@githolon/dsl 0.101.6 → 0.102.0

package/dart/lib/src/runner/offline-install.mjs

@@ -0,0 +1,4729 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// runner/offline-install.ts
+import { readFileSync, writeFileSync as writeFileSync2, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2, dirname } from "node:path";
+import { randomBytes, webcrypto as wc } from "node:crypto";
+import { fileURLToPath } from "node:url";
+
+// runner/runtime-refresh.ts
+import { statSync, renameSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+var RUNTIME_FRESH_MS = 15 * 60 * 1e3;
+var _refreshedDirs = /* @__PURE__ */ new Set();
+function runtimeIsWarm(dir, freshMs = RUNTIME_FRESH_MS) {
+  try {
+    const w = statSync(join(dir, "holon.wasm")).mtimeMs;
+    const t = statSync(join(dir, "holon-testmint.wasm")).mtimeMs;
+    const p = statSync(join(dir, "packages.json")).mtimeMs;
+    return Date.now() - Math.min(w, t, p) < freshMs;
+  } catch {
+    return false;
+  }
+}
+function atomicWrite(target, data) {
+  const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`;
+  writeFileSync(tmp, data);
+  renameSync(tmp, target);
+}
+async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log: log2, mode } = {}) {
+  const m = String(mode ?? process.env["NOMOS_RUNTIME_REFRESH"] ?? "auto").toLowerCase();
+  if (m === "never") return false;
+  if (m !== "always") {
+    if (_refreshedDirs.has(dir)) return false;
+    if (runtimeIsWarm(dir)) return false;
+  }
+  try {
+    const r = await fetchImpl(`${cloud}/v1/runtime/holon.wasm`);
+    if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
+    const bytes = new Uint8Array(await r.arrayBuffer());
+    const testmintResp = await fetchImpl(`${cloud}/v1/runtime/holon-testmint.wasm`);
+    if (!testmintResp.ok) throw new Error(`test-mint runtime wasm \u2192 ${testmintResp.status}`);
+    const testmintBytes = new Uint8Array(await testmintResp.arrayBuffer());
+    const pkgsResp = await fetchImpl(`${cloud}/v1/runtime/packages`);
+    if (!pkgsResp.ok) throw new Error(`runtime packages \u2192 ${pkgsResp.status}`);
+    const pkgText = await pkgsResp.text();
+    mkdirSync(dir, { recursive: true });
+    atomicWrite(join(dir, "holon.wasm"), bytes);
+    atomicWrite(join(dir, "holon-testmint.wasm"), testmintBytes);
+    atomicWrite(join(dir, "packages.json"), pkgText);
+    _refreshedDirs.add(dir);
+    if (typeof log2 === "function") log2(`offline-install: refreshed runtime cache from the cloud \u2192 ${dir}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/_adapter/engine.ts
+var engine_exports = {};
+__export(engine_exports, {
+  NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
+  admitAll: () => admitAll,
+  admitIntentOffers: () => admitIntentOffers,
+  applyIntentBytes: () => applyIntentBytes,
+  archiveRefusedMain: () => archiveRefusedMain,
+  attestationSign: () => attestationSign,
+  attestedRead: () => attestedRead,
+  author: () => author,
+  authorEphemeral: () => authorEphemeral,
+  authorKeygen: () => authorKeygen,
+  authorOn: () => authorOn,
+  backupHead: () => backupHead,
+  backupToCustody: () => backupToCustody,
+  boot: () => boot,
+  call: () => call,
+  certSign: () => certSign,
+  check: () => check,
+  checkpointStateHash: () => checkpointStateHash,
+  clearCheckpointRefs: () => clearCheckpointRefs,
+  collectGlobalIntents: () => collectGlobalIntents,
+  collectHomedIntents: () => collectHomedIntents,
+  commitAndPush: () => commitAndPush,
+  count: () => count,
+  countRemoteCommits: () => countRemoteCommits,
+  countTenantRows: () => countTenantRows,
+  countTenantRowsByHome: () => countTenantRowsByHome,
+  createEngine: () => createEngine,
+  cryptoKeygen: () => cryptoKeygen,
+  cryptoOwnedDeviceRequest: () => cryptoOwnedDeviceRequest,
+  cryptoOwnedPrepareApproval: () => cryptoOwnedPrepareApproval,
+  cryptoOwnedPrepareRecovery: () => cryptoOwnedPrepareRecovery,
+  cryptoOwnedScopeKey: () => cryptoOwnedScopeKey,
+  cryptoSealField: () => cryptoSealField,
+  cryptoUnwrapKey: () => cryptoUnwrapKey,
+  cryptoWrapKey: () => cryptoWrapKey,
+  currentLaw: () => currentLaw,
+  declaredCapabilities: () => declaredCapabilities,
+  deepVerifyShard: () => deepVerifyShard,
+  delegationCertSign: () => delegationCertSign,
+  deleteRefusedRef: () => deleteRefusedRef,
+  deploy: () => deploy,
+  deriveSummarySuffix: () => deriveSummarySuffix,
+  describe: () => describe,
+  directiveRoutes: () => directiveRoutes,
+  domainPackage: () => domainPackage,
+  emitOutbox: () => emitOutbox,
+  eraCertSign: () => eraCertSign,
+  evalCanonicalPred: () => evalCanonicalPred,
+  evolveDryRun: () => evolveDryRun,
+  expand: () => expand,
+  exportCheckpoint: () => exportCheckpoint,
+  extremum: () => extremum,
+  flushDeferredProjections: () => flushDeferredProjections,
+  gitdirOf: () => gitdirOf,
+  globalAggregates: () => globalAggregates,
+  historyPreflight: () => historyPreflight,
+  historyRestorePreflight: () => historyRestorePreflight,
+  importCheckpoint: () => importCheckpoint,
+  ingestPackAsCustody: () => ingestPackAsCustody,
+  installPayload: () => installPayload,
+  installedLaw: () => installedLaw,
+  isWarranted: () => isWarranted,
+  kernelStamp: () => kernelStamp,
+  kgit: () => kgit,
+  lawParity: () => lawParity,
+  ledgerStats: () => ledgerStats,
+  listRefusedRefs: () => listRefusedRefs,
+  materializeGenesis: () => materializeGenesis,
+  materializeRefused: () => materializeRefused,
+  migrateHomes: () => migrateHomes,
+  mintId: () => mintId,
+  mountEphemeralWorkspace: () => mountEphemeralWorkspace,
+  mountWorkspace: () => mountWorkspace,
+  nomosActive: () => nomosActive,
+  offerAdmit: () => offerAdmit,
+  offerIntent: () => offerIntent,
+  outboxRefExists: () => outboxRefExists,
+  packBornChildren: () => packBornChildren,
+  packDelta: () => packDelta,
+  parseAttestedReadNeed: () => parseAttestedReadNeed,
+  pendingConflictSummary: () => pendingConflictSummary,
+  pendingConflicts: () => pendingConflicts,
+  placementDirectives: () => placementDirectives,
+  projectionStats: () => projectionStats,
+  promotePreflighted: () => promotePreflighted,
+  pushCheckpoint: () => pushCheckpoint,
+  pushShape: () => pushShape,
+  pushStagedCheckpoint: () => pushStagedCheckpoint,
+  qById: () => qById,
+  query: () => query,
+  queryEphemeral: () => queryEphemeral,
+  reactorScan: () => reactorScan,
+  readCheckpointBlob: () => readCheckpointBlob,
+  readPosture: () => readPosture,
+  readShape: () => readShape,
+  rebirthCompact: () => rebirthCompact,
+  reconcileBornPacks: () => reconcileBornPacks,
+  refreshProjection: () => refreshProjection,
+  refusedSummary: () => refusedSummary,
+  replicateIntents: () => replicateIntents,
+  repoArgOf: () => repoArgOf,
+  restoreCheckpointFromCustody: () => restoreCheckpointFromCustody,
+  restorePreviousPreflighted: () => restorePreviousPreflighted,
+  scopedReads: () => scopedReads,
+  sealAttestationBatches: () => sealAttestationBatches,
+  sealHomes: () => sealHomes,
+  servePack: () => servePack,
+  setTestKRoot: () => setTestKRoot,
+  sha256hex: () => sha256hex,
+  snapshot: () => snapshot,
+  spatialBboxParams: () => spatialBboxParams,
+  spatialWithin: () => spatialWithin,
+  stageCheckpoint: () => stageCheckpoint,
+  stagePayload: () => stagePayload,
+  stats: () => stats,
+  sum: () => sum,
+  summaryCloseAgainstHeld: () => summaryCloseAgainstHeld,
+  unmount: () => unmount,
+  verifyChain: () => verifyChain,
+  verifyChainLocal: () => verifyChainLocal,
+  warmEngine: () => warmEngine,
+  writeCheckpointObjects: () => writeCheckpointObjects,
+  writeOutboxRef: () => writeOutboxRef,
+  writeRefusedRef: () => writeRefusedRef,
+  wrongHomeVerdict: () => wrongHomeVerdict
+});
+
+// ../../node_modules/@bjorn3/browser_wasi_shim/dist/wasi_defs.js
+var CLOCKID_REALTIME = 0;
+var CLOCKID_MONOTONIC = 1;
+var ERRNO_SUCCESS = 0;
+var ERRNO_BADF = 8;
+var ERRNO_EXIST = 20;
+var ERRNO_INVAL = 28;
+var ERRNO_ISDIR = 31;
+var ERRNO_NAMETOOLONG = 37;
+var ERRNO_NOENT = 44;
+var ERRNO_NOSYS = 52;
+var ERRNO_NOTDIR = 54;
+var ERRNO_NOTEMPTY = 55;
+var ERRNO_NOTSUP = 58;
+var ERRNO_PERM = 63;
+var ERRNO_NOTCAPABLE = 76;
+var RIGHTS_FD_DATASYNC = 1 << 0;
+var RIGHTS_FD_READ = 1 << 1;
+var RIGHTS_FD_SEEK = 1 << 2;
+var RIGHTS_FD_FDSTAT_SET_FLAGS = 1 << 3;
+var RIGHTS_FD_SYNC = 1 << 4;
+var RIGHTS_FD_TELL = 1 << 5;
+var RIGHTS_FD_WRITE = 1 << 6;
+var RIGHTS_FD_ADVISE = 1 << 7;
+var RIGHTS_FD_ALLOCATE = 1 << 8;
+var RIGHTS_PATH_CREATE_DIRECTORY = 1 << 9;
+var RIGHTS_PATH_CREATE_FILE = 1 << 10;
+var RIGHTS_PATH_LINK_SOURCE = 1 << 11;
+var RIGHTS_PATH_LINK_TARGET = 1 << 12;
+var RIGHTS_PATH_OPEN = 1 << 13;
+var RIGHTS_FD_READDIR = 1 << 14;
+var RIGHTS_PATH_READLINK = 1 << 15;
+var RIGHTS_PATH_RENAME_SOURCE = 1 << 16;
+var RIGHTS_PATH_RENAME_TARGET = 1 << 17;
+var RIGHTS_PATH_FILESTAT_GET = 1 << 18;
+var RIGHTS_PATH_FILESTAT_SET_SIZE = 1 << 19;
+var RIGHTS_PATH_FILESTAT_SET_TIMES = 1 << 20;
+var RIGHTS_FD_FILESTAT_GET = 1 << 21;
+var RIGHTS_FD_FILESTAT_SET_SIZE = 1 << 22;
+var RIGHTS_FD_FILESTAT_SET_TIMES = 1 << 23;
+var RIGHTS_PATH_SYMLINK = 1 << 24;
+var RIGHTS_PATH_REMOVE_DIRECTORY = 1 << 25;
+var RIGHTS_PATH_UNLINK_FILE = 1 << 26;
+var RIGHTS_POLL_FD_READWRITE = 1 << 27;
+var RIGHTS_SOCK_SHUTDOWN = 1 << 28;
+var Iovec = class _Iovec {
+  static read_bytes(view, ptr) {
+    const iovec = new _Iovec();
+    iovec.buf = view.getUint32(ptr, true);
+    iovec.buf_len = view.getUint32(ptr + 4, true);
+    return iovec;
+  }
+  static read_bytes_array(view, ptr, len) {
+    const iovecs = [];
+    for (let i = 0; i < len; i++) {
+      iovecs.push(_Iovec.read_bytes(view, ptr + 8 * i));
+    }
+    return iovecs;
+  }
+};
+var Ciovec = class _Ciovec {
+  static read_bytes(view, ptr) {
+    const iovec = new _Ciovec();
+    iovec.buf = view.getUint32(ptr, true);
+    iovec.buf_len = view.getUint32(ptr + 4, true);
+    return iovec;
+  }
+  static read_bytes_array(view, ptr, len) {
+    const iovecs = [];
+    for (let i = 0; i < len; i++) {
+      iovecs.push(_Ciovec.read_bytes(view, ptr + 8 * i));
+    }
+    return iovecs;
+  }
+};
+var WHENCE_SET = 0;
+var WHENCE_CUR = 1;
+var WHENCE_END = 2;
+var FILETYPE_CHARACTER_DEVICE = 2;
+var FILETYPE_DIRECTORY = 3;
+var FILETYPE_REGULAR_FILE = 4;
+var Dirent = class {
+  head_length() {
+    return 24;
+  }
+  name_length() {
+    return this.dir_name.byteLength;
+  }
+  write_head_bytes(view, ptr) {
+    view.setBigUint64(ptr, this.d_next, true);
+    view.setBigUint64(ptr + 8, this.d_ino, true);
+    view.setUint32(ptr + 16, this.dir_name.length, true);
+    view.setUint8(ptr + 20, this.d_type);
+  }
+  write_name_bytes(view8, ptr, buf_len) {
+    view8.set(this.dir_name.slice(0, Math.min(this.dir_name.byteLength, buf_len)), ptr);
+  }
+  constructor(next_cookie, d_ino, name, type) {
+    const encoded_name = new TextEncoder().encode(name);
+    this.d_next = next_cookie;
+    this.d_ino = d_ino;
+    this.d_namlen = encoded_name.byteLength;
+    this.d_type = type;
+    this.dir_name = encoded_name;
+  }
+};
+var FDFLAGS_APPEND = 1 << 0;
+var FDFLAGS_DSYNC = 1 << 1;
+var FDFLAGS_NONBLOCK = 1 << 2;
+var FDFLAGS_RSYNC = 1 << 3;
+var FDFLAGS_SYNC = 1 << 4;
+var Fdstat = class {
+  write_bytes(view, ptr) {
+    view.setUint8(ptr, this.fs_filetype);
+    view.setUint16(ptr + 2, this.fs_flags, true);
+    view.setBigUint64(ptr + 8, this.fs_rights_base, true);
+    view.setBigUint64(ptr + 16, this.fs_rights_inherited, true);
+  }
+  constructor(filetype, flags) {
+    this.fs_rights_base = 0n;
+    this.fs_rights_inherited = 0n;
+    this.fs_filetype = filetype;
+    this.fs_flags = flags;
+  }
+};
+var FSTFLAGS_ATIM = 1 << 0;
+var FSTFLAGS_ATIM_NOW = 1 << 1;
+var FSTFLAGS_MTIM = 1 << 2;
+var FSTFLAGS_MTIM_NOW = 1 << 3;
+var OFLAGS_CREAT = 1 << 0;
+var OFLAGS_DIRECTORY = 1 << 1;
+var OFLAGS_EXCL = 1 << 2;
+var OFLAGS_TRUNC = 1 << 3;
+var Filestat = class {
+  write_bytes(view, ptr) {
+    view.setBigUint64(ptr, this.dev, true);
+    view.setBigUint64(ptr + 8, this.ino, true);
+    view.setUint8(ptr + 16, this.filetype);
+    view.setBigUint64(ptr + 24, this.nlink, true);
+    view.setBigUint64(ptr + 32, this.size, true);
+    view.setBigUint64(ptr + 38, this.atim, true);
+    view.setBigUint64(ptr + 46, this.mtim, true);
+    view.setBigUint64(ptr + 52, this.ctim, true);
+  }
+  constructor(ino, filetype, size) {
+    this.dev = 0n;
+    this.nlink = 0n;
+    this.atim = 0n;
+    this.mtim = 0n;
+    this.ctim = 0n;
+    this.ino = ino;
+    this.filetype = filetype;
+    this.size = size;
+  }
+};
+var EVENTTYPE_CLOCK = 0;
+var EVENTRWFLAGS_FD_READWRITE_HANGUP = 1 << 0;
+var SUBCLOCKFLAGS_SUBSCRIPTION_CLOCK_ABSTIME = 1 << 0;
+var Subscription = class _Subscription {
+  static read_bytes(view, ptr) {
+    return new _Subscription(view.getBigUint64(ptr, true), view.getUint8(ptr + 8), view.getUint32(ptr + 16, true), view.getBigUint64(ptr + 24, true), view.getUint16(ptr + 36, true));
+  }
+  constructor(userdata, eventtype, clockid, timeout, flags) {
+    this.userdata = userdata;
+    this.eventtype = eventtype;
+    this.clockid = clockid;
+    this.timeout = timeout;
+    this.flags = flags;
+  }
+};
+var Event = class {
+  write_bytes(view, ptr) {
+    view.setBigUint64(ptr, this.userdata, true);
+    view.setUint16(ptr + 8, this.error, true);
+    view.setUint8(ptr + 10, this.eventtype);
+  }
+  constructor(userdata, error, eventtype) {
+    this.userdata = userdata;
+    this.error = error;
+    this.eventtype = eventtype;
+  }
+};
+var RIFLAGS_RECV_PEEK = 1 << 0;
+var RIFLAGS_RECV_WAITALL = 1 << 1;
+var ROFLAGS_RECV_DATA_TRUNCATED = 1 << 0;
+var SDFLAGS_RD = 1 << 0;
+var SDFLAGS_WR = 1 << 1;
+var PREOPENTYPE_DIR = 0;
+var PrestatDir = class {
+  write_bytes(view, ptr) {
+    view.setUint32(ptr, this.pr_name.byteLength, true);
+  }
+  constructor(name) {
+    this.pr_name = new TextEncoder().encode(name);
+  }
+};
+var Prestat = class _Prestat {
+  static dir(name) {
+    const prestat = new _Prestat();
+    prestat.tag = PREOPENTYPE_DIR;
+    prestat.inner = new PrestatDir(name);
+    return prestat;
+  }
+  write_bytes(view, ptr) {
+    view.setUint32(ptr, this.tag, true);
+    this.inner.write_bytes(view, ptr + 4);
+  }
+};
+
+// ../../node_modules/@bjorn3/browser_wasi_shim/dist/debug.js
+var Debug = class Debug2 {
+  enable(enabled) {
+    this.log = createLogger(enabled === void 0 ? true : enabled, this.prefix);
+  }
+  get enabled() {
+    return this.isEnabled;
+  }
+  constructor(isEnabled) {
+    this.isEnabled = isEnabled;
+    this.prefix = "wasi:";
+    this.enable(isEnabled);
+  }
+};
+function createLogger(enabled, prefix) {
+  if (enabled) {
+    const a = console.log.bind(console, "%c%s", "color: #265BA0", prefix);
+    return a;
+  } else {
+    return () => {
+    };
+  }
+}
+var debug = new Debug(false);
+
+// ../../node_modules/@bjorn3/browser_wasi_shim/dist/wasi.js
+var WASIProcExit = class extends Error {
+  constructor(code) {
+    super("exit with exit code " + code);
+    this.code = code;
+  }
+};
+var WASI = class WASI2 {
+  start(instance) {
+    this.inst = instance;
+    try {
+      instance.exports._start();
+      return 0;
+    } catch (e) {
+      if (e instanceof WASIProcExit) {
+        return e.code;
+      } else {
+        throw e;
+      }
+    }
+  }
+  initialize(instance) {
+    this.inst = instance;
+    if (instance.exports._initialize) {
+      instance.exports._initialize();
+    }
+  }
+  constructor(args, env, fds, options = {}) {
+    this.args = [];
+    this.env = [];
+    this.fds = [];
+    debug.enable(options.debug);
+    this.args = args;
+    this.env = env;
+    this.fds = fds;
+    const self = this;
+    this.wasiImport = { args_sizes_get(argc, argv_buf_size) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      buffer.setUint32(argc, self.args.length, true);
+      let buf_size = 0;
+      for (const arg2 of self.args) {
+        buf_size += arg2.length + 1;
+      }
+      buffer.setUint32(argv_buf_size, buf_size, true);
+      debug.log(buffer.getUint32(argc, true), buffer.getUint32(argv_buf_size, true));
+      return 0;
+    }, args_get(argv, argv_buf) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      const orig_argv_buf = argv_buf;
+      for (let i = 0; i < self.args.length; i++) {
+        buffer.setUint32(argv, argv_buf, true);
+        argv += 4;
+        const arg2 = new TextEncoder().encode(self.args[i]);
+        buffer8.set(arg2, argv_buf);
+        buffer.setUint8(argv_buf + arg2.length, 0);
+        argv_buf += arg2.length + 1;
+      }
+      if (debug.enabled) {
+        debug.log(new TextDecoder("utf-8").decode(buffer8.slice(orig_argv_buf, argv_buf)));
+      }
+      return 0;
+    }, environ_sizes_get(environ_count, environ_size) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      buffer.setUint32(environ_count, self.env.length, true);
+      let buf_size = 0;
+      for (const environ of self.env) {
+        buf_size += new TextEncoder().encode(environ).length + 1;
+      }
+      buffer.setUint32(environ_size, buf_size, true);
+      debug.log(buffer.getUint32(environ_count, true), buffer.getUint32(environ_size, true));
+      return 0;
+    }, environ_get(environ, environ_buf) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      const orig_environ_buf = environ_buf;
+      for (let i = 0; i < self.env.length; i++) {
+        buffer.setUint32(environ, environ_buf, true);
+        environ += 4;
+        const e = new TextEncoder().encode(self.env[i]);
+        buffer8.set(e, environ_buf);
+        buffer.setUint8(environ_buf + e.length, 0);
+        environ_buf += e.length + 1;
+      }
+      if (debug.enabled) {
+        debug.log(new TextDecoder("utf-8").decode(buffer8.slice(orig_environ_buf, environ_buf)));
+      }
+      return 0;
+    }, clock_res_get(id, res_ptr) {
+      let resolutionValue;
+      switch (id) {
+        case CLOCKID_MONOTONIC: {
+          resolutionValue = 5000n;
+          break;
+        }
+        case CLOCKID_REALTIME: {
+          resolutionValue = 1000000n;
+          break;
+        }
+        default:
+          return ERRNO_NOSYS;
+      }
+      const view = new DataView(self.inst.exports.memory.buffer);
+      view.setBigUint64(res_ptr, resolutionValue, true);
+      return ERRNO_SUCCESS;
+    }, clock_time_get(id, precision, time) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      if (id === CLOCKID_REALTIME) {
+        buffer.setBigUint64(time, BigInt((/* @__PURE__ */ new Date()).getTime()) * 1000000n, true);
+      } else if (id == CLOCKID_MONOTONIC) {
+        let monotonic_time;
+        try {
+          monotonic_time = BigInt(Math.round(performance.now() * 1e6));
+        } catch (e) {
+          monotonic_time = 0n;
+        }
+        buffer.setBigUint64(time, monotonic_time, true);
+      } else {
+        buffer.setBigUint64(time, 0n, true);
+      }
+      return 0;
+    }, fd_advise(fd, offset, len, advice) {
+      if (self.fds[fd] != void 0) {
+        return ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_allocate(fd, offset, len) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_allocate(offset, len);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_close(fd) {
+      if (self.fds[fd] != void 0) {
+        const ret = self.fds[fd].fd_close();
+        self.fds[fd] = void 0;
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_datasync(fd) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_sync();
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_fdstat_get(fd, fdstat_ptr) {
+      if (self.fds[fd] != void 0) {
+        const { ret, fdstat } = self.fds[fd].fd_fdstat_get();
+        if (fdstat != null) {
+          fdstat.write_bytes(new DataView(self.inst.exports.memory.buffer), fdstat_ptr);
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_fdstat_set_flags(fd, flags) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_fdstat_set_flags(flags);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_fdstat_set_rights(fd, fs_rights_base, fs_rights_inheriting) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_fdstat_set_rights(fs_rights_base, fs_rights_inheriting);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_filestat_get(fd, filestat_ptr) {
+      if (self.fds[fd] != void 0) {
+        const { ret, filestat } = self.fds[fd].fd_filestat_get();
+        if (filestat != null) {
+          filestat.write_bytes(new DataView(self.inst.exports.memory.buffer), filestat_ptr);
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_filestat_set_size(fd, size) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_filestat_set_size(size);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_filestat_set_times(fd, atim, mtim, fst_flags) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_filestat_set_times(atim, mtim, fst_flags);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_pread(fd, iovs_ptr, iovs_len, offset, nread_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const iovecs = Iovec.read_bytes_array(buffer, iovs_ptr, iovs_len);
+        let nread = 0;
+        for (const iovec of iovecs) {
+          const { ret, data } = self.fds[fd].fd_pread(iovec.buf_len, offset);
+          if (ret != ERRNO_SUCCESS) {
+            buffer.setUint32(nread_ptr, nread, true);
+            return ret;
+          }
+          buffer8.set(data, iovec.buf);
+          nread += data.length;
+          offset += BigInt(data.length);
+          if (data.length != iovec.buf_len) {
+            break;
+          }
+        }
+        buffer.setUint32(nread_ptr, nread, true);
+        return ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_prestat_get(fd, buf_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const { ret, prestat } = self.fds[fd].fd_prestat_get();
+        if (prestat != null) {
+          prestat.write_bytes(buffer, buf_ptr);
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_prestat_dir_name(fd, path_ptr, path_len) {
+      if (self.fds[fd] != void 0) {
+        const { ret, prestat } = self.fds[fd].fd_prestat_get();
+        if (prestat == null) {
+          return ret;
+        }
+        const prestat_dir_name = prestat.inner.pr_name;
+        const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+        buffer8.set(prestat_dir_name.slice(0, path_len), path_ptr);
+        return prestat_dir_name.byteLength > path_len ? ERRNO_NAMETOOLONG : ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_pwrite(fd, iovs_ptr, iovs_len, offset, nwritten_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const iovecs = Ciovec.read_bytes_array(buffer, iovs_ptr, iovs_len);
+        let nwritten = 0;
+        for (const iovec of iovecs) {
+          const data = buffer8.slice(iovec.buf, iovec.buf + iovec.buf_len);
+          const { ret, nwritten: nwritten_part } = self.fds[fd].fd_pwrite(data, offset);
+          if (ret != ERRNO_SUCCESS) {
+            buffer.setUint32(nwritten_ptr, nwritten, true);
+            return ret;
+          }
+          nwritten += nwritten_part;
+          offset += BigInt(nwritten_part);
+          if (nwritten_part != data.byteLength) {
+            break;
+          }
+        }
+        buffer.setUint32(nwritten_ptr, nwritten, true);
+        return ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_read(fd, iovs_ptr, iovs_len, nread_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const iovecs = Iovec.read_bytes_array(buffer, iovs_ptr, iovs_len);
+        let nread = 0;
+        for (const iovec of iovecs) {
+          const { ret, data } = self.fds[fd].fd_read(iovec.buf_len);
+          if (ret != ERRNO_SUCCESS) {
+            buffer.setUint32(nread_ptr, nread, true);
+            return ret;
+          }
+          buffer8.set(data, iovec.buf);
+          nread += data.length;
+          if (data.length != iovec.buf_len) {
+            break;
+          }
+        }
+        buffer.setUint32(nread_ptr, nread, true);
+        return ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_readdir(fd, buf, buf_len, cookie, bufused_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        let bufused = 0;
+        while (true) {
+          const { ret, dirent } = self.fds[fd].fd_readdir_single(cookie);
+          if (ret != 0) {
+            buffer.setUint32(bufused_ptr, bufused, true);
+            return ret;
+          }
+          if (dirent == null) {
+            break;
+          }
+          if (buf_len - bufused < dirent.head_length()) {
+            bufused = buf_len;
+            break;
+          }
+          const head_bytes = new ArrayBuffer(dirent.head_length());
+          dirent.write_head_bytes(new DataView(head_bytes), 0);
+          buffer8.set(new Uint8Array(head_bytes).slice(0, Math.min(head_bytes.byteLength, buf_len - bufused)), buf);
+          buf += dirent.head_length();
+          bufused += dirent.head_length();
+          if (buf_len - bufused < dirent.name_length()) {
+            bufused = buf_len;
+            break;
+          }
+          dirent.write_name_bytes(buffer8, buf, buf_len - bufused);
+          buf += dirent.name_length();
+          bufused += dirent.name_length();
+          cookie = dirent.d_next;
+        }
+        buffer.setUint32(bufused_ptr, bufused, true);
+        return 0;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_renumber(fd, to) {
+      if (self.fds[fd] != void 0 && self.fds[to] != void 0) {
+        const ret = self.fds[to].fd_close();
+        if (ret != 0) {
+          return ret;
+        }
+        self.fds[to] = self.fds[fd];
+        self.fds[fd] = void 0;
+        return 0;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_seek(fd, offset, whence, offset_out_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const { ret, offset: offset_out } = self.fds[fd].fd_seek(offset, whence);
+        buffer.setBigInt64(offset_out_ptr, offset_out, true);
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_sync(fd) {
+      if (self.fds[fd] != void 0) {
+        return self.fds[fd].fd_sync();
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_tell(fd, offset_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const { ret, offset } = self.fds[fd].fd_tell();
+        buffer.setBigUint64(offset_ptr, offset, true);
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, fd_write(fd, iovs_ptr, iovs_len, nwritten_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const iovecs = Ciovec.read_bytes_array(buffer, iovs_ptr, iovs_len);
+        let nwritten = 0;
+        for (const iovec of iovecs) {
+          const data = buffer8.slice(iovec.buf, iovec.buf + iovec.buf_len);
+          const { ret, nwritten: nwritten_part } = self.fds[fd].fd_write(data);
+          if (ret != ERRNO_SUCCESS) {
+            buffer.setUint32(nwritten_ptr, nwritten, true);
+            return ret;
+          }
+          nwritten += nwritten_part;
+          if (nwritten_part != data.byteLength) {
+            break;
+          }
+        }
+        buffer.setUint32(nwritten_ptr, nwritten, true);
+        return ERRNO_SUCCESS;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_create_directory(fd, path_ptr, path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        return self.fds[fd].path_create_directory(path);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_filestat_get(fd, flags, path_ptr, path_len, filestat_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        const { ret, filestat } = self.fds[fd].path_filestat_get(flags, path);
+        if (filestat != null) {
+          filestat.write_bytes(buffer, filestat_ptr);
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_filestat_set_times(fd, flags, path_ptr, path_len, atim, mtim, fst_flags) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        return self.fds[fd].path_filestat_set_times(flags, path, atim, mtim, fst_flags);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_link(old_fd, old_flags, old_path_ptr, old_path_len, new_fd, new_path_ptr, new_path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[old_fd] != void 0 && self.fds[new_fd] != void 0) {
+        const old_path = new TextDecoder("utf-8").decode(buffer8.slice(old_path_ptr, old_path_ptr + old_path_len));
+        const new_path = new TextDecoder("utf-8").decode(buffer8.slice(new_path_ptr, new_path_ptr + new_path_len));
+        const { ret, inode_obj } = self.fds[old_fd].path_lookup(old_path, old_flags);
+        if (inode_obj == null) {
+          return ret;
+        }
+        return self.fds[new_fd].path_link(new_path, inode_obj, false);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_open(fd, dirflags, path_ptr, path_len, oflags, fs_rights_base, fs_rights_inheriting, fd_flags, opened_fd_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        debug.log(path);
+        const { ret, fd_obj } = self.fds[fd].path_open(dirflags, path, oflags, fs_rights_base, fs_rights_inheriting, fd_flags);
+        if (ret != 0) {
+          return ret;
+        }
+        self.fds.push(fd_obj);
+        const opened_fd = self.fds.length - 1;
+        buffer.setUint32(opened_fd_ptr, opened_fd, true);
+        return 0;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_readlink(fd, path_ptr, path_len, buf_ptr, buf_len, nread_ptr) {
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        debug.log(path);
+        const { ret, data } = self.fds[fd].path_readlink(path);
+        if (data != null) {
+          const data_buf = new TextEncoder().encode(data);
+          if (data_buf.length > buf_len) {
+            buffer.setUint32(nread_ptr, 0, true);
+            return ERRNO_BADF;
+          }
+          buffer8.set(data_buf, buf_ptr);
+          buffer.setUint32(nread_ptr, data_buf.length, true);
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_remove_directory(fd, path_ptr, path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        return self.fds[fd].path_remove_directory(path);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_rename(fd, old_path_ptr, old_path_len, new_fd, new_path_ptr, new_path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0 && self.fds[new_fd] != void 0) {
+        const old_path = new TextDecoder("utf-8").decode(buffer8.slice(old_path_ptr, old_path_ptr + old_path_len));
+        const new_path = new TextDecoder("utf-8").decode(buffer8.slice(new_path_ptr, new_path_ptr + new_path_len));
+        let { ret, inode_obj } = self.fds[fd].path_unlink(old_path);
+        if (inode_obj == null) {
+          return ret;
+        }
+        ret = self.fds[new_fd].path_link(new_path, inode_obj, true);
+        if (ret != ERRNO_SUCCESS) {
+          if (self.fds[fd].path_link(old_path, inode_obj, true) != ERRNO_SUCCESS) {
+            throw "path_link should always return success when relinking an inode back to the original place";
+          }
+        }
+        return ret;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_symlink(old_path_ptr, old_path_len, fd, new_path_ptr, new_path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const old_path = new TextDecoder("utf-8").decode(buffer8.slice(old_path_ptr, old_path_ptr + old_path_len));
+        const new_path = new TextDecoder("utf-8").decode(buffer8.slice(new_path_ptr, new_path_ptr + new_path_len));
+        return ERRNO_NOTSUP;
+      } else {
+        return ERRNO_BADF;
+      }
+    }, path_unlink_file(fd, path_ptr, path_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer);
+      if (self.fds[fd] != void 0) {
+        const path = new TextDecoder("utf-8").decode(buffer8.slice(path_ptr, path_ptr + path_len));
+        return self.fds[fd].path_unlink_file(path);
+      } else {
+        return ERRNO_BADF;
+      }
+    }, poll_oneoff(in_ptr, out_ptr, nsubscriptions) {
+      if (nsubscriptions === 0) {
+        return ERRNO_INVAL;
+      }
+      if (nsubscriptions > 1) {
+        debug.log("poll_oneoff: only a single subscription is supported");
+        return ERRNO_NOTSUP;
+      }
+      const buffer = new DataView(self.inst.exports.memory.buffer);
+      const s = Subscription.read_bytes(buffer, in_ptr);
+      const eventtype = s.eventtype;
+      const clockid = s.clockid;
+      const timeout = s.timeout;
+      if (eventtype !== EVENTTYPE_CLOCK) {
+        debug.log("poll_oneoff: only clock subscriptions are supported");
+        return ERRNO_NOTSUP;
+      }
+      let getNow = void 0;
+      if (clockid === CLOCKID_MONOTONIC) {
+        getNow = () => BigInt(Math.round(performance.now() * 1e6));
+      } else if (clockid === CLOCKID_REALTIME) {
+        getNow = () => BigInt((/* @__PURE__ */ new Date()).getTime()) * 1000000n;
+      } else {
+        return ERRNO_INVAL;
+      }
+      const endTime = (s.flags & SUBCLOCKFLAGS_SUBSCRIPTION_CLOCK_ABSTIME) !== 0 ? timeout : getNow() + timeout;
+      while (endTime > getNow()) {
+      }
+      const event = new Event(s.userdata, ERRNO_SUCCESS, eventtype);
+      event.write_bytes(buffer, out_ptr);
+      return ERRNO_SUCCESS;
+    }, proc_exit(exit_code) {
+      throw new WASIProcExit(exit_code);
+    }, proc_raise(sig) {
+      throw "raised signal " + sig;
+    }, sched_yield() {
+    }, random_get(buf, buf_len) {
+      const buffer8 = new Uint8Array(self.inst.exports.memory.buffer).subarray(buf, buf + buf_len);
+      if ("crypto" in globalThis && (typeof SharedArrayBuffer === "undefined" || !(self.inst.exports.memory.buffer instanceof SharedArrayBuffer))) {
+        for (let i = 0; i < buf_len; i += 65536) {
+          crypto.getRandomValues(buffer8.subarray(i, i + 65536));
+        }
+      } else {
+        for (let i = 0; i < buf_len; i++) {
+          buffer8[i] = Math.random() * 256 | 0;
+        }
+      }
+    }, sock_recv(fd, ri_data, ri_flags) {
+      throw "sockets not supported";
+    }, sock_send(fd, si_data, si_flags) {
+      throw "sockets not supported";
+    }, sock_shutdown(fd, how) {
+      throw "sockets not supported";
+    }, sock_accept(fd, flags) {
+      throw "sockets not supported";
+    } };
+  }
+};
+
+// ../../node_modules/@bjorn3/browser_wasi_shim/dist/fd.js
+var Fd = class {
+  fd_allocate(offset, len) {
+    return ERRNO_NOTSUP;
+  }
+  fd_close() {
+    return 0;
+  }
+  fd_fdstat_get() {
+    return { ret: ERRNO_NOTSUP, fdstat: null };
+  }
+  fd_fdstat_set_flags(flags) {
+    return ERRNO_NOTSUP;
+  }
+  fd_fdstat_set_rights(fs_rights_base, fs_rights_inheriting) {
+    return ERRNO_NOTSUP;
+  }
+  fd_filestat_get() {
+    return { ret: ERRNO_NOTSUP, filestat: null };
+  }
+  fd_filestat_set_size(size) {
+    return ERRNO_NOTSUP;
+  }
+  fd_filestat_set_times(atim, mtim, fst_flags) {
+    return ERRNO_NOTSUP;
+  }
+  fd_pread(size, offset) {
+    return { ret: ERRNO_NOTSUP, data: new Uint8Array() };
+  }
+  fd_prestat_get() {
+    return { ret: ERRNO_NOTSUP, prestat: null };
+  }
+  fd_pwrite(data, offset) {
+    return { ret: ERRNO_NOTSUP, nwritten: 0 };
+  }
+  fd_read(size) {
+    return { ret: ERRNO_NOTSUP, data: new Uint8Array() };
+  }
+  fd_readdir_single(cookie) {
+    return { ret: ERRNO_NOTSUP, dirent: null };
+  }
+  fd_seek(offset, whence) {
+    return { ret: ERRNO_NOTSUP, offset: 0n };
+  }
+  fd_sync() {
+    return 0;
+  }
+  fd_tell() {
+    return { ret: ERRNO_NOTSUP, offset: 0n };
+  }
+  fd_write(data) {
+    return { ret: ERRNO_NOTSUP, nwritten: 0 };
+  }
+  path_create_directory(path) {
+    return ERRNO_NOTSUP;
+  }
+  path_filestat_get(flags, path) {
+    return { ret: ERRNO_NOTSUP, filestat: null };
+  }
+  path_filestat_set_times(flags, path, atim, mtim, fst_flags) {
+    return ERRNO_NOTSUP;
+  }
+  path_link(path, inode, allow_dir) {
+    return ERRNO_NOTSUP;
+  }
+  path_unlink(path) {
+    return { ret: ERRNO_NOTSUP, inode_obj: null };
+  }
+  path_lookup(path, dirflags) {
+    return { ret: ERRNO_NOTSUP, inode_obj: null };
+  }
+  path_open(dirflags, path, oflags, fs_rights_base, fs_rights_inheriting, fd_flags) {
+    return { ret: ERRNO_NOTDIR, fd_obj: null };
+  }
+  path_readlink(path) {
+    return { ret: ERRNO_NOTSUP, data: null };
+  }
+  path_remove_directory(path) {
+    return ERRNO_NOTSUP;
+  }
+  path_rename(old_path, new_fd, new_path) {
+    return ERRNO_NOTSUP;
+  }
+  path_unlink_file(path) {
+    return ERRNO_NOTSUP;
+  }
+};
+var Inode = class _Inode {
+  static issue_ino() {
+    return _Inode.next_ino++;
+  }
+  static root_ino() {
+    return 0n;
+  }
+  constructor() {
+    this.ino = _Inode.issue_ino();
+  }
+};
+Inode.next_ino = 1n;
+
+// ../../node_modules/@bjorn3/browser_wasi_shim/dist/fs_mem.js
+var OpenFile = class extends Fd {
+  fd_allocate(offset, len) {
+    if (this.file.size > offset + len) {
+    } else {
+      const new_data = new Uint8Array(Number(offset + len));
+      new_data.set(this.file.data, 0);
+      this.file.data = new_data;
+    }
+    return ERRNO_SUCCESS;
+  }
+  fd_fdstat_get() {
+    return { ret: 0, fdstat: new Fdstat(FILETYPE_REGULAR_FILE, 0) };
+  }
+  fd_filestat_set_size(size) {
+    if (this.file.size > size) {
+      this.file.data = new Uint8Array(this.file.data.buffer.slice(0, Number(size)));
+    } else {
+      const new_data = new Uint8Array(Number(size));
+      new_data.set(this.file.data, 0);
+      this.file.data = new_data;
+    }
+    return ERRNO_SUCCESS;
+  }
+  fd_read(size) {
+    const slice = this.file.data.slice(Number(this.file_pos), Number(this.file_pos + BigInt(size)));
+    this.file_pos += BigInt(slice.length);
+    return { ret: 0, data: slice };
+  }
+  fd_pread(size, offset) {
+    const slice = this.file.data.slice(Number(offset), Number(offset + BigInt(size)));
+    return { ret: 0, data: slice };
+  }
+  fd_seek(offset, whence) {
+    let calculated_offset;
+    switch (whence) {
+      case WHENCE_SET:
+        calculated_offset = offset;
+        break;
+      case WHENCE_CUR:
+        calculated_offset = this.file_pos + offset;
+        break;
+      case WHENCE_END:
+        calculated_offset = BigInt(this.file.data.byteLength) + offset;
+        break;
+      default:
+        return { ret: ERRNO_INVAL, offset: 0n };
+    }
+    if (calculated_offset < 0) {
+      return { ret: ERRNO_INVAL, offset: 0n };
+    }
+    this.file_pos = calculated_offset;
+    return { ret: 0, offset: this.file_pos };
+  }
+  fd_tell() {
+    return { ret: 0, offset: this.file_pos };
+  }
+  fd_write(data) {
+    if (this.file.readonly) return { ret: ERRNO_BADF, nwritten: 0 };
+    if (this.file_pos + BigInt(data.byteLength) > this.file.size) {
+      const old = this.file.data;
+      this.file.data = new Uint8Array(Number(this.file_pos + BigInt(data.byteLength)));
+      this.file.data.set(old);
+    }
+    this.file.data.set(data, Number(this.file_pos));
+    this.file_pos += BigInt(data.byteLength);
+    return { ret: 0, nwritten: data.byteLength };
+  }
+  fd_pwrite(data, offset) {
+    if (this.file.readonly) return { ret: ERRNO_BADF, nwritten: 0 };
+    if (offset + BigInt(data.byteLength) > this.file.size) {
+      const old = this.file.data;
+      this.file.data = new Uint8Array(Number(offset + BigInt(data.byteLength)));
+      this.file.data.set(old);
+    }
+    this.file.data.set(data, Number(offset));
+    return { ret: 0, nwritten: data.byteLength };
+  }
+  fd_filestat_get() {
+    return { ret: 0, filestat: this.file.stat() };
+  }
+  constructor(file) {
+    super();
+    this.file_pos = 0n;
+    this.file = file;
+  }
+};
+var OpenDirectory = class extends Fd {
+  fd_seek(offset, whence) {
+    return { ret: ERRNO_BADF, offset: 0n };
+  }
+  fd_tell() {
+    return { ret: ERRNO_BADF, offset: 0n };
+  }
+  fd_allocate(offset, len) {
+    return ERRNO_BADF;
+  }
+  fd_fdstat_get() {
+    return { ret: 0, fdstat: new Fdstat(FILETYPE_DIRECTORY, 0) };
+  }
+  fd_readdir_single(cookie) {
+    if (debug.enabled) {
+      debug.log("readdir_single", cookie);
+      debug.log(cookie, this.dir.contents.keys());
+    }
+    if (cookie == 0n) {
+      return { ret: ERRNO_SUCCESS, dirent: new Dirent(1n, this.dir.ino, ".", FILETYPE_DIRECTORY) };
+    } else if (cookie == 1n) {
+      return { ret: ERRNO_SUCCESS, dirent: new Dirent(2n, this.dir.parent_ino(), "..", FILETYPE_DIRECTORY) };
+    }
+    if (cookie >= BigInt(this.dir.contents.size) + 2n) {
+      return { ret: 0, dirent: null };
+    }
+    const [name, entry] = Array.from(this.dir.contents.entries())[Number(cookie - 2n)];
+    return { ret: 0, dirent: new Dirent(cookie + 1n, entry.ino, name, entry.stat().filetype) };
+  }
+  path_filestat_get(flags, path_str) {
+    const { ret: path_err, path } = Path.from(path_str);
+    if (path == null) {
+      return { ret: path_err, filestat: null };
+    }
+    const { ret, entry } = this.dir.get_entry_for_path(path);
+    if (entry == null) {
+      return { ret, filestat: null };
+    }
+    return { ret: 0, filestat: entry.stat() };
+  }
+  path_lookup(path_str, dirflags) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return { ret: path_ret, inode_obj: null };
+    }
+    const { ret, entry } = this.dir.get_entry_for_path(path);
+    if (entry == null) {
+      return { ret, inode_obj: null };
+    }
+    return { ret: ERRNO_SUCCESS, inode_obj: entry };
+  }
+  path_open(dirflags, path_str, oflags, fs_rights_base, fs_rights_inheriting, fd_flags) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return { ret: path_ret, fd_obj: null };
+    }
+    let { ret, entry } = this.dir.get_entry_for_path(path);
+    if (entry == null) {
+      if (ret != ERRNO_NOENT) {
+        return { ret, fd_obj: null };
+      }
+      if ((oflags & OFLAGS_CREAT) == OFLAGS_CREAT) {
+        const { ret: ret2, entry: new_entry } = this.dir.create_entry_for_path(path_str, (oflags & OFLAGS_DIRECTORY) == OFLAGS_DIRECTORY);
+        if (new_entry == null) {
+          return { ret: ret2, fd_obj: null };
+        }
+        entry = new_entry;
+      } else {
+        return { ret: ERRNO_NOENT, fd_obj: null };
+      }
+    } else if ((oflags & OFLAGS_EXCL) == OFLAGS_EXCL) {
+      return { ret: ERRNO_EXIST, fd_obj: null };
+    }
+    if ((oflags & OFLAGS_DIRECTORY) == OFLAGS_DIRECTORY && entry.stat().filetype !== FILETYPE_DIRECTORY) {
+      return { ret: ERRNO_NOTDIR, fd_obj: null };
+    }
+    return entry.path_open(oflags, fs_rights_base, fd_flags);
+  }
+  path_create_directory(path) {
+    return this.path_open(0, path, OFLAGS_CREAT | OFLAGS_DIRECTORY, 0n, 0n, 0).ret;
+  }
+  path_link(path_str, inode, allow_dir) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return path_ret;
+    }
+    if (path.is_dir) {
+      return ERRNO_NOENT;
+    }
+    const { ret: parent_ret, parent_entry, filename, entry } = this.dir.get_parent_dir_and_entry_for_path(path, true);
+    if (parent_entry == null || filename == null) {
+      return parent_ret;
+    }
+    if (entry != null) {
+      const source_is_dir = inode.stat().filetype == FILETYPE_DIRECTORY;
+      const target_is_dir = entry.stat().filetype == FILETYPE_DIRECTORY;
+      if (source_is_dir && target_is_dir) {
+        if (allow_dir && entry instanceof Directory) {
+          if (entry.contents.size == 0) {
+          } else {
+            return ERRNO_NOTEMPTY;
+          }
+        } else {
+          return ERRNO_EXIST;
+        }
+      } else if (source_is_dir && !target_is_dir) {
+        return ERRNO_NOTDIR;
+      } else if (!source_is_dir && target_is_dir) {
+        return ERRNO_ISDIR;
+      } else if (inode.stat().filetype == FILETYPE_REGULAR_FILE && entry.stat().filetype == FILETYPE_REGULAR_FILE) {
+      } else {
+        return ERRNO_EXIST;
+      }
+    }
+    if (!allow_dir && inode.stat().filetype == FILETYPE_DIRECTORY) {
+      return ERRNO_PERM;
+    }
+    parent_entry.contents.set(filename, inode);
+    return ERRNO_SUCCESS;
+  }
+  path_unlink(path_str) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return { ret: path_ret, inode_obj: null };
+    }
+    const { ret: parent_ret, parent_entry, filename, entry } = this.dir.get_parent_dir_and_entry_for_path(path, true);
+    if (parent_entry == null || filename == null) {
+      return { ret: parent_ret, inode_obj: null };
+    }
+    if (entry == null) {
+      return { ret: ERRNO_NOENT, inode_obj: null };
+    }
+    parent_entry.contents.delete(filename);
+    return { ret: ERRNO_SUCCESS, inode_obj: entry };
+  }
+  path_unlink_file(path_str) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return path_ret;
+    }
+    const { ret: parent_ret, parent_entry, filename, entry } = this.dir.get_parent_dir_and_entry_for_path(path, false);
+    if (parent_entry == null || filename == null || entry == null) {
+      return parent_ret;
+    }
+    if (entry.stat().filetype === FILETYPE_DIRECTORY) {
+      return ERRNO_ISDIR;
+    }
+    parent_entry.contents.delete(filename);
+    return ERRNO_SUCCESS;
+  }
+  path_remove_directory(path_str) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return path_ret;
+    }
+    const { ret: parent_ret, parent_entry, filename, entry } = this.dir.get_parent_dir_and_entry_for_path(path, false);
+    if (parent_entry == null || filename == null || entry == null) {
+      return parent_ret;
+    }
+    if (!(entry instanceof Directory) || entry.stat().filetype !== FILETYPE_DIRECTORY) {
+      return ERRNO_NOTDIR;
+    }
+    if (entry.contents.size !== 0) {
+      return ERRNO_NOTEMPTY;
+    }
+    if (!parent_entry.contents.delete(filename)) {
+      return ERRNO_NOENT;
+    }
+    return ERRNO_SUCCESS;
+  }
+  fd_filestat_get() {
+    return { ret: 0, filestat: this.dir.stat() };
+  }
+  fd_filestat_set_size(size) {
+    return ERRNO_BADF;
+  }
+  fd_read(size) {
+    return { ret: ERRNO_BADF, data: new Uint8Array() };
+  }
+  fd_pread(size, offset) {
+    return { ret: ERRNO_BADF, data: new Uint8Array() };
+  }
+  fd_write(data) {
+    return { ret: ERRNO_BADF, nwritten: 0 };
+  }
+  fd_pwrite(data, offset) {
+    return { ret: ERRNO_BADF, nwritten: 0 };
+  }
+  constructor(dir) {
+    super();
+    this.dir = dir;
+  }
+};
+var PreopenDirectory = class extends OpenDirectory {
+  fd_prestat_get() {
+    return { ret: 0, prestat: Prestat.dir(this.prestat_name) };
+  }
+  constructor(name, contents) {
+    super(new Directory(contents));
+    this.prestat_name = name;
+  }
+};
+var File = class extends Inode {
+  path_open(oflags, fs_rights_base, fd_flags) {
+    if (this.readonly && (fs_rights_base & BigInt(RIGHTS_FD_WRITE)) == BigInt(RIGHTS_FD_WRITE)) {
+      return { ret: ERRNO_PERM, fd_obj: null };
+    }
+    if ((oflags & OFLAGS_TRUNC) == OFLAGS_TRUNC) {
+      if (this.readonly) return { ret: ERRNO_PERM, fd_obj: null };
+      this.data = new Uint8Array([]);
+    }
+    const file = new OpenFile(this);
+    if (fd_flags & FDFLAGS_APPEND) file.fd_seek(0n, WHENCE_END);
+    return { ret: ERRNO_SUCCESS, fd_obj: file };
+  }
+  get size() {
+    return BigInt(this.data.byteLength);
+  }
+  stat() {
+    return new Filestat(this.ino, FILETYPE_REGULAR_FILE, this.size);
+  }
+  constructor(data, options) {
+    super();
+    this.data = new Uint8Array(data);
+    this.readonly = !!options?.readonly;
+  }
+};
+var Path = class Path2 {
+  static from(path) {
+    const self = new Path2();
+    self.is_dir = path.endsWith("/");
+    if (path.startsWith("/")) {
+      return { ret: ERRNO_NOTCAPABLE, path: null };
+    }
+    if (path.includes("\0")) {
+      return { ret: ERRNO_INVAL, path: null };
+    }
+    for (const component of path.split("/")) {
+      if (component === "" || component === ".") {
+        continue;
+      }
+      if (component === "..") {
+        if (self.parts.pop() == void 0) {
+          return { ret: ERRNO_NOTCAPABLE, path: null };
+        }
+        continue;
+      }
+      self.parts.push(component);
+    }
+    return { ret: ERRNO_SUCCESS, path: self };
+  }
+  to_path_string() {
+    let s = this.parts.join("/");
+    if (this.is_dir) {
+      s += "/";
+    }
+    return s;
+  }
+  constructor() {
+    this.parts = [];
+    this.is_dir = false;
+  }
+};
+var Directory = class _Directory extends Inode {
+  parent_ino() {
+    if (this.parent == null) {
+      return Inode.root_ino();
+    }
+    return this.parent.ino;
+  }
+  path_open(oflags, fs_rights_base, fd_flags) {
+    return { ret: ERRNO_SUCCESS, fd_obj: new OpenDirectory(this) };
+  }
+  stat() {
+    return new Filestat(this.ino, FILETYPE_DIRECTORY, 0n);
+  }
+  get_entry_for_path(path) {
+    let entry = this;
+    for (const component of path.parts) {
+      if (!(entry instanceof _Directory)) {
+        return { ret: ERRNO_NOTDIR, entry: null };
+      }
+      const child = entry.contents.get(component);
+      if (child !== void 0) {
+        entry = child;
+      } else {
+        debug.log(component);
+        return { ret: ERRNO_NOENT, entry: null };
+      }
+    }
+    if (path.is_dir) {
+      if (entry.stat().filetype != FILETYPE_DIRECTORY) {
+        return { ret: ERRNO_NOTDIR, entry: null };
+      }
+    }
+    return { ret: ERRNO_SUCCESS, entry };
+  }
+  get_parent_dir_and_entry_for_path(path, allow_undefined) {
+    const filename = path.parts.pop();
+    if (filename === void 0) {
+      return { ret: ERRNO_INVAL, parent_entry: null, filename: null, entry: null };
+    }
+    const { ret: entry_ret, entry: parent_entry } = this.get_entry_for_path(path);
+    if (parent_entry == null) {
+      return { ret: entry_ret, parent_entry: null, filename: null, entry: null };
+    }
+    if (!(parent_entry instanceof _Directory)) {
+      return { ret: ERRNO_NOTDIR, parent_entry: null, filename: null, entry: null };
+    }
+    const entry = parent_entry.contents.get(filename);
+    if (entry === void 0) {
+      if (!allow_undefined) {
+        return { ret: ERRNO_NOENT, parent_entry: null, filename: null, entry: null };
+      } else {
+        return { ret: ERRNO_SUCCESS, parent_entry, filename, entry: null };
+      }
+    }
+    if (path.is_dir) {
+      if (entry.stat().filetype != FILETYPE_DIRECTORY) {
+        return { ret: ERRNO_NOTDIR, parent_entry: null, filename: null, entry: null };
+      }
+    }
+    return { ret: ERRNO_SUCCESS, parent_entry, filename, entry };
+  }
+  create_entry_for_path(path_str, is_dir) {
+    const { ret: path_ret, path } = Path.from(path_str);
+    if (path == null) {
+      return { ret: path_ret, entry: null };
+    }
+    let { ret: parent_ret, parent_entry, filename, entry } = this.get_parent_dir_and_entry_for_path(path, true);
+    if (parent_entry == null || filename == null) {
+      return { ret: parent_ret, entry: null };
+    }
+    if (entry != null) {
+      return { ret: ERRNO_EXIST, entry: null };
+    }
+    debug.log("create", path);
+    let new_child;
+    if (!is_dir) {
+      new_child = new File(new ArrayBuffer(0));
+    } else {
+      new_child = new _Directory(/* @__PURE__ */ new Map());
+    }
+    parent_entry.contents.set(filename, new_child);
+    entry = new_child;
+    return { ret: ERRNO_SUCCESS, entry };
+  }
+  constructor(contents) {
+    super();
+    this.parent = null;
+    if (contents instanceof Array) {
+      this.contents = new Map(contents);
+    } else {
+      this.contents = contents;
+    }
+    for (const entry of this.contents.values()) {
+      if (entry instanceof _Directory) {
+        entry.parent = this;
+      }
+    }
+  }
+};
+var ConsoleStdout = class _ConsoleStdout extends Fd {
+  fd_filestat_get() {
+    const filestat = new Filestat(this.ino, FILETYPE_CHARACTER_DEVICE, BigInt(0));
+    return { ret: 0, filestat };
+  }
+  fd_fdstat_get() {
+    const fdstat = new Fdstat(FILETYPE_CHARACTER_DEVICE, 0);
+    fdstat.fs_rights_base = BigInt(RIGHTS_FD_WRITE);
+    return { ret: 0, fdstat };
+  }
+  fd_write(data) {
+    this.write(data);
+    return { ret: 0, nwritten: data.byteLength };
+  }
+  static lineBuffered(write) {
+    const dec4 = new TextDecoder("utf-8", { fatal: false });
+    let line_buf = "";
+    return new _ConsoleStdout((buffer) => {
+      line_buf += dec4.decode(buffer, { stream: true });
+      const lines = line_buf.split("\n");
+      for (const [i, line] of lines.entries()) {
+        if (i < lines.length - 1) {
+          write(line);
+        } else {
+          line_buf = line;
+        }
+      }
+    });
+  }
+  constructor(write) {
+    super();
+    this.ino = Inode.issue_ino();
+    this.write = write;
+  }
+};
+
+// src/_adapter/git-fs.ts
+function fsErr(code, p) {
+  const e = new Error(`${code}: ${p}`);
+  e.code = code;
+  return e;
+}
+function makeGitFs(preopen, mount, { File: File2, Directory: Directory2 }) {
+  const root = preopen.dir;
+  const isDir = (n) => !!n && n.contents instanceof Map;
+  function parts(p) {
+    if (p === mount) return [];
+    if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
+    const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
+    return rel === "" ? [] : rel.split("/");
+  }
+  function resolve(ps) {
+    let cur = root;
+    for (const part of ps) {
+      if (!isDir(cur)) return null;
+      const next = cur.contents.get(part);
+      if (next === void 0) return null;
+      cur = next;
+    }
+    return cur;
+  }
+  const parent = (ps) => resolve(ps.slice(0, -1));
+  const leaf = (ps) => ps[ps.length - 1];
+  const promises = {
+    async readFile(p, opts) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (isDir(n)) throw fsErr("EISDIR", p);
+      const data = n.data ?? new Uint8Array(0);
+      const encoding = typeof opts === "string" ? opts : opts && opts.encoding;
+      return encoding ? new TextDecoder().decode(data) : new Uint8Array(data);
+    },
+    async writeFile(p, data) {
+      const ps = parts(p);
+      const par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+      par.contents.set(leaf(ps), new File2(bytes));
+    },
+    async unlink(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
+    },
+    async readdir(p) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (!isDir(n)) throw fsErr("ENOTDIR", p);
+      return [...n.contents.keys()];
+    },
+    async mkdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      if (par.contents.has(leaf(ps))) throw fsErr("EEXIST", p);
+      par.contents.set(leaf(ps), new Directory2(/* @__PURE__ */ new Map()));
+    },
+    async rmdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      par.contents.delete(leaf(ps));
+    },
+    async stat(p) {
+      return promises.lstat(p);
+    },
+    async lstat(p) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      const dir = isDir(n);
+      return {
+        type: dir ? "dir" : "file",
+        mode: dir ? 16384 : 33188,
+        size: dir ? 0 : n.data ? n.data.length : 0,
+        ino: 0,
+        mtimeMs: 0,
+        ctimeMs: 0,
+        uid: 1,
+        gid: 1,
+        dev: 1,
+        isFile: () => !dir,
+        isDirectory: () => dir,
+        isSymbolicLink: () => false
+      };
+    },
+    async readlink(p) {
+      throw fsErr("EINVAL", p);
+    },
+    async symlink() {
+      throw fsErr("EPERM", "symlink unsupported");
+    },
+    async chmod() {
+    }
+  };
+  return { promises };
+}
+
+// src/_adapter/tree.ts
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function flatten(dir, prefix, out) {
+  for (const [name, inode] of dir.contents ?? /* @__PURE__ */ new Map()) {
+    const path = prefix ? prefix + "/" + name : name;
+    if (inode.contents instanceof Map) {
+      out.push({ path, dir: true });
+      flatten(inode, path, out);
+    } else {
+      out.push({ path, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+    }
+  }
+}
+function serializeTree(workTree) {
+  const entries = [];
+  flatten(workTree, "", entries);
+  const chunks = [];
+  const header = new Uint8Array(4);
+  new DataView(header.buffer).setUint32(0, entries.length, true);
+  chunks.push(header);
+  for (const e of entries) {
+    const pathBytes = enc.encode(e.path);
+    const body = e.dir ? new Uint8Array(0) : e.bytes ?? new Uint8Array(0);
+    const meta = new Uint8Array(9);
+    const dv = new DataView(meta.buffer);
+    dv.setUint8(0, e.dir ? 1 : 0);
+    dv.setUint32(1, pathBytes.length, true);
+    dv.setUint32(5, body.length, true);
+    chunks.push(meta, pathBytes, body);
+  }
+  let total = 0;
+  for (const c of chunks) total += c.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+
+// src/_adapter/custody-transport.ts
+var enc2 = new TextEncoder();
+var dec2 = new TextDecoder();
+var ZERO_OID = "0".repeat(40);
+var EMPTY_PACK = new Uint8Array([
+  80,
+  65,
+  67,
+  75,
+  0,
+  0,
+  0,
+  2,
+  0,
+  0,
+  0,
+  0,
+  // "PACK", ver 2, 0 objects
+  2,
+  157,
+  8,
+  130,
+  59,
+  216,
+  168,
+  234,
+  181,
+  16,
+  173,
+  106,
+  // sha1(the 12 header bytes)
+  199,
+  92,
+  130,
+  60,
+  253,
+  62,
+  211,
+  30
+]);
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out.set(c, o);
+    o += c.length;
+  }
+  return out;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+var FLUSH = enc2.encode("0000");
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
+  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}) {
+  if (!updates.length) return { ok: true, noop: true };
+  const cmds = [];
+  updates.forEach((u, i) => {
+    const old = u.oldOid || ZERO_OID;
+    const neu = u.newOid || ZERO_OID;
+    const caps = i === 0 ? "\0report-status" : "";
+    cmds.push(pkt(`${old} ${neu} ${u.ref}${caps}
+`));
+  });
+  cmds.push(FLUSH);
+  const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
+  const r = await fetch(`${remote}/git-receive-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+    body
+  });
+  const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
+  const unpacked = /unpack ok/.test(txt);
+  const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
+  if (!(r.ok && unpacked && everyRefOk && !/\bng /.test(txt))) {
+    throw new Error(`receive-pack ${r.status}: ${txt.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 200)}`);
+  }
+  return { ok: true };
+}
+
+// src/_adapter/managed-promotion.ts
+var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
+function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
+  if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  if (!report.promotable && !acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "exact history changes under the candidate; provide an acceptanceReason to make that business decision accountable"
+    };
+  }
+  if (!report.atStateRoot || !report.historyHash || !report.reportHash || !report.projection) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "the complete pre-flight report is missing its state, projection, or content proof"
+    };
+  }
+  const provedDomains = report.domains?.length ? report.domains : [report.domain];
+  if (!provedDomains.includes(domain)) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: `the package-wide report does not cover the generated business area '${domain}'`
+    };
+  }
+  const reportEvidence = JSON.parse(JSON.stringify(report));
+  if (Array.isArray(reportEvidence.divergences)) {
+    for (const divergence of reportEvidence.divergences) {
+      if (divergence && typeof divergence === "object") {
+        delete divergence.atCommit;
+      }
+    }
+  }
+  const preflight = {
+    candidateHash,
+    // A package may be reached through any one of its generated domain clients. The
+    // kernel chooses one canonical domain for the private receipt so the exact same
+    // package/history proof has one identity regardless of that entry point.
+    domain: report.domain,
+    atHash: report.atHash,
+    atStateRoot: report.atStateRoot,
+    historyHash: report.historyHash,
+    reportHash: report.reportHash,
+    reportJson: JSON.stringify(reportEvidence),
+    complete: true,
+    evolveOk: true,
+    rawPromotable: report.promotable,
+    projectionEqual: report.projection.equal,
+    replayedIntents: report.replayedIntents,
+    candidateIntents: report.candidateIntents,
+    divergenceCount: report.divergences.length,
+    baselineRoot: report.projection.baselineRoot,
+    candidateRoot: report.projection.candidateRoot,
+    ...!report.promotable && acceptanceReason ? { acceptanceReason } : {}
+  };
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: `${RELEASE_RECEIPT_PREFIX}${report.reportHash}`,
+    payload: {
+      domainHash: candidateHash,
+      ...opts.replaces ? { replaces: opts.replaces } : {},
+      retireReplaced: opts.retireReplaced ?? false,
+      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      preflight
+    }
+  };
+}
+function prepareManagedRestoration(report, currentHash, priorHash, domain, opts = {}) {
+  if (!report.dispositions || typeof report.dispositions !== "object") {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "restoration refused: the exact-history proof did not derive its predecessor dispositions"
+    };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  const prepared = prepareManagedPromotion(report, priorHash, domain, {
+    dispositions: report.dispositions,
+    ...acceptanceReason ? { acceptanceReason } : {}
+  });
+  if (!prepared.ok) {
+    return {
+      ...prepared,
+      stage: prepared.stage === "acceptance" ? "acceptance" : "preflight"
+    };
+  }
+  if (!acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "restoring previous law needs a business reason even when historical outcomes are unchanged"
+    };
+  }
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: prepared.receiptId,
+    payload: {
+      candidateHash: currentHash,
+      priorHash,
+      dispositions: report.dispositions,
+      preflight: prepared.payload.preflight
+    }
+  };
+}
+
+// src/_adapter/engine.ts
+var enc3 = new TextEncoder();
+var dec3 = new TextDecoder();
+var BRANCH = "main";
+var RESULT_PACK_INLINE_MAX = 256 * 1024;
+var dirOf = (n) => n;
+var repoArgOf = (ws) => `/work/ws/${ws}`;
+var gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc3.encode(JSON.stringify(o)));
+}
+var unpack = (p) => {
+  const v = typeof p === "bigint" ? p : BigInt(p);
+  return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
+};
+async function sha256hex(t) {
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
+  return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+function osEntropyBuffer(n) {
+  const bytes = new Uint8Array(n * 8);
+  for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
+  const out = new Array(n), T = 2 ** 53;
+  for (let i = 0; i < n; i++) {
+    let z = 0n;
+    for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
+    out[i] = Number(z >> 11n) / T;
+  }
+  return out;
+}
+function stringifyBig(o) {
+  return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
+}
+var log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
+function call(ex, mode, fields, STDERR) {
+  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
+  const reqPtr = ex.git_holon_alloc(req.length);
+  try {
+    new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
+    let packed;
+    try {
+      packed = ex.git_holon_call(reqPtr, req.length);
+    } catch (e) {
+      const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
+      throw new Error(`${String(e?.stack || e)}${tail}`);
+    }
+    const { ptr, len } = unpack(packed);
+    try {
+      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
+      return e.result;
+    } finally {
+      ex.git_holon_dealloc(ptr, len);
+    }
+  } finally {
+    ex.git_holon_dealloc(reqPtr, req.length);
+  }
+}
+var repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+var bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+var kgit = {
+  // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+  resolveRef: (eng2, gitdir, ref) => JSON.parse(call(eng2.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng2.STDERR)).oid,
+  // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+  readBlob: (eng2, gitdir, oid, path) => {
+    const r = JSON.parse(call(eng2.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path }, eng2.STDERR));
+    return r.ok ? bytesFromB64(r.blobB64) : null;
+  },
+  // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+  // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+  intentsAbove: (eng2, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng2.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng2.STDERR)).intents,
+  // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+  listRefs: (eng2, gitdir, prefix) => JSON.parse(call(eng2.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng2.STDERR)).refs,
+  // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+  writeRef: (eng2, gitdir, ref, value) => JSON.parse(call(eng2.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng2.STDERR)),
+  // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+  deleteRef: (eng2, gitdir, ref) => JSON.parse(call(eng2.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng2.STDERR)),
+  // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
+  applyPack: (eng2, ws, packBytes) => applyPackInto(eng2, ws, packBytes),
+  // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+  // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+  writeMetaCommit: (eng2, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng2.ex, "write_meta_commit", {
+    repoArg: repoArgOfGitdir(gitdir),
+    parents,
+    files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+    message,
+    timeSecs,
+    ref
+  }, eng2.STDERR)).oid
+};
+var installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
+var stagePayload = (hash, usda, installedBy, supersedes) => ({
+  domainHash: hash,
+  packageUsda: usda,
+  installedBy,
+  dependencies: [],
+  ...supersedes ? { supersedes } : {},
+  finalizers: []
+});
+async function createEngine({ wasmModule: wasmModule2, bootstrapPkg, nomosPkg, replica: replica2, installedBy = "nomos-cloud" }) {
+  const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
+  const root = /* @__PURE__ */ new Map();
+  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
+  root.set("ws", new Directory(/* @__PURE__ */ new Map()));
+  const preopen = new PreopenDirectory("/work", root);
+  const STDERR = [];
+  const pushStderr = (l) => {
+    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
+    STDERR.push(l);
+  };
+  const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
+  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
+  const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
+  const inst = await WebAssembly.instantiate(wasmModule2, { wasi_snapshot_preview1: wasi.wasiImport });
+  const code = wasi.start(inst);
+  if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
+  const instExports = inst.exports;
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
+  const eng2 = {
+    ex: instExports,
+    preopen,
+    STDERR,
+    seq: 0,
+    replica: replica2,
+    hashes,
+    bootstrapPkg,
+    nomosPkg,
+    installedBy,
+    fs: makeGitFs(preopen, "/work", { File, Directory }),
+    mounted: /* @__PURE__ */ new Map(),
+    // ws -> { restored, remoteMain, restoreError }
+    mainIntents: /* @__PURE__ */ new Map()
+    // ws -> { head, ids:Set, oids:Set } (admission idempotence)
+  };
+  return eng2;
+}
+function directiveRoutes(eng2) {
+  return /* @__PURE__ */ new Map();
+}
+var routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
+function routeTagHexOfMintedId(id) {
+  const i = id.indexOf("_");
+  if (i <= 0) return void 0;
+  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();
+  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : void 0;
+}
+async function wrongHomeVerdict(shardRouting, route, payload) {
+  const value = payload ? payload[route.key] : void 0;
+  if (typeof value !== "string" || !value) return null;
+  const rows = await shardRouting.assignments() || [];
+  let assignment = null;
+  if (route.via === "axis") {
+    assignment = rows.find((a) => a.homeKey === value) || null;
+  } else {
+    const tag = routeTagHexOfMintedId(value);
+    if (tag !== void 0) {
+      for (const a of rows) {
+        if (await routeTagHexOfHomeKey(String(a.homeKey)) === tag) {
+          assignment = a;
+          break;
+        }
+      }
+    }
+  }
+  if (!assignment) {
+    return {
+      error: `no shard placement for this write's home ('${route.key}': ${value.slice(0, 80)}) \u2014 author the derived placement intent (birth<Type>) on the coordinator '${shardRouting.coordinatorWs}' first, then POST /dead-letters/retry`,
+      deadLettered: true
+    };
+  }
+  const movingTo = typeof assignment.status === "string" && assignment.status.startsWith("moving:") ? assignment.status.slice("moving:".length) : null;
+  if (movingTo) {
+    return {
+      error: `home-moving: home '${value.slice(0, 80)}' is migrating ${assignment.shard} -> ${movingTo} (shard map v${assignment.mapVersion ?? 1}) \u2014 parked; a routed client retries automatically after the handoff seals`,
+      homeMoving: { homeKey: value, from: assignment.shard, target: movingTo, workspace: `${shardRouting.coordinatorWs}--${movingTo}` },
+      deadLettered: true
+    };
+  }
+  if (shardRouting.selfLabel === assignment.shard) return null;
+  const correct = `${shardRouting.coordinatorWs}--${assignment.shard}`;
+  return {
+    error: `wrong-home: this write's home is assigned to '${correct}' (shard map v${assignment.mapVersion ?? 1}) \u2014 the client's shard map is stale; a routed client re-routes and retries automatically`,
+    wrongHome: { workspace: correct, ...assignment.mapVersion !== void 0 ? { mapVersion: assignment.mapVersion } : {} }
+  };
+}
+var SUMMARY_SEP = "";
+var summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
+var splitSummaryKey = (key) => {
+  const i = key.indexOf(SUMMARY_SEP);
+  return [key.slice(0, i), key.slice(i + 1)];
+};
+var NOMOS_SHARD_ROWS_READ = "nomosShardRows";
+function tenantTypes(eng2) {
+  return /* @__PURE__ */ new Set();
+}
+function placementDirectives(eng2) {
+  return /* @__PURE__ */ new Map();
+}
+function scopedReads(eng2) {
+  return [];
+}
+function evalCanonicalPred(pred, get) {
+  if (!pred || typeof pred !== "object") return true;
+  if (pred.kind === "and") return (pred.clauses || []).every((c) => evalCanonicalPred(c, get));
+  if (pred.kind === "or") return (pred.clauses || []).some((c) => evalCanonicalPred(c, get));
+  const raw = get(pred.field);
+  const present = raw !== void 0 && raw !== null;
+  const canonical = present ? String(raw) : void 0;
+  if (pred.kind === "eq") return present && canonical === pred.value;
+  if (pred.kind === "ne") return !present || canonical !== pred.value;
+  return true;
+}
+function globalAggregates(eng2) {
+  return /* @__PURE__ */ new Set();
+}
+function parseIntentEvents(blob) {
+  let doc;
+  try {
+    doc = JSON.parse(dec3.decode(blob));
+  } catch {
+    return [];
+  }
+  const events = Array.isArray(doc && doc.events) ? doc.events : [];
+  return events.map((ev) => {
+    const sets = /* @__PURE__ */ new Map();
+    for (const op of ev.ops || []) {
+      const v = op && op.op && op.op.Set;
+      if (v === void 0) continue;
+      if (typeof v.Str === "string") sets.set(op.field, v.Str);
+      else if (typeof v.Int === "number") sets.set(op.field, v.Int);
+    }
+    return { aggregate: String(ev.aggregate || ""), sets };
+  });
+}
+var groupOf = (read, data) => {
+  if (read.by === null) return "";
+  const v = data ? data[read.by] : void 0;
+  return v === void 0 || v === null ? void 0 : String(v);
+};
+var tallyOf = (eng2, ws, read, group) => read.kind === "count" ? count(eng2, ws, read.id, group).count : read.kind === "sum" ? sum(eng2, ws, read.id, group).sum : extremum(eng2, ws, read.id, read.kind, group).value;
+var isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
+var extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
+function beginSummaryCapture(eng2, ws, ctx, blob) {
+  const events = parseIntentEvents(blob);
+  if (events.length === 0) return null;
+  const pre = /* @__PURE__ */ new Map();
+  const candidates = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (!pre.has(ev.aggregate)) {
+      const rows = qById(eng2, ws, ev.aggregate);
+      pre.set(ev.aggregate, rows.length ? { type: rows[0].type, data: rows[0].data || {} } : null);
+    }
+    const before = pre.get(ev.aggregate);
+    const evType = ev.sets.get("__type") ?? (before ? before.type : void 0);
+    for (const read of ctx.reads) {
+      if (read.of !== evType) continue;
+      const oldGroup = before ? groupOf(read, before.data) : void 0;
+      if (oldGroup !== void 0) candidates.add(summaryKey(read.id, oldGroup));
+      if (read.by === null) candidates.add(summaryKey(read.id, ""));
+      else if (ev.sets.has(read.by)) candidates.add(summaryKey(read.id, String(ev.sets.get(read.by))));
+    }
+  }
+  const preTallies = /* @__PURE__ */ new Map();
+  for (const key of candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const v = tallyOf(eng2, ws, read, group);
+    preTallies.set(key, v);
+    if (!ctx.prevs.has(key)) ctx.prevs.set(key, { read, group, value: v });
+  }
+  return { events, pre, candidates, preTallies };
+}
+function finishSummaryCapture(eng2, ws, ctx, cap, oid, intentId) {
+  const deltas = [];
+  for (const key of cap.candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const after = tallyOf(eng2, ws, read, group);
+    if (isExtremumRead(read)) {
+      const before = cap.preTallies.has(key) ? cap.preTallies.get(key) : null;
+      if (after !== before) {
+        deltas.push({ readId, group, delta: after });
+        if (!extremumMonotone(read, before, after)) ctx.rederived.add(key);
+      }
+    } else {
+      const before = cap.preTallies.get(key) ?? 0;
+      if (after !== before) deltas.push({ readId, group, delta: after - before });
+    }
+    ctx.values.set(key, { read, group, value: after });
+  }
+  let rowsDelta = 0;
+  for (const [aggregateId, before] of cap.pre) {
+    const rows = qById(eng2, ws, aggregateId);
+    const type = rows.length ? rows[0].type : before ? before.type : void 0;
+    if (type === void 0 || !tenantTypes(eng2).has(type)) continue;
+    const existsAfter = rows.length > 0;
+    const flip = !before && existsAfter ? 1 : before && !existsAfter ? -1 : 0;
+    if (flip === 0) continue;
+    rowsDelta += flip;
+    const homeKey = ctx.homeKeySet && ctx.homeKeySet.has(aggregateId) ? aggregateId : ctx.homeTags ? ctx.homeTags.get(routeTagHexOfMintedId(aggregateId) ?? "") : void 0;
+    if (homeKey !== void 0) {
+      deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: flip });
+      ctx.rowsByHome.set(homeKey, (ctx.rowsByHome.get(homeKey) ?? 0) + flip);
+    }
+  }
+  if (rowsDelta !== 0) {
+    deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: rowsDelta });
+    ctx.rowsDelta += rowsDelta;
+  }
+  if (deltas.length > 0) ctx.events.push({ oid, intentId: intentId || "", deltas });
+}
+function summaryOfCapture(ctx, fromOid, toOid) {
+  if (ctx.events.length === 0 || !toOid || fromOid === toOid) return null;
+  const touched = /* @__PURE__ */ new Set();
+  for (const ev of ctx.events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
+  const subtotals = [];
+  for (const [key, cur] of ctx.values) {
+    const extremum2 = isExtremumRead(cur.read);
+    const prev = ctx.prevs.get(key);
+    const prevValue = prev ? prev.value : extremum2 ? null : 0;
+    if (cur.value === prevValue && !touched.has(key)) continue;
+    subtotals.push({
+      readId: cur.read.id,
+      group: cur.group,
+      kind: cur.read.kind,
+      prev: prevValue,
+      value: cur.value,
+      ...extremum2 && ctx.rederived.has(key) ? { rederived: true } : {}
+    });
+  }
+  if (subtotals.length === 0 && ctx.rowsDelta === 0 && ctx.rowsByHome.size === 0) return null;
+  return {
+    fromOid: fromOid || "",
+    toOid,
+    subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+    events: ctx.events,
+    rowsDelta: ctx.rowsDelta,
+    // SLICE 8: the exact per-home row deltas — the adapter closes each against the
+    // coordinator-held per-home subtotal exactly like the "" grand total.
+    rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
+  };
+}
+async function deriveSummarySuffix(eng2, ws, fromOid) {
+  const reads = scopedReads(eng2);
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  if (!head) return { ok: false, error: "no local main to derive from" };
+  const commits = kgit.intentsAbove(eng2, gitdir, head);
+  const state = /* @__PURE__ */ new Map();
+  const running = /* @__PURE__ */ new Map();
+  const bump = (key, d) => running.set(key, (running.get(key) ?? 0) + d);
+  const extRows = /* @__PURE__ */ new Map();
+  const extRunning = /* @__PURE__ */ new Map();
+  const extRederived = /* @__PURE__ */ new Set();
+  const extBucketRows = (key) => {
+    let m = extRows.get(key);
+    if (!m) {
+      m = /* @__PURE__ */ new Map();
+      extRows.set(key, m);
+    }
+    return m;
+  };
+  const recomputeExt = (read, key) => {
+    let v = null;
+    const m = extRows.get(key);
+    if (m) for (const x of m.values()) v = v === null ? x : read.kind === "min" ? Math.min(v, x) : Math.max(v, x);
+    return v;
+  };
+  const homeKeySet = /* @__PURE__ */ new Set();
+  const homeTags = /* @__PURE__ */ new Map();
+  let prevs = null;
+  let extPrevs = null;
+  let events = [];
+  let inSuffix = fromOid === "" || fromOid === void 0;
+  if (inSuffix) {
+    prevs = /* @__PURE__ */ new Map();
+    extPrevs = /* @__PURE__ */ new Map();
+  }
+  let sawFrom = inSuffix;
+  for (const c of commits) {
+    let blob = null;
+    try {
+      blob = bytesFromB64(c.intentB64);
+    } catch {
+    }
+    const deltas = [];
+    let intentId = "";
+    if (blob) {
+      let doc = null;
+      try {
+        doc = JSON.parse(dec3.decode(blob));
+      } catch {
+      }
+      if (doc && Array.isArray(doc.strikes) && doc.strikes.length > 0) {
+        return { ok: true, strikeBearing: true, head };
+      }
+      intentId = doc && doc.id || "";
+      for (const ev of parseIntentEvents(blob)) {
+        const cur = state.get(ev.aggregate) ?? { type: void 0, fields: /* @__PURE__ */ new Map(), exists: false };
+        const newType = ev.sets.get("__type");
+        if (newType !== void 0) cur.type = newType;
+        const tallyBefore = /* @__PURE__ */ new Map();
+        for (const read of reads) {
+          if (read.of !== cur.type && read.of !== newType) continue;
+          tallyBefore.set(read.id, contribution(read, cur));
+        }
+        const existedBefore = cur.exists;
+        for (const [f, v] of ev.sets) cur.fields.set(f, v);
+        cur.exists = true;
+        state.set(ev.aggregate, cur);
+        const effType = cur.type ?? newType;
+        if (effType === "NomosHomeReceipt") {
+          const hk = cur.fields.get("homeKey");
+          if (typeof hk === "string" && hk && !homeKeySet.has(hk)) {
+            homeKeySet.add(hk);
+            homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+          }
+        }
+        if (!existedBefore && effType !== void 0 && tenantTypes(eng2).has(effType)) {
+          bump(summaryKey(NOMOS_SHARD_ROWS_READ, ""), 1);
+          deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: 1 });
+          const homeKey = homeKeySet.has(ev.aggregate) ? ev.aggregate : homeTags.get(routeTagHexOfMintedId(ev.aggregate) ?? "");
+          if (homeKey !== void 0) {
+            bump(summaryKey(NOMOS_SHARD_ROWS_READ, homeKey), 1);
+            deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: 1 });
+          }
+        }
+        for (const read of reads) {
+          if (read.of !== cur.type) continue;
+          const before = tallyBefore.get(read.id) ?? null;
+          const after = contribution(read, cur);
+          if (isExtremumRead(read)) {
+            const touchedBuckets = /* @__PURE__ */ new Set();
+            if (before) {
+              const bk = summaryKey(read.id, before.group);
+              if (!after || after.group !== before.group) extBucketRows(bk).delete(ev.aggregate);
+              touchedBuckets.add(bk);
+            }
+            if (after) {
+              const ak = summaryKey(read.id, after.group);
+              extBucketRows(ak).set(ev.aggregate, after.value);
+              touchedBuckets.add(ak);
+            }
+            for (const bk of touchedBuckets) {
+              const ov = extRunning.has(bk) ? extRunning.get(bk) ?? null : null;
+              const nv = recomputeExt(read, bk);
+              if (nv === ov) continue;
+              extRunning.set(bk, nv);
+              if (inSuffix) {
+                if (!extremumMonotone(read, ov, nv)) extRederived.add(bk);
+                const [, group] = splitSummaryKey(bk);
+                deltas.push({ readId: read.id, group, delta: nv, __extremum: true });
+              }
+            }
+          } else {
+            for (const d of contributionDiff(read, before, after)) {
+              bump(summaryKey(d.readId, d.group), d.delta ?? 0);
+              deltas.push(d);
+            }
+          }
+        }
+      }
+    }
+    if (inSuffix && deltas.length) {
+      const byKey = /* @__PURE__ */ new Map();
+      const extLast = /* @__PURE__ */ new Map();
+      for (const d of deltas) {
+        const k = summaryKey(d.readId, d.group);
+        if (d.__extremum) extLast.set(k, d.delta);
+        else byKey.set(k, (byKey.get(k) ?? 0) + d.delta);
+      }
+      const merged = [...byKey.entries()].filter(([, d]) => d !== 0).map(([k, d]) => {
+        const [readId, group] = splitSummaryKey(k);
+        return { readId, group, delta: d };
+      });
+      for (const [k, v] of extLast) {
+        const [readId, group] = splitSummaryKey(k);
+        merged.push({ readId, group, delta: v });
+      }
+      if (merged.length) events.push({ oid: c.oid, intentId, deltas: merged });
+    }
+    if (!inSuffix && c.oid === fromOid) {
+      inSuffix = true;
+      sawFrom = true;
+      prevs = new Map(running);
+      extPrevs = new Map(extRunning);
+    }
+  }
+  if (!sawFrom) return { ok: false, error: `fromOid ${String(fromOid).slice(0, 12)} is not on this shard's main \u2014 cannot derive the suffix` };
+  if (!prevs) prevs = /* @__PURE__ */ new Map();
+  const touched = /* @__PURE__ */ new Set();
+  for (const ev of events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
+  const subtotals = [];
+  const keys = /* @__PURE__ */ new Set([...running.keys(), ...prevs.keys()]);
+  for (const key of keys) {
+    const value = running.get(key) ?? 0;
+    const prev = prevs.get(key) ?? 0;
+    if (value === prev && !touched.has(key)) continue;
+    const [readId, group] = splitSummaryKey(key);
+    const read = reads.find((r) => r.id === readId);
+    subtotals.push({ readId, group, kind: readId === NOMOS_SHARD_ROWS_READ ? "rows" : read ? read.kind : "count", prev, value });
+  }
+  const extKeys = /* @__PURE__ */ new Set([...extRunning.keys(), ...extPrevs ? extPrevs.keys() : []]);
+  for (const key of extKeys) {
+    const value = extRunning.has(key) ? extRunning.get(key) : null;
+    const prev = extPrevs && extPrevs.has(key) ? extPrevs.get(key) : null;
+    if (value === prev && !touched.has(key)) continue;
+    const [readId, group] = splitSummaryKey(key);
+    const read = reads.find((r) => r.id === readId);
+    if (!read) continue;
+    subtotals.push({ readId, group, kind: read.kind, prev, value, ...extRederived.has(key) ? { rederived: true } : {} });
+  }
+  if (subtotals.length === 0) return { ok: true, upToDate: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: fromOid || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+      events
+    }
+  };
+}
+function contribution(read, cur) {
+  if (!cur || !cur.exists || cur.type !== read.of) return null;
+  if (read.where && !evalCanonicalPred(read.where, (f) => cur.fields.get(f))) return null;
+  const group = read.by === null ? "" : cur.fields.has(read.by) ? String(cur.fields.get(read.by)) : void 0;
+  if (group === void 0) return null;
+  if (read.kind === "count") return { group, value: 1 };
+  const raw = cur.fields.get(read.field);
+  if (isExtremumRead(read) && typeof raw !== "number") return null;
+  return { group, value: typeof raw === "number" ? raw : 0 };
+}
+function contributionDiff(read, before, after) {
+  const out = [];
+  if (before && after && before.group === after.group) {
+    const d = after.value - before.value;
+    if (d !== 0) out.push({ readId: read.id, group: after.group, delta: d });
+    return out;
+  }
+  if (before) out.push({ readId: read.id, group: before.group, delta: -before.value });
+  if (after) out.push({ readId: read.id, group: after.group, delta: after.value });
+  return out.filter((d) => d.delta !== 0);
+}
+function countTenantRows(eng2, ws) {
+  let total = 0;
+  for (const type of tenantTypes(eng2)) {
+    total += query(eng2, ws, "aggregatesByType", JSON.stringify({ __type: type })).length;
+  }
+  return total;
+}
+async function countTenantRowsByHome(eng2, ws, homeKeys) {
+  const keySet = new Set(homeKeys);
+  const tagOf = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
+  const out = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) out.set(hk, 0);
+  for (const type of tenantTypes(eng2)) {
+    for (const r of query(eng2, ws, "aggregatesByType", JSON.stringify({ __type: type }))) {
+      const id = String(r.id || "");
+      const hk = keySet.has(id) ? id : tagOf.get(routeTagHexOfMintedId(id) ?? "");
+      if (hk !== void 0) out.set(hk, (out.get(hk) ?? 0) + 1);
+    }
+  }
+  return out;
+}
+async function collectHomedIntents(eng2, ws, homeKeys) {
+  const routes = directiveRoutes(eng2);
+  const tagOf = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
+  const keySet = new Set(homeKeys);
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng2, gitdir, head) : [];
+  const docs = [];
+  const strikeParity = /* @__PURE__ */ new Map();
+  for (const c of commits) {
+    let doc = null;
+    try {
+      const blob = bytesFromB64(c.intentB64);
+      doc = JSON.parse(dec3.decode(blob));
+      docs.push({ oid: c.oid, blob, doc });
+    } catch {
+      continue;
+    }
+    for (const target of doc && Array.isArray(doc.strikes) ? doc.strikes : []) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    if (!id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
+    const dom = doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
+    const dirId = doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
+    const route = dom && dirId ? routes.get(`${dom} ${dirId}`) : null;
+    if (!route) continue;
+    const value = doc.payload.payload ? doc.payload.payload[route.key] : void 0;
+    if (typeof value !== "string" || !value) continue;
+    let homeKey = null;
+    if (route.via === "axis") homeKey = keySet.has(value) ? value : null;
+    else {
+      const tag = routeTagHexOfMintedId(value);
+      homeKey = tag !== void 0 ? tagOf.get(tag) ?? null : null;
+    }
+    if (homeKey !== null) out.push({ oid, id, homeKey, blob });
+  }
+  return out;
+}
+async function migrateHomes(eng2, ws, ledger, sourceWs, homeKeys, { onlyIds = null } = {}) {
+  const wanted = onlyIds ? new Set(onlyIds) : null;
+  const homed = await collectHomedIntents(eng2, sourceWs, homeKeys);
+  const main = await mainIntentIds(eng2, ws);
+  const migrated = [], skipped = [], refused = [];
+  for (const e of homed) {
+    if (wanted && !wanted.has(e.id)) continue;
+    if (main.ids.has(e.id)) {
+      skipped.push(e.id);
+      continue;
+    }
+    const res = offerAdmit(eng2, ws, e.blob);
+    if (res.ok) {
+      main.ids.add(e.id);
+      main.oids.add(res.head);
+      main.head = res.head;
+      migrated.push(e.id);
+    } else {
+      refused.push({ intentId: e.id, oid: e.oid.slice(0, 10), error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  if (migrated.length) await commitAndPush(eng2, ws, ledger);
+  log("migrate-homes", { ws, from: sourceWs, migrated: migrated.length, skipped: skipped.length, refused: refused.length });
+  return { migrated, skipped, refused };
+}
+async function sealHomes(eng2, ws, ledger, { domain, lawHash, homeKeys, target, migratedIds, sealedAt }) {
+  const have = new Set(migratedIds);
+  const homed = await collectHomedIntents(eng2, ws, homeKeys);
+  const missing = homed.filter((e) => !have.has(e.id)).map((e) => e.id);
+  if (missing.length) return { ok: false, missing };
+  const ids = homed.map((e) => e.id);
+  const CHUNK = 1024;
+  let head = null, struck = 0;
+  for (let i = 0; i < Math.max(1, Math.ceil(ids.length / CHUNK)); i++) {
+    const intentIds = ids.slice(i * CHUNK, (i + 1) * CHUNK);
+    const res = author(eng2, ws, domain, "nomosSealHome", { homeKeys: [...homeKeys], target, intentIds, sealedAt }, lawHash, { rngDraws: 8 });
+    if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused the seal").slice(0, 400) };
+    head = res.head;
+    struck += intentIds.length;
+  }
+  await commitAndPush(eng2, ws, ledger);
+  log("seal-homes", { ws, target, homes: homeKeys.length, struck, head });
+  return { ok: true, head, struck };
+}
+async function summaryCloseAgainstHeld(eng2, ws, heldRows, heldFrontier) {
+  const head = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+  if (!head) return { ok: false, error: "no local main to close against" };
+  if (head === heldFrontier) return { ok: true, upToDate: true, head };
+  const subtotals = [];
+  const deltas = [];
+  const heldHomes = heldRows.map((row) => row.data || row).filter((d) => d.readId === NOMOS_SHARD_ROWS_READ && typeof d.group === "string" && d.group !== "").map((d) => d.group);
+  const byHome = heldHomes.length ? await countTenantRowsByHome(eng2, ws, heldHomes) : /* @__PURE__ */ new Map();
+  for (const row of heldRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    const group = typeof d.group === "string" ? d.group : "";
+    if (d.kind === "min" || d.kind === "max") {
+      const heldVal = d.empty === 1 || typeof d.value !== "number" ? null : d.value;
+      const nowVal = extremum(eng2, ws, d.readId, d.kind, group).value;
+      if (nowVal === heldVal) continue;
+      subtotals.push({ readId: d.readId, group, kind: d.kind, prev: heldVal, value: nowVal, rederived: true });
+      deltas.push({ readId: d.readId, group, delta: nowVal });
+      continue;
+    }
+    const held = typeof d.value === "number" ? d.value : 0;
+    let now;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) now = group === "" ? countTenantRows(eng2, ws) : byHome.get(group) ?? 0;
+    else if (d.kind === "sum") now = sum(eng2, ws, d.readId, group).sum;
+    else now = count(eng2, ws, d.readId, group).count;
+    if (now === held) continue;
+    subtotals.push({ readId: d.readId, group, kind: d.kind === "sum" || d.kind === "rows" ? d.kind : "count", prev: held, value: now });
+    deltas.push({ readId: d.readId, group, delta: now - held });
+  }
+  if (subtotals.length === 0) return { ok: true, frontierOnly: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: heldFrontier || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+      events: [{ oid: head, intentId: "", deltas }]
+    }
+  };
+}
+async function collectGlobalIntents(eng2, ws) {
+  const globals = globalAggregates(eng2);
+  if (globals.size === 0) return [];
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng2, gitdir, head) : [];
+  const typeOf = /* @__PURE__ */ new Map();
+  const strikeParity = /* @__PURE__ */ new Map();
+  const docs = [];
+  for (const c of commits) {
+    let blob = null, doc = null;
+    try {
+      blob = bytesFromB64(c.intentB64);
+      doc = JSON.parse(dec3.decode(blob));
+    } catch {
+      continue;
+    }
+    docs.push({ oid: c.oid, blob, doc });
+    for (const target of doc && Array.isArray(doc.strikes) ? doc.strikes : []) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    let touches = false;
+    for (const ev of parseIntentEvents(blob)) {
+      const newType = ev.sets.get("__type");
+      if (newType !== void 0 && !typeOf.has(ev.aggregate)) typeOf.set(ev.aggregate, newType);
+      const t = newType ?? typeOf.get(ev.aggregate);
+      if (t !== void 0 && globals.has(t)) touches = true;
+    }
+    if (!touches || !id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
+    out.push({ oid, id, blob });
+  }
+  return out;
+}
+async function replicateIntents(eng2, ws, ledger, intents, { push = true } = {}) {
+  const main = await mainIntentIds(eng2, ws);
+  const replicated = [], skipped = [], refused = [];
+  for (const e of intents) {
+    if (e.id && main.ids.has(e.id)) {
+      skipped.push(e.id);
+      continue;
+    }
+    const res = offerAdmit(eng2, ws, e.blob);
+    if (res.ok) {
+      if (e.id) main.ids.add(e.id);
+      main.oids.add(res.head);
+      main.head = res.head;
+      replicated.push(e.id || res.head);
+    } else {
+      refused.push({ intentId: e.id || "", error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  if (replicated.length && push) await commitAndPush(eng2, ws, ledger);
+  log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
+  return { replicated, skipped, refused };
+}
+async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
+  const main = await mainIntentIds(eng2, ws);
+  const sessions = /* @__PURE__ */ new Map();
+  const deadLetters = [];
+  let admittedTotal = 0;
+  const born = [];
+  const birthOutcomes = [];
+  const timings = { spans: [], intents: 0, sessions: 0 };
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng2).length > 0 ? { reads: scopedReads(eng2), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng2, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const gitdir0 = gitdirOf(ws);
+  const headBefore = summaryCtx ? kgit.resolveRef(eng2, gitdir0, BRANCH) : null;
+  const t0 = Date.now();
+  let seq = 0;
+  const span = (name, kind, depth = 1, extra = {}) => {
+    const s0 = Date.now();
+    return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
+  };
+  for (const offer of Array.isArray(offers) ? offers : []) {
+    const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
+    const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
+    sessions.set(cid, rec);
+    const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
+    let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+    try {
+      if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
+      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+        continue;
+      }
+      let doc = null;
+      try {
+        doc = JSON.parse(dec3.decode(blob));
+      } catch {
+      }
+      const intentId = typeof doc?.id === "string" ? doc.id : null;
+      const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
+      const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
+      const oid = String(offer?.oid || intentId || "").slice(0, 10);
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent \u2014 governance enters its own admin lane" });
+        continue;
+      }
+      if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+        const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+        continue;
+      }
+      if (intentId && main.ids.has(intentId)) {
+        rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
+        continue;
+      }
+      const cap = summaryCtx ? beginSummaryCapture(eng2, ws, summaryCtx, blob) : null;
+      const _tOffer = Date.now();
+      const res = offerAdmit(eng2, ws, blob, { defer: false });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: false, ok: res.ok });
+      if (res.ok) {
+        if (intentId) main.ids.add(intentId);
+        main.oids.add(res.head);
+        main.head = res.head;
+        rec.admitted.push({ oid, head: res.head });
+        admittedTotal += 1;
+        if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
+        if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
+        if (cap) finishSummaryCapture(eng2, ws, summaryCtx, cap, res.head ?? "", intentId);
+      } else {
+        const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+      }
+    } catch (e) {
+      rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
+    } finally {
+      done();
+    }
+  }
+  timings.sessions = sessions.size;
+  timings.intents = admittedTotal;
+  if (deadLetters.length) {
+    try {
+      await materializeRefused(eng2, ws, ledger, deadLetters);
+    } catch (e) {
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  if (admittedTotal) {
+    const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
+    await commitAndPush(eng2, ws, ledger);
+    sealDone();
+  }
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng2, gitdir, BRANCH) ?? main.head;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng2, ws, clientBase ?? "");
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch {
+    }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  const bornPacked = born.length ? packBornChildren(eng2, born) : born;
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+}
+async function checkpointStateHash(eng2, ws) {
+  const rows = query(eng2, ws, "aggregatesByType", JSON.stringify({ __type: "NomosSummarySubtotal" }));
+  const canon = rows.map((r) => {
+    const d = r.data || {};
+    return { id: r.id, readId: d.readId, group: d.group, shard: d.shard, kind: d.kind, value: d.value, frontier: d.frontier };
+  }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  return sha256hex(JSON.stringify(canon));
+}
+async function authorOn(eng2, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountWorkspace(eng2, ws, ledger);
+  let res;
+  try {
+    res = author(eng2, ws, domain, directiveId, payload, lawHash, opts);
+  } catch (e) {
+    return { ok: false, error: String(e?.message || e).slice(0, 500) };
+  }
+  if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
+  await commitAndPush(eng2, ws, ledger);
+  const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng2, res.born) : res.born;
+  return { ok: true, head: res.head, born: bornPacked ?? [], birthOutcomes: res.birthOutcomes ?? [] };
+}
+async function deepVerifyShard(eng2, shardWs, shardLedger, coordinatorRows) {
+  const replay = await verifyChain(eng2, shardWs, shardLedger);
+  if (!replay.valid) {
+    return { verdict: `invalid:${replay.check || "replay"}`, replay, checks: [] };
+  }
+  await mountWorkspace(eng2, shardWs, shardLedger);
+  const checks = [];
+  let allMatch = true;
+  const heldHomes = coordinatorRows.map((row) => row.data || row).filter((d) => d.readId === NOMOS_SHARD_ROWS_READ && typeof d.group === "string" && d.group !== "").map((d) => d.group);
+  const byHome = heldHomes.length ? await countTenantRowsByHome(eng2, shardWs, heldHomes) : /* @__PURE__ */ new Map();
+  for (const row of coordinatorRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    const group = d.group ?? "";
+    if (d.kind === "min" || d.kind === "max") {
+      const heldVal = d.empty === 1 || typeof d.value !== "number" ? null : d.value;
+      const recomputed2 = extremum(eng2, shardWs, d.readId, d.kind, group).value;
+      const match2 = recomputed2 === heldVal;
+      if (!match2) allMatch = false;
+      checks.push({ readId: d.readId, group, kind: d.kind, coordinator: heldVal, shard: recomputed2, match: match2 });
+      continue;
+    }
+    let recomputed;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) {
+      recomputed = group === "" ? countTenantRows(eng2, shardWs) : byHome.get(group) ?? 0;
+    } else if (d.kind === "sum") {
+      recomputed = sum(eng2, shardWs, d.readId, group).sum;
+    } else {
+      recomputed = count(eng2, shardWs, d.readId, group).count;
+    }
+    const match = recomputed === d.value;
+    if (!match) allMatch = false;
+    checks.push({ readId: d.readId, group, coordinator: d.value, shard: recomputed, match });
+  }
+  const head = kgit.resolveRef(eng2, gitdirOf(shardWs), BRANCH);
+  return {
+    verdict: allMatch ? "verified" : "mismatch",
+    head,
+    intents: replay.intents,
+    plansRerun: replay.plansRerun,
+    checks
+  };
+}
+function stageWorkspaceDir(eng2, ws) {
+  const wsContents = /* @__PURE__ */ new Map();
+  dirOf(eng2.preopen.dir.contents.get("ws")).contents.set(ws, new Directory(wsContents));
+}
+async function mountWorkspace(eng2, ws, ledger) {
+  if (eng2.mounted.has(ws)) return eng2.mounted.get(ws);
+  stageWorkspaceDir(eng2, ws);
+  const gitdir = gitdirOf(ws);
+  let restored = false, remoteMain = null, restoreError = null;
+  try {
+    await custodySkeleton(eng2, gitdir);
+    remoteMain = await custodyFetch(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+    if (remoteMain) {
+      kgit.writeRef(eng2, gitdir, "HEAD", "ref: refs/heads/main");
+      restored = true;
+    }
+  } catch (e) {
+    restoreError = String(e?.stack || e).split("\n").slice(0, 5).join(" | ");
+  }
+  const m = { restored, remoteMain, restoreError };
+  eng2.mounted.set(ws, m);
+  return m;
+}
+function assertAuthored(res, what) {
+  if (!res || res.ok === false) throw new Error(`${what}: ${String(res && res.error || "law refused the intent").slice(0, 500)}`);
+  return res;
+}
+async function mountEphemeralWorkspace(eng2, ws, { domainHash = "", packageUsda = "" } = {}) {
+  let m = eng2.mounted.get(ws);
+  if (!m) {
+    stageWorkspaceDir(eng2, ws);
+    m = { restored: false, remoteMain: null, restoreError: null, ephemeral: true };
+    eng2.mounted.set(ws, m);
+  }
+  if (!nomosActive(eng2, ws)) {
+    assertAuthored(
+      author(eng2, ws, "bootstrap", "installDomain", installPayload(eng2.hashes.nomos, eng2.nomosPkg, eng2.installedBy), "", { deferProjection: false, rngDraws: 8 }),
+      `ephemeral workspace '${ws}' bootstrap`
+    );
+  }
+  if (domainHash && packageUsda && qById(eng2, ws, `domain-installation:${domainHash}`).length === 0) {
+    assertAuthored(
+      author(eng2, ws, "nomos", "installDomain", installPayload(domainHash, packageUsda, eng2.installedBy), eng2.hashes.nomos, { deferProjection: false, rngDraws: 8 }),
+      `ephemeral workspace '${ws}' installDomain(${domainHash.slice(0, 12)})`
+    );
+  }
+  return m;
+}
+async function authorEphemeral(eng2, ws, mountOpts, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountEphemeralWorkspace(eng2, ws, mountOpts);
+  return author(eng2, ws, domain, directiveId, payload, lawHash, { deferProjection: false, ...opts });
+}
+async function queryEphemeral(eng2, ws, mountOpts, queryId, paramsJson, principal = "", keys = []) {
+  await mountEphemeralWorkspace(eng2, ws, mountOpts);
+  return query(eng2, ws, queryId, paramsJson, principal, keys);
+}
+function unmount(eng2, ws) {
+  eng2.mounted.delete(ws);
+  eng2.mainIntents.delete(ws);
+  const wsRoot = dirOf(eng2.preopen.dir.contents.get("ws"));
+  if (wsRoot) wsRoot.contents.delete(ws);
+}
+function writeWork(eng2, name, bytes) {
+  eng2.preopen.dir.contents.set(name, new File(bytes));
+}
+function currentLaw(eng2, ws) {
+  const out = JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "currentLaw" }), branch: BRANCH }, eng2.STDERR));
+  return out.keyMap || {};
+}
+function installedLaw(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng2.STDERR));
+}
+function kernelStamp(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    queryBytes: b64Json({ op: "kernelStamp" }),
+    branch: BRANCH
+  }, eng2.STDERR));
+}
+function domainPackage(eng2, ws, hash) {
+  return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng2.STDERR));
+}
+function declaredCapabilities(eng2, ws) {
+  const out = JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "declaredCapabilities" }), branch: BRANCH }, eng2.STDERR));
+  return out.capabilities || [];
+}
+function reactorScan(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "outbox", { repoArg: repoArgOf(ws), branch: BRANCH }, eng2.STDERR));
+}
+function evolveDryRun(eng2, ws, usda, domainHash, dispositions = null) {
+  const r = author(eng2, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng2.installedBy, dispositions), eng2.hashes.nomos, { dryRun: true, deferProjection: false });
+  return r.ok ? { admits: true } : { admits: false, detail: r.error };
+}
+function mintId(eng2, typeTag) {
+  return JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "mint", typeTag, nowMillis: Date.now() }) }, eng2.STDERR)).id;
+}
+function author(eng2, ws, domain, directiveId, payload, controllerHash, opts = {}) {
+  const seq = eng2.seq++;
+  const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng2.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  if (opts.__nomosConflictSnapshots !== void 0 && opts.__nomosConflictSnapshots.length > 0) {
+    capPorts.conflict_snapshots = opts.__nomosConflictSnapshots;
+  }
+  if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
+  if (opts.principalVerified !== void 0) {
+    capPorts.principal = opts.actor ?? "";
+    capPorts.principal_verified = !!opts.principalVerified;
+  }
+  const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
+  writeWork(eng2, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
+  writeWork(eng2, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+  const genesis = !controllerHash;
+  const attestorSecretFor = (from) => {
+    const s = opts.attestorSecrets;
+    if (!s) return null;
+    if (typeof s === "string") return s;
+    return typeof s[from] === "string" ? s[from] : null;
+  };
+  const defer = opts.deferProjection !== false;
+  const offerOnce = () => JSON.parse(call(eng2.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.spans ? { spans: true } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng2.STDERR));
+  let v = offerOnce();
+  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
+    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
+    if (!need || !eng2.mounted.has(need.from)) break;
+    const secret = attestorSecretFor(need.from);
+    if (!secret) break;
+    const served = attestedRead(eng2, need.from, {
+      queryId: need.queryId,
+      paramsJson: JSON.stringify(need.args),
+      attestorSecret: secret,
+      nowMs: opts.attestNowMs ?? Date.now(),
+      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
+      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
+      includeRosterProof: true
+    });
+    if (!served || served.ok !== true) break;
+    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
+    writeWork(eng2, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+    v = offerOnce();
+  }
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, born: v.born ?? [], birthOutcomes: v.birthOutcomes ?? [], ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  if (defer && res.ok) (eng2.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  return res;
+}
+function materializeGenesis(eng2, ws, genesisChain, opts = {}) {
+  return JSON.parse(call(eng2.ex, "materialize_genesis", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    genesisChain,
+    clockMs: opts.clockMs ?? 17e11,
+    replica: eng2.replica,
+    rngSeed: opts.rngSeed ?? 1,
+    branch: BRANCH
+  }, eng2.STDERR));
+}
+function setTestKRoot(eng2, kRootPublicB64) {
+  return JSON.parse(call(eng2.ex, "set_test_k_root", { kRootPublicB64 }, eng2.STDERR));
+}
+function refreshProjection(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "refresh" }), branch: BRANCH }, eng2.STDERR));
+}
+function flushDeferredProjections(eng2) {
+  for (const ws of eng2.pendingProjection ?? []) {
+    const _t = Date.now();
+    try {
+      refreshProjection(eng2, ws);
+    } catch {
+    }
+    log("flush-projection-ms", { ws, ms: Date.now() - _t });
+  }
+  if (eng2.pendingProjection) eng2.pendingProjection.clear();
+}
+function exportCheckpoint(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "checkpoint_export", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng2.STDERR));
+}
+function importCheckpoint(eng2, ws, blobB64, frontierB64, stateRoot) {
+  return JSON.parse(call(eng2.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64, ...frontierB64 ? { frontier: frontierB64 } : {}, ...stateRoot ? { stateRoot } : {} }, eng2.STDERR));
+}
+var CKPT_REF = (lawHash) => `refs/meta/checkpoint/${lawHash}`;
+async function streamAll(stream) {
+  const chunks = [];
+  const reader = stream.getReader();
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  let len = 0;
+  for (const c of chunks) len += c.length;
+  const out = new Uint8Array(len);
+  let at = 0;
+  for (const c of chunks) {
+    out.set(c, at);
+    at += c.length;
+  }
+  return out;
+}
+async function gzip(bytes) {
+  const cs = new CompressionStream("gzip");
+  return streamAll(new Response(bytes).body.pipeThrough(cs));
+}
+async function gunzip(bytes) {
+  const ds = new DecompressionStream("gzip");
+  return streamAll(new Response(bytes).body.pipeThrough(ds));
+}
+async function writeCheckpointObjects(eng2, ws, ex, lawHash) {
+  const gitdir = gitdirOf(ws);
+  const files = [];
+  let rawLen = 0, gzLen = 0;
+  if (ex.blob) {
+    const gz = await gzip(enc3.encode(ex.blob));
+    rawLen = ex.blob.length;
+    gzLen = gz.length;
+    files.push({ path: "checkpoint", bytes: gz });
+  }
+  let fgzLen = 0;
+  if (ex.frontier) {
+    const fgz = await gzip(enc3.encode(ex.frontier));
+    fgzLen = fgz.length;
+    files.push({ path: "frontier", bytes: fgz });
+  }
+  files.push({ path: "meta", bytes: enc3.encode(JSON.stringify({ cursor: ex.cursor, bytes: ex.bytes ?? 0, lawHash, codec: "gzip", raw: rawLen, stored: gzLen, frontierStored: fgzLen, ...ex.stateRoot ? { stateRoot: ex.stateRoot } : {} })) });
+  const ref = CKPT_REF(lawHash);
+  const commitOid = kgit.writeMetaCommit(eng2, gitdir, { parents: [], files, message: `checkpoint ${ws} @${String(ex.cursor).slice(0, 16)}`, timeSecs: 0, ref });
+  return { ref, commitOid };
+}
+async function readCheckpointBlob(eng2, ws, commitOid) {
+  const gitdir = gitdirOf(ws);
+  let codec = "gzip";
+  let stateRoot = null;
+  try {
+    const m = JSON.parse(dec3.decode(kgit.readBlob(eng2, gitdir, commitOid, "meta") ?? new Uint8Array()));
+    codec = m.codec ?? "gzip";
+    stateRoot = m.stateRoot ?? null;
+  } catch {
+  }
+  const dezip = async (b) => dec3.decode(codec === "gzip" ? await gunzip(b) : b);
+  let blob = null;
+  try {
+    const b = kgit.readBlob(eng2, gitdir, commitOid, "checkpoint");
+    if (b) blob = await dezip(b);
+  } catch {
+  }
+  let frontier = null;
+  try {
+    const f = kgit.readBlob(eng2, gitdir, commitOid, "frontier");
+    if (f) frontier = await dezip(f);
+  } catch {
+  }
+  return { blob, frontier, stateRoot };
+}
+async function lawParity(eng2, ws, lawHash) {
+  if (lawHash) return lawHash;
+  try {
+    const map = currentLaw(eng2, ws) || {};
+    return await sha256hex(JSON.stringify(Object.entries(map).sort()));
+  } catch {
+    return null;
+  }
+}
+async function pushCheckpoint(eng2, ws, ledger, lawHash) {
+  try {
+    lawHash = await lawParity(eng2, ws, lawHash) ?? "";
+    if (!lawHash) return { pushed: false, reason: "no-law" };
+    const gitdir = gitdirOf(ws);
+    const head = kgit.resolveRef(eng2, gitdir, "refs/heads/main");
+    eng2._ckptPushed ??= /* @__PURE__ */ new Map();
+    if (head && eng2._ckptPushed.get(ws) === `${lawHash}:${head}`) {
+      return { pushed: false, reason: "unchanged" };
+    }
+    const ex = exportCheckpoint(eng2, ws);
+    if (!ex || ex.empty || !ex.ok || !ex.blob) return { pushed: false, reason: ex && ex.empty ? "empty" : "no-blob" };
+    const tag = `${lawHash}:${ex.cursor}`;
+    if (eng2._ckptPushed.get(ws) === tag) return { pushed: false, reason: "unchanged" };
+    const { ref } = await writeCheckpointObjects(eng2, ws, ex, lawHash);
+    await custodyPush(eng2, ws, ledger, { remoteRef: ref });
+    eng2._ckptPushed.set(ws, tag);
+    return { pushed: true, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
+  } catch (e) {
+    return { pushed: false, reason: String(e?.message || e).slice(0, 160) };
+  }
+}
+async function stageCheckpoint(eng2, ws, lawHash) {
+  try {
+    lawHash = await lawParity(eng2, ws, lawHash) ?? "";
+    if (!lawHash) return null;
+    eng2._ckptPushed ??= /* @__PURE__ */ new Map();
+    const ex = exportCheckpoint(eng2, ws);
+    if (!ex || ex.empty || !ex.ok || !ex.blob) return null;
+    const tag = `${lawHash}:${ex.cursor}`;
+    if (eng2._ckptPushed.get(ws) === tag) return null;
+    const { ref } = await writeCheckpointObjects(eng2, ws, ex, lawHash);
+    return { ref, tag, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
+  } catch {
+    return null;
+  }
+}
+async function pushStagedCheckpoint(eng2, ws, ledger, staged) {
+  if (!staged || !staged.ref) return { pushed: false };
+  await custodyPush(eng2, ws, ledger, { remoteRef: staged.ref });
+  (eng2._ckptPushed ??= /* @__PURE__ */ new Map()).set(ws, staged.tag);
+  return { pushed: true, cursor: staged.cursor, bytes: staged.bytes };
+}
+async function clearCheckpointRefs(ledger) {
+  const headers = ledger.headers || {};
+  const refs = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: "refs/meta/checkpoint/" });
+  const deleted = [];
+  for (const ref of Object.keys(refs)) {
+    try {
+      await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref, oldOid: refs[ref], newOid: ZERO_OID }] }));
+      deleted.push(ref);
+    } catch {
+    }
+  }
+  return deleted;
+}
+async function restoreCheckpointFromCustody(eng2, ws, ledger, lawHash) {
+  try {
+    const mounted = eng2.mounted.get(ws);
+    if (mounted?.checkpoint?.restored) {
+      return { restored: false, reason: "already-mounted-checkpoint" };
+    }
+    lawHash = await lawParity(eng2, ws, lawHash) ?? "";
+    if (!lawHash) return { restored: false, reason: "no-law" };
+    const ref = CKPT_REF(lawHash);
+    const serverRefs = await custodyLsRefs(ledger, ref);
+    const foundOid = serverRefs[ref];
+    if (!foundOid) return { restored: false, reason: "absent" };
+    await custodyFetch(eng2, ws, ledger, { remoteRef: ref });
+    const { blob, frontier, stateRoot } = await readCheckpointBlob(eng2, ws, foundOid);
+    const r = importCheckpoint(eng2, ws, blob, frontier, stateRoot);
+    if (r && r.restored === true && r.cursor) {
+      eng2._ckptPushed ??= /* @__PURE__ */ new Map();
+      eng2._ckptPushed.set(ws, `${lawHash}:${r.cursor}`);
+    }
+    return { restored: r && r.restored === true, frontierSeeded: r && r.frontierSeeded === true, cursor: r && r.cursor, reason: r && r.reason };
+  } catch (e) {
+    return { restored: false, reason: String(e?.message || e).slice(0, 160) };
+  }
+}
+var pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
+var fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+var applyPackInto = (eng2, ws, pack) => {
+  if (!pack || !pack.length) return;
+  const r = JSON.parse(call(eng2.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng2.STDERR));
+  if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+};
+async function custodySkeleton(eng2, gitdir) {
+  const p = eng2.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
+    try {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+    }
+  }
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
+}
+var custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+async function custodyFetch(eng2, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) {
+    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    if (pk) applyPackInto(eng2, ws, pk);
+  }
+  kgit.writeRef(eng2, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+  const headers = ledger.headers || {};
+  const remoteRefFull = fullRef(remoteRef);
+  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  const oldOid = remote[remoteRefFull] || ZERO_OID;
+  if (del) {
+    if (oldOid === ZERO_OID) return;
+    return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: ZERO_OID }] }));
+  }
+  const tgt = newOid || kgit.resolveRef(eng2, gitdirOf(ws), fullRef(localRef || remoteRef));
+  if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
+  if (tgt === oldOid) return;
+  let pack = null;
+  if (!pointer) {
+    pack = oldOid !== ZERO_OID ? packDelta(eng2, ws, oldOid, tgt) : null;
+    if (!pack) pack = packDelta(eng2, ws, "", tgt);
+  }
+  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+}
+async function commitAndPush(eng2, ws, ledger) {
+  try {
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+  } catch (e) {
+    unmount(eng2, ws);
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
+  }
+}
+async function pushShape(eng2, ws, ledger) {
+  try {
+    const st = projectionStats(eng2, ws);
+    const bytes = st && (st.sqliteBytes ?? st.bytes);
+    if (bytes == null) return;
+    const gitdir = gitdirOf(ws);
+    const head = kgit.resolveRef(eng2, gitdir, "refs/heads/main");
+    if (!head) return;
+    const newRef = `refs/meta/shape/b${bytes}`;
+    eng2._lastShapeRef ??= /* @__PURE__ */ new Map();
+    if (eng2._lastShapeRef.get(ws) === newRef) return;
+    kgit.writeRef(eng2, gitdir, newRef, head);
+    await custodyPush(eng2, ws, ledger, { remoteRef: newRef, pointer: true });
+    const prev = eng2._lastShapeRef.get(ws);
+    if (prev && prev !== newRef) {
+      try {
+        await custodyPush(eng2, ws, ledger, { remoteRef: prev, del: true });
+      } catch {
+      }
+    }
+    eng2._lastShapeRef.set(ws, newRef);
+  } catch {
+  }
+}
+async function readShape(ledger) {
+  try {
+    const refs = await custodyLsRefs(ledger, "refs/meta/shape/");
+    let best = null;
+    for (const ref of Object.keys(refs)) {
+      const m = /refs\/meta\/shape\/b(\d+)$/.exec(ref);
+      if (m) {
+        const bytes = +m[1];
+        if (!best || bytes > best.bytes) best = { bytes };
+      }
+    }
+    return best;
+  } catch {
+    return null;
+  }
+}
+var qById = (eng2, ws, id, principal = "", keys = []) => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng2.STDERR));
+var query = (eng2, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng2.STDERR));
+var check = (eng2, ws, object, relation, subject) => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "check", object, relation, subject }), branch: BRANCH }, eng2.STDERR));
+var expand = (eng2, ws, object, relation) => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "expand", object, relation }), branch: BRANCH }, eng2.STDERR));
+var cryptoSealField = (eng2, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "cryptoSealField", scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) }, eng2.STDERR)).envelope;
+var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = "", requireSeat = true, record, recordEpoch = 0, recordWrap) => {
+  const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
+  const derived = JSON.parse(call(eng2.ex, "query", {
+    queryBytes: b64Json({
+      op: "cryptoOwnedScopeKey",
+      workspace: workspace2,
+      principal,
+      authorSecret,
+      scope,
+      ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+      ...recordWrap === void 0 ? {} : { recordWrap }
+    })
+  }, eng2.STDERR));
+  const ownedKeySubject = String(derived.ownedKeySubject || "");
+  if (!requireSeat) {
+    return {
+      scope: String(derived.scope || scope),
+      epoch: Number(derived.epoch) || 0,
+      key: String(derived.scopeKey || ""),
+      ownedKeySubject,
+      ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+      keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+      principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+    };
+  }
+  if (principal) {
+    let hex = "";
+    for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
+    const object = `nomos-owned-principal:${hex || "00"}`;
+    const rows = qById(eng2, workspace2, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+    const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
+    const leaves = row?.data?.subjects ?? row?.subjects ?? {};
+    const leaf = (raw) => {
+      if (raw && typeof raw === "object") return raw;
+      try {
+        return typeof raw === "string" ? JSON.parse(raw) : {};
+      } catch {
+        return {};
+      }
+    };
+    const active = Object.entries(leaves).filter(([, raw]) => leaf(raw).status === "active").map(([subject]) => subject);
+    if (active.length === 0 && Object.keys(leaves).length === 0) {
+      return {
+        scope: String(derived.scope || scope),
+        epoch: Number(derived.epoch) || 0,
+        key: String(derived.scopeKey || ""),
+        ownedKeySubject,
+        ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+        keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+        principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+      };
+    }
+    if (!active.includes(ownedKeySubject)) {
+      throw new Error(
+        "this device is waiting for approval \u2014 approve its opaque request on an already-working device"
+      );
+    }
+    const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
+    if (!custody) throw new Error("the approved device has no owned-data handoff");
+    const opened = JSON.parse(call(eng2.ex, "query", {
+      queryBytes: b64Json({
+        op: "cryptoOwnedScopeKey",
+        workspace: workspace2,
+        principal,
+        authorSecret,
+        scope,
+        ownedCustody: custody,
+        ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+        ...recordWrap === void 0 ? {} : { recordWrap }
+      })
+    }, eng2.STDERR));
+    return {
+      scope: String(opened.scope || scope),
+      epoch: Number(opened.epoch) || 0,
+      key: String(opened.scopeKey || ""),
+      ownedKeySubject,
+      keyCommitment: typeof opened.keyCommitment === "string" ? opened.keyCommitment : void 0,
+      principalWrappingPublic: typeof opened.principalWrappingPublic === "string" ? opened.principalWrappingPublic : void 0
+    };
+  }
+  return {
+    scope: String(derived.scope || scope),
+    epoch: Number(derived.epoch) || 0,
+    key: String(derived.scopeKey || ""),
+    ownedKeySubject,
+    ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+    keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+    principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+  };
+};
+var cryptoOwnedDeviceRequest = (eng2, workspace2, principal, authorSecret, scope) => String(JSON.parse(call(eng2.ex, "query", {
+  queryBytes: b64Json({ op: "cryptoOwnedDeviceRequest", workspace: workspace2, principal, authorSecret, scope })
+}, eng2.STDERR)).request || "");
+var cryptoOwnedPrepareApproval = (eng2, args) => JSON.parse(call(eng2.ex, "query", {
+  queryBytes: b64Json({ op: "cryptoOwnedPrepareApproval", ...args })
+}, eng2.STDERR));
+var cryptoOwnedPrepareRecovery = (eng2, args) => JSON.parse(call(eng2.ex, "query", {
+  queryBytes: b64Json({ op: "cryptoOwnedPrepareRecovery", ...args })
+}, eng2.STDERR));
+var cryptoKeygen = (eng2) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "cryptoKeygen" }) }, eng2.STDERR));
+var authorKeygen = (eng2) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng2.STDERR));
+var eraCertSign = (eng2, args) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "eraCertSign", ...args }) }, eng2.STDERR));
+var delegationCertSign = (eng2, { secret, grantorId, relation, subject, epoch, certChain }) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "delegationCertSign", secret, grantorId, relation, subject, epoch, ...certChain ? { certChain } : {} }) }, eng2.STDERR));
+function describe(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "describe", workspace: ws }), branch: BRANCH }, eng2.STDERR));
+}
+var attestationSign = (eng2, { secret, asserterWorkspace, object, relation, subject, attestedAt }) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "attestationSign", secret, asserterWorkspace, object, relation, subject, attestedAt }) }, eng2.STDERR));
+var attestedRead = (eng2, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng2.ex, "query", {
+  repoArg: repoArgOf(ws),
+  workspace: ws,
+  branch: BRANCH,
+  queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
+}, eng2.STDERR));
+function parseAttestedReadNeed(error) {
+  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
+  if (!m) return null;
+  let blob = m[3];
+  for (let i = 0; i < 4; i++) {
+    try {
+      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
+    } catch {
+      blob = blob.replace(/\\(["\\])/g, "$1");
+    }
+  }
+  return null;
+}
+var certSign = (eng2, {
+  child,
+  founder,
+  verified,
+  parentKey,
+  parentId,
+  epoch,
+  secret,
+  verifiedVia,
+  idpToken,
+  capturedClock,
+  authProviderIssuer,
+  authProviderJwks,
+  authProviderAudience
+}) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({
+  op: "certSign",
+  child,
+  founder,
+  verified,
+  parentKey,
+  parentId,
+  epoch,
+  secret,
+  // forwarded only when present (the op reads them optionally; absent ⇒ classic cert bytes).
+  ...verifiedVia !== void 0 ? { verifiedVia } : {},
+  ...idpToken !== void 0 ? { idpToken } : {},
+  ...capturedClock !== void 0 ? { capturedClock } : {},
+  ...authProviderIssuer !== void 0 ? { authProviderIssuer } : {},
+  ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
+  ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
+}) }, eng2.STDERR)).cert;
+var cryptoWrapKey = (eng2, { recipientPub, scopeKey }) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "cryptoWrapKey", recipientPub, scopeKey }) }, eng2.STDERR));
+var cryptoUnwrapKey = (eng2, { secret, hpkeEpk, ct }) => JSON.parse(call(eng2.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng2.STDERR)).scopeKey;
+var readPosture = (eng2, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng2.STDERR));
+var count = (eng2, ws, countId, groupKey, principal = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng2.STDERR));
+var sum = (eng2, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng2.STDERR));
+var pendingConflicts = (eng2, ws, principal = "", aggregateType = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts", aggregateType }), principal, branch: BRANCH }, eng2.STDERR));
+var pendingConflictSummary = (eng2, ws, principal = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflictSummary" }), principal, branch: BRANCH }, eng2.STDERR));
+var spatialBboxParams = (bbox) => {
+  const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
+  return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
+};
+var spatialWithin = (eng2, ws, spatialId, bbox, principal = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "spatial", spatialId, ...spatialBboxParams(bbox) }), principal, branch: BRANCH }, eng2.STDERR));
+var extremum = (eng2, ws, extremumId, kind, groupKey, principal = "") => JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "extremum", extremumId, kind, groupKey: groupKey ?? "" }), principal, branch: BRANCH }, eng2.STDERR));
+function packDelta(eng2, ws, base, head) {
+  try {
+    const r = JSON.parse(call(eng2.ex, "pack_delta", { repoArg: repoArgOf(ws), base, head }, eng2.STDERR));
+    if (!r || r.ok !== true || typeof r.packB64 !== "string") return null;
+    return Uint8Array.from(atob(r.packB64), (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+function servePack(eng2, ws, base = "") {
+  let head = null;
+  try {
+    head = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+  } catch {
+  }
+  let r;
+  try {
+    r = JSON.parse(call(eng2.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng2.STDERR));
+  } catch (e) {
+    const msg = String(e);
+    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+      try {
+        const full = JSON.parse(call(eng2.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng2.STDERR));
+        if (full && full.ok === true && typeof full.packB64 === "string") {
+          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
+        }
+      } catch {
+      }
+    }
+    throw e;
+  }
+  if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
+  return { packB64: r.packB64, bytes: r.bytes, ...head ? { head } : {} };
+}
+function packBornChildren(eng2, born) {
+  if (!Array.isArray(born) || !born.length) return born;
+  return born.map((b) => {
+    const child = b && typeof b.workspace === "string" ? b.workspace : null;
+    const head = b && typeof b.head === "string" ? b.head : null;
+    if (!child || !/^[0-9a-f]{40}$/i.test(head || "")) {
+      log("born-pack-skipped", { workspace: child, head, reason: "malformed born entry" });
+      return b;
+    }
+    try {
+      const pack = packDelta(eng2, child, "", head);
+      if (!pack || !pack.length) {
+        log("born-pack-empty", { workspace: child, head });
+        return b;
+      }
+      return { ...b, packB64: b64Bytes(pack), packBytes: pack.length };
+    } catch (e) {
+      log("born-pack-failed", { workspace: child, head, error: String(e).slice(0, 200) });
+      return b;
+    }
+  });
+}
+function reconcileBornPacks(eng2, children) {
+  const born = [];
+  const missing = [];
+  for (const child of Array.isArray(children) ? children : []) {
+    if (typeof child !== "string" || !child) continue;
+    const head = kgit.resolveRef(eng2, gitdirOf(child), BRANCH);
+    if (!head || !/^[0-9a-f]{40}$/i.test(head)) {
+      missing.push(child);
+      continue;
+    }
+    const pack = packDelta(eng2, child, "", head);
+    if (!pack || !pack.length) {
+      missing.push(child);
+      continue;
+    }
+    born.push({ workspace: child, head, packB64: b64Bytes(pack), packBytes: pack.length });
+  }
+  return { born, missing };
+}
+async function ingestPackAsCustody(eng2, ws, packBytes, head) {
+  if (!packBytes || !packBytes.length) throw new Error(`ingestPackAsCustody: empty pack for '${ws}'`);
+  if (!/^[0-9a-f]{40}$/i.test(head || "")) throw new Error(`ingestPackAsCustody: bad head '${head}' for '${ws}'`);
+  unmount(eng2, ws);
+  stageWorkspaceDir(eng2, ws);
+  const gitdir = gitdirOf(ws);
+  await custodySkeleton(eng2, gitdir);
+  applyPackInto(eng2, ws, packBytes);
+  kgit.writeRef(eng2, gitdir, "refs/heads/main", head);
+  kgit.writeRef(eng2, gitdir, "HEAD", "ref: refs/heads/main");
+  eng2.mounted.set(ws, { restored: true, remoteMain: head, restoreError: null });
+  return { ok: true, head: kgit.resolveRef(eng2, gitdir, "refs/heads/main") };
+}
+var nomosActive = (eng2, ws) => qById(eng2, ws, `domain-installation:${eng2.hashes.nomos}`).length > 0;
+function offerIntent(eng2, ws, bytes, opts = {}) {
+  const name = `offer-in-${eng2.seq++}.json`;
+  writeWork(eng2, name, bytes);
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  return JSON.parse(call(eng2.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng2.STDERR));
+}
+function offerAdmit(eng2, ws, bytes, opts = {}) {
+  const v = offerIntent(eng2, ws, bytes, opts);
+  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+function applyIntentBytes(eng2, ws, bytes, opts = {}) {
+  return offerAdmit(eng2, ws, bytes, opts);
+}
+async function mainIntentIds(eng2, ws) {
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  if (!head) return { head: null, ids: /* @__PURE__ */ new Set(), oids: /* @__PURE__ */ new Set() };
+  const cached = eng2.mainIntents.get(ws);
+  if (cached && cached.head === head) return cached;
+  const ids = /* @__PURE__ */ new Set(), oids = /* @__PURE__ */ new Set();
+  for (const c of kgit.intentsAbove(eng2, gitdir, head, "", 500)) {
+    oids.add(c.oid);
+    try {
+      const id = JSON.parse(dec3.decode(bytesFromB64(c.intentB64))).id;
+      if (typeof id === "string" && id) ids.add(id);
+    } catch {
+    }
+  }
+  const m = { head, ids, oids };
+  eng2.mainIntents.set(ws, m);
+  return m;
+}
+async function admitAll(eng2, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
+  const routes = shardRouting ? directiveRoutes(eng2) : null;
+  const gitdir = gitdirOf(ws);
+  const H = () => ({ ...ledger.headers || {} });
+  const _t0 = Date.now();
+  let _fetchMs = 0, _sealMs = 0, _intents = 0;
+  const _spans = [];
+  let _traceSeq = 0;
+  const _span = (name, kind, depth = 1, extra = {}) => {
+    const t0 = Date.now();
+    return (end = {}) => {
+      const t1 = Date.now();
+      _spans.push({ id: `admit-${_t0}-${_traceSeq++}`, track: "cloud", name, kind, depth, t0, t1, ...extra, ...end });
+    };
+  };
+  const sessionRefPrefix = "refs/heads/session/";
+  const sessions = {};
+  const _scanDone = _span("scan session refs", "cscan", 1);
+  for (const [ref, oid] of Object.entries(await custodyLsRefs(ledger, sessionRefPrefix))) {
+    if (ref.startsWith(sessionRefPrefix) && oid) sessions[ref.slice(sessionRefPrefix.length)] = oid;
+  }
+  _scanDone({ sessions: Object.keys(sessions).length });
+  const _scanMs = Date.now() - _t0;
+  const results = [], deadLetters = [], placements = [], splits = [], globalsOut = [];
+  const consumed = [];
+  let totalAdmitted = 0;
+  const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng2) : null;
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng2).length > 0 ? { reads: scopedReads(eng2), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  const canDeferProjection = !summaryCtx && !(globalsDeclared && globalsDeclared.size > 0);
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng2, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const headBefore = summaryCtx ? kgit.resolveRef(eng2, gitdir, BRANCH) : null;
+  for (const [cid, head] of Object.entries(sessions)) {
+    const ref = `refs/heads/session/${cid}`;
+    const shortCid = cid.length > 14 ? `${cid.slice(0, 14)}...` : cid;
+    const _sessionDone = _span(`session ${shortCid}`, "csession", 1, { client: cid });
+    try {
+      const _fetchDone = _span(`fetch ${shortCid}`, "cfetch", 2, { client: cid });
+      const _f = Date.now();
+      try {
+        const localMain = kgit.resolveRef(eng2, gitdir, BRANCH);
+        try {
+          await custodyFetch(eng2, ws, ledger, { remoteRef: ref, have: localMain });
+        } catch (thinErr) {
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr?.message || thinErr).slice(0, 160) });
+          await custodyFetch(eng2, ws, ledger, { remoteRef: ref, have: null });
+        }
+      } finally {
+        _fetchMs += Date.now() - _f;
+        _fetchDone();
+      }
+      const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
+      const main = await mainIntentIds(eng2, ws);
+      const recent = kgit.intentsAbove(eng2, gitdir, head ?? "", "", 100);
+      const chain = [];
+      for (let i = recent.length - 1; i >= 0; i--) {
+        if (main.oids.has(recent[i].oid)) break;
+        chain.push(recent[i]);
+      }
+      chain.reverse();
+      _walkDone({ intents: chain.length });
+      const admitted = [], rejected = [], skipped = [];
+      const _gateDone = _span(`gate+fold ${shortCid}`, "cgate", 2, { client: cid, intents: chain.length });
+      for (const c of chain) {
+        const oid = c.oid;
+        try {
+          const blob = bytesFromB64(c.intentB64);
+          let dom = null, intentId = null, dirId = null;
+          try {
+            const doc = JSON.parse(dec3.decode(blob));
+            intentId = typeof doc.id === "string" ? doc.id : null;
+            dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
+            dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
+          } catch {
+          }
+          if (!dom) {
+            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent \u2014 governance enters its own admin lane" });
+            continue;
+          }
+          if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+            const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+            continue;
+          }
+          if (routes && dom && dirId) {
+            if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
+              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' \u2014 the \xA76 handoff seals are authored by the adapter after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
+              continue;
+            }
+            const route = routes.get(`${dom} ${dirId}`);
+            if (route) {
+              let payloadObj = null;
+              try {
+                payloadObj = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+              } catch {
+              }
+              const verdict2 = await wrongHomeVerdict(shardRouting, route, payloadObj);
+              if (verdict2) {
+                rejected.push({ oid: oid.slice(0, 10), error: verdict2.error, ...verdict2.wrongHome ? { wrongHome: verdict2.wrongHome } : {}, ...verdict2.homeMoving ? { homeMoving: verdict2.homeMoving } : {}, ...verdict2.deadLettered ? { deadLettered: true } : {} });
+                if (verdict2.deadLettered) deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error: verdict2.error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+            }
+            if (dirId === "nomosReceiveAssignment" && shardRouting) {
+              let p = null;
+              try {
+                p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+              } catch {
+              }
+              const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
+              const rows = homeKey ? await shardRouting.assignments() || [] : [];
+              const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
+              if (!a) {
+                const error = `assignment receipt for home '${String(homeKey).slice(0, 80)}' has NO placement on the coordinator '${shardRouting.coordinatorWs}' \u2014 author the derived placement intent (birth<Type>) first, then POST /dead-letters/retry`;
+                rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+                deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+              if (a.shard !== shardRouting.selfLabel || p && p.shard !== shardRouting.selfLabel) {
+                const correct = `${shardRouting.coordinatorWs}--${a.shard}`;
+                rejected.push({
+                  oid: oid.slice(0, 10),
+                  error: `wrong-home: the coordinator's shard map assigns home '${homeKey.slice(0, 80)}' to '${correct}' (not this workspace) \u2014 a routed client re-routes and retries automatically`,
+                  wrongHome: { workspace: correct, ...a.mapVersion !== void 0 ? { mapVersion: a.mapVersion } : {} }
+                });
+                continue;
+              }
+            }
+          }
+          if (intentId && main.ids.has(intentId)) {
+            skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
+            continue;
+          }
+          const cap = summaryCtx ? beginSummaryCapture(eng2, ws, summaryCtx, blob) : null;
+          const verdict = offerIntent(eng2, ws, blob, { defer: canDeferProjection });
+          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.verdict?.reason ?? verdict.error ?? "the offer was refused" };
+          if (res.ok) {
+            main.ids.add(intentId);
+            main.oids.add(res.head);
+            main.head = res.head;
+            admitted.push({ oid: oid.slice(0, 10), head: res.head });
+            if (cap) finishSummaryCapture(eng2, ws, summaryCtx, cap, res.head ?? "", intentId);
+            if (shardRouting && dirId) {
+              const placement = placementDirectives(eng2).get(dirId);
+              if (placement) {
+                let p = null;
+                try {
+                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+                } catch {
+                }
+                const homeKey = p ? p[String(placement.keyField)] : void 0;
+                if (typeof homeKey === "string" && typeof p?.shard === "string") {
+                  placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
+                }
+              }
+              if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
+                let p = null;
+                try {
+                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+                } catch {
+                }
+                if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
+                  splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
+                }
+              }
+            }
+            if (globalsDeclared && globalsDeclared.size > 0) {
+              let touchesGlobal = false;
+              for (const ev of parseIntentEvents(blob)) {
+                const rows = qById(eng2, ws, ev.aggregate);
+                const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : void 0);
+                if (t !== void 0 && globalsDeclared.has(t)) {
+                  touchesGlobal = true;
+                  break;
+                }
+              }
+              if (touchesGlobal) globalsOut.push({ intentId: intentId || "", oid: oid.slice(0, 10), blob });
+            }
+          } else {
+            const wh = String(res.error || "").match(/wrong-home:(s\d+)/);
+            if (wh) {
+              const coordinator = shardRouting && shardRouting.coordinatorWs || (ws.match(/^(.*)--s\d+$/) || [])[1] || ws;
+              rejected.push({
+                oid: oid.slice(0, 10),
+                error: `wrong-home: this write's home is assigned to '${coordinator}--${wh[1]}' \u2014 the chain gate's homing invariant refused it; a routed client re-routes and retries automatically`,
+                wrongHome: { workspace: `${coordinator}--${wh[1]}` }
+              });
+              continue;
+            }
+            const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+          }
+        } catch (e) {
+          rejected.push({ oid: oid.slice(0, 10), error: String(e).slice(0, 200) });
+        }
+      }
+      _gateDone({ admitted: admitted.length, rejected: rejected.length, skipped: skipped.length });
+      _intents += admitted.length;
+      totalAdmitted += admitted.length;
+      consumed.push({ cid, ref });
+      results.push({ session: cid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+    } catch (e) {
+      results.push({ session: cid, error: String(e).slice(0, 200) });
+    } finally {
+      _sessionDone();
+    }
+  }
+  if (canDeferProjection && totalAdmitted) {
+    const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
+    try {
+      refreshProjection(eng2, ws);
+    } catch (e) {
+      log("admit-projection-flush-failed", { ws, error: String(e).slice(0, 200) });
+    } finally {
+      _projDone();
+    }
+  }
+  let unparkedSessions = /* @__PURE__ */ new Set();
+  if (deadLetters.length) {
+    try {
+      unparkedSessions = (await materializeRefused(eng2, ws, ledger, deadLetters)).unparkedSessions;
+    } catch (e) {
+      unparkedSessions = new Set(deadLetters.map((dl) => dl.session).filter(Boolean));
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const prunable = unparkedSessions.size ? consumed.filter((c) => !unparkedSessions.has(c.cid)) : consumed;
+  const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
+  const deferDurability = defer && !hasCoordination;
+  let _sealed = true;
+  if (totalAdmitted && !deferDurability) {
+    const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
+    const _s = Date.now();
+    try {
+      await commitAndPush(eng2, ws, ledger);
+    } catch (e) {
+      _sealed = false;
+      log("admit-batch-push-failed", { ws, sessions: consumed.length, admitted: totalAdmitted, error: String(e).slice(0, 200) });
+    } finally {
+      _sealMs += Date.now() - _s;
+      _sealDone();
+    }
+  }
+  if (_sealed && !deferDurability) {
+    for (const { ref } of prunable) {
+      try {
+        await custodyPush(eng2, ws, ledger, { remoteRef: ref, del: true });
+      } catch {
+      }
+    }
+  }
+  const newMain = kgit.resolveRef(eng2, gitdir, BRANCH);
+  log("admit", { ws, sessions: results.length, main: newMain });
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
+  const _total = Date.now() - _t0;
+  const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
+  return {
+    sessions: results,
+    main: newMain,
+    deadLetters,
+    timings,
+    ...summary ? { summary } : {},
+    ...placements.length ? { placements } : {},
+    ...splits.length ? { splits } : {},
+    ...globalsOut.length ? { globals: globalsOut } : {},
+    // The adapter's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
+    // un-backed-up commits and `consumed` are the session branches to delete AFTER the push lands.
+    ...deferDurability && totalAdmitted ? { deferred: true, consumed: prunable, admitted: totalAdmitted } : {}
+  };
+}
+async function backupHead(eng2, ws, ledger, head) {
+  if (!eng2.mounted.has(ws)) return { ok: false, error: "not mounted" };
+  if (!head) return { ok: false, error: "no head" };
+  try {
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    return { ok: true, head };
+  } catch (e) {
+    return { ok: false, error: String(e?.message || e).slice(0, 200), head };
+  }
+}
+async function backupToCustody(eng2, ws, ledger, { consumed = [] } = {}) {
+  if (!eng2.mounted.has(ws)) return { ok: false, error: "not mounted" };
+  const gitdir = gitdirOf(ws);
+  let head = null;
+  head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  if (!head) return { ok: false, error: "no local main" };
+  try {
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+  } catch (e) {
+    return { ok: false, error: String(e).slice(0, 200), head };
+  }
+  for (const { ref } of consumed) {
+    try {
+      await custodyPush(eng2, ws, ledger, { remoteRef: ref, del: true });
+    } catch {
+    }
+  }
+  return { ok: true, head };
+}
+async function verifyChain(eng2, ws, ledger) {
+  unmount(eng2, ws);
+  const m = await mountWorkspace(eng2, ws, ledger);
+  if (!m.restored) {
+    return { valid: false, check: "mount", error: m.restoreError || "no refs/heads/main on the ledger \u2014 nothing to verify (push refs/heads/main to deliver a chain first)" };
+  }
+  try {
+    return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng2.STDERR));
+  } finally {
+    unmount(eng2, ws);
+  }
+}
+function verifyChainLocal(eng2, ws) {
+  return JSON.parse(call(eng2.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng2.STDERR));
+}
+function historyPreflight(eng2, ws, domain, candidateHash, atHash, dispositions) {
+  return JSON.parse(call(eng2.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    branch: BRANCH,
+    queryBytes: b64Json({
+      op: "historyPreflight",
+      domain,
+      candidateHash,
+      atHash,
+      ...dispositions ? { dispositions } : {}
+    })
+  }, eng2.STDERR));
+}
+function historyRestorePreflight(eng2, ws, domain, currentHash, priorHash, atHash, actor) {
+  return JSON.parse(call(eng2.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    branch: BRANCH,
+    queryBytes: b64Json({
+      op: "historyPreflight",
+      domain,
+      candidateHash: priorHash,
+      atHash,
+      restorePreviousOf: currentHash,
+      ackBy: actor
+    })
+  }, eng2.STDERR));
+}
+function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng2.installedBy || "").trim();
+  if (!actingPrincipal && !opts.authToken) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "promotion needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const atHash = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+  if (!atHash) {
+    return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  }
+  let report;
+  try {
+    report = historyPreflight(eng2, ws, domain, candidateHash, atHash, opts.dispositions);
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedPromotion(report, candidateHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const {
+    replaces: _replaces,
+    retireReplaced: _retireReplaced,
+    dispositions: _dispositions,
+    acceptanceReason: _acceptance,
+    ...authorOpts
+  } = opts;
+  const result = author(eng2, ws, "nomos", "promoteDomain", prepared.payload, eng2.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "promoted", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
+function restorePreviousPreflighted(eng2, ws, domain, currentHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng2.installedBy || "").trim();
+  if (!actingPrincipal) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "model restoration needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const resolved = currentLaw(eng2, ws)[domain];
+  if (resolved !== currentHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "the generated model is no longer current; nothing changed [nomos.rollout.restore-current-changed]"
+    };
+  }
+  const current = qById(eng2, ws, `domain-installation:${currentHash}`)[0]?.data;
+  const priorHash = typeof current?.["spec.supersedes"] === "string" ? current["spec.supersedes"] : "";
+  if (!priorHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "this model has no previous model to restore [nomos.rollout.restore-no-previous]"
+    };
+  }
+  const atHash = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+  if (!atHash) return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  let report;
+  try {
+    report = historyRestorePreflight(
+      eng2,
+      ws,
+      domain,
+      currentHash,
+      priorHash,
+      atHash,
+      actingPrincipal
+    );
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedRestoration(report, currentHash, priorHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const { acceptanceReason: _acceptance, ...authorOpts } = opts;
+  const result = author(eng2, ws, "nomos", "rollbackDomain", prepared.payload, eng2.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "restored", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
+async function rebirthCompact(eng2, ws, ledger, { reason = "", supersededAt = 0, parent = "" } = {}) {
+  const incWs = `${ws}__rebirth`;
+  try {
+    if (!eng2.mounted.has(ws)) await mountWorkspace(eng2, ws, ledger || { remote: "https://unborn.invalid/", headers: {} });
+    const srcGitdir = gitdirOf(ws);
+    const oldHead = kgit.resolveRef(eng2, srcGitdir, BRANCH);
+    if (!/^[0-9a-f]{40}$/i.test(oldHead || "")) return { ok: false, error: `'${ws}' has no refs/heads/main to rebirth \u2014 nothing to compact` };
+    const sealed = kgit.intentsAbove(eng2, srcGitdir, oldHead, "", 0);
+    if (!Array.isArray(sealed) || !sealed.length) return { ok: false, error: `'${ws}' main carries no intents to replay` };
+    unmount(eng2, incWs);
+    await mountEphemeralWorkspace(eng2, incWs, {});
+    const isGenesisBootstrapInstall = (c) => {
+      try {
+        const doc = JSON.parse(dec3.decode(bytesFromB64(c.intentB64)));
+        return doc?.payload?.domain === "bootstrap" && doc?.payload?.directiveId === "installDomain";
+      } catch {
+        return false;
+      }
+    };
+    const transformState = (sealedBytes, _ctx) => sealedBytes;
+    const carried = [];
+    const parkedIntents = [];
+    const parkedBlobs = [];
+    let idx = -1, lastCarriedIdx = -1, firstParkedIdx = -1;
+    for (const c of sealed) {
+      idx++;
+      if (isGenesisBootstrapInstall(c)) continue;
+      let bytes;
+      try {
+        bytes = transformState(bytesFromB64(c.intentB64), { oid: c.oid, incWs });
+      } catch {
+        parkedIntents.push({ oid: c.oid, reason: "undecodable intent blob" });
+        parkedBlobs.push(bytesFromB64(c.intentB64));
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+        continue;
+      }
+      const r = applyIntentBytes(eng2, incWs, bytes, { defer: false });
+      if (r && r.ok) {
+        carried.push(c.oid);
+        lastCarriedIdx = idx;
+      } else {
+        parkedIntents.push({ oid: c.oid, reason: String(r && r.error || "refused").slice(0, 200) });
+        parkedBlobs.push(bytes);
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+      }
+    }
+    const scarShape = parkedIntents.length === 0 ? "none" : firstParkedIdx > lastCarriedIdx ? "tail" : "mid-chain";
+    const incGitdir = gitdirOf(incWs);
+    const head = kgit.resolveRef(eng2, incGitdir, BRANCH);
+    if (!/^[0-9a-f]{40}$/i.test(head || "")) {
+      unmount(eng2, incWs);
+      return { ok: false, error: `the incarnation folded no intents (all ${sealed.length} refused \u2014 all parked-to-be, nothing to serve)`, parked: parkedIntents.length, parkedIntents };
+    }
+    const incChain = kgit.intentsAbove(eng2, incGitdir, head, "", 0);
+    const genesisOid = incChain.length ? incChain[0].oid : head;
+    let parkedRef = "";
+    let parkedTip = "";
+    if (parkedBlobs.length) {
+      parkedRef = `refs/heads/unreplayed/${supersededAt || Date.now()}`;
+      let parentOid = head;
+      for (let i = 0; i < parkedBlobs.length; i++) {
+        parentOid = kgit.writeMetaCommit(eng2, incGitdir, {
+          parents: [parentOid],
+          files: [{ path: "intent.json", bytes: parkedBlobs[i] }],
+          message: `unreplayed: ${parkedIntents[i].oid.slice(0, 12)} \u2014 ${parkedIntents[i].reason.slice(0, 120)}`,
+          timeSecs: 0,
+          ref: i === parkedBlobs.length - 1 ? parkedRef : ""
+        });
+      }
+      parkedTip = parentOid;
+    }
+    const verdict = verifyChainLocal(eng2, incWs);
+    const verified = verdict && verdict.valid === true;
+    let packB64 = "";
+    let parkedPackB64 = "";
+    if (verified) {
+      const pack = packDelta(eng2, incWs, "", head);
+      if (pack && pack.length) packB64 = b64Bytes(pack);
+      if (parkedTip) {
+        const ppack = packDelta(eng2, incWs, head, parkedTip);
+        if (ppack && ppack.length) parkedPackB64 = b64Bytes(ppack);
+        if (!parkedPackB64) {
+          unmount(eng2, incWs);
+          return { ok: false, error: "parked intents exist but produced no parked pack \u2014 refusing (parked work must never be lost)", parked: parkedIntents.length };
+        }
+      }
+    }
+    unmount(eng2, incWs);
+    if (verified && !packB64) return { ok: false, error: "the incarnation self-verified but produced no pack", verified: true };
+    return {
+      ok: true,
+      packB64,
+      head,
+      genesisOid,
+      verified,
+      ...verified ? {} : { verifyError: verdict && verdict.error || "verify_chain returned invalid" },
+      carried: carried.length,
+      parked: parkedIntents.length,
+      parkedIntents,
+      scarShape,
+      ...parkedTip ? { parkedRef, parkedTip, parkedPackB64 } : {},
+      // rebornFrom = the SUPERSEDED chain's genesis oid (the old ancestry the reborn holon descends
+      // from). Surfaced for the worker's status contract; NOT re-authored IN-CHAIN here (stamping it
+      // onto birthCloud would re-sign the record → the operator key, the CLI lane).
+      rebornFrom: sealed[0].oid,
+      parent,
+      reason,
+      supersededAt
+    };
+  } catch (e) {
+    try {
+      unmount(eng2, incWs);
+    } catch {
+    }
+    return { ok: false, error: String(e?.message || e).slice(0, 300) };
+  }
+}
+async function archiveRefusedMain(eng2, ws, ledger, label) {
+  unmount(eng2, ws);
+  const m = await mountWorkspace(eng2, ws, ledger);
+  if (!m.restored) {
+    unmount(eng2, ws);
+    return { archived: false, error: "no main to archive" };
+  }
+  const gitdir = gitdirOf(ws);
+  try {
+    await custodyPush(eng2, ws, ledger, { localRef: "refs/heads/main", remoteRef: `refs/heads/refused/${label}`, pointer: true });
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", del: true });
+    return { archived: true, ref: `refs/heads/refused/${label}` };
+  } finally {
+    unmount(eng2, ws);
+  }
+}
+var refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+async function writeRefusedRef(eng2, ws, dl) {
+  const gitdir = gitdirOf(ws);
+  const blob = dl.blob instanceof Uint8Array ? dl.blob : enc3.encode(String(dl.blob || ""));
+  const refForStamp = refusedRefName(dl.intentId || dl.oid);
+  let parkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const prevOid = kgit.resolveRef(eng2, gitdir, refForStamp);
+    if (prevOid) {
+      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng2, gitdir, prevOid, "verdict.json") ?? new Uint8Array()));
+      if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
+    }
+  } catch {
+  }
+  const verdict = enc3.encode(JSON.stringify({
+    offerId: dl.intentId || null,
+    oid: dl.oid || null,
+    domain: dl.domain || null,
+    directiveId: dl.directiveId || null,
+    session: dl.session || null,
+    parkedAt,
+    verdict: { reason: String(dl.error || "refused") }
+  }));
+  const ref = refusedRefName(dl.intentId || dl.oid);
+  kgit.writeMetaCommit(eng2, gitdir, {
+    parents: [],
+    files: [{ path: "intent.json", bytes: blob }, { path: "verdict.json", bytes: verdict }],
+    message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} \u2014 ${String(dl.error || "").slice(0, 120)}`,
+    timeSecs: 0,
+    ref
+  });
+  return ref;
+}
+async function listRefusedRefs(eng2, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng2, gitdir, "refs/heads/refused/");
+  const out = [];
+  for (const { ref, oid } of refs) {
+    try {
+      const vb = kgit.readBlob(eng2, gitdir, oid, "verdict.json") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng2, gitdir, oid, "intent.json") ?? new Uint8Array();
+      const v = JSON.parse(dec3.decode(vb));
+      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
+    } catch {
+    }
+  }
+  return out;
+}
+async function refusedSummary(eng2, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng2, gitdir, "refs/heads/refused/");
+  let count2 = 0, latestParkedAt = null;
+  for (const { oid } of refs) {
+    try {
+      const v = JSON.parse(dec3.decode(kgit.readBlob(eng2, gitdir, oid, "verdict.json") ?? new Uint8Array()));
+      count2++;
+      if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
+    } catch {
+    }
+  }
+  return { count: count2, latestParkedAt };
+}
+async function materializeRefused(eng2, ws, ledger, deadLetters) {
+  const refs = [];
+  const unparkedSessions = /* @__PURE__ */ new Set();
+  for (const dl of deadLetters || []) {
+    try {
+      const ref = await writeRefusedRef(eng2, ws, dl);
+      await custodyPush(eng2, ws, ledger, { remoteRef: ref });
+      refs.push(ref);
+    } catch (e) {
+      if (dl && dl.session) unparkedSessions.add(dl.session);
+      log("refused-ref-materialize-failed", { ws, intentId: dl?.intentId, error: String(e).slice(0, 200) });
+    }
+  }
+  return { refs, unparkedSessions };
+}
+async function deleteRefusedRef(eng2, ws, ledger, offerId) {
+  const gitdir = gitdirOf(ws);
+  const ref = refusedRefName(offerId);
+  try {
+    kgit.deleteRef(eng2, gitdir, ref);
+  } catch {
+  }
+  try {
+    await custodyPush(eng2, ws, ledger, { remoteRef: ref, del: true });
+  } catch (e) {
+    log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+  }
+  return ref;
+}
+var outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+async function outboxRefExists(eng2, ws, requestId) {
+  return !!kgit.resolveRef(eng2, gitdirOf(ws), outboxRefName(requestId));
+}
+async function writeOutboxRef(eng2, ws, rec) {
+  const gitdir = gitdirOf(ws);
+  const orderBlob = enc3.encode(JSON.stringify(rec.order ?? {}));
+  const delivery = enc3.encode(JSON.stringify({
+    requestId: rec.requestId || null,
+    capability: rec.capability || null,
+    url: rec.url || null,
+    status: rec.status || "delivered",
+    httpStatus: rec.httpStatus ?? null
+  }));
+  const ref = outboxRefName(rec.requestId);
+  kgit.writeMetaCommit(eng2, gitdir, {
+    parents: [],
+    files: [{ path: "order.json", bytes: orderBlob }, { path: "delivery.json", bytes: delivery }],
+    message: `outbox: ${rec.capability || "?"} \u2192 ${String(rec.url || "?").slice(0, 80)}`,
+    timeSecs: 0,
+    ref
+  });
+  return ref;
+}
+async function emitOutbox(eng2, ws, ledger) {
+  const orders = (() => {
+    try {
+      return reactorScan(eng2, ws);
+    } catch {
+      return [];
+    }
+  })();
+  if (!Array.isArray(orders) || orders.length === 0) return { delivered: [], skipped: 0, errors: 0 };
+  const byType = /* @__PURE__ */ new Map();
+  for (const c of declaredCapabilities(eng2, ws)) if (c && c.aggregateId) byType.set(c.aggregateId, c);
+  const gitdir = gitdirOf(ws);
+  const delivered = [];
+  let skipped = 0, errors = 0;
+  for (const order of orders) {
+    const cap = byType.get(order.taskType);
+    if (!cap || !cap.endpoint) {
+      skipped++;
+      continue;
+    }
+    if (await outboxRefExists(eng2, ws, order.requestId)) {
+      skipped++;
+      continue;
+    }
+    try {
+      const res = await fetch(cap.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-nomos-capability": cap.capability, "x-nomos-workspace": ws },
+        body: JSON.stringify({ capability: cap.capability, requestId: order.requestId, taskType: order.taskType, params: order.params, scheduledAt: order.scheduledAt, deadlineAt: order.deadlineAt }),
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (!res.ok) {
+        errors++;
+        log("outbox-deliver-non2xx", { ws, requestId: order.requestId, url: cap.endpoint, status: res.status });
+        continue;
+      }
+      const ref = await writeOutboxRef(eng2, ws, { requestId: order.requestId, capability: cap.capability, url: cap.endpoint, order, status: "delivered", httpStatus: res.status });
+      try {
+        await custodyPush(eng2, ws, ledger, { remoteRef: ref });
+      } catch (e) {
+        log("outbox-ref-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+      }
+      delivered.push(order.requestId);
+    } catch (e) {
+      errors++;
+      log("outbox-deliver-failed", { ws, requestId: order.requestId, url: cap.endpoint, error: String(e).slice(0, 200) });
+    }
+  }
+  if (delivered.length || errors) log("outbox", { ws, delivered: delivered.length, skipped, errors });
+  return { delivered, skipped, errors };
+}
+var GENESIS_WARRANT_ID = "genesis-warrant:self";
+var isWarranted = (eng2, ws) => qById(eng2, ws, GENESIS_WARRANT_ID).length > 0;
+async function boot(eng2, ws, ledger) {
+  const m = await mountWorkspace(eng2, ws, ledger);
+  if (nomosActive(eng2, ws)) {
+    if (ws !== "root" && !isWarranted(eng2, ws)) {
+      throw new Error(
+        `unwarranted-workspace: '${ws}' is booted but its genesis never landed a GenesisWarrant \u2014 an era-0 workspace is born ONLY by its parent's warranted+attested birth. This is a host-authored/legacy orphan and will not serve (author its birth on its parent to bring it into the holarchy lawfully).`
+      );
+    }
+    return { status: "already-initialized", head: m.remoteMain ?? void 0, controllerHash: eng2.hashes.nomos, rows: qById(eng2, ws, `domain-installation:${eng2.hashes.nomos}`), mount: m };
+  }
+  throw new Error(
+    `unborn-workspace: '${ws}' has no genesis and the host does not create workspaces \u2014 author its birth on its PARENT (birthChild/birthHome/an estate .births()); the parent's offer-effect materializes it in custody, then it serves from here. (root self-adopts via _ensureRootGenesis; this is not that path.)`
+  );
+}
+async function deploy(eng2, ws, ledger, usda, domainHash, dispositions, opts = {}) {
+  const existing = qById(eng2, ws, `domain-installation:${domainHash}`);
+  if (existing.length > 0) {
+    const phase = String(existing[0]?.data?.["status.phase"] ?? "");
+    return {
+      head: kgit.resolveRef(eng2, gitdirOf(ws), BRANCH),
+      installation: existing,
+      staged: phase === "Pending",
+      alreadyInstalled: true
+    };
+  }
+  const before = currentLaw(eng2, ws);
+  const tenantHashes = [...new Set(Object.values(before).filter(
+    (hash) => typeof hash === "string" && hash !== eng2.hashes.bootstrap && hash !== eng2.hashes.nomos
+  ))];
+  const upgrade = tenantHashes.length > 0;
+  let supersedes = opts.supersedes?.trim() || void 0;
+  if (supersedes !== void 0 && !tenantHashes.includes(supersedes)) {
+    throw new Error(
+      `deploy-predecessor-changed: the client named ${supersedes.slice(0, 12)}\u2026 as the current model, but this workspace no longer serves it. Refresh and deploy again; nothing was committed.`
+    );
+  }
+  if (upgrade && supersedes === void 0) {
+    if (tenantHashes.length === 1) supersedes = tenantHashes[0];
+    else {
+      throw new Error(
+        `deploy-predecessor-ambiguous: this workspace currently serves ${tenantHashes.length} business-model packages. Nomos will not guess which one this candidate follows; use the generated deploy client, which binds the candidate to the current model before staging. Nothing was committed.`
+      );
+    }
+  }
+  if (upgrade && dispositions && Object.keys(dispositions).length > 0) {
+    throw new Error(
+      "deploy-manual-evolution-refused: successor deployment no longer accepts caller-chosen schema dispositions. Schema evolution belongs to the candidate model's adoption proof; nothing was committed."
+    );
+  }
+  const directiveId = upgrade ? "stageDomain" : "installDomain";
+  const payload = upgrade ? stagePayload(domainHash, usda, eng2.installedBy, supersedes) : installPayload(domainHash, usda, eng2.installedBy, dispositions);
+  const result = author(eng2, ws, "nomos", directiveId, payload, eng2.hashes.nomos, {
+    actor: opts.actor ?? "",
+    ...opts.authToken ? { authToken: opts.authToken } : {},
+    ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}
+  });
+  if (result.ok === false) {
+    unmount(eng2, ws);
+    throw new Error(
+      `deploy-refused: ${upgrade ? "staging" : "installing"} ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
+  try {
+    const installation = qById(eng2, ws, `domain-installation:${domainHash}`);
+    if (upgrade) {
+      const phase = String(installation[0]?.data?.["status.phase"] ?? "");
+      if (phase !== "Pending") {
+        throw new Error(
+          `deploy-did-not-stage: candidate ${domainHash.slice(0, 12)}\u2026 admitted but its lifecycle phase is '${phase || "missing"}', not Pending. Custody was not pushed.`
+        );
+      }
+      const after = currentLaw(eng2, ws);
+      const moved = Object.entries(before).filter(([key, hash]) => after[key] !== hash);
+      if (moved.length > 0 || Object.values(after).includes(domainHash)) {
+        throw new Error(
+          `deploy-activated-candidate: staging ${domainHash.slice(0, 12)}\u2026 changed served law (${moved.map(([key]) => key).join(", ") || "candidate became current"}). Nomos refuses to persist an upgrade that bypassed model.adopt().`
+        );
+      }
+      await commitAndPush(eng2, ws, ledger);
+      return { head: result.head, installation, staged: true, supersedes };
+    }
+    const law = installedLaw(eng2, ws);
+    const installed = (law?.domains ?? []).find((row) => row?.domainHash === domainHash);
+    const keys = installed?.domainKeys ?? installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
+    if (keys.length > 0) {
+      const currentLaw3 = law?.currentLaw ?? {};
+      const stale = keys.filter((k) => currentLaw3[k] !== domainHash);
+      if (stale.length > 0) {
+        throw new Error(
+          `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw3[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+        );
+      }
+    }
+    await commitAndPush(eng2, ws, ledger);
+    return { head: result.head, installation, staged: false };
+  } catch (error) {
+    unmount(eng2, ws);
+    throw error;
+  }
+}
+function snapshot(eng2, ws) {
+  const wsDir = dirOf(eng2.preopen.dir.contents.get("ws")).contents.get(ws);
+  return serializeTree(wsDir);
+}
+function stats(eng2) {
+  return {
+    mounted: eng2.mounted.size,
+    wasmLinearMemMB: +(eng2.ex.memory.buffer.byteLength / 1048576).toFixed(1)
+  };
+}
+async function ledgerStats(eng2, ws, ledger = null) {
+  const gitdir = gitdirOf(ws);
+  let head = kgit.resolveRef(eng2, gitdir, BRANCH);
+  if (!head && ledger?.remote) {
+    try {
+      await custodySkeleton(eng2, gitdir);
+      const remoteMain = await custodyFetch(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+      if (!remoteMain) return { head: null, commits: 0 };
+      kgit.writeRef(eng2, gitdir, "HEAD", `ref: refs/heads/${BRANCH}`);
+      head = kgit.resolveRef(eng2, gitdir, BRANCH);
+      const mounted2 = eng2.mounted.get(ws);
+      if (mounted2) {
+        mounted2.restored = true;
+        mounted2.remoteMain = remoteMain;
+        mounted2.restoreError = null;
+      }
+    } catch {
+    }
+  }
+  if (!head) return { head: null, commits: 0 };
+  const mounted = eng2.mounted.get(ws);
+  if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
+  const commits = kgit.intentsAbove(eng2, gitdir, head).length;
+  const out = { head, commits };
+  if (mounted) mounted.ledgerStats = out;
+  return out;
+}
+async function countRemoteCommits(eng2, ledger) {
+  const head = (await custodyLsRefs(ledger, "refs/heads/main"))["refs/heads/main"] || null;
+  if (!head) return { head: null, commits: 0 };
+  const scratch = "__ledgercount__";
+  try {
+    stageWorkspaceDir(eng2, scratch);
+    await custodySkeleton(eng2, gitdirOf(scratch));
+    await custodyFetch(eng2, scratch, ledger, { remoteRef: "refs/heads/main" });
+    const commits = kgit.intentsAbove(eng2, gitdirOf(scratch), head).length;
+    return { head, commits };
+  } finally {
+    try {
+      dirOf(eng2.preopen.dir.contents.get("ws")).contents.delete(scratch);
+    } catch {
+    }
+  }
+}
+var projectionStats = (eng2, ws) => JSON.parse(call(eng2.ex, "query", ws ? { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "projectionStats" }), branch: BRANCH } : { queryBytes: b64Json({ op: "projectionStats" }) }, eng2.STDERR));
+function warmEngine(eng2) {
+  flushDeferredProjections(eng2);
+  return JSON.parse(call(eng2.ex, "query", { repoArg: "/work", workspace: "root", queryBytes: b64Json({ op: "warm" }), branch: BRANCH }, eng2.STDERR));
+}
+function sealAttestationBatches(eng2, ws, domain, controllerHash, opts = {}) {
+  const snap = JSON.parse(call(eng2.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    branch: BRANCH,
+    queryBytes: b64Json({ op: "attestationOpenBatch", repoArg: repoArgOf(ws), nowMs: opts.nowMs ?? Date.now(), unmounting: !!opts.unmounting })
+  }, eng2.STDERR));
+  const outcomes = [];
+  for (const b of snap.batches ?? []) {
+    if (b.leafCount === 0) continue;
+    if (!(b.shouldSeal || opts.force)) continue;
+    const payload = {
+      batchId: b.batchId,
+      batchRoot: b.batchRoot,
+      leafCount: b.leafCount,
+      leaves: b.leaves,
+      firstAt: b.firstAt,
+      lastAt: b.lastAt,
+      headAtSeal: b.headAtSeal,
+      foldRootAtSeal: b.foldRootAtSeal,
+      signerKeyHash: b.signerKeyHash
+    };
+    const r = author(eng2, ws, domain, "recordAttestationBatch", payload, controllerHash, {
+      actor: "workspace:read-attestor",
+      ...opts.authorOpts ?? {}
+    });
+    if (!r.ok) {
+      outcomes.push({ batchId: b.batchId, ok: false, error: r.error });
+      continue;
+    }
+    JSON.parse(call(eng2.ex, "query", {
+      repoArg: repoArgOf(ws),
+      workspace: ws,
+      branch: BRANCH,
+      queryBytes: b64Json({ op: "attestationBatchClear", batchId: b.batchId, leafCount: b.leafCount })
+    }, eng2.STDERR));
+    outcomes.push({ batchId: b.batchId, ok: true, leafCount: b.leafCount, intent: r.intentOut });
+  }
+  return outcomes;
+}
+
+// runner/offline-install.ts
+var HERE = dirname(fileURLToPath(import.meta.url));
+var engineModule = process.env["NOMOS_ADAPTER_ENGINE"] ? await import(process.env["NOMOS_ADAPTER_ENGINE"]) : engine_exports;
+var treeModule = process.env["NOMOS_ADAPTER_TREE"] ? await import(process.env["NOMOS_ADAPTER_TREE"]) : { serializeTree };
+var { createEngine: createEngine2, mountWorkspace: mountWorkspace2, author: author2, installPayload: installPayload2, authorKeygen: authorKeygen2, refreshProjection: refreshProjection2, currentLaw: currentLaw2, exportCheckpoint: exportCheckpoint2 } = engineModule;
+var { serializeTree: serializeTree2 } = treeModule;
+var die = (msg) => {
+  process.stderr.write(`offline-install: ${msg}
+`);
+  process.exit(1);
+};
+var sha256hex2 = async (s) => {
+  const b = typeof s === "string" ? new TextEncoder().encode(s) : s;
+  const h = await wc.subtle.digest("SHA-256", b);
+  return [...new Uint8Array(h)].map((x) => x.toString(16).padStart(2, "0")).join("");
+};
+var arg = (name) => {
+  const i = process.argv.indexOf(name);
+  return i >= 0 ? process.argv[i + 1] : void 0;
+};
+var deployPaths = (arg("--deploy") || "").split(",").map((s) => s.trim()).filter(Boolean);
+var workspace = arg("--workspace") || "test-ws";
+var outPath = arg("--out");
+var runtimeDir = arg("--runtime") || process.env["NOMOS_OFFLINE_RUNTIME"] || join2(homedir(), ".holon", "runtime");
+if (!deployPaths.length) die("no --deploy JSON path(s) given");
+if (!outPath) die("no --out snapshot path given");
+var CLOUD = (process.env["NOMOS_CLOUD"] || "https://nomos.captainapp.co.uk").replace(/\/+$/, "");
+var STALE_RUNTIME_HINT = "your cached kernel runtime may be stale \u2014 rm -rf ~/.holon/runtime and re-run (it re-fetches from the cloud)";
+var looksLikeStaleRuntime = (msg) => /\bbbox param\b|missing.*param|non-numeric|unknown (op|query op)|unsupported op|unexpected (field|key)|no such op/i.test(msg);
+await refreshRuntimeDir(CLOUD, runtimeDir, { log: (m) => process.stderr.write(m + "\n") });
+var wasmFile = join2(runtimeDir, "holon-testmint.wasm");
+var pkgsFile = join2(runtimeDir, "packages.json");
+if (!existsSync(wasmFile) || !existsSync(pkgsFile)) {
+  die(`test runtime cache missing at ${runtimeDir} (holon-testmint.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`);
+}
+var wasm = readFileSync(wasmFile);
+var pkgs = JSON.parse(readFileSync(pkgsFile, "utf8"));
+var wasmModule = await WebAssembly.compile(wasm);
+var replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
+var eng = await createEngine2({ wasmModule, bootstrapPkg: pkgs.bootstrap, nomosPkg: pkgs.nomos, replica, installedBy: "nomos-test-harness" });
+await mountWorkspace2(eng, workspace, { remote: "https://unborn.invalid/", headers: {} });
+var guarded = (fn) => {
+  try {
+    return fn();
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (looksLikeStaleRuntime(msg)) throw new Error(`${msg} \u2014 ${STALE_RUNTIME_HINT}`);
+    throw e;
+  }
+};
+var requireAdmission = (what, verdict) => {
+  const result = verdict;
+  if (result?.ok === true) return;
+  die(`${what} was refused by the candidate kernel: ${String(result?.error ?? "no admission verdict")}`);
+};
+requireAdmission(
+  "framework install",
+  guarded(() => author2(eng, workspace, "bootstrap", "installDomain", installPayload2(eng.hashes.nomos, eng.nomosPkg, "nomos-test-harness"), ""))
+);
+var lawHashes = [];
+var expectedDomainLaw = /* @__PURE__ */ new Map();
+for (const p of deployPaths) {
+  if (!existsSync(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
+  const deploy2 = JSON.parse(readFileSync(p, "utf8"));
+  const usda = deploy2.packageUsda;
+  if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
+  const lawHash = await sha256hex2(usda);
+  requireAdmission(
+    `application install from ${p}`,
+    guarded(() => author2(eng, workspace, "nomos", "installDomain", installPayload2(lawHash, usda, "nomos-test-harness"), eng.hashes.nomos))
+  );
+  lawHashes.push(lawHash);
+  for (const declared of deploy2?.summary?.domains ?? []) {
+    if (typeof declared?.domain === "string") expectedDomainLaw.set(declared.domain, lawHash);
+  }
+  process.stderr.write(`offline-install: installed ${p} (law ${lawHash.slice(0, 12)}\u2026)
+`);
+}
+var wsNode = eng.preopen.dir.contents.get("ws").contents.get(workspace);
+if (!wsNode) die(`internal: workspace tree '${workspace}' not found after install`);
+guarded(() => refreshProjection2(eng, workspace));
+var activeLaw = guarded(() => currentLaw2(eng, workspace));
+for (const [domain, expected] of expectedDomainLaw) {
+  if (activeLaw?.[domain] !== expected) {
+    die(`installed package did not become current for domain '${domain}': expected ${expected}, received ${activeLaw?.[domain] ?? "(none)"}`);
+  }
+}
+var treeBytes = serializeTree2(wsNode);
+var checkpoint = guarded(() => exportCheckpoint2(eng, workspace));
+var snapshotBytes = new TextEncoder().encode(JSON.stringify({
+  v: 2,
+  tree: Buffer.from(treeBytes).toString("base64"),
+  ckpt: typeof checkpoint?.blob === "string" ? checkpoint.blob : null,
+  frontier: typeof checkpoint?.frontier === "string" ? checkpoint.frontier : null,
+  cursor: checkpoint?.cursor ?? null,
+  syncedBase: null
+}));
+writeFileSync2(outPath, snapshotBytes);
+process.stderr.write(`offline-install: application-ready snapshot written (${snapshotBytes.length} bytes) \u2192 ${outPath}
+`);
+var harnessDevice = authorKeygen2(eng);
+process.stdout.write(JSON.stringify({ ok: true, snapshot: outPath, workspace, lawHashes, frameworkHash: eng.hashes.nomos, devicePublic: harnessDevice.public, deviceSecret: harnessDevice.secret }) + "\n");