@lapxo/head 0.1.5 → 0.1.6

package/TARGET.bound

@@ -1,8 +1,9 @@
 bound-lock/1 about="# Connect any API\n\nhead reads an API by the document its provider already publishes, at the address you give it. head names no provider and connects none of its own: what is connected is what you hand it. Here is one way for each level of access, with an API of each kind.\n\n### No access: a document that says nothing about it\n\nTake an API whose document lists its operations and states nothing about access. head does not guess what that means: it tries a read once with nothing attached, and keeps what it saw (`access/<source>/<operation>/observed anonymous`) as a receipt its own key signs. Nothing but a read is ever tried this way.\n\nConnect the document by its address, `https://<provider>/openapi.yaml`, by the site that publishes it, or by a folder holding it, as `forecast`, then read one of its operations. With no place yet, one yes founds your place in `~/place`, connects the document there and lets head read `forecast` for the next 90 days. A document that names several servers asks once which one. The answer comes back typed by what the document declares, one value a line, with a signed receipt of the read (abridged):\n\n```text\nanswer/<request>/current/temperature   number  …\nanswer/<request>/current_units/temperature   text    …\nread/forecast/<operation>/<request>    digest  sha256:… signed by head\n```\n\nAn overlay can still say what the provider says on its own site, so the place states it rather than observes it:\n\n```yaml\noverlay: 1.0.0\ninfo: { title: the forecast, read without a key, version: '1' }\nactions:\n  - target: \"$.paths['/forecast'].get\"\n    description: the provider says this read needs no key\n    update: { security: [] }\n```\n\nWhatever API you connect, its terms are the provider's: read them before you connect it, and say where an answer came from when they ask you to.\n\n### A declared flow: OAuth 2.0\n\nTake an API whose document declares OAuth 2.0 with an authorization code. head compiles it into the two steps it takes, the provider's page with PKCE and then the token exchange, and nobody writes a line of it. What it needs is yours: the client id of an app you registered with the provider, signed into the place as `keys/access/<source>/<flow> client <id>`. Until then head says so and calls nothing.\n\n### A secret entered by hand\n\nWhen a document declares a bearer token or an API key and no way to obtain one, the key is a secret input. head asks for it on its own one-time page, never through the model, and only when the place's root allows a secret with `access/secret-inputs`. It is kept in the keychain, never in a file.\n\n### When the document says too little\n\nA login of its own (an email, a one-time code, a choice of account) is written once as an `x-access` flow, an Arazzo profile in an overlay, and every API of the same issuer refers to it with one `$ref`. The profile and its vectors are on topos-openapi's own page, `docs/x-access.md` in `@lapxo/topos-openapi`. Every API connected this way is read the same way afterwards: one access per issuer, each answer typed and kept.\n" at=policy:head/connect/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api shape=docs/connect-any-api.md value=lock
-bound-lock/1 about="# head\n\nAn API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility.\n\n## Install\n\n- **As an extension:** download `head-<version>-<digest>.mcpb` from the [latest release](https://github.com/Lapxo/head/releases/latest) and open it. Its digest is in the release notes.\n- **By command:** `npx -y @lapxo/head@0.1.5`, for an assistant that starts its servers by command.\n\nhead runs on macOS for now. Its keys live in your keychain, never in a file.\n\n## The first minute\n\nhead connects nothing when it is installed, and names no provider: what it reads is the API you hand it.\n\n1. Ask your assistant something. With no place yet, head says so, and asks for the address of the document of an API that answers it.\n2. Give that address and say yes once. head founds your place in `~/place`, connects the API from its document, pinned by the digest of what it read, and lets head read it for the next 90 days.\n3. Your assistant asks again by itself, and the answer comes back typed, with the source it came from and a receipt signed by head's key.\n" at=policy:head/version/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/readme shape=README.md value=lock
+bound-lock/1 about="# head\n\nAn API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](https://github.com/Lapxo/head/blob/main/docs/connect-any-api.md) shows each level of access.\n\nA person does four things, in the client they talk to. **Connect** an API: hand head its document, and an overlay beside it when it says too little; it is compiled once and pinned, and the first connect with no place founds `~/place` on the same yes, its root key kept in the keychain. **Ask**: name what you want by its name or in your own words; head finds it in its own registry of the source, never listing the rest to the model, obtains access the first time as the document declares it, calls only what reads, types the answer and lands a receipt. An answer of nothing is what the source holds today, said with its hour; no byte at all is no answer, and the read stays owed until one brings them. **Do** what is not a read, once you say yes to that very call. **Share** a place: share makes a package you can send and verify; your lines are a plain text file you can copy. A client starts head with `head run`; typed alone, `head` says this and starts nothing.\n\n**Your lines.** Beside your place's lock, `birth.bound` holds your lines and nothing of head's: your root and your devices, the sources you connected, what you allowed, each offer you used under the words you asked it by. It is a text file with your lines, in your own words: read it with `cat`, copy it, paste it. head's own lines are its profile, which you see when you ask why.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one stays open until its responsibilities are reduced or split.\n\n## Install\n\n- **As an extension:** download `head-<version>-<digest>.mcpb` from the [latest release](https://github.com/Lapxo/head/releases/latest) and open it. Its digest is in the release notes.\n- **By command:** `npx -y @lapxo/head@0.1.6 run`, for an assistant that starts its servers by command.\n\nhead runs on macOS for now. Its keys live in your keychain, never in a file.\n\n## The first minute\n\nhead connects nothing when it is installed, and names no provider: what it reads is the API you hand it.\n\n1. Ask your assistant something. With no place yet, head says so, and asks for the address of the document of an API that answers it.\n2. Give that address and say yes once. head founds your place in `~/place`, connects the API from its document, pinned by the digest of what it read, and lets head read it for the next 90 days.\n3. Your assistant asks again by itself, and the answer comes back typed, with the source it came from and a receipt signed by head's key.\n" at=policy:head/verified-delivery/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/readme shape=README.md value=lock
+bound-lock/1 about="*.mts\n*changelog*\n" at=policy:head/bundle-exclusions/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/exclusions shape=.mcpbignore value=lock
 bound-lock/1 about="A lot is drafted lines, one a line, each by=target and unsigned: nothing was asked." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/bad-lot value=lock
 bound-lock/1 about="A place is founded in an absolute folder: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-absolute value=lock
-bound-lock/1 about="A source the place compiles, by the name the place gives it: alone, its region, what it offers; with an operation, one read of it." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/source value=string
+bound-lock/1 about="A source the place compiles, by the name the place gives it: alone, its region, what of it was used and how much more it offers; with an operation, one read of it." at=policy:head/verbs/0.1.6 by=target form=alphabet measure=id role=writes scope=tool/ask/source value=string
 bound-lock/1 about="A source the place compiles." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/access/source value=string
 bound-lock/1 about="A source the place compiles." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/source value=string
 bound-lock/1 about="A source the place compiles: an API it holds the document of, by the name the place gives it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/source value=string
@@ -10,6 +11,7 @@ bound-lock/1 about="A source this place connected whose access reads the documen
 bound-lock/1 about="Access to {source} ({flow}) was refused and is not proven since: {place} holds it open." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending value=lock
 bound-lock/1 about="Access to {source} is kept in this keychain, its receipt landed without the secret: nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/access-kept value=lock
 bound-lock/1 about="Admit another device into a place, once whoever holds its root says yes: the key its own key tool handed, under a name, covering what is given — without it, what a member is: asking, keeping what it read, proving access. What it claims to cover is not read." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit value=place|key|name|coverage
+bound-lock/1 about="All Head source lines under the existing 0.1.5 ceiling. No local identity fingerprint or duplicated call-resolution wrapper is delivered; contracts remain in the lock and source comments are concise." at=policy:head/verified-delivery/0.1.6 by=target form=interval measure=source-lines role=writes scope=source/lines value=0..2600
 bound-lock/1 about="Allow one offer that is not of class read, up to a number of times." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can value=source|operation|times
 bound-lock/1 about="An API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility." at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/idea value=lock
 bound-lock/1 about="An MCP server that reads any API by its document: access asked once per issuer, every answer typed by the world that compiled it, every read kept with a signed receipt." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/what value=lock
@@ -25,6 +27,7 @@ bound-lock/1 about="Any API, read by its document" at=policy:head/docs by=target
 bound-lock/1 about="Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/ask value=place|source|operation|args|view|card|key|lines|why|history|closes|sources
 bound-lock/1 about="Ask me before {operation} on {source} is called, every time. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/text value=lock
 bound-lock/1 about="Ask the person before an offer is called, every time." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask value=source|operation
+bound-lock/1 about="Asked of a link, the transport it is read by: the lines of head-s profile the place was born with, and who laid them." at=policy:head/verbs/0.1.6 by=target form=alphabet measure=id role=writes scope=tool/connect/why value=boolean
 bound-lock/1 about="Call one offer that is not of class read, only as far as the person allowed it and after their yes when they asked to be asked. The intent lands before the call and the receipt after; a call that never answered stays open until a look closes it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act value=place|source|operation|args
 bound-lock/1 about="Clone, `npm ci && npm test`. A vector that gives you a different answer is the contribution: send it with what it printed. Lines land through the fold, never by hand; when a page and the lock disagree, the lock is right." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/contributing value=lock
 bound-lock/1 about="Closed {intent} by this read ({digest}). It counts as done: act runs again only within what is still allowed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/closed value=lock
@@ -33,11 +36,12 @@ bound-lock/1 about="Connect a source to a place, once the person says yes: its d
 bound-lock/1 about="Connect any API" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api/heading value=lock
 bound-lock/1 about="Connect {source} to the place {place} from {document} with the connect tool, then show me what it offers." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/text value=lock
 bound-lock/1 about="Connected to {place} from the package {package}: {sources} — every document and every pin as it names them. Nothing was granted with them: access is asked here, issuer by issuer." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/received value=lock
+bound-lock/1 about="Desktop Extension exclusions applied by the native packager without changing installed dependencies" at=policy:head/bundle-exclusions/0.1.6 by=target form=alphabet measure=id needs=.mcpbignore role=demands scope=view/bundle-exclusions shape=.mcpbignore value=text
 bound-lock/1 about="Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, call an offer that is not a read, or keep what the person states as theirs. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act." at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/do value=action|card|place|dir|name|key|coverage|lot|to|urls|who|source|operation|args|said|withdraw
 bound-lock/1 about="Drafted lines, one a line, each by=target and unsigned: shown to the person and, on their yes to exactly those, signed by their key and folded as if landed. Nothing lands; the answer names the lot do lands." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/lines value=string
 bound-lock/1 about="Earlier, {source} answered the same request at {at}, under receipt {digest}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-earlier value=lock
 bound-lock/1 about="For access and act: a source the place compiles." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/source value=string
-bound-lock/1 about="For act, the operation, by the id the source offers it under; for access, the read whose access is proven, without one the first read the source offers." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/operation value=string
+bound-lock/1 about="For act, the operation, by its name or in the person-s words; for access, the read whose access is proven, without one the first read the source offers." at=policy:head/verbs/0.1.6 by=target form=alphabet measure=id role=writes scope=tool/do/operation value=string
 bound-lock/1 about="For act: the parameters by name, and body for what the operation is sent." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/args value=object
 bound-lock/1 about="For admit: the lines the other device-s key action answered, or the line holding its public key." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/key value=string
 bound-lock/1 about="For admit: what it may sign there, as scopes joined by |; without it, what a member may." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/coverage value=string
@@ -65,6 +69,7 @@ bound-lock/1 about="Keep what the person states in this conversation as theirs,
 bound-lock/1 about="Keep {source} read-only. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly/text value=lock
 bound-lock/1 about="Kept as yours in {place}: {said}" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claimed value=lock
 bound-lock/1 about="Land a lot plan signed, by its digest, while the place still stands on the base it was planned against." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/land value=lot
+bound-lock/1 about="More than one of what {source} offers fits \"{asked}\": the person chooses the one they meant, in head-s form, which lists them to the person alone." at=policy:head/surface/0.1.6 by=target form=alphabet measure=id role=writes scope=said/pick-offer value=lock
 bound-lock/1 about="No answer of {operation} on {source} is held for this request: there is no line to say why. A read of it, at 8, lands the receipt that would." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/why-none value=lock
 bound-lock/1 about="No intent {intent} stands open for this source: nothing was closed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/nothing-open value=lock
 bound-lock/1 about="No link: a link needs the address where its bytes are published. {document} is ready to publish as it is; share again with that address, or send the package-s digest apart as before." at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/shared-unlinked value=lock
@@ -90,7 +95,6 @@ bound-lock/1 about="Prove access to {source} in {place} with the do tool, as its
 bound-lock/1 about="Read one view of a place as bound folds it, at the resolution ask reads it at; or what a source offers, as typed lines: at 0 where it is reached and the class of each offer, past it their forms and how access is proven; or, with an operation of class read, that operation once: the response comes back with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. Nothing else is ever called." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/look value=place|view|source|operation|args|closes|history|why
 bound-lock/1 about="Receive a package another place shared: from a file or an address, by the digest its sender sent apart from it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive value=package|digest|place
 bound-lock/1 about="Receive the package {package} into the place {place} with the connect tool: its lock as the document, named by the digest {digest}. Ask me before you do, and tell me which sources it connected and that access is asked here again." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/text value=lock
-bound-lock/1 about="Reuse only the native lines/evidence identities returned by the installed Bound CLI; request result text under that expected identity. If identity is unavailable, read fresh without cache. No filesystem fingerprint or maintenance exclusion is an authority." at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=reading/use value=bound-view-identity
 bound-lock/1 about="Several sources, joined by |, asked the same operation with the same arguments: what they agree on is marked by who says it, and what they differ on is shown from each." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=tool/ask/sources value=string
 bound-lock/1 about="Share a place with someone: its sources, as a package they connect by its digest." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share value=place|who
 bound-lock/1 about="Share the place {place} with {who}: pack it with the do tool, as its share action, into a folder I share, show me the package-s digest, and tell me to send {who} the folder — or the addresses it is published at — and the digest apart from it, over a private channel." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/share/text value=lock
@@ -140,12 +144,12 @@ bound-lock/1 about="The name the place knows that device by." at=policy:head/sur
 bound-lock/1 about="The name the source is known by in the place; none for a package, whose lock names its sources." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/source value=string
 bound-lock/1 about="The name the source is known by." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/source value=string
 bound-lock/1 about="The operation asked before the source was connected, by the id the source offers it under: asked again once it is; optional." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/operation value=string
+bound-lock/1 about="The operation, by its name or in the person-s words: head finds it among what the source offers, the person choosing where more than one fits." at=policy:head/verbs/0.1.6 by=target form=alphabet measure=id role=writes scope=tool/look/operation value=string
+bound-lock/1 about="The operation, by its name or in the person-s words: head finds it among what the source offers, the person choosing where more than one fits; read once, when it is of the class head reads." at=policy:head/verbs/0.1.6 by=target form=alphabet measure=id role=writes scope=tool/ask/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/operation value=string
-bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/operation value=string
-bound-lock/1 about="The operation, by the id the source offers it under: read once, when it is of the class head reads." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/operation value=string
 bound-lock/1 about="The package-s lock: an absolute file, or an encrypted address." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/package value=string
 bound-lock/1 about="The parameters by name, and body for what the operation is sent." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/args value=object
 bound-lock/1 about="The parameters of that operation, by name; optional." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/args value=object
@@ -173,6 +177,7 @@ bound-lock/1 about="This device keeps no keychain head can reach: no key was mad
 bound-lock/1 about="This device-s person key already attests {scope} in {place}, or the place states it itself: a second line of it is read only through a fold of this key-s lines, which bound does not publish. Nothing was signed; the place-s root can sign it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/attested-again value=lock
 bound-lock/1 about="This keychain keeps no root of {place}: whoever holds it connects sources and admits devices there. Nothing was asked." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-root value=lock
 bound-lock/1 about="This place signs no view of cells: nothing is open to ask." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-cells value=lock
+bound-lock/1 about="Validate every completed cached lines/evidence view with the public identity returned by Bound, and bind new result text to that expected identity. A missing or refused identity never validates an older result. Head keeps no filesystem fingerprint or maintenance exclusion as a substitute." at=policy:head/verified-delivery/0.1.6 by=target form=alphabet measure=id role=writes scope=reading/use value=bound-view-identity
 bound-lock/1 about="What do I have in head? List my places and the sources each one holds." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have/text value=lock
 bound-lock/1 about="What do I have: my places and the sources each one holds." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have value=
 bound-lock/1 about="What happened: what head read and did in my place." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened value=
@@ -200,6 +205,8 @@ bound-lock/1 about="With an operation and its parameters: what was retained of t
 bound-lock/1 about="With an operation and its parameters: what was retained of that read, as of when it was made, instead of a current answer. Nothing is called; the place must allow it." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/history value=boolean
 bound-lock/1 about="With an operation and its parameters: why its newest answer stands — who said it and when, its receipt digest, and the pins it rests on, read off the place-s evidence and lines. Nothing is called." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/look/why value=boolean
 bound-lock/1 about="With card: the key whose cells are asked; without one, every open cell." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/key value=string
+bound-lock/1 about="You would have {operation} on {source} called, {call}, if you admit it for this call alone, your yes signed for it and nothing else. Yes?" at=policy:head/surface/0.1.6-suggest by=target form=alphabet measure=id role=writes scope=said/elicit-act value=lock
+bound-lock/1 about="You would have {sources} read in {place} until {until} if you admit it: no read asks again before then, writes still do. Yes?" at=policy:head/surface/0.1.6-suggest by=target form=alphabet measure=id role=writes scope=said/grant value=lock
 bound-lock/1 about="a client that asks, or head-s page opened" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/cannot-ask/next value=none
 bound-lock/1 about="a count of the readings made ahead of a question apart from those a question made, so a read ahead never spends what a question needs; until then head marks its reads ahead itself" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/probes value=probes@1
 bound-lock/1 about="a device key attests; it never admits another key" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/class value=attest
@@ -209,6 +216,7 @@ bound-lock/1 about="a document of a profile a world reads" at=policy:head/shape/
 bound-lock/1 about="a document that offers an operation" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/nothing-offered/next value=none
 bound-lock/1 about="a document the person names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/use-none/next value=none
 bound-lock/1 about="a folder apart from the place-s own" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/share-to/next value=none
+bound-lock/1 about="a form read at its own resolution: none is given, and the form answers at the one it reads by default" at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=resolution/own value=own
 bound-lock/1 about="a host head runs on" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/platform/next value=none
 bound-lock/1 about="a keychain head reaches" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-keychain/next value=none
 bound-lock/1 about="a link whose location is optional, as the plan of topos names it: until then share prints no link without an address, and the digest goes apart" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/reference-location value=reference-location@1
@@ -240,10 +248,12 @@ bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust-secret/next value=none
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust/next value=none
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/visit/next value=none
+bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/pick-offer/next value=none
 bound-lock/1 about="a release category that admits the lines a release pins by (dep/* package digests, uses/* pins, sources/* tarballs) as what the release checks. On 0.2.5, release/category/pins pointed at uses/**|dep/**|sources/** resolves no pin: uses/** and dep/** name no obligation, and sources/** selects only sources/lines, a code ceiling. Until bound pays it, the category stands as it is and the pins are read in the lock" at=policy:head/release/pins/0.1.5 by=target form=alphabet measure=id role=demands scope=bound/release-pins value=release-pins@1
 bound-lock/1 about="a signer over an encrypted file, for hosts with no keychain: only where a place declares it and every line it signs is marked so; never a default" at=policy:head/platform by=target form=alphabet measure=id role=demands scope=signer/encrypted-file value=declared|marked
 bound-lock/1 about="a source reached at the document-s origin" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-cross-origin/next value=none
 bound-lock/1 about="a source-s own mark, and the mark of one that is the same source in another form or shares a declared lineage" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/mark value=●|○
+bound-lock/1 about="a text file with the person-s lines, in their own words, beside the place-s lock: each line head lands at the person-s at, drafted with no signature and gone with its withdraw. Bound reads it as it reads the place, so head writes it with the land, never while a fold runs. Read with cat, shared as it is; it grows with use" at=policy:head/founding/0.1.6/land by=target form=alphabet measure=id role=writes scope=founding/birth-file value=birth.bound
 bound-lock/1 about="a view explained: the lines it stands on with the readings of their ceilings; read for a person, a view is read with no resolution, at its own" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/view/why value=1
 bound-lock/1 about="a view is lines of text" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=resource/view/mime value=text/plain
 bound-lock/1 about="a view of cells the place signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-cells/next value=none
@@ -285,6 +295,7 @@ bound-lock/1 about="bound-lock/1 at=policy:person/allows by=target form=interval
 bound-lock/1 about="bound-lock/1 at=policy:person/asks by=target form=alphabet measure=status role=writes scope=ask/{source}/{operation} value=present" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/line value=lock
 bound-lock/1 about="bound-s words a person sees in the first minute: no resolution number, no refusal of bound-s" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=person-words value=0..0
 bound-lock/1 about="card reads and never writes" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/card/hints value=readOnly|idempotent
+bound-lock/1 about="card, as a person reads it: at its own resolution" at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=resolution/card/person value=own
 bound-lock/1 about="composing policies is bound-s" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/parent-lock/next value=none
 bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=id needs=docs/connect-any-api.md role=demands scope=view/docs-connect-any-api shape=docs/connect-any-api.md value=text
 bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=region/docs-connect-any-api value=lock
@@ -299,7 +310,7 @@ bound-lock/1 about="every reader of a place head founds is a bounded process: it
 bound-lock/1 about="every reader of a place head founds is handed everything connected, and the fold decides which reads what: one that reads a document and finds nothing of its own answers empty, completed; a document no world reads is open by name" at=policy:head/birth by=target form=alphabet measure=id role=writes scope=birth/reader/empty value=allow
 bound-lock/1 about="every tool and resource line has its module, and every module its line" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/unmatched value=0..0
 bound-lock/1 about="head answers calls and nothing else: no timer, no worker, no resident process" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/scheduled value=0..0
-bound-lock/1 about="head asks before it calls {operation} on {source}: {call}. Say yes only to this call; your yes is signed for it alone." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit-act value=lock
+bound-lock/1 about="head answers inside an MCP client, which starts it with head run. There you connect an API, ask it, do what it offers and share your place. Your own lines are birth.bound beside your place-s lock: a plain text file you can copy." at=policy:head/cli/0.1.6 by=target form=alphabet measure=id role=writes scope=cli/help value=lock
 bound-lock/1 about="head asks to admit the device {name} into {place}, covering {coverage}: it may sign only that there. Say yes only to this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit-admit value=lock
 bound-lock/1 about="head asks to connect to {place} every source the package {package} names whose bytes arrived, in its order: {sources}. Each is compiled here and held to the package-s pin; nothing the sharing place was granted comes with it. Waiting for their bytes, connected when they arrive: {open}. Say yes only to this." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/elicit-receive value=lock
 bound-lock/1 about="head asks to connect {source} to {place} from {document} {overlay}: compiled once and pinned; nothing is called. Say yes only to this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit-connect value=lock
@@ -311,7 +322,6 @@ bound-lock/1 about="head carries no transport for {origin}: nothing was called.
 bound-lock/1 about="head could not reach the person: this client asks no form and sends no address, and this device-s browser did not open head-s page. Nothing was called. A client that asks forms or sends addresses, or a browser this device can open, would." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/cannot-ask value=lock
 bound-lock/1 about="head is a host: it answers a protocol and names no verb of its own" at=policy:head/ceilings by=target form=interval measure=cli-verbs role=reads scope=cli/verbs value=0..0
 bound-lock/1 about="head keeps no planned lot {lot}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-lot value=lock
-bound-lock/1 about="head may read {sources} in {place} until {until}: no read asks again before then, writes still do. Say yes only to exactly this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/grant value=lock
 bound-lock/1 about="head names no client anywhere, adapters included: what it asks through is what the client declares, read by its capabilities" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/client-words value=0..0
 bound-lock/1 about="head names no kind of source outside its transport adapters: those words live in worlds" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/kind-words value=0..0
 bound-lock/1 about="head runs on {supported}; this host is {platform}: nothing was done. Its secret store and browser opener are none head carries. A host head runs on pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/platform value=lock
@@ -333,10 +343,10 @@ bound-lock/1 about="how many tools may configure a place: what asks never config
 bound-lock/1 about="how to contribute, from this lock" at=policy:head/docs by=target form=alphabet measure=id role=demands scope=view/guide shape=CONTRIBUTING.md value=guide-at-zero
 bound-lock/1 about="its encrypted address" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/insecure-origin/next value=none
 bound-lock/1 about="look reads and never writes; asked twice of the same place it answers the same" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/hints value=readOnly|idempotent
-bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  workflow_dispatch:\nconcurrency: release-delivery\njobs:\n  approve:\n    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.judge.outputs.tag }}\n      digest: ${{ steps.judge.outputs.digest }}\n      archive: ${{ steps.judge.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --prefix .instrument --no-save --ignore-scripts @lapxo/bound@0.2.5\n      - name: Prepare release\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          TAG=\"v$(node -p \"require('./package.json').version\")\"\n          printf 'TAG=%s\\n' \"$TAG\" >> \"$GITHUB_ENV\"\n          git fetch origin \"refs/tags/$TAG:refs/tags/$TAG\"\n          gh api --paginate \"repos/$GITHUB_REPOSITORY/releases\" --jq '.[].tag_name' > \"$RUNNER_TEMP/release-tags\"\n          if grep -Fxq \"$TAG\" \"$RUNNER_TEMP/release-tags\"; then\n            printf 'RELEASE %s · exists\\n' \"$TAG\"\n          else\n            gh release create \"$TAG\" --verify-tag --draft --title \"$TAG\" --generate-notes\n            printf 'RELEASE %s · draft created · awaiting signed assets\\n' \"$TAG\"\n          fi\n      - name: Read owner approval\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --pattern approval-signed --dir .release\n          node .instrument/node_modules/@lapxo/bound/dist/cli/verb.js fold --as release .release/approval-signed > .release/verdict\n          cat .release/verdict\n      - name: Judge the approved release archive\n        id: judge\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          read -r status digest archive source extra < .release/verdict\n          test \"$status\" = READY\n          test -z \"$extra\"\n          gh release download \"$TAG\" --pattern \"$archive\" --dir .release\n          printf '%s  %s\\n' \"${digest#sha256:}\" \".release/$archive\" | sha256sum -c -\n          expected=\"$(node -p \"require('./package.json').name+'@'+require('./package.json').version\")\"\n          actual=\"$(tar -xOf \".release/$archive\" package/package.json | node -p \"const p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.name+'@'+p.version\")\"\n          test \"$actual\" = \"$expected\"\n          printf 'SOURCE release/%s/%s · %s · declared %s\\n' \"$TAG\" \"$archive\" \"$digest\" \"$source\"\n          printf 'tag=%s\\ndigest=%s\\narchive=%s\\n' \"$TAG\" \"$digest\" \"$archive\" >> \"$GITHUB_OUTPUT\"\n  bundle:\n    needs: approve\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Make the Desktop Extension from the approved archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          mkdir -p \"$RUNNER_TEMP/release\"\n          gh release download \"$TAG\" --pattern \"$ARCHIVE\" --dir \"$RUNNER_TEMP/release\"\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \"$RUNNER_TEMP/release/$ARCHIVE\" | shasum -a 256 -c -\n          test \"v$(node -p \"require('./manifest.json').version\")\" = \"$TAG\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$RUNNER_TEMP/release/$ARCHIVE\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          test \"$one\" = \"$two\"\n          bundle=\"head-${TAG#v}-${one:0:16}.mcpb\"\n          cp \"$RUNNER_TEMP/head-1.mcpb\" \"$RUNNER_TEMP/$bundle\"\n          printf 'BUNDLE=%s\\nMADE=sha256:%s\\n' \"$bundle\" \"$one\" >> \"$GITHUB_ENV\"\n          printf 'BUNDLE %s · sha256:%s · made twice · from %s\\n' \"$bundle\" \"$one\" \"$DIGEST\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/$BUNDLE\" node --test test/bundle.test.ts\n      - name: Attach it to the release, its digest in the notes\n        run: |\n          set -euo pipefail\n          gh release view \"$TAG\" --json body --jq .body > \"$RUNNER_TEMP/notes.md\"\n          if grep -q 'The Desktop Extension `head-' \"$RUNNER_TEMP/notes.md\"; then\n            grep -Fq \"$MADE\" \"$RUNNER_TEMP/notes.md\" || { printf 'REFUSE·bundle the release names another digest than %s\\n' \"$MADE\"; exit 1; }\n          else\n            printf '\\n\\nThe signature covers `%s` (`%s`). The Desktop Extension `%s` (`%s`) is made by this workflow from that archive, packed by mcpb and repacked with fixed times, modes and order; made again, it gives the same digest.\\n' \"$ARCHIVE\" \"$DIGEST\" \"$BUNDLE\" \"$MADE\" >> \"$RUNNER_TEMP/notes.md\"\n            gh release edit \"$TAG\" --notes-file \"$RUNNER_TEMP/notes.md\"\n          fi\n          gh release upload \"$TAG\" \"$RUNNER_TEMP/$BUNDLE\" --clobber\n          mkdir -p \"$RUNNER_TEMP/back\"\n          gh release download \"$TAG\" --pattern \"$BUNDLE\" --dir \"$RUNNER_TEMP/back\"\n          printf '%s  %s\\n' \"${MADE#sha256:}\" \"$RUNNER_TEMP/back/$BUNDLE\" | shasum -a 256 -c -\n  publish:\n    needs: [approve, bundle]\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      id-token: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0' --ignore-scripts\n      - name: Stage the approved release archive\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --pattern \"$ARCHIVE\" --dir .release\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \".release/$ARCHIVE\" | sha256sum -c -\n          gh release edit \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --draft=false\n          printf 'RELEASE %s · published · %s\\n' \"$TAG\" \"$DIGEST\"\n          npm stage publish \".release/$ARCHIVE\" --access public --ignore-scripts\n          printf 'STAGED %s · %s · owner approval pending\\n' \"$ARCHIVE\" \"$DIGEST\"\n" at=policy:head/forge/0.2.5 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/release shape=.github/workflows/release.yml value=lock
-bound-lock/1 about="name: suite-map\non:\n  push:\n    branches: ['suite-map/**']\npermissions:\n  contents: read\njobs:\n  map:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n          fetch-depth: 0\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Run each test file alone, three at a time, its processes measured, keeping only what of head they ran\n        run: |\n          set -uo pipefail\n          map=\"$RUNNER_TEMP/suite-map\"\n          mkdir -p \"$map\"\n          measure() {\n            out=\"$1/$(basename \"$2\")\"\n            mkdir -p \"$out\"\n            NODE_V8_COVERAGE=\"$out\" node --test \"$2\" > \"$out.log\" 2>&1 || echo \"FAILED $2\" >> \"$out.log\"\n            grep -L -F \"$GITHUB_WORKSPACE/src/\" \"$out\"/*.json 2>/dev/null | xargs rm -f\n          }\n          export -f measure\n          ls test/*.test.ts | xargs -P 3 -I{} bash -c 'measure \"$0\" \"$1\"' \"$map\" {}\n          git log --format='%H %s' origin/main..HEAD > \"$map/commits.txt\"\n          cat \"$map\"/*.log | grep -E '^(FAILED|ℹ (pass|fail))' || true\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: suite-map\n          path: ${{ runner.temp }}/suite-map/\n          if-no-files-found: error\n" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/suite-map shape=.github/workflows/suite-map.yml value=lock
-bound-lock/1 about="name: tag\non:\n  workflow_run:\n    workflows: [test]\n    types: [completed]\njobs:\n  tag:\n    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha }}\n          fetch-depth: 0\n      - run: |\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          git tag --list \"$version\" | grep -q . && exit 0\n          git tag \"$version\" && git push origin \"$version\"\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/tag shape=.github/workflows/tag.yml value=lock
-bound-lock/1 about="name: test\non:\n  push:\n    branches: [main, 'measure/**']\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 3\n        run: |\n          set -euo pipefail\n          node --test --test-shard=${{ matrix.shard }}/3 test/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: ${{ runner.temp }}/head-tests.log\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Measure a new person's first minute against an API on this machine\n        run: |\n          set -euo pipefail\n          HEAD_ONBOARDING=1 node --test test/onboarding.test.ts 2>&1 | tee -a \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n" at=policy:head/forge/measure/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
+bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  workflow_dispatch:\nconcurrency: release-delivery\njobs:\n  approve:\n    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.judge.outputs.tag }}\n      digest: ${{ steps.judge.outputs.digest }}\n      archive: ${{ steps.judge.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --prefix .instrument --no-save --ignore-scripts @lapxo/bound@0.2.5\n      - name: Prepare release\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          TAG=\"v$(node -p \"require('./package.json').version\")\"\n          printf 'TAG=%s\\n' \"$TAG\" >> \"$GITHUB_ENV\"\n          git fetch origin \"refs/tags/$TAG:refs/tags/$TAG\"\n          gh api --paginate \"repos/$GITHUB_REPOSITORY/releases\" --jq '.[].tag_name' > \"$RUNNER_TEMP/release-tags\"\n          if grep -Fxq \"$TAG\" \"$RUNNER_TEMP/release-tags\"; then\n            printf 'RELEASE %s · exists\\n' \"$TAG\"\n          else\n            gh release create \"$TAG\" --verify-tag --draft --title \"$TAG\" --generate-notes\n            printf 'RELEASE %s · draft created · awaiting signed assets\\n' \"$TAG\"\n          fi\n      - name: Read owner approval\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --pattern approval-signed --dir .release\n          node .instrument/node_modules/@lapxo/bound/dist/cli/verb.js fold --as release .release/approval-signed > .release/verdict\n          cat .release/verdict\n      - name: Judge the approved release archive\n        id: judge\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          read -r status digest archive source extra < .release/verdict\n          test \"$status\" = READY\n          test -z \"$extra\"\n          gh release download \"$TAG\" --pattern \"$archive\" --dir .release\n          printf '%s  %s\\n' \"${digest#sha256:}\" \".release/$archive\" | sha256sum -c -\n          expected=\"$(node -p \"require('./package.json').name+'@'+require('./package.json').version\")\"\n          actual=\"$(tar -xOf \".release/$archive\" package/package.json | node -p \"const p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.name+'@'+p.version\")\"\n          test \"$actual\" = \"$expected\"\n          printf 'SOURCE release/%s/%s · %s · declared %s\\n' \"$TAG\" \"$archive\" \"$digest\" \"$source\"\n          printf 'tag=%s\\ndigest=%s\\narchive=%s\\n' \"$TAG\" \"$digest\" \"$archive\" >> \"$GITHUB_OUTPUT\"\n  bundle:\n    needs: approve\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Make the Desktop Extension from the approved archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          mkdir -p \"$RUNNER_TEMP/release\"\n          gh release download \"$TAG\" --pattern \"$ARCHIVE\" --dir \"$RUNNER_TEMP/release\"\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \"$RUNNER_TEMP/release/$ARCHIVE\" | shasum -a 256 -c -\n          test \"v$(node -p \"require('./manifest.json').version\")\" = \"$TAG\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$RUNNER_TEMP/release/$ARCHIVE\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json .mcpbignore \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          test \"$one\" = \"$two\"\n          bundle=\"head-${TAG#v}-${one:0:16}.mcpb\"\n          cp \"$RUNNER_TEMP/head-1.mcpb\" \"$RUNNER_TEMP/$bundle\"\n          printf 'BUNDLE=%s\\nMADE=sha256:%s\\n' \"$bundle\" \"$one\" >> \"$GITHUB_ENV\"\n          printf 'BUNDLE %s · sha256:%s · made twice · from %s\\n' \"$bundle\" \"$one\" \"$DIGEST\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/$BUNDLE\" node --test test/bundle.test.ts\n      - name: Attach it to the release, its digest in the notes\n        run: |\n          set -euo pipefail\n          gh release view \"$TAG\" --json body --jq .body > \"$RUNNER_TEMP/notes.md\"\n          if grep -q 'The Desktop Extension `head-' \"$RUNNER_TEMP/notes.md\"; then\n            grep -Fq \"$MADE\" \"$RUNNER_TEMP/notes.md\" || { printf 'REFUSE·bundle the release names another digest than %s\\n' \"$MADE\"; exit 1; }\n          else\n            printf '\\n\\nThe signature covers `%s` (`%s`). The Desktop Extension `%s` (`%s`) is made by this workflow from that archive, packed by mcpb and repacked with fixed times, modes and order; made again, it gives the same digest.\\n' \"$ARCHIVE\" \"$DIGEST\" \"$BUNDLE\" \"$MADE\" >> \"$RUNNER_TEMP/notes.md\"\n            gh release edit \"$TAG\" --notes-file \"$RUNNER_TEMP/notes.md\"\n          fi\n          gh release upload \"$TAG\" \"$RUNNER_TEMP/$BUNDLE\" --clobber\n          mkdir -p \"$RUNNER_TEMP/back\"\n          gh release download \"$TAG\" --pattern \"$BUNDLE\" --dir \"$RUNNER_TEMP/back\"\n          printf '%s  %s\\n' \"${MADE#sha256:}\" \"$RUNNER_TEMP/back/$BUNDLE\" | shasum -a 256 -c -\n  publish:\n    needs: [approve, bundle]\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      id-token: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0' --ignore-scripts\n      - name: Stage the approved release archive\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --pattern \"$ARCHIVE\" --dir .release\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \".release/$ARCHIVE\" | sha256sum -c -\n          gh release edit \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --draft=false\n          printf 'RELEASE %s · published · %s\\n' \"$TAG\" \"$DIGEST\"\n          npm stage publish \".release/$ARCHIVE\" --access public --ignore-scripts\n          printf 'STAGED %s · %s · owner approval pending\\n' \"$ARCHIVE\" \"$DIGEST\"\n" at=policy:head/bundle-exclusions/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/release shape=.github/workflows/release.yml value=lock
+bound-lock/1 about="name: suite-map\non:\n  push:\n    branches: ['suite-map/**']\npermissions:\n  contents: read\njobs:\n  map:\n    strategy:\n      fail-fast: false\n      matrix:\n        shard: [1, 2, 3, 4, 5, 6]\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n          fetch-depth: 0\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Run each test file of this shard alone, three at a time, its processes measured, keeping only what of head they ran\n        run: |\n          set -uo pipefail\n          map=\"$RUNNER_TEMP/suite-map\"\n          mkdir -p \"$map\"\n          measure() {\n            out=\"$1/$(basename \"$2\")\"\n            mkdir -p \"$out\"\n            NODE_V8_COVERAGE=\"$out\" node --test \"$2\" > \"$out.log\" 2>&1 || echo \"FAILED $2\" >> \"$out.log\"\n            grep -L -F \"$GITHUB_WORKSPACE/src/\" \"$out\"/*.json 2>/dev/null | xargs rm -f\n          }\n          export -f measure\n          ls test/*.test.ts | awk -v s=\"${{ matrix.shard }}\" 'NR % 6 == s % 6' | xargs -P 3 -I{} bash -c 'measure \"$0\" \"$1\"' \"$map\" {}\n          git log --format='%H %s' origin/main..HEAD > \"$map/commits.txt\"\n          cat \"$map\"/*.log | grep -E '^(FAILED|ℹ (pass|fail))' || true\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: suite-map-${{ matrix.shard }}\n          path: ${{ runner.temp }}/suite-map/\n          if-no-files-found: error\n" at=policy:head/forge/suite-map/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/suite-map shape=.github/workflows/suite-map.yml value=lock
+bound-lock/1 about="name: tag\non:\n  push:\n    branches: [main]\njobs:\n  tag:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      actions: read\n      pull-requests: read\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n      - name: Tag the version once the pull request that merged it was checked green on this very tree\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          git tag --list \"$version\" | grep -q . && { printf 'TAG %s · exists\\n' \"$version\"; exit 0; }\n          tree=\"$(git rev-parse \"HEAD^{tree}\")\"\n          pr=\"$(gh api \"repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls\" --jq '.[0].number // empty')\"\n          test -n \"$pr\" || { printf 'REFUSE %s · no pull request merged %s\\n' \"$version\" \"$GITHUB_SHA\"; exit 1; }\n          head=\"$(gh api \"repos/$GITHUB_REPOSITORY/pulls/$pr\" --jq .head.sha)\"\n          run=\"$(gh api \"repos/$GITHUB_REPOSITORY/actions/workflows/test.yml/runs?event=pull_request&head_sha=$head&status=success\" --jq '.workflow_runs[0].id // empty')\"\n          test -n \"$run\" || { printf 'REFUSE %s · pull request #%s has no green test run at %s\\n' \"$version\" \"$pr\" \"$head\"; exit 1; }\n          gh run download \"$run\" -R \"$GITHUB_REPOSITORY\" --name tested-tree --dir \"$RUNNER_TEMP/tested\"\n          tested=\"$(cat \"$RUNNER_TEMP/tested/tested-tree\")\"\n          test \"$tested\" = \"$tree\" || { printf 'REFUSE %s · run %s of pull request #%s tested tree %s; main holds %s\\n' \"$version\" \"$run\" \"$pr\" \"$tested\" \"$tree\"; exit 1; }\n          printf 'TAG %s · tree %s · tested by run %s of pull request #%s\\n' \"$version\" \"$tree\" \"$run\" \"$pr\"\n          git tag \"$version\" && git push origin \"$version\"\n" at=policy:head/forge/tag/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/tag shape=.github/workflows/tag.yml value=lock
+bound-lock/1 about="name: test\non:\n  push:\n    branches: [main, 'measure/**']\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3, 4, 5, 6]\n    runs-on: ubuntu-latest\n    env:\n      SHARD_1: test/marks.test.ts test/named.test.ts test/answered.test.ts\n      SHARD_2: test/ahead-read.test.ts test/gestures.test.ts test/claims.test.ts test/verbs.test.ts test/share-receive.test.ts test/world.test.ts test/numbers.test.ts test/session.test.ts\n      SHARD_3: test/marks-lineage.test.ts test/authorizer.test.ts test/act.test.ts test/share-refused.test.ts test/consent.test.ts test/shape.test.ts test/adopt.test.ts test/trust.test.ts test/release.test.ts test/device.test.ts test/process.test.ts test/surface.test.ts test/stores.test.ts test/refusal-record.test.ts test/bound.test.ts test/welcome.test.ts test/signer.test.ts test/warm-compact.test.ts test/pack.test.ts test/pending-document.test.ts test/keys.test.ts test/acts.test.ts test/onboarding.test.ts test/bundle.test.ts\n      SHARD_4: test/channels.test.ts test/kept-zero-moved.test.ts test/reuse.test.ts test/walk.test.ts test/kept-zero.test.ts test/first-run.test.ts test/fold-ahead.test.ts test/warm.test.ts test/asking.test.ts test/transport.test.ts\n      SHARD_5: test/fetch.test.ts test/access.test.ts test/share.test.ts test/link-url.test.ts test/first-minute.test.ts test/places.test.ts test/born-closed.test.ts test/reading-identity.test.ts\n      SHARD_6: test/org.test.ts test/connect.test.ts test/issuer.test.ts test/observed.test.ts test/read.test.ts test/use.test.ts test/place-neutral.test.ts\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - name: Require every test file in exactly one shard\n        run: diff <(printf '%s\\n' $SHARD_1 $SHARD_2 $SHARD_3 $SHARD_4 $SHARD_5 $SHARD_6 | sort) <(ls test/*.test.ts | sort)\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 6, the files listed for it\n        run: |\n          set -euo pipefail\n          files=\"SHARD_${{ matrix.shard }}\"\n          node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=\"$RUNNER_TEMP/head-junit.xml\" ${!files} 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: |\n            ${{ runner.temp }}/head-tests.log\n            ${{ runner.temp }}/head-junit.xml\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Measure a new person's first minute against an API on this machine\n        run: |\n          set -euo pipefail\n          HEAD_ONBOARDING=1 node --test test/onboarding.test.ts 2>&1 | tee -a \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json .mcpbignore \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n  tree:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - name: Keep the tree this run tests, so a tag can rest on it once the pull request is merged\n        run: git rev-parse \"HEAD^{tree}\" | tee \"$RUNNER_TEMP/tested-tree\"\n      - uses: actions/upload-artifact@v4\n        with:\n          name: tested-tree\n          path: ${{ runner.temp }}/tested-tree\n          if-no-files-found: error\n" at=policy:head/bundle-exclusions/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
 bound-lock/1 about="no answer of head carries a secret: only public halves and lines leave" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/secrets-out value=0..0
 bound-lock/1 about="no world typed the answer" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/untyped/next value=none
 bound-lock/1 about="nothing arrived yet" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-owed/next value=none
@@ -348,8 +358,10 @@ bound-lock/1 about="one document a source" at=policy:head/shape/0.1.2 by=target
 bound-lock/1 about="one of the actions do names" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action/next value=none
 bound-lock/1 about="open: no world reads {kind}. {document} was laid and taken back; nothing was connected. The line that pays it:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-world value=lock
 bound-lock/1 about="places reads and never writes; asked twice it answers the same" at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/places/hints value=readOnly|idempotent
+bound-lock/1 about="places, as a person reads it: at its own resolution" at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=resolution/places/person value=own
 bound-lock/1 about="places/<name> value=<folder>, signed by the index-s root: where each place head founded lives" at=policy:head/home by=target form=alphabet measure=id role=writes scope=home/family value=places
 bound-lock/1 about="plan again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/base-moved/next value=none
+bound-lock/1 about="plan, as a person reads it: at its own resolution" at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=resolution/plan/person value=own
 bound-lock/1 about="questions the person answers before it: the place, the origin, reads — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=count role=writes scope=baseline/onboarding/questions value=3..3
 bound-lock/1 about="read/rate is spent for {source} this hour: nothing was called. The next hour pays it, or a wider read/rate the place-s root signs." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/rate value=lock
 bound-lock/1 about="red: {coordinate} took {seconds} s, over {scope} {ceiling}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/red value=lock
@@ -361,6 +373,7 @@ bound-lock/1 about="the SDK head reads lines through, as published" at=policy:he
 bound-lock/1 about="the Secret Service of a Linux session, through libsecret-s secret-tool" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/linux/store value=secret-tool
 bound-lock/1 about="the Windows Credential Manager, through Windows PowerShell-s password vault" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/store value=credential-manager
 bound-lock/1 about="the actions do carries out, each by the catalogue tool of its name" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=do/actions value=place|admit|land|share|key|access|act|claim
+bound-lock/1 about="the at that says a line is the person-s: their root, their members, the sources they connect, what they grant and what they use. Their birth file holds the lines of the place said so, and no other" at=policy:head/founding/0.1.6 by=target form=alphabet measure=id role=writes scope=founding/person-at value=policy:person/
 bound-lock/1 about="the authenticated histories a place received, each with its origin" at=policy:head/walk by=target form=alphabet measure=id role=demands scope=birth/view/evidence value=evidence
 bound-lock/1 about="the bytes it waits on, then the package connected again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open/next value=none
 bound-lock/1 about="the bytes the digest names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-digest/next value=none
@@ -373,6 +386,7 @@ bound-lock/1 about="the check on every push and every proposal: the suite in sha
 bound-lock/1 about="the check on every push and every proposal: the suite in shards on each node the place names, the timed tests alone, and the Desktop Extension made twice from the archive npm would publish" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=region/pipeline-test value=lock
 bound-lock/1 about="the class a receipt-s at names, followed by when it was read" at=policy:head/receipts by=target form=alphabet measure=id role=writes scope=receipt/at value=receipt
 bound-lock/1 about="the class of what a link names and the algorithm it names it by" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/reference value=standing|sha256
+bound-lock/1 about="the command a client starts head with; a person never needs it, since four verbs are theirs: connect, ask, do and share" at=policy:head/cli/0.1.6 by=target form=alphabet measure=id role=writes scope=cli/run value=run
 bound-lock/1 about="the command that opens this device-s browser at head-s page when the client cannot send the person an address; started directly, never through a shell" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/darwin/browser value=open
 bound-lock/1 about="the compiled standing at {file} no longer hashes to the digest the place pins:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/compiled-moved value=lock
 bound-lock/1 about="the coordinates a reader is given when only the view of answers reads its region: what a call answered" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answers/coordinates value=.answers/**
@@ -393,6 +407,7 @@ bound-lock/1 about="the family a typed answer is kept under: kept/<source>/<oper
 bound-lock/1 about="the family a typed answer is said in: answer/<request>, one line a value" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/answer value=answer
 bound-lock/1 about="the family access is kept under: access/<flow>/obtained|renewed|entered, a receipt without the secret, the flow its issuer-s where one issues it" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/family value=access
 bound-lock/1 about="the family an act is kept under: act/<source>/<operation>/<request>, its intent, and /done, its receipt" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=act/family value=act
+bound-lock/1 about="the family of the person-s lines of use: use/<source>/<their name> names the offer a request reached, in the request-s own words, signed with the receipt of its first use" at=policy:head/use/0.1.6 by=target form=alphabet measure=id role=writes scope=use/family value=use
 bound-lock/1 about="the family of what a person allows: allow/<source>/<operation> times, allow/<source> a cap over all" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=allow/family value=allow
 bound-lock/1 about="the family of what a person wants to be asked before" at=policy:head/acts by=target form=alphabet measure=id role=writes scope=ask/family value=ask
 bound-lock/1 about="the family what a person states is kept under in a place, one line a statement, by the digest of its words and when it was stated" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/family value=claim
@@ -403,11 +418,11 @@ bound-lock/1 about="the fields a place-s native receipts project, as topos decla
 bound-lock/1 about="the fields a walked line may carry: a world-s blob is pinned with its shape, and a grant the person witnessed names its witness; a field the contract omits makes the place unwalkable" at=policy:head/walk/0.1.1 by=target form=alphabet measure=id role=writes scope=birth/wire/walk/fields value=scope|role|form|measure|value|by|at|epoch|condition|needs|shape|witness
 bound-lock/1 about="the fields this place-s native receipts project, as topos declares them, so bound renders receipts.bound with no other world (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/receipt-fields value=scope|role|measure|form|value|at
 bound-lock/1 about="the first cell of a new-with-source question, after the pause a person types, by the client-s clock: the worst of two runs, Node 24, attempt 1, load 22.9, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-with-source/typed value=0..3670
-bound-lock/1 about="the first cell of a new-with-source question, chained as a model asks, by the client-s clock: the worst of two runs, Node 24, attempt 2, load 29.5, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-with-source/chained value=0..4220
+bound-lock/1 about="the first cell of a new-with-source question, chained as a model asks, by the client-s clock: the worst of two runs on each Node, Node 24, attempt 2, load 16.1, CI run 39379057480 at 379c801, macOS, 3 cpus" at=policy:head/ceilings/0.1.6 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-with-source/chained value=0..3060
 bound-lock/1 about="the first cell of a new-without-source question, after the pause a person types, by the client-s clock: the worst of two runs, Node 22, attempt 3, load 15.7, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-without-source/typed value=0..2520
 bound-lock/1 about="the first cell of a new-without-source question, chained as a model asks, by the client-s clock: the worst of two runs, Node 22, attempt 3, load 15.7, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/new-without-source/chained value=0..5070
 bound-lock/1 about="the first cell of a repeated-with-receipt question, after the pause a person types, by the client-s clock: the worst of two runs, Node 24, attempt 1, load 22.9, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/repeated-with-receipt/typed value=0..90
-bound-lock/1 about="the first cell of a repeated-with-receipt question, chained as a model asks, by the client-s clock: the worst of two runs, Node 24, attempt 2, load 29.5, CI run 39359639837 at cb6bf02, macOS, 3 cpus" at=policy:head/ceilings/0.1.5 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/repeated-with-receipt/chained value=0..2320
+bound-lock/1 about="the first cell of a repeated-with-receipt question, chained as a model asks, by the client-s clock: the worst of two runs on each Node, Node 24, attempt 2, load 16.1, CI run 39379057480 at 379c801, macOS, 3 cpus" at=policy:head/ceilings/0.1.6 by=target form=interval measure=milliseconds role=writes scope=seconds/first-cell/repeated-with-receipt/chained value=0..2120
 bound-lock/1 about="the first read-s own seconds, red against answer/seconds 0..2 — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=seconds role=writes scope=baseline/answer/seconds value=3..3
 bound-lock/1 about="the folder a person-s first place is founded in, under their own home, when they connect a source naming no place: named for what it holds, theirs to rename by founding another" at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=first-run/folder value=place
 bound-lock/1 about="the folder of a place a body is laid in while bound reads it, and taken from once it has" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answers value=.answers
@@ -428,12 +443,12 @@ bound-lock/1 about="the ledger a place-s history is said to come from, named by
 bound-lock/1 about="the line a place declares its act result by; head lands nothing where land would print none" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/profile value=wire/act-result
 bound-lock/1 about="the line that follows" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-world/next value=none
 bound-lock/1 about="the lines a place admits a content transport by, the first the one a link is inspected only where it stands" at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=link/transport value=wire/transport|transport/https|transport/timeout|transport/response-bytes
-bound-lock/1 about="the lines of all of head-s source, together, read by head-s suite: what the regions hold and what the seven regions of 0.1.5 need; a new region-s folder is paid from it, never raised" at=policy:head/ceilings/0.1.5 by=target form=interval measure=source-lines role=writes scope=source/lines value=0..2600
 bound-lock/1 about="the lines of each file of the onboard region, read by head-s suite: split from the sources that connect, never raised; a region ceiling landed after founding has no reading of bound-s, so bound holds it as data" at=policy:head/ceilings/0.1.2 by=target form=interval measure=file-lines role=writes scope=onboard/lines value=0..40
 bound-lock/1 about="the lines of each file of the ports region, alone" at=policy:head/ceilings by=target form=interval measure=file-lines role=reads scope=ports/lines value=0..120
 bound-lock/1 about="the lines of the access region, together" at=policy:head/ceilings by=target form=interval measure=access-lines role=reads scope=access/lines value=0..100
 bound-lock/1 about="the lines of the adopt region, together" at=policy:head/ceilings by=target form=interval measure=adopt-lines role=reads scope=adopt/lines value=0..60
 bound-lock/1 about="the lines of the ahead region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=ahead-lines role=writes scope=ahead/lines value=0..60
+bound-lock/1 about="the lines of the answers region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.6 by=target form=interval measure=answers-lines role=writes scope=answers/lines value=0..29
 bound-lock/1 about="the lines of the claims region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=claims-lines role=writes scope=claims/lines value=0..40
 bound-lock/1 about="the lines of the compile region, together" at=policy:head/ceilings by=target form=interval measure=compile-lines role=reads scope=compile/lines value=0..80
 bound-lock/1 about="the lines of the core region, together" at=policy:head/ceilings by=target form=interval measure=core-lines role=reads scope=core/lines value=0..800
@@ -442,6 +457,7 @@ bound-lock/1 about="the lines of the links region, together, read by head-s suit
 bound-lock/1 about="the lines of the marks region, together, read by head-s suite; paid from the ceiling of the whole source" at=policy:head/ceilings/0.1.5 by=target form=interval measure=marks-lines role=writes scope=marks/lines value=0..60
 bound-lock/1 about="the lines of the places region, together: split from the places that also connected, never raised" at=policy:head/ceilings by=target form=interval measure=places-lines role=reads scope=places/lines value=0..90
 bound-lock/1 about="the lines of the sources region, together: split from the places that also founded, never raised" at=policy:head/ceilings by=target form=interval measure=sources-lines role=reads scope=sources/lines value=0..150
+bound-lock/1 about="the lines of the use region, together, read by head-s suite; paid from the ceiling of the whole source" at=witness:an-answer-of-nothing-kept-apart by=target form=interval measure=use-lines role=writes scope=use/lines value=0..49
 bound-lock/1 about="the lines of the verbs region, together, read by head-s suite; a region ceiling landed after founding has no reading of bound-s, so bound holds it as data" at=policy:head/ceilings/0.1.4 by=target form=interval measure=verbs-lines role=writes scope=verbs/lines value=0..80
 bound-lock/1 about="the lines of the walk region, together" at=policy:head/ceilings by=target form=interval measure=walk-lines role=reads scope=walk/lines value=0..40
 bound-lock/1 about="the lines the other device-s key tool answered" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-key/next value=none
@@ -460,7 +476,7 @@ bound-lock/1 about="the most bytes head reads of a document it connects from an
 bound-lock/1 about="the most bytes head reads of what one bound process prints; past it the process is stopped, and what it printed is no reading" at=policy:head/bound by=target form=interval measure=bytes role=writes scope=bound/printed value=0..16777216
 bound-lock/1 about="the most head reads of a world-s standing to learn its readers" at=policy:head/ceilings by=target form=interval measure=bytes role=reads scope=world/standing-bytes value=0..1048576
 bound-lock/1 about="the next hour, or a wider read/rate the root signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/rate/next value=none
-bound-lock/1 about="the numbers a cell shows that are exact by construction — epochs, counts and caps, pins, digests, the times lines carry: no model, kind structural" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/structural value=ceiling|offers|reads|count|allowed|done|epoch|pinned|digest|card|pin|at|until
+bound-lock/1 about="the numbers a cell shows that are exact by construction — epochs, counts and caps, pins, digests, the times lines carry: no model, kind structural" at=policy:head/numbers/0.1.6 by=target form=alphabet measure=id role=writes scope=numbers/structural value=ceiling|offers|reads|count|allowed|done|epoch|pinned|digest|card|pin|at|until|more
 bound-lock/1 about="the numbers a cell shows that head measured: each names its model and the params it was measured with" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/measured value=seconds
 bound-lock/1 about="the one adapter access runs by, whatever the kind: the steps a scheme-s flow declares, the inputs it asks as it declares them, the token it keeps and how it rides a request" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/adapter value=flow
 bound-lock/1 about="the one class of offer head reads; every other class is listed, never called" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/callable value=read
@@ -484,6 +500,7 @@ bound-lock/1 about="the protocol handler Windows opens an address with, started
 bound-lock/1 about="the protocol head answers through, imported by one file only" at=policy:head/pins by=target form=alphabet measure=digest needs=node_modules/@modelcontextprotocol/sdk role=reads scope=dep/sdk shape=package value=sha256:63a3962282ff29d2ce532945c2edefd9b7c7195b8ec20c027e120e4498b0cb19
 bound-lock/1 about="the protocol is spoken by one file; everything else answers in lines" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/sdk-importers value=0..1
 bound-lock/1 about="the questions a new person answers to the first answer" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=onboarding/questions value=0..1
+bound-lock/1 about="the questions head asks for what an answer lacks: each one question, one yes and the lines it admits, in one shape, you would have it if you admit it, yes" at=policy:head/surface/0.1.6-suggest by=target form=alphabet measure=id role=writes scope=suggest/prompts value=grant|elicit-act
 bound-lock/1 about="the receipt stands as evidence" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-gone/next value=none
 bound-lock/1 about="the receipt stands as evidence" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-untyped/next value=none
 bound-lock/1 about="the receipts head-s repository carries: the observations at 8, the summary at 0, the region bytes at 1" at=policy:head/docs by=target form=alphabet measure=id role=demands scope=view/receipts shape=receipts.bound value=receipts@8|receipts@0|receipts@1
@@ -525,6 +542,7 @@ bound-lock/1 about="the view bound renders a place-s receipts by, beside its loc
 bound-lock/1 about="the view of a place-s authenticated history: head reads its own receipts there, and the person-s attestations" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/evidence value=evidence
 bound-lock/1 about="the worlds every place adopts when it connects; topos-mcp is pinned beside them for the tests and the offline vector, and adopted once bound composes readings (0.1.7), in head 0.1.1" at=policy:head/worlds by=target form=alphabet measure=id role=writes scope=world/adopts value=topos-openapi
 bound-lock/1 about="unencrypted transport, which the adapter sends only to this device" at=policy:head/transport by=target form=alphabet measure=id role=writes scope=adapter/http value=request
+bound-lock/1 about="view, as a person reads it: at its own resolution" at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=resolution/view/person value=own
 bound-lock/1 about="waiting at most this long for it" at=policy:head/link/0.1.5 by=target form=interval measure=milliseconds role=writes scope=birth/transport/timeout value=0..10000
 bound-lock/1 about="what a clone runs: it installs, and every vector of head runs against bound as published" at=policy:head/docs by=target form=alphabet measure=id role=writes scope=check value="npm ci && npm test"
 bound-lock/1 about="what a device a place admits covers unless whoever admits it says otherwise: it asks, keeps what it read and proves access; it widens nothing and calls nothing that changes the world" at=policy:head/places by=target form=alphabet measure=id role=writes scope=member/coverage value=read/**|kept/**|access/**
@@ -544,10 +562,12 @@ bound-lock/1 about="what a question of a founded place, read fresh adds to the m
 bound-lock/1 about="what a question read before is answered from: kept while its receipt and its context stand, read again and said why once either moved" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/kept value=src/kept/**
 bound-lock/1 about="what a read made ahead of its question is marked by, beside its receipt and under the receipt-s own at, so the place-s rate counts what reads ahead spent apart from what questions spent, each read once" at=policy:head/ahead/0.1.5 by=target form=alphabet measure=id role=writes scope=ahead/mark value=ahead
 bound-lock/1 about="what a region of the place is measured by, as obligations reads it: its coordinates and the leaves it writes" at=policy:head/forge by=target form=alphabet measure=id role=reads scope=audit/wire/region-measures value=coordinates|leaves
+bound-lock/1 about="what a source answered, kept apart from what it never sent: a body of nothing is its answer, with its receipt and hour; no bytes is no answer, its cause said and the read owed as a need until bytes arrive" at=policy:project/0.1.6 by=target form=alphabet measure=coordinates role=reads scope=region/answers value=src/answers/**
 bound-lock/1 about="what a source offers, as a person reads it: where it is reached and the class of each offer" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/person value=0
 bound-lock/1 about="what a source offers, explained: each offer-s forms and how access is proven, in the order of trust" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/why value=1
 bound-lock/1 about="what a source said, relayed with who said it and when: never head-s measure, and never a success by itself" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=numbers/reported value=status
 bound-lock/1 about="what a statement taken back is attested by, beside it: what a person attests stands for good, so taking it back is attesting that" at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=claim/withdrawn value=withdrawn
+bound-lock/1 about="what an offer is reached by: head-s own registry of a source-s offers, local, matched to the words a request uses, the person choosing where several fit; each offer used becomes the person-s line" at=policy:project/0.1.6 by=target form=alphabet measure=coordinates role=reads scope=region/use value=src/use/**
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-landed/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unfolded/next value=none
@@ -563,6 +583,7 @@ bound-lock/1 about="what head is, how it is installed and the first minute with
 bound-lock/1 about="what is not measured between sources that differ" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/loss value="the loss between"
 bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=id needs=.github/workflows/suite-map.yml role=demands scope=view/pipeline-suite-map shape=.github/workflows/suite-map.yml value=text
 bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=region/pipeline-suite-map value=lock
+bound-lock/1 about="what of head-s birth is the person-s: the language they read, how long a kept answer may stand, their root-s resolution. It is said at the person-s at and written to their birth file; the rest of the birth is head-s profile, which the person sees only with why" at=policy:head/founding/0.1.6 by=target form=alphabet measure=id role=writes scope=founding/person value=lang|allow/reuse|keys/root
 bound-lock/1 about="what one question asked of several sources is answered with: the fields they agree on, marked by who says them, and the ones they differ on, each shown" at=policy:project/0.1.5 by=target form=alphabet measure=coordinates role=reads scope=region/marks value=src/marks/**
 bound-lock/1 about="what share needs: the folder it writes" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/required value=to
 bound-lock/1 about="what that loss waits on" at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=marks/loss-needs value=topos-origin
@@ -584,7 +605,7 @@ bound-lock/1 about="where topos-mcp 0.1.0 publishes its standing: bound fetches
 bound-lock/1 about="where topos-openapi 0.1.0 publishes its standing: bound fetches it there for every place that pins it, and head reads its readers from it, both by its digest" at=policy:head/worlds/0.2.0 by=target form=alphabet measure=id role=writes scope=sources/topos-openapi value=https://github.com/Lapxo/topos-openapi/releases/download/v0.1.1/standing.bound
 bound-lock/1 about="who is in a place: founding it with its root, admitting another device" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/places value=src/places/**
 bound-lock/1 about="whoever holds the place-s root" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-root/next value=none
-bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.5\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"ask\",\n      \"description\": \"Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source.\"\n    },\n    {\n      \"name\": \"do\",\n      \"description\": \"Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, call an offer that is not a read, or keep what the person states as theirs. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/version/0.1.5 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
+bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.6\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\",\n        \"run\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"ask\",\n      \"description\": \"Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source.\"\n    },\n    {\n      \"name\": \"do\",\n      \"description\": \"Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, call an offer that is not a read, or keep what the person states as theirs. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/version/0.1.6 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
 bound-lock/1 about="{action} is not in the card of {place}: {why}. Nothing was done." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card value=lock
 bound-lock/1 about="{count} lines landed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/landed value=lock
 bound-lock/1 about="{dir} is a place already: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-exists value=lock
@@ -596,9 +617,6 @@ bound-lock/1 about="{document} is not at the origin {via} is reached at, and {vi
 bound-lock/1 about="{document} moved to another address, which head follows only without the access and for bytes named by their digest: name the document-s digest. Nothing was connected." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/fetch-redirect value=lock
 bound-lock/1 about="{document} was compiled under {world} {pin}, and this head pins {held}. Nothing was connected. A package shared from a head that pins {held}, or this head at the release that pins {pin}, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/package-world value=lock
 bound-lock/1 about="{document} was not read: an https address, or a file inside the place or a folder the client shares, is. Nothing was connected." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/document-unread value=lock
-bound-lock/1 about="{field} is {value}, said by {sources} ({marks}). I don-t know whether they are independent." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-unknown value=lock
-bound-lock/1 about="{field} is {value}, said by {sources} ({marks}). Nobody has declared that they share lineage." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-undeclared value=lock
-bound-lock/1 about="{field} is {value}, said by {sources} ({marks}): {source} looks like the same lineage as {other} and may add nothing." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/agreed-lineage value=lock
 bound-lock/1 about="{flow} asks a one-time code" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-one-time value=lock
 bound-lock/1 about="{flow} asks a secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-secret value=lock
 bound-lock/1 about="{flow} asks no secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-none value=lock
@@ -625,34 +643,40 @@ bound-lock/1 about="{place} covers {coverage} for the key that would sign; {scop
 bound-lock/1 about="{place} does not allow retained reads of {source} to be inspected. Whoever configures it can sign this line:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-undeclared value=lock
 bound-lock/1 about="{place} has no source connected: there is nothing to pack. Nothing was written." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/share-none value=lock
 bound-lock/1 about="{place} moved since the card {card} was asked, or none was: nothing was done. Ask for its card again, and act on what it shows." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card-stale value=lock
+bound-lock/1 about="{place} reads a #bound: link by the transport head-s profile laid at its birth: these lines are head-s, never yours, and none of them grants anything of yours. A transport that carries something of yours is asked for the first time it is needed." at=policy:head/surface/0.1.6 by=target form=alphabet measure=id role=writes scope=said/why-transport value=lock
 bound-lock/1 about="{place} was acted in, and its receipts did not close: {why}" at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open value=lock
 bound-lock/1 about="{place} was born before its wire named who witnesses a widening, so nothing its root signs as one lands there until it does. head proposes this lot — the wire it stands on withdrawn and said again with the witness, signed by the root alone: plan it, then land it; nothing is migrated:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unwitnessed value=lock
 bound-lock/1 about="{place} would stand on {parent} as its parent lock. Composing a parent-s policy with a child-s is bound-s to do, and this head does not: nothing was adopted, called or signed. A package another place shared is connected by the digest its sender sent apart from it." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/parent-lock value=lock
+bound-lock/1 about="{sources} backed that {field} is {value} ({marks}). I don-t know whether they are independent." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/agreed-unknown value=lock
+bound-lock/1 about="{sources} backed that {field} is {value} ({marks}). Nobody has declared that they share lineage." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/agreed-undeclared value=lock
+bound-lock/1 about="{sources} backed that {field} is {value} ({marks}): {source} looks like the same lineage as {other} and may add nothing." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/agreed-lineage value=lock
 bound-lock/1 about="{source} answered {operation} at {at}: the answer this conversation already holds ({digest}), kept by the receipt {receipt}. Nothing was called and nothing is sent again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept value=lock
-bound-lock/1 about="{source} answered {operation} from {origin} at {at}: said under the key {by} at epoch {epoch}, receipt {digest}. It rests on the pin {pin} of {source}, landed at epoch {pinned}, and on the world {worlds}. Who crossed it is not said: bound computes no encounters yet." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/why value=lock
+bound-lock/1 about="{source} answered {operation} from {origin} at {at}: backed by the key {by} at epoch {epoch}, receipt {digest}. It rests on the pin {pin} of {source}, landed at epoch {pinned}, and on the world {worlds}. Who crossed it is not said: bound computes no encounters yet." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/why value=lock
 bound-lock/1 about="{source} answered {status} to {operation} at {at}, and no world typed the answer here {why}: head hands no body." at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/untyped value=lock
 bound-lock/1 about="{source} answered {status} to {operation} at {at}. What its document declares of the answer, one value a line:" at=policy:head/numbers/0.1.5 by=target form=alphabet measure=id role=writes scope=said/answered value=lock
+bound-lock/1 about="{source} answered {status} to {operation} at {at}: nothing, as it holds it today at this resolution, not that there never is. Its receipt stands; there is no body to hand." at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=said/answered-nothing value=lock
+bound-lock/1 about="{source} backed that {field} is {value}, at {at}." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/forked value=lock
+bound-lock/1 about="{source} backed that {field} is {value}, at {at}; no other requested source backed this field. This is incomplete evidence, not disagreement." at=policy:head/surface/0.1.6-backed by=target form=alphabet measure=id role=writes scope=said/partial value=lock
 bound-lock/1 about="{source} compiled here as {got}, not as the {pin} the package names: the same documents compile otherwise under this head. The place holds what it compiled, and the package is refused. A package shared from a head at this release pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/package-pin value=lock
 bound-lock/1 about="{source} declares no origin: nothing was called. The person-s line allow/origin/{source}, naming where it is reached, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/no-origin value=lock
 bound-lock/1 about="{source} declares several origins ({origins}): the person picks one as region/{source} origin; none is a default, production least of all. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/pick-origin value=lock
-bound-lock/1 about="{source} did not answer: nothing landed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unreachable-source value=lock
 bound-lock/1 about="{source} did not grant access the way it declares: nothing was kept and nothing was called. Entering it again, as {source} accepts it, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/login-refused value=lock
 bound-lock/1 about="{source} does not state how access to {operation} is proven, and only a read is ever tried with nothing attached: nothing was called. An overlay beside its document that states the access of {method} {path} pays it." at=policy:head/connect/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-unstated value=lock
 bound-lock/1 about="{source} is a document of a profile the world does not read: {why}. It was laid and taken back; nothing was connected. A document of a profile a world reads pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-unsupported value=lock
 bound-lock/1 about="{source} is a document the world could not parse: {why}. It was laid and taken back; nothing was connected. The document mended where {why} points pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-unparsed value=lock
 bound-lock/1 about="{source} is connected to {place}, and head may read it: ask {operation} again, with {args}." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready value=lock
-bound-lock/1 about="{source} is connected to {place}: {offers} offers, {reads} of them read; every other is listed, never called. Pinned as {pin}. How access is proven, and where it is reached:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/connected value=lock
+bound-lock/1 about="{source} is connected to {place}: {offers} offers, {reads} of them read; each callable by its name or in the person-s words, none listed until used. Pinned as {pin}. How access is proven, and where it is reached:" at=policy:head/surface/0.1.6 by=target form=alphabet measure=id role=writes scope=said/connected value=lock
 bound-lock/1 about="{source} is pinned otherwise than when {operation} was read at {at}, so what was kept of it stands no longer: it was read again." at=policy:head/kept/0.1.5 by=target form=alphabet measure=id role=writes scope=said/kept-changed value=lock
 bound-lock/1 about="{source} is reached through a provider that needs a client the person registered: sign keys/access/{source}/<scheme> client with it. head invents none. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-client value=lock
 bound-lock/1 about="{source} names two different documents ({why}), and a source is one: neither was read. It was laid and taken back; nothing was connected. One document for {source} pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-collision value=lock
 bound-lock/1 about="{source} offers no {operation}: nothing was called. What it offers is listed by look at 1." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/unknown-operation value=lock
+bound-lock/1 about="{source} offers {more} more, listed only once used: each is callable by its name or in the person-s words." at=policy:head/surface/0.1.6 by=target form=alphabet measure=id role=writes scope=said/more-offers value=lock
 bound-lock/1 about="{source} proves access to {operation} by {kinds}, and none of them says how its token rides a request: nothing was called. An overlay that says it pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/no-adapter value=lock
 bound-lock/1 about="{source} referred to {by} before it was here: compiled again, its pin now {pin}. Nothing was reconnected and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/resolved value=lock
 bound-lock/1 about="{source} refers to {refs}, which no document of this place declares yet: a demand, paid when the document that declares it is connected — {source} is then compiled again, never reconnected." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unresolved value=lock
 bound-lock/1 about="{source} refused the read without access and named who issues it: {issuer}. head observed how — its metadata, the steps, a client where the server registers one — and the next read signs in there, on head-s page, once; its token and refresh are kept in this keychain and renewed on use." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/authorizer-observed value=lock
 bound-lock/1 about="{source} refused {operation} with the access head held for it: that access is spent, kept nowhere but marked so, and {place} shows it open. Prove it again once." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused value=lock
-bound-lock/1 about="{source} said {field} is {value}, at {at}." at=policy:head/marks/0.1.5 by=target form=alphabet measure=id role=writes scope=said/forked value=lock
-bound-lock/1 about="{source} said {field} is {value}, at {at}; the other requested sources have no value for this field. This is incomplete evidence, not disagreement." at=policy:head/view-identity/0.1.5 by=target form=alphabet measure=id role=writes scope=said/partial value=lock
+bound-lock/1 about="{source} sent no bytes ({why}): there is no answer and no receipt, and the read stays owed in the place until a read of it brings them." at=policy:head/surface/0.1.6-answered by=target form=alphabet measure=id role=writes scope=said/unreachable-source value=lock
 bound-lock/1 about="{source} states its reads need no access: nothing was kept and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/access-anonymous value=lock
 bound-lock/1 about="{source} waits on bytes that did not arrive, or did not hash to the package, and were not used: {waits}. Bring them beside the package lock by any means and connect the package again; the place holds the demand until they arrive." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open value=lock
 bound-lock/1 about="{source} would ask you for {input}, a secret, and this place-s root allows no more on head-s page: nothing was asked and nothing was called. Its root may sign access/secret-inputs to allow it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/secret-unallowed value=lock
@@ -690,6 +714,9 @@ bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measu
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/reused/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/used/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why/next value=none
+bound-lock/1 about=done at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/more-offers/next value=none
+bound-lock/1 about=done at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/why-transport/next value=none
+bound-lock/1 about=done at=policy:head/shape/0.1.6-answered by=target form=alphabet measure=id role=writes scope=said/answered-nothing/next value=none
 bound-lock/1 about=refused at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claim-none/next value=none
 bound-lock/1 about=refused at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role=writes scope=said/claims-declined/next value=none
 bound-lock/1 about=refused at=policy:head/link/0.1.5 by=target form=alphabet measure=id role=writes scope=said/link-refused/next value=none
@@ -774,7 +801,7 @@ bound-lock/1 at=policy:head/claims/0.1.5 by=target form=alphabet measure=id role
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/digest-algorithms value=sha256
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/era value=era1
 bound-lock/1 at=policy:head/cryptography by=target form=alphabet measure=id role=reads scope=wire/signature-algorithms value=ed25519:era1
-bound-lock/1 at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/coverage value=read/**|kept/**|act/**|access/**
+bound-lock/1 at=policy:head/device/0.1.6 by=target form=alphabet measure=id role=writes scope=device/head/coverage value=read/**|kept/**|act/**|access/**|use/**
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=dep/runtime-prose-render shape=dist/regions/text.js value=sha256:67c56505dc51e1f7c0e9926df43d0e05d19a158edd4b1be1db95666d0bac8951
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=sources/prose-render value=https://github.com/Lapxo/topos/releases/download/v0.1.13/907115916d64425dd23305fc74d91ea937f933de4949fb0c4dc94fb1106bd33e
 bound-lock/1 at=policy:head/forge by=target form=alphabet measure=id role=writes scope=sources/runtime-prose-render value=https://github.com/Lapxo/topos/releases/download/v0.1.13/67c56505dc51e1f7c0e9926df43d0e05d19a158edd4b1be1db95666d0bac8951
@@ -932,6 +959,10 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/visit/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why-none/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why/state value=done
+bound-lock/1 at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/more-offers/state value=done
+bound-lock/1 at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/pick-offer/state value=asked
+bound-lock/1 at=policy:head/shape/0.1.6 by=target form=alphabet measure=id role=writes scope=said/why-transport/state value=done
+bound-lock/1 at=policy:head/shape/0.1.6-answered by=target form=alphabet measure=id role=writes scope=said/answered-nothing/state value=done
 bound-lock/1 at=policy:head/signer by=target form=interval measure=bytes role=writes scope=signer/response-bytes value=1048576..1048576
 bound-lock/1 at=policy:head/signer by=target form=interval measure=milliseconds role=writes scope=signer/timeout value=30000..30000
 bound-lock/1 at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access/required value=source
@@ -1047,4 +1078,4 @@ bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=
 bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/source value=src/**
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=license value=MIT
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=name value=@lapxo/head
-bound-lock/1 at=policy:project/0.1.5 by=target form=alphabet measure=id role=writes scope=version value=0.1.5
+bound-lock/1 at=policy:project/0.1.6 by=target form=alphabet measure=id role=writes scope=version value=0.1.6