/@lapxo/topos/-/topos-0.2.1.tgz
 bound-lock/1 about="where topos-mcp 0.1.0 publishes its standing: bound fetches it there for every place that pins it, and head reads its readers from it, both by its digest" at=policy:head/worlds/0.2.0 by=target form=alphabet measure=id role=writes scope=sources/topos-mcp value=https://github.com/Lapxo/topos-mcp/releases/download/v0.1.1/standing.bound
 bound-lock/1 about="where topos-openapi 0.1.0 publishes its standing: bound fetches it there for every place that pins it, and head reads its readers from it, both by its digest" at=policy:head/worlds/0.2.0 by=target form=alphabet measure=id role=writes scope=sources/topos-openapi value=https://github.com/Lapxo/topos-openapi/releases/download/v0.1.1/standing.bound
 bound-lock/1 about="who is in a place: founding it with its root, admitting another device" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/places value=src/places/**
 bound-lock/1 about="whoever holds the place-s root" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-root/next value=none
-bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.4\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"ask\",\n      \"description\": \"Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source.\"\n    },\n    {\n      \"name\": \"do\",\n      \"description\": \"Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, or call an offer that is not a read. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/version/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
+bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.5\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"ask\",\n      \"description\": \"Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source.\"\n    },\n    {\n      \"name\": \"do\",\n      \"description\": \"Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, call an offer that is not a read, or keep what the person states as theirs. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/version/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
 bound-lock/1 about="{action} is not in the card of {place}: {why}. Nothing was done." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card value=lock
 bound-lock/1 about="{count} lines landed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/landed value=lock
 bound-lock/1 about="{dir} is a place already: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-exists value=lock
-bound-lock/1 about="{document} answered {status} to the access {via} holds. Nothing was connected. Access {via} holds that {document} accepts pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/fetch-status value=lock
+bound-lock/1 about="{document} answered {status} at {at} to the access {via} holds. Nothing was connected. Access {via} holds that {document} accepts pays it." at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/fetch-status value=lock
 bound-lock/1 about="{document} carries {scope}, which a package does not: a package names by digest, each once, the worlds its sources were compiled under and each source-s document, overlay and pin, in an order its pins rest in, and grants nothing. Nothing was connected." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/package-line value=lock
 bound-lock/1 about="{document} has not arrived, so {source} is not connected yet: {place} owes it. Ask {operation} again, with {args}, once it can be read; nothing else is asked." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/bytes-owed value=lock
 bound-lock/1 about="{document} hashes to {got}, not to the {digest} it was named by. Nothing was connected. The bytes that digest names pay it, or the digest these bytes hash to, from whoever sent them." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-digest value=lock
@@ -513,10 +596,14 @@ bound-lock/1 about="{document} is not at the origin {via} is reached at, and {vi
 bound-lock/1 about="{document} moved to another address, which head follows only without the access and for bytes named by their digest: name the document-s digest. Nothing was connected." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/fetch-redirect value=lock
 bound-lock/1 about="{document} was compiled under {world} {pin}, and this head pins {held}. Nothing was connected. A package shared from a head that pins {held}, or this head at the release that pins {pin}, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/package-world value=lock
 bound-lock/1 about="{document} was not read: an https address, or a file inside the place or a folder the client shares, is. Nothing was connected." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/document-unread value=lock
+bound-lock/1 about="{field} is {value}, said by {sources} ({marks}). I don-t know whether they are independent." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-unknown value=lock
+bound-lock/1 about="{field} is {value}, said by {sources} ({marks}). Nobody has declared that they share lineage." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-undeclared value=lock
+bound-lock/1 about="{field} is {value}, said by {sources} ({marks}): {source} looks like the same lineage as {other} and may add nothing." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-lineage value=lock
 bound-lock/1 about="{flow} asks a one-time code" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-one-time value=lock
 bound-lock/1 about="{flow} asks a secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-secret value=lock
 bound-lock/1 about="{flow} asks no secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-none value=lock
 bound-lock/1 about="{form} declares no resolution that explains it: this is what ask reads, and nothing more." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared value=lock
+bound-lock/1 about="{link} was not inspected: {why}. Nothing was connected." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-refused value=lock
 bound-lock/1 about="{message}. The page comes back to this device once, and only the secret it yields is kept, in your keychain." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/visit value=lock
 bound-lock/1 about="{name} at {dir} — sources: {sources}. Grants standing today: {grants}. Last read: {last}." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/place-held value=lock
 bound-lock/1 about="{name} is admitted into {place}, covering {coverage}:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/admitted value=lock
@@ -532,6 +619,8 @@ bound-lock/1 about="{origin} is in use from {dir}, as {source}: read-only, every
 bound-lock/1 about="{origin} is not encrypted and is not this device: nothing was sent to it. Its encrypted address pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/insecure-origin value=lock
 bound-lock/1 about="{origin} published no document a world compiles: tried {tried}. The place stays founded; a document named by the person is connected to it with connect." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/use-none value=lock
 bound-lock/1 about="{place} admits a key named {name} already, or this key under another name: nothing was admitted. Another name pays it, or the old admission withdrawn by the place-s root." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/key-taken value=lock
+bound-lock/1 about="{place} admits no content transport, so no link is inspected there. These lines admit one, for you to sign: {lines}" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/transport-missing value=lock
+bound-lock/1 about="{place} admits no field for who carried a statement here, its witness, so nothing was kept. Whoever configures {place} can sign these lines: {lines}" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-unadmitted value=lock
 bound-lock/1 about="{place} covers {coverage} for the key that would sign; {scope} is not in it, so nothing was asked, called or signed. Whoever configures {place} can sign these lines:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/not-covered value=lock
 bound-lock/1 about="{place} does not allow retained reads of {source} to be inspected. Whoever configures it can sign this line:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-undeclared value=lock
 bound-lock/1 about="{place} has no source connected: there is nothing to pack. Nothing was written." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/share-none value=lock
@@ -539,9 +628,10 @@ bound-lock/1 about="{place} moved since the card {card} was asked, or none was:
 bound-lock/1 about="{place} was acted in, and its receipts did not close: {why}" at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open value=lock
 bound-lock/1 about="{place} was born before its wire named who witnesses a widening, so nothing its root signs as one lands there until it does. head proposes this lot — the wire it stands on withdrawn and said again with the witness, signed by the root alone: plan it, then land it; nothing is migrated:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unwitnessed value=lock
 bound-lock/1 about="{place} would stand on {parent} as its parent lock. Composing a parent-s policy with a child-s is bound-s to do, and this head does not: nothing was adopted, called or signed. A package another place shared is connected by the digest its sender sent apart from it." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/parent-lock value=lock
+bound-lock/1 about="{source} answered {operation} at {at}: the answer this conversation already holds ({digest}), kept by the receipt {receipt}. Nothing was called and nothing is sent again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept value=lock
 bound-lock/1 about="{source} answered {operation} from {origin} at {at}: said under the key {by} at epoch {epoch}, receipt {digest}. It rests on the pin {pin} of {source}, landed at epoch {pinned}, and on the world {worlds}. Who crossed it is not said: bound computes no encounters yet." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/why value=lock
-bound-lock/1 about="{source} answered {status} to {operation}, and no world typed the answer here {why}: head hands no body." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/untyped value=lock
-bound-lock/1 about="{source} answered {status} to {operation}. What its document declares of the answer, one value a line:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/answered value=lock
+bound-lock/1 about="{source} answered {status} to {operation} at {at}, and no world typed the answer here {why}: head hands no body." at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/untyped value=lock
+bound-lock/1 about="{source} answered {status} to {operation} at {at}. What its document declares of the answer, one value a line:" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/answered value=lock
 bound-lock/1 about="{source} compiled here as {got}, not as the {pin} the package names: the same documents compile otherwise under this head. The place holds what it compiled, and the package is refused. A package shared from a head at this release pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/package-pin value=lock
 bound-lock/1 about="{source} declares no origin: nothing was called. The person-s line allow/origin/{source}, naming where it is reached, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/no-origin value=lock
 bound-lock/1 about="{source} declares several origins ({origins}): the person picks one as region/{source} origin; none is a default, production least of all. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/pick-origin value=lock
@@ -552,6 +642,7 @@ bound-lock/1 about="{source} is a document of a profile the world does not read:
 bound-lock/1 about="{source} is a document the world could not parse: {why}. It was laid and taken back; nothing was connected. The document mended where {why} points pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-unparsed value=lock
 bound-lock/1 about="{source} is connected to {place}, and head may read it: ask {operation} again, with {args}." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready value=lock
 bound-lock/1 about="{source} is connected to {place}: {offers} offers, {reads} of them read; every other is listed, never called. Pinned as {pin}. How access is proven, and where it is reached:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/connected value=lock
+bound-lock/1 about="{source} is pinned otherwise than when {operation} was read at {at}, so what was kept of it stands no longer: it was read again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-changed value=lock
 bound-lock/1 about="{source} is reached through a provider that needs a client the person registered: sign keys/access/{source}/<scheme> client with it. head invents none. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-client value=lock
 bound-lock/1 about="{source} names two different documents ({why}), and a source is one: neither was read. It was laid and taken back; nothing was connected. One document for {source} pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-collision value=lock
 bound-lock/1 about="{source} offers no {operation}: nothing was called. What it offers is listed by look at 1." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/unknown-operation value=lock
@@ -560,11 +651,28 @@ bound-lock/1 about="{source} referred to {by} before it was here: compiled again
 bound-lock/1 about="{source} refers to {refs}, which no document of this place declares yet: a demand, paid when the document that declares it is connected — {source} is then compiled again, never reconnected." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unresolved value=lock
 bound-lock/1 about="{source} refused the read without access and named who issues it: {issuer}. head observed how — its metadata, the steps, a client where the server registers one — and the next read signs in there, on head-s page, once; its token and refresh are kept in this keychain and renewed on use." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/authorizer-observed value=lock
 bound-lock/1 about="{source} refused {operation} with the access head held for it: that access is spent, kept nowhere but marked so, and {place} shows it open. Prove it again once." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused value=lock
+bound-lock/1 about="{source} said {field} is {value}, at {at}." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/forked value=lock
+bound-lock/1 about="{source} said {field} is {value}, at {at}; the other requested sources have no value for this field. This is incomplete evidence, not disagreement." at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=said/partial value=lock
 bound-lock/1 about="{source} states its reads need no access: nothing was kept and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/access-anonymous value=lock
 bound-lock/1 about="{source} waits on bytes that did not arrive, or did not hash to the package, and were not used: {waits}. Bring them beside the package lock by any means and connect the package again; the place holds the demand until they arrive." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open value=lock
 bound-lock/1 about="{source} would ask you for {input}, a secret, and this place-s root allows no more on head-s page: nothing was asked and nothing was called. Its root may sign access/secret-inputs to allow it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/secret-unallowed value=lock
 bound-lock/1 about="{to} is not a folder a package is written into: it must be absolute, inside {place} or a folder the client shares, apart from the place-s own folders, and hold no lock but a package. Nothing was written." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/share-to value=lock
+bound-lock/1 about="{what} is not measured: it waits on {needs}, and no number stands for it." at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unmeasured value=lock
 bound-lock/1 about=done at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/connected/next value=ask
+bound-lock/1 about=done at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claimed/next value=none
+bound-lock/1 about=done at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unclaimed/next value=none
+bound-lock/1 about=done at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-changed/next value=none
+bound-lock/1 about=done at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-expired/next value=none
+bound-lock/1 about=done at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-withdrawn/next value=none
+bound-lock/1 about=done at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept/next value=none
+bound-lock/1 about=done at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/inspected/next value=none
+bound-lock/1 about=done at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-link/next value=none
+bound-lock/1 about=done at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-unlinked/next value=none
+bound-lock/1 about=done at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/sharer-unverified/next value=none
+bound-lock/1 about=done at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-lineage/next value=none
+bound-lock/1 about=done at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-undeclared/next value=none
+bound-lock/1 about=done at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-unknown/next value=none
+bound-lock/1 about=done at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/forked/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-anonymous/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-kept/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/admitted/next value=none
@@ -582,6 +690,9 @@ bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measu
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/reused/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/used/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why/next value=none
+bound-lock/1 about=refused at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claim-none/next value=none
+bound-lock/1 about=refused at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-declined/next value=none
+bound-lock/1 about=refused at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-refused/next value=none
 bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/next value=do
 bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/next/args value=action:access|source:$source|place:$place
 bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/state value=open
@@ -651,11 +762,19 @@ bound-lock/1 at=policy:head/ceilings by=target form=interval measure=count role=
 bound-lock/1 at=policy:head/ceilings by=target form=interval measure=duplicate-bodies role=reads scope=duplicate/src value=0..0
 bound-lock/1 at=policy:head/ceilings by=target form=interval measure=s role=reads scope=cost/act value=0..60
 bound-lock/1 at=policy:head/ceilings by=target form=interval measure=unreceipted needs=README.md role=reads scope=door/unreceipted value=0..0
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=device/person/coverage value=allow/**|ask/**|claim/**
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claim-none/state value=refused
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claimed/state value=done
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-declined/state value=refused
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-unadmitted/next value=ask
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-unadmitted/next/args value=place:$place|lines:$lines
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-unadmitted/state value=refused
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/elicit-claims/state value=asked
+bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unclaimed/state value=done
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/digest-algorithms value=sha256
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/era value=era1
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/signature-algorithms value=ed25519:era1
 bound-lock/1 at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/coverage value=read/**|kept/**|act/**|access/**
-bound-lock/1 at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/person/coverage value=allow/**|ask/**
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=dep/runtime-prose-render shape=dist/regions/text.js value=sha256:67c56505dc51e1f7c0e9926df43d0e05d19a158edd4b1be1db95666d0bac8951
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=sources/prose-render value=https://github.com/Lapxo/topos/releases/download/v0.1.13/907115916d64425dd23305fc74d91ea937f933de4949fb0c4dc94fb1106bd33e
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=sources/runtime-prose-render value=https://github.com/Lapxo/topos/releases/download/v0.1.13/67c56505dc51e1f7c0e9926df43d0e05d19a158edd4b1be1db95666d0bac8951
@@ -665,6 +784,24 @@ bound-lock/1 at=policy:head/home by=target form=alphabet measure=id role=writes
 bound-lock/1 at=policy:head/home by=target form=alphabet measure=id role=writes scope=home/name value=home
 bound-lock/1 at=policy:head/journals by=target form=alphabet measure=class role=writes scope=keys/fold value=fold
 bound-lock/1 at=policy:head/journals by=target form=alphabet measure=class role=writes scope=keys/reader value=read
+bound-lock/1 at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-changed/state value=done
+bound-lock/1 at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-expired/state value=done
+bound-lock/1 at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-withdrawn/state value=done
+bound-lock/1 at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept/state value=done
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/inspected/state value=done
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-owed/state value=open
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-refused/state value=refused
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-link/state value=done
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-unlinked/state value=done
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/sharer-unverified/state value=done
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/transport-missing/next value=ask
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/transport-missing/next/args value=place:$place|lines:$lines
+bound-lock/1 at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/transport-missing/state value=refused
+bound-lock/1 at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-lineage/state value=done
+bound-lock/1 at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-undeclared/state value=done
+bound-lock/1 at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-unknown/state value=done
+bound-lock/1 at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/forked/state value=done
+bound-lock/1 at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/unmeasured/state value=open
 bound-lock/1 at=policy:head/release by=target form=alphabet measure=id role=writes scope=release/blocks value=integrity|pins|cli|surface
 bound-lock/1 at=policy:head/release by=target form=alphabet measure=id role=writes scope=release/category/cli value=cli/**|cost/act
 bound-lock/1 at=policy:head/release by=target form=alphabet measure=id role=writes scope=release/category/integrity value=literal/host|literal/key|literal/org|literal/path|duplicate/src|door/unreceipted
@@ -859,6 +996,13 @@ bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-none/next/args value=source:$source|operation:$operation
 bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared/state value=done
 bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/required value=action|card
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=bound/identity value=reading-identity
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=said/partial/next value=none
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=said/partial/state value=open
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=interval measure=bytes role=writes scope=birth/reading-identity/bytes value=0..16777216
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=interval measure=files role=writes scope=birth/reading-identity/files value=0..2048
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=interval measure=probes role=writes scope=birth/reading-identity/probes value=0..1
+bound-lock/1 at=policy:head/view-identity/0.1.5 by=target form=interval measure=readings role=writes scope=birth/reading-identity/readings value=0..16
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/access value=access
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/anonymous value=anonymous
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/carry value=carry
@@ -903,4 +1047,4 @@ bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=
 bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/source value=src/**
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=license value=MIT
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=name value=@lapxo/head
-bound-lock/1 at=policy:project/0.1.4 by=target form=alphabet measure=id role=writes scope=version value=0.1.4
+bound-lock/1 at=policy:project/0.1.5 by=target form=alphabet measure=id role=writes scope=version value=0.1.5