@githolon/dsl 0.113.4 → 0.114.0

package/dart_types/lib/src/proto/nomos/kernel/v1/kernel.pb.dart

@@ -1989,6 +1989,7 @@ class OfferAdmitted extends $pb.GeneratedMessage {
     $core.String? installedLawHash,
     PlacementAdopted? placement,
     $core.bool? alreadyApplied,
+    OfferStateChange? stateChange,
   }) {
     final result = create();
     if (head != null) result.head = head;
@@ -2003,6 +2004,7 @@ class OfferAdmitted extends $pb.GeneratedMessage {
     if (installedLawHash != null) result.installedLawHash = installedLawHash;
     if (placement != null) result.placement = placement;
     if (alreadyApplied != null) result.alreadyApplied = alreadyApplied;
+    if (stateChange != null) result.stateChange = stateChange;
     return result;
   }
 
@@ -2038,6 +2040,8 @@ class OfferAdmitted extends $pb.GeneratedMessage {
     ..aOM<PlacementAdopted>(11, _omitFieldNames ? '' : 'placement',
         subBuilder: PlacementAdopted.create)
     ..aOB(12, _omitFieldNames ? '' : 'alreadyApplied')
+    ..aOM<OfferStateChange>(13, _omitFieldNames ? '' : 'stateChange',
+        subBuilder: OfferStateChange.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -2152,6 +2156,99 @@ class OfferAdmitted extends $pb.GeneratedMessage {
   $core.bool hasAlreadyApplied() => $_has(11);
   @$pb.TagNumber(12)
   void clearAlreadyApplied() => $_clearField(12);
+
+  /// What this offer changed in the workspace's current state, typed the way reads resolve it, so a
+  /// host can tell which declared reads the offer can change (CAP-760). Absent when the kernel cannot
+  /// say exactly; a host then treats every read as changed.
+  @$pb.TagNumber(13)
+  OfferStateChange get stateChange => $_getN(12);
+  @$pb.TagNumber(13)
+  set stateChange(OfferStateChange value) => $_setField(13, value);
+  @$pb.TagNumber(13)
+  $core.bool hasStateChange() => $_has(12);
+  @$pb.TagNumber(13)
+  void clearStateChange() => $_clearField(13);
+  @$pb.TagNumber(13)
+  OfferStateChange ensureStateChange() => $_ensure(12);
+}
+
+/// The aggregates one admitted offer changed, by the type a read resolves for each (its `__type`,
+/// else its id), between the head it was admitted on and the head it produced. Exact or wider,
+/// never narrower: every aggregate whose state differs between the two heads is counted.
+class OfferStateChange extends $pb.GeneratedMessage {
+  factory OfferStateChange({
+    $core.String? parentHead,
+    $core.Iterable<$core.String>? aggregateTypes,
+    $core.bool? archives,
+  }) {
+    final result = create();
+    if (parentHead != null) result.parentHead = parentHead;
+    if (aggregateTypes != null) result.aggregateTypes.addAll(aggregateTypes);
+    if (archives != null) result.archives = archives;
+    return result;
+  }
+
+  OfferStateChange._();
+
+  factory OfferStateChange.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory OfferStateChange.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'OfferStateChange',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'parentHead')
+    ..pPS(2, _omitFieldNames ? '' : 'aggregateTypes')
+    ..aOB(3, _omitFieldNames ? '' : 'archives')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OfferStateChange clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  OfferStateChange copyWith(void Function(OfferStateChange) updates) =>
+      super.copyWith((message) => updates(message as OfferStateChange))
+          as OfferStateChange;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static OfferStateChange create() => OfferStateChange._();
+  @$core.override
+  OfferStateChange createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static OfferStateChange getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<OfferStateChange>(create);
+  static OfferStateChange? _defaultInstance;
+
+  /// The head this offer was admitted on; OfferAdmitted.head is its child.
+  @$pb.TagNumber(1)
+  $core.String get parentHead => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set parentHead($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasParentHead() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearParentHead() => $_clearField(1);
+
+  /// Sorted, without duplicates.
+  @$pb.TagNumber(2)
+  $pb.PbList<$core.String> get aggregateTypes => $_getList(1);
+
+  /// An aggregate this offer changed may be absent (archived) at the new head.
+  @$pb.TagNumber(3)
+  $core.bool get archives => $_getBF(2);
+  @$pb.TagNumber(3)
+  set archives($core.bool value) => $_setBool(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasArchives() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearArchives() => $_clearField(3);
 }
 
 class OfferAggregateRef extends $pb.GeneratedMessage {
@@ -5318,6 +5415,7 @@ enum QueryResponse_Result {
   workspaceEffectReceipt,
   openApiDescription,
   installedLawDeclarations,
+  applicationResultDelta,
   notSet
 }
 
@@ -5346,6 +5444,10 @@ class QueryResponse extends $pb.GeneratedMessage {
     WorkspaceEffectReceiptResponse? workspaceEffectReceipt,
     OpenApiDescriptionResponse? openApiDescription,
     InstalledLawDeclarationsResponse? installedLawDeclarations,
+    ApplicationResultDelta? applicationResultDelta,
+    $core.String? resultFrontier,
+    FullResultReason? fullResultReason,
+    ReadDependencies? resultDependencies,
   }) {
     final result = create();
     if (value != null) result.value = value;
@@ -5385,6 +5487,12 @@ class QueryResponse extends $pb.GeneratedMessage {
       result.openApiDescription = openApiDescription;
     if (installedLawDeclarations != null)
       result.installedLawDeclarations = installedLawDeclarations;
+    if (applicationResultDelta != null)
+      result.applicationResultDelta = applicationResultDelta;
+    if (resultFrontier != null) result.resultFrontier = resultFrontier;
+    if (fullResultReason != null) result.fullResultReason = fullResultReason;
+    if (resultDependencies != null)
+      result.resultDependencies = resultDependencies;
     return result;
   }
 
@@ -5421,6 +5529,7 @@ class QueryResponse extends $pb.GeneratedMessage {
     28: QueryResponse_Result.workspaceEffectReceipt,
     29: QueryResponse_Result.openApiDescription,
     30: QueryResponse_Result.installedLawDeclarations,
+    31: QueryResponse_Result.applicationResultDelta,
     0: QueryResponse_Result.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -5450,7 +5559,8 @@ class QueryResponse extends $pb.GeneratedMessage {
       27,
       28,
       29,
-      30
+      30,
+      31
     ])
     ..aOM<NomosValue>(1, _omitFieldNames ? '' : 'value',
         subBuilder: NomosValue.create)
@@ -5515,6 +5625,14 @@ class QueryResponse extends $pb.GeneratedMessage {
     ..aOM<InstalledLawDeclarationsResponse>(
         30, _omitFieldNames ? '' : 'installedLawDeclarations',
         subBuilder: InstalledLawDeclarationsResponse.create)
+    ..aOM<ApplicationResultDelta>(
+        31, _omitFieldNames ? '' : 'applicationResultDelta',
+        subBuilder: ApplicationResultDelta.create)
+    ..aOS(32, _omitFieldNames ? '' : 'resultFrontier')
+    ..aE<FullResultReason>(33, _omitFieldNames ? '' : 'fullResultReason',
+        enumValues: FullResultReason.values)
+    ..aOM<ReadDependencies>(34, _omitFieldNames ? '' : 'resultDependencies',
+        subBuilder: ReadDependencies.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -5558,6 +5676,7 @@ class QueryResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(28)
   @$pb.TagNumber(29)
   @$pb.TagNumber(30)
+  @$pb.TagNumber(31)
   QueryResponse_Result whichResult() =>
       _QueryResponse_ResultByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(1)
@@ -5582,6 +5701,7 @@ class QueryResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(28)
   @$pb.TagNumber(29)
   @$pb.TagNumber(30)
+  @$pb.TagNumber(31)
   void clearResult() => $_clearField($_whichOneof(0));
 
   /// Cutover debt for fixed framework queries which have not yet gained a
@@ -5864,6 +5984,234 @@ class QueryResponse extends $pb.GeneratedMessage {
   @$pb.TagNumber(30)
   InstalledLawDeclarationsResponse ensureInstalledLawDeclarations() =>
       $_ensure(22);
+
+  /// Incremental answer to a RowsQuery carrying `since_frontier` (CAP-731). The kernel computed
+  /// it from the exact state change set between the two read positions, under the same read
+  /// policies, principal and visibility as a full read. Merging it into the result read at
+  /// `base_frontier` yields, byte for byte, the full result at `frontier`.
+  @$pb.TagNumber(31)
+  ApplicationResultDelta get applicationResultDelta => $_getN(23);
+  @$pb.TagNumber(31)
+  set applicationResultDelta(ApplicationResultDelta value) =>
+      $_setField(31, value);
+  @$pb.TagNumber(31)
+  $core.bool hasApplicationResultDelta() => $_has(23);
+  @$pb.TagNumber(31)
+  void clearApplicationResultDelta() => $_clearField(31);
+  @$pb.TagNumber(31)
+  ApplicationResultDelta ensureApplicationResultDelta() => $_ensure(23);
+
+  /// The kernel-issued read position of a complete `application_result` for a declared rows
+  /// query. Opaque to every caller: only the kernel interprets it, when it comes back as
+  /// `RowsQuery.since_frontier`. Absent on every other result.
+  @$pb.TagNumber(32)
+  $core.String get resultFrontier => $_getSZ(24);
+  @$pb.TagNumber(32)
+  set resultFrontier($core.String value) => $_setString(24, value);
+  @$pb.TagNumber(32)
+  $core.bool hasResultFrontier() => $_has(24);
+  @$pb.TagNumber(32)
+  void clearResultFrontier() => $_clearField(32);
+
+  /// Why a RowsQuery that asked for a delta (`since_frontier`) was answered in full. Present only
+  /// on such answers; a real failure is a Failure, never a reason.
+  @$pb.TagNumber(33)
+  FullResultReason get fullResultReason => $_getN(25);
+  @$pb.TagNumber(33)
+  set fullResultReason(FullResultReason value) => $_setField(33, value);
+  @$pb.TagNumber(33)
+  $core.bool hasFullResultReason() => $_has(25);
+  @$pb.TagNumber(33)
+  void clearFullResultReason() => $_clearField(33);
+
+  /// What can change the answer of a declared rows query at its read position (CAP-760): present
+  /// beside `result_frontier` or an `application_result_delta` when the kernel can name it exactly.
+  /// Absent means anything may change it.
+  @$pb.TagNumber(34)
+  ReadDependencies get resultDependencies => $_getN(26);
+  @$pb.TagNumber(34)
+  set resultDependencies(ReadDependencies value) => $_setField(34, value);
+  @$pb.TagNumber(34)
+  $core.bool hasResultDependencies() => $_has(26);
+  @$pb.TagNumber(34)
+  void clearResultDependencies() => $_clearField(34);
+  @$pb.TagNumber(34)
+  ReadDependencies ensureResultDependencies() => $_ensure(26);
+}
+
+/// The state a declared rows result reads, from the installed read law. A state change touching none
+/// of it leaves the next delta from this result's position empty. Exact or wider, never narrower.
+class ReadDependencies extends $pb.GeneratedMessage {
+  factory ReadDependencies({
+    $core.Iterable<$core.String>? aggregateTypes,
+    $core.bool? readsArchives,
+    $core.String? readAt,
+  }) {
+    final result = create();
+    if (aggregateTypes != null) result.aggregateTypes.addAll(aggregateTypes);
+    if (readsArchives != null) result.readsArchives = readsArchives;
+    if (readAt != null) result.readAt = readAt;
+    return result;
+  }
+
+  ReadDependencies._();
+
+  factory ReadDependencies.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ReadDependencies.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ReadDependencies',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..pPS(1, _omitFieldNames ? '' : 'aggregateTypes')
+    ..aOB(2, _omitFieldNames ? '' : 'readsArchives')
+    ..aOS(3, _omitFieldNames ? '' : 'readAt')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ReadDependencies clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ReadDependencies copyWith(void Function(ReadDependencies) updates) =>
+      super.copyWith((message) => updates(message as ReadDependencies))
+          as ReadDependencies;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ReadDependencies create() => ReadDependencies._();
+  @$core.override
+  ReadDependencies createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ReadDependencies getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ReadDependencies>(create);
+  static ReadDependencies? _defaultInstance;
+
+  /// Aggregate types (as OfferStateChange.aggregate_types names them) whose state the rows, their
+  /// membership or the read law come from. Sorted, without duplicates.
+  @$pb.TagNumber(1)
+  $pb.PbList<$core.String> get aggregateTypes => $_getList(0);
+
+  /// A combined field reads a related row by reference: an archive of any aggregate may change it.
+  @$pb.TagNumber(2)
+  $core.bool get readsArchives => $_getBF(1);
+  @$pb.TagNumber(2)
+  set readsArchives($core.bool value) => $_setBool(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasReadsArchives() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearReadsArchives() => $_clearField(2);
+
+  /// The commit whose state this answer shows (as OfferStateChange.parent_head names a head).
+  @$pb.TagNumber(3)
+  $core.String get readAt => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set readAt($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasReadAt() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearReadAt() => $_clearField(3);
+}
+
+/// The rows of one declared query that changed between two kernel-issued read positions.
+class ApplicationResultDelta extends $pb.GeneratedMessage {
+  factory ApplicationResultDelta({
+    $core.String? baseFrontier,
+    $core.String? frontier,
+    $0.Any? changedRows,
+    $core.Iterable<$core.String>? removedIds,
+  }) {
+    final result = create();
+    if (baseFrontier != null) result.baseFrontier = baseFrontier;
+    if (frontier != null) result.frontier = frontier;
+    if (changedRows != null) result.changedRows = changedRows;
+    if (removedIds != null) result.removedIds.addAll(removedIds);
+    return result;
+  }
+
+  ApplicationResultDelta._();
+
+  factory ApplicationResultDelta.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ApplicationResultDelta.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ApplicationResultDelta',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.kernel.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'baseFrontier')
+    ..aOS(2, _omitFieldNames ? '' : 'frontier')
+    ..aOM<$0.Any>(3, _omitFieldNames ? '' : 'changedRows',
+        subBuilder: $0.Any.create)
+    ..pPS(4, _omitFieldNames ? '' : 'removedIds')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ApplicationResultDelta clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ApplicationResultDelta copyWith(
+          void Function(ApplicationResultDelta) updates) =>
+      super.copyWith((message) => updates(message as ApplicationResultDelta))
+          as ApplicationResultDelta;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ApplicationResultDelta create() => ApplicationResultDelta._();
+  @$core.override
+  ApplicationResultDelta createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ApplicationResultDelta getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ApplicationResultDelta>(create);
+  static ApplicationResultDelta? _defaultInstance;
+
+  /// The position the caller's result must be at (the request's `since_frontier`).
+  @$pb.TagNumber(1)
+  $core.String get baseFrontier => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set baseFrontier($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasBaseFrontier() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearBaseFrontier() => $_clearField(1);
+
+  /// The position this delta advances it to; the next request's `since_frontier`.
+  @$pb.TagNumber(2)
+  $core.String get frontier => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set frontier($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasFrontier() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearFrontier() => $_clearField(2);
+
+  /// Every added or changed visible row, encoded with the SAME `QueryResult_<identity>` contract as
+  /// the full result (rows sorted by id; no page metadata), so generated decoders decode it.
+  @$pb.TagNumber(3)
+  $0.Any get changedRows => $_getN(2);
+  @$pb.TagNumber(3)
+  set changedRows($0.Any value) => $_setField(3, value);
+  @$pb.TagNumber(3)
+  $core.bool hasChangedRows() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearChangedRows() => $_clearField(3);
+  @$pb.TagNumber(3)
+  $0.Any ensureChangedRows() => $_ensure(2);
+
+  /// Ids that no longer belong to the result. Sorted, disjoint from `changed_rows`; an id the
+  /// caller never held is a no-op.
+  @$pb.TagNumber(4)
+  $pb.PbList<$core.String> get removedIds => $_getList(3);
 }
 
 /// OpenAPI is already a JSON document, not a tenant value or a recursive NomosValue tree.
@@ -6382,6 +6730,9 @@ class MaintenanceQuantumQuery extends $pb.GeneratedMessage {
     $core.bool? localReadOnly,
     $core.bool? maintainGitCustody,
     $core.bool? readIndexOnly,
+    $core.bool? maintainAddressedFrontiers,
+    $core.bool? flushDurability,
+    $core.bool? localWriteBurst,
   }) {
     final result = create();
     if (requestedDomain != null) result.requestedDomain = requestedDomain;
@@ -6392,6 +6743,10 @@ class MaintenanceQuantumQuery extends $pb.GeneratedMessage {
     if (maintainGitCustody != null)
       result.maintainGitCustody = maintainGitCustody;
     if (readIndexOnly != null) result.readIndexOnly = readIndexOnly;
+    if (maintainAddressedFrontiers != null)
+      result.maintainAddressedFrontiers = maintainAddressedFrontiers;
+    if (flushDurability != null) result.flushDurability = flushDurability;
+    if (localWriteBurst != null) result.localWriteBurst = localWriteBurst;
     return result;
   }
 
@@ -6415,6 +6770,9 @@ class MaintenanceQuantumQuery extends $pb.GeneratedMessage {
     ..aOB(4, _omitFieldNames ? '' : 'localReadOnly')
     ..aOB(5, _omitFieldNames ? '' : 'maintainGitCustody')
     ..aOB(6, _omitFieldNames ? '' : 'readIndexOnly')
+    ..aOB(7, _omitFieldNames ? '' : 'maintainAddressedFrontiers')
+    ..aOB(8, _omitFieldNames ? '' : 'flushDurability')
+    ..aOB(9, _omitFieldNames ? '' : 'localWriteBurst')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6493,6 +6851,51 @@ class MaintenanceQuantumQuery extends $pb.GeneratedMessage {
   $core.bool hasReadIndexOnly() => $_has(5);
   @$pb.TagNumber(6)
   void clearReadIndexOnly() => $_clearField(6);
+
+  /// The idle pin quantum: pin the live positions the current raw frontier index
+  /// does not serve (normally the admitted frontier behind unsynced local
+  /// writes), once per position, and prune every other addressed derivative in
+  /// bounded batches. No reader waits on it, so the host sends it only after the
+  /// workspace has been write-idle for a quiet window, never during a burst.
+  /// Exclusive of the other modes; maintenance_pending asks for another quantum.
+  @$pb.TagNumber(7)
+  $core.bool get maintainAddressedFrontiers => $_getBF(6);
+  @$pb.TagNumber(7)
+  set maintainAddressedFrontiers($core.bool value) => $_setBool(6, value);
+  @$pb.TagNumber(7)
+  $core.bool hasMaintainAddressedFrontiers() => $_has(6);
+  @$pb.TagNumber(7)
+  void clearMaintainAddressedFrontiers() => $_clearField(7);
+
+  /// The durability flush quantum (CAP-746). Under the deferred durability policy a save forces
+  /// nothing to stable storage; the kernel owes every file it wrote to one ordered flush (objects,
+  /// then refs, then disposable SQLite, then a last-known-good marker per workspace). The host
+  /// decides WHEN (after a short write-quiet window, bounded during a long burst); the kernel
+  /// decides WHAT, and flushes everything it owes, whichever workspace the quantum names. A no-op
+  /// under the synchronous policy. Exclusive of the other modes; maintenance_pending asks for
+  /// another quantum.
+  @$pb.TagNumber(8)
+  $core.bool get flushDurability => $_getBF(7);
+  @$pb.TagNumber(8)
+  set flushDurability($core.bool value) => $_setBool(7, value);
+  @$pb.TagNumber(8)
+  $core.bool hasFlushDurability() => $_has(7);
+  @$pb.TagNumber(8)
+  void clearFlushDurability() => $_clearField(8);
+
+  /// The peer's local writes are in a burst (CAP-750). Packing loose custody objects waits for the
+  /// person to pause, so the host sends a custody quantum (maintain_git_custody) during a burst
+  /// only after the kernel reported loose_custody_pressure. The kernel then packs one small slice of
+  /// loose objects and does nothing else in that quantum: no staged-pack promotion, no multi-pack
+  /// index or repack step, no command warming.
+  @$pb.TagNumber(9)
+  $core.bool get localWriteBurst => $_getBF(8);
+  @$pb.TagNumber(9)
+  set localWriteBurst($core.bool value) => $_setBool(8, value);
+  @$pb.TagNumber(9)
+  $core.bool hasLocalWriteBurst() => $_has(8);
+  @$pb.TagNumber(9)
+  void clearLocalWriteBurst() => $_clearField(9);
 }
 
 class MaintenanceQuantumResponse extends $pb.GeneratedMessage {
@@ -6508,6 +6911,7 @@ class MaintenanceQuantumResponse extends $pb.GeneratedMessage {
     $core.String? preparedCommandDomain,
     $core.String? preparedCommandPackage,
     $core.String? preparedCommandSelector,
+    $core.bool? looseCustodyPressure,
   }) {
     final result = create();
     if (workspace != null) result.workspace = workspace;
@@ -6525,6 +6929,8 @@ class MaintenanceQuantumResponse extends $pb.GeneratedMessage {
       result.preparedCommandPackage = preparedCommandPackage;
     if (preparedCommandSelector != null)
       result.preparedCommandSelector = preparedCommandSelector;
+    if (looseCustodyPressure != null)
+      result.looseCustodyPressure = looseCustodyPressure;
     return result;
   }
 
@@ -6558,6 +6964,7 @@ class MaintenanceQuantumResponse extends $pb.GeneratedMessage {
     ..aOS(9, _omitFieldNames ? '' : 'preparedCommandDomain')
     ..aOS(10, _omitFieldNames ? '' : 'preparedCommandPackage')
     ..aOS(11, _omitFieldNames ? '' : 'preparedCommandSelector')
+    ..aOB(12, _omitFieldNames ? '' : 'looseCustodyPressure')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -6679,6 +7086,18 @@ class MaintenanceQuantumResponse extends $pb.GeneratedMessage {
   $core.bool hasPreparedCommandSelector() => $_has(10);
   @$pb.TagNumber(11)
   void clearPreparedCommandSelector() => $_clearField(11);
+
+  /// The loose objects this kernel instance has written and not yet packed exceed the growth guard
+  /// (CAP-750). Reported on every maintenance quantum, so a host holding custody packing back for a
+  /// burst learns when an endless burst must pack in small slices after all.
+  @$pb.TagNumber(12)
+  $core.bool get looseCustodyPressure => $_getBF(11);
+  @$pb.TagNumber(12)
+  set looseCustodyPressure($core.bool value) => $_setBool(11, value);
+  @$pb.TagNumber(12)
+  $core.bool hasLooseCustodyPressure() => $_has(11);
+  @$pb.TagNumber(12)
+  void clearLooseCustodyPressure() => $_clearField(12);
 }
 
 class OsgiAttribute extends $pb.GeneratedMessage {
@@ -8835,6 +9254,7 @@ class SyncResponse extends $pb.GeneratedMessage {
     $core.Iterable<SyncRefusedIntent>? refusedLocal,
     CustodyDisagreement? custodyDisagreement,
     $core.Iterable<$core.String>? parkedLocalRefs,
+    $core.bool? replayPending,
   }) {
     final result = create();
     if (admitted != null) result.admitted = admitted;
@@ -8855,6 +9275,7 @@ class SyncResponse extends $pb.GeneratedMessage {
     if (custodyDisagreement != null)
       result.custodyDisagreement = custodyDisagreement;
     if (parkedLocalRefs != null) result.parkedLocalRefs.addAll(parkedLocalRefs);
+    if (replayPending != null) result.replayPending = replayPending;
     return result;
   }
 
@@ -8891,6 +9312,7 @@ class SyncResponse extends $pb.GeneratedMessage {
     ..aOM<CustodyDisagreement>(13, _omitFieldNames ? '' : 'custodyDisagreement',
         subBuilder: CustodyDisagreement.create)
     ..pPS(14, _omitFieldNames ? '' : 'parkedLocalRefs')
+    ..aOB(15, _omitFieldNames ? '' : 'replayPending')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -9000,6 +9422,19 @@ class SyncResponse extends $pb.GeneratedMessage {
   /// Non-empty means `refused_local` left main and is recoverable from the refused-offer desk.
   @$pb.TagNumber(14)
   $pb.PbList<$core.String> get parkedLocalRefs => $_getList(12);
+
+  /// The replay spent its `replay_offer_budget` before finishing (CAP-757). Nothing was published:
+  /// live main is unchanged and `head` is still the live head. The kernel keeps its private
+  /// candidate; the same request again continues it from the next offer. Every other field is
+  /// empty until the answer that completes the replay.
+  @$pb.TagNumber(15)
+  $core.bool get replayPending => $_getBF(13);
+  @$pb.TagNumber(15)
+  set replayPending($core.bool value) => $_setBool(13, value);
+  @$pb.TagNumber(15)
+  $core.bool hasReplayPending() => $_has(13);
+  @$pb.TagNumber(15)
+  void clearReplayPending() => $_clearField(15);
 }
 
 class CustodyDisagreement extends $pb.GeneratedMessage {
@@ -14685,6 +15120,7 @@ class RowsQuery extends $pb.GeneratedMessage {
     $core.String? principal,
     $core.List<$core.int>? argumentsUsda,
     $0.Any? applicationArguments,
+    $core.String? sinceFrontier,
   }) {
     final result = create();
     if (id != null) result.id = id;
@@ -14693,6 +15129,7 @@ class RowsQuery extends $pb.GeneratedMessage {
     if (argumentsUsda != null) result.argumentsUsda = argumentsUsda;
     if (applicationArguments != null)
       result.applicationArguments = applicationArguments;
+    if (sinceFrontier != null) result.sinceFrontier = sinceFrontier;
     return result;
   }
 
@@ -14718,6 +15155,7 @@ class RowsQuery extends $pb.GeneratedMessage {
         4, _omitFieldNames ? '' : 'argumentsUsda', $pb.PbFieldType.OY)
     ..aOM<$0.Any>(5, _omitFieldNames ? '' : 'applicationArguments',
         subBuilder: $0.Any.create)
+    ..aOS(6, _omitFieldNames ? '' : 'sinceFrontier')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -14792,6 +15230,19 @@ class RowsQuery extends $pb.GeneratedMessage {
   void clearApplicationArguments() => $_clearField(5);
   @$pb.TagNumber(5)
   $0.Any ensureApplicationArguments() => $_ensure(4);
+
+  /// Opt-in incremental read (CAP-731): the `result_frontier` (or delta `frontier`) of the result
+  /// the caller holds for this exact query and arguments. The kernel answers with an
+  /// `application_result_delta` from that position, or with the full result and a typed
+  /// `full_result_reason`. Only valid with the application Protobuf result format.
+  @$pb.TagNumber(6)
+  $core.String get sinceFrontier => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set sinceFrontier($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasSinceFrontier() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearSinceFrontier() => $_clearField(6);
 }
 
 class PageQuery extends $pb.GeneratedMessage {
@@ -17486,6 +17937,7 @@ class SyncRequest extends $pb.GeneratedMessage {
     $core.String? toHead,
     $core.bool? parkRefusedLocal,
     $fixnum.Int64? parkedAtMillis,
+    $core.int? replayOfferBudget,
   }) {
     final result = create();
     if (target != null) result.target = target;
@@ -17493,6 +17945,7 @@ class SyncRequest extends $pb.GeneratedMessage {
     if (toHead != null) result.toHead = toHead;
     if (parkRefusedLocal != null) result.parkRefusedLocal = parkRefusedLocal;
     if (parkedAtMillis != null) result.parkedAtMillis = parkedAtMillis;
+    if (replayOfferBudget != null) result.replayOfferBudget = replayOfferBudget;
     return result;
   }
 
@@ -17518,6 +17971,8 @@ class SyncRequest extends $pb.GeneratedMessage {
     ..a<$fixnum.Int64>(
         5, _omitFieldNames ? '' : 'parkedAtMillis', $pb.PbFieldType.OU6,
         defaultOrMaker: $fixnum.Int64.ZERO)
+    ..aI(6, _omitFieldNames ? '' : 'replayOfferBudget',
+        fieldType: $pb.PbFieldType.OU3)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -17593,6 +18048,20 @@ class SyncRequest extends $pb.GeneratedMessage {
   $core.bool hasParkedAtMillis() => $_has(4);
   @$pb.TagNumber(5)
   void clearParkedAtMillis() => $_clearField(5);
+
+  /// The most offers (incoming and local) this call judges before it answers `replay_pending`
+  /// (CAP-757). Receiving a backlog is then bounded steps the host interleaves with foreground
+  /// work, never one call that holds the kernel for the whole backlog. Absent or 0 replays
+  /// everything in one call, as before. Local writes made between steps are rebased in the same
+  /// replay; anything else that moves live main starts it again.
+  @$pb.TagNumber(6)
+  $core.int get replayOfferBudget => $_getIZ(5);
+  @$pb.TagNumber(6)
+  set replayOfferBudget($core.int value) => $_setUnsignedInt32(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasReplayOfferBudget() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearReplayOfferBudget() => $_clearField(6);
 }
 
 /// Immutable process configuration supplied once by the Peer Office before it
@@ -17604,12 +18073,17 @@ class KernelConfigurationRequest extends $pb.GeneratedMessage {
   factory KernelConfigurationRequest({
     $core.List<$core.int>? trustRootPublicKey,
     $core.bool? trustsCustodianHistory,
+    $core.bool? deferredDurability,
+    $core.bool? hostCallLedger,
   }) {
     final result = create();
     if (trustRootPublicKey != null)
       result.trustRootPublicKey = trustRootPublicKey;
     if (trustsCustodianHistory != null)
       result.trustsCustodianHistory = trustsCustodianHistory;
+    if (deferredDurability != null)
+      result.deferredDurability = deferredDurability;
+    if (hostCallLedger != null) result.hostCallLedger = hostCallLedger;
     return result;
   }
 
@@ -17630,6 +18104,8 @@ class KernelConfigurationRequest extends $pb.GeneratedMessage {
     ..a<$core.List<$core.int>>(
         1, _omitFieldNames ? '' : 'trustRootPublicKey', $pb.PbFieldType.OY)
     ..aOB(2, _omitFieldNames ? '' : 'trustsCustodianHistory')
+    ..aOB(3, _omitFieldNames ? '' : 'deferredDurability')
+    ..aOB(4, _omitFieldNames ? '' : 'hostCallLedger')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -17676,14 +18152,44 @@ class KernelConfigurationRequest extends $pb.GeneratedMessage {
   $core.bool hasTrustsCustodianHistory() => $_has(1);
   @$pb.TagNumber(2)
   void clearTrustsCustodianHistory() => $_clearField(2);
+
+  /// A peer property, not law (CAP-746): this peer is a personal device whose saves acknowledge
+  /// once their writes reach the OS. The kernel forces nothing to stable storage on the hot path
+  /// and owes it to an ordered background flush (MaintenanceQuantumQuery.flush_durability); a
+  /// reopen after an unclean shutdown returns main to the last flushed head if its newer custody
+  /// is unreadable and rebuilds unsynced disposable indexes. Absent or false keeps synchronous
+  /// durability (the cloud custodian). Immutable once set.
+  @$pb.TagNumber(3)
+  $core.bool get deferredDurability => $_getBF(2);
+  @$pb.TagNumber(3)
+  set deferredDurability($core.bool value) => $_setBool(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasDeferredDurability() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearDeferredDurability() => $_clearField(3);
+
+  /// Observability only, never law: this host counts the host calls it services into the kernel's
+  /// per-offer phase ledger (kernel/src/offer_phases.rs). The kernel answers with the ledger's
+  /// address in its own linear memory; the host adds one call and its nanoseconds there for every
+  /// host call, and reads the finished offer line back from the same block. Changes no judgment.
+  @$pb.TagNumber(4)
+  $core.bool get hostCallLedger => $_getBF(3);
+  @$pb.TagNumber(4)
+  set hostCallLedger($core.bool value) => $_setBool(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasHostCallLedger() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearHostCallLedger() => $_clearField(4);
 }
 
 class KernelConfigurationResponse extends $pb.GeneratedMessage {
   factory KernelConfigurationResponse({
     Acknowledged? result,
+    $core.int? hostCallLedger,
   }) {
     final result$ = create();
     if (result != null) result$.result = result;
+    if (hostCallLedger != null) result$.hostCallLedger = hostCallLedger;
     return result$;
   }
 
@@ -17703,6 +18209,8 @@ class KernelConfigurationResponse extends $pb.GeneratedMessage {
       createEmptyInstance: create)
     ..aOM<Acknowledged>(1, _omitFieldNames ? '' : 'result',
         subBuilder: Acknowledged.create)
+    ..aI(2, _omitFieldNames ? '' : 'hostCallLedger',
+        fieldType: $pb.PbFieldType.OU3)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -17737,6 +18245,16 @@ class KernelConfigurationResponse extends $pb.GeneratedMessage {
   void clearResult() => $_clearField(1);
   @$pb.TagNumber(1)
   Acknowledged ensureResult() => $_ensure(0);
+
+  /// Present when the request asked for `host_call_ledger`: the ledger block's linear-memory address.
+  @$pb.TagNumber(2)
+  $core.int get hostCallLedger => $_getIZ(1);
+  @$pb.TagNumber(2)
+  set hostCallLedger($core.int value) => $_setUnsignedInt32(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasHostCallLedger() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearHostCallLedger() => $_clearField(2);
 }
 
 enum CustodyRequest_Operation {
@@ -19571,6 +20089,7 @@ class IntentsAboveRequest extends $pb.GeneratedMessage {
     $fixnum.Int64? limit,
     $core.bool? completeLogical,
     $core.bool? compactStored,
+    $core.bool? fromBase,
   }) {
     final result = create();
     if (repo != null) result.repo = repo;
@@ -19580,6 +20099,7 @@ class IntentsAboveRequest extends $pb.GeneratedMessage {
     if (limit != null) result.limit = limit;
     if (completeLogical != null) result.completeLogical = completeLogical;
     if (compactStored != null) result.compactStored = compactStored;
+    if (fromBase != null) result.fromBase = fromBase;
     return result;
   }
 
@@ -19605,6 +20125,7 @@ class IntentsAboveRequest extends $pb.GeneratedMessage {
         defaultOrMaker: $fixnum.Int64.ZERO)
     ..aOB(6, _omitFieldNames ? '' : 'completeLogical')
     ..aOB(7, _omitFieldNames ? '' : 'compactStored')
+    ..aOB(8, _omitFieldNames ? '' : 'fromBase')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -19688,6 +20209,19 @@ class IntentsAboveRequest extends $pb.GeneratedMessage {
   $core.bool hasCompactStored() => $_has(6);
   @$pb.TagNumber(7)
   void clearCompactStored() => $_clearField(7);
+
+  /// With `base` and a nonzero `limit`: the `limit` commits immediately ABOVE base, oldest first,
+  /// rather than the newest `limit` below head. A bounded continuation from a boundary the
+  /// receiver already holds; only the selected commits' changes are read. Refused when base is
+  /// not on head's first-parent chain.
+  @$pb.TagNumber(8)
+  $core.bool get fromBase => $_getBF(7);
+  @$pb.TagNumber(8)
+  set fromBase($core.bool value) => $_setBool(7, value);
+  @$pb.TagNumber(8)
+  $core.bool hasFromBase() => $_has(7);
+  @$pb.TagNumber(8)
+  void clearFromBase() => $_clearField(8);
 }
 
 class HistorySummaryRequest extends $pb.GeneratedMessage {