@githolon/testing 0.15.0 → 0.16.1

package/vendor/engine/engine.mjs

@@ -1,31 +1,41 @@
-// AUTO-SYNCED from cloud/holon-host/src/engine.mjs by testing/build.mjs — DO NOT EDIT HERE.
-// Nomos Cloud — THE ENGINE PLANE (one machinery, two hosts).
+// AUTO-SYNCED from adapter/engine.mjs by testing/build.mjs — DO NOT EDIT HERE.
+// Nomos — THE CLOUDFLARE SHELL's ENGINE PLANE (the adapter logic that boots + drives the offer-kernel).
 //
-// Everything that touches a resident holon wasm instance + its /work tree lives HERE,
-// extracted from the HolonDO so the 12GiB CONTAINER tier runs the IDENTICAL logic the
-// edge DO runs (the old container worker was a drifting fork — killed). The hosts differ
-// only in what they inject:
+// Everything that boots the offer-kernel wasm + drives its /work tree lives HERE (the adapter the
+// Cloudflare shell wraps; "host" is out — OFFER_KERNEL_ARCHITECTURE.dot). THE OFFER-KERNEL RUNS IN THE
+// 12GiB CONTAINER — that is its only runtime now (we no longer run the kernel on the edge DO). The
+// container (container/server.mjs) is a thin Node wrapper around this file: wasm compiled from disk, replica
+// from the container instance base, ledgers ARRIVE on each op (containers have no Workers bindings — the
+// control-plane DO mints the Artifacts token and sends it).
 //
-//   * the EDGE host (worker.mjs HolonDO): wasm via the wrangler CompiledWasm import,
-//     replica from the DO id, ledgers minted from env.ARTIFACTS, runs in workerd;
-//   * the HEAVY host (container/holon-worker.mjs): wasm compiled from disk, replica
-//     from the container instance base, ledgers ARRIVE on each op (containers have no
-//     Workers bindings — the control-plane DO mints tokens and sends them), runs in Node.
-//
-// CONTROL PLANE STAYS IN THE DO: ownership secrets, the DLQ store,
+// CONTROL PLANE STAYS IN THE DO (CloudflareShellDO — it does NOT run the kernel): ownership secrets, the DLQ store,
 // quotas/rates, alarms. The engine RETURNS data (e.g. dead-letter entries with intent
-// bytes) and the host persists. Runtime-neutral: workerd + Node 22 (globalThis.crypto,
+// bytes) and the adapter persists. Runtime-neutral: workerd + Node 22 (globalThis.crypto,
 // fetch, TextEncoder are the only ambient dependencies).
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git from "isomorphic-git";
-import http from "isomorphic-git/http/web";
 import { makeGitFs } from "./git-fs.mjs";
 import { serializeTree } from "./tree.mjs";
+// THE DUMB-PIPE CUSTODY TRANSPORT (raw git smart-HTTP over fetch, zero isomorphic-git). Same-dir module,
+// synced into the container context by deploy.sh alongside engine.mjs.
+import { lsRefs, fetchPack, pushPack, ZERO_OID } from "./custody-transport.mjs";
 
 const enc = new TextEncoder(), dec = new TextDecoder();
 const BRANCH = "main";
+// The largest result-delta the offer response will carry inline (settle perf — saves the client a second
+// round-trip). A normal write's delta is a few KiB; a far-behind client exceeds this and falls back to GET /pack.
+const RESULT_PACK_INLINE_MAX = 256 * 1024;
 export const repoArgOf = (ws) => `/work/ws/${ws}`;
 export const gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 0x8000) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc.encode(JSON.stringify(o)));
+}
 
 const unpack = (p) => { const v = typeof p === "bigint" ? p : BigInt(p); return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) }; };
 export async function sha256hex(t) { const b = await crypto.subtle.digest("SHA-256", enc.encode(t)); return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join(""); }
@@ -55,23 +65,62 @@ function call(ex, mode, fields, STDERR) {
   } finally { ex.git_holon_dealloc(reqPtr, req.length); }
 }
 
+// ── KERNEL GIT PLUMBING (kgit) — the cloud shell speaks NO git; the kernel (gix) owns the odb. ──
+// These wrap the kernel's local-object RPCs (the adapter is a byte pipe, never touches objects/refs).
+// They mirror the isomorphic-git call shapes they replace so the migration is a 1:1 substitution.
+// The repo dir the wasm opens is `${repoArg}/nomos.git`; the adapter names it as `gitdir` everywhere, so
+// derive repoArg back from it (gitdir === gitdirOf(ws) === `${repoArgOf(ws)}/nomos.git`).
+const repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+const bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+const kgit = {
+  // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+  resolveRef: (eng, gitdir, ref) =>
+    JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+  // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+  readBlob: (eng, gitdir, oid, path) => {
+    const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path }, eng.STDERR));
+    return r.ok ? bytesFromB64(r.blobB64) : null;
+  },
+  // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+  // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+  intentsAbove: (eng, gitdir, head, base = "", limit = 0) =>
+    JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+  // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+  listRefs: (eng, gitdir, prefix) =>
+    JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+  // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+  writeRef: (eng, gitdir, ref, value) =>
+    JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+  // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+  deleteRef: (eng, gitdir, ref) =>
+    JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+  // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+  // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+  writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) =>
+    JSON.parse(call(eng.ex, "write_meta_commit", {
+      repoArg: repoArgOfGitdir(gitdir), parents,
+      files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+      message, timeSecs, ref,
+    }, eng.STDERR)).oid,
+};
+
 function seedManifests(_m, _strings) {
   // Runtime manifests are committed inside USDA packages and derived by the holon
   // from active installed law. Hosts must not seed admission/projection sidecars.
 }
 
-// (#39 BAILIFF: no host-chosen `authorityScope` literal. It was a dead, hardcoded "workspace/root" stamped
+// (#39 BAILIFF: no adapter-chosen `authorityScope` literal. It was a dead, hardcoded "workspace/root" stamped
 //  onto EVERY install — incl. non-root tenants — that NOTHING in the kernel ever reads for a decision
-//  (domain_lifecycle.rs folds it to an Option<String> and never branches on it). The host carries the
+//  (domain_lifecycle.rs folds it to an Option<String> and never branches on it). The adapter carries the
 //  package bytes; it does not author an authority-scoping fact the law never declared. Absent ⇒ folded None.)
 export const installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...(dispositions ? { dispositions } : {}) });
 
 /**
  * Boot the resident wasm + /work tree. `wasmModule` is a PRECOMPILED WebAssembly.Module
- * (the host compiles its way); `replica` = the host's unique 63-bit id.
+ * (the adapter compiles its way); `replica` = the adapter's unique 63-bit id.
  *
  * Runtime read/admission metadata is sovereign holon state: committed USDA packages
- * are folded by the githolon, and the host never stages manifest sidecars.
+ * are folded by the githolon, and the adapter never stages manifest sidecars.
  */
 export async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
   const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
@@ -96,11 +145,11 @@ export async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica
   return eng;
 }
 
-// There is NO host→holon manifest channel. The wasm derives every read/identity
+// There is NO adapter→holon manifest channel. The wasm derives every read/identity
 // manifest from the FOLDED ledger (installed_read_manifest_bytes_from_state) and
-// refuses a package lacking nomosReadProjection. A host cannot provide a manifest:
+// refuses a package lacking nomosReadProjection. A adapter cannot provide a manifest:
 // the op does not exist (Read Confinement — the kernel's transition function, not a
-// host convention). `setManifests` is gone, not no-op'd, so the lie is unrepresentable.
+// adapter convention). `setManifests` is gone, not no-op'd, so the lie is unrepresentable.
 
 // ── TRANSPARENT SHARDING: the WRONG-HOME GATE (the edge bailiff — sharding slice 2) ──
 //
@@ -117,8 +166,8 @@ export async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica
 /** directive routes off the effective identity manifests: `${domain} ${directiveId}` → route. */
 export function directiveRoutes(eng) {
   void eng;
-  // Host-side manifest taxonomy is retired. Shard routing needs a holon-owned
-  // taxonomy API before it can be re-enabled without leaking law into the host.
+  // Adapter-side manifest taxonomy is retired. Shard routing needs a holon-owned
+  // taxonomy API before it can be re-enabled without leaking law into the adapter.
   return new Map();
 }
 
@@ -133,7 +182,7 @@ function routeTagHexOfMintedId(id) {
 }
 
 /**
- * Judge ONE routed intent against the shard map. `shardRouting` is HOST-INJECTED:
+ * Judge ONE routed intent against the shard map. `shardRouting` is ADAPTER-INJECTED:
  * `{ selfLabel, coordinatorWs, assignments() }` — `selfLabel` is this workspace's shard
  * label (`s<k>`) or null when it IS the coordinator; `assignments()` resolves the
  * ACTIVE `NomosShardAssignment` rows from the coordinator's law-state. Returns null to
@@ -187,7 +236,7 @@ export async function wrongHomeVerdict(shardRouting, route, payload) {
 
 // ── §5.2 — THE DELTA LANE (sharding slice 3): the shard-side EMITTER machinery ──
 //
-// After a shard's edge admission folds a batch, the HOST authors one coalesced
+// After a shard's edge admission folds a batch, the ADAPTER authors one coalesced
 // `nomosPropagateSummary` Order into the COORDINATOR's chain: per touched
 // (scoped read, group) the ABSOLUTE subtotal + the covered range's per-intent
 // event deltas as content-addressed evidence. The coordinator's ONE gate
@@ -209,7 +258,7 @@ export const NOMOS_SHARD_ROWS_READ = "nomosShardRows";
 const FRAMEWORK_AGG_TYPES = new Set([
   "NomosShardAssignment", "NomosShardIdentity", "NomosHomeReceipt", "NomosShardRegistry",
   "NomosShardPolicy", "NomosSummarySubtotal", "NomosSummaryFrontier", "NomosDeepVerify",
-  "NomosCheckpointSeal",
+  "NomosCheckpointSeal", "NomosMoveObligation", // P6 — the move-leg obligation (coordinator law-state)
   // CONTROL-PLANE law-state (every chain carries them via installDomain) — never tenant data:
   "PolicyBundle", "DomainInstallation",
 ]);
@@ -233,7 +282,7 @@ export function placementDirectives(eng) {
 /** The ESTATE-SCOPED maintained reads off the effective identity manifests.
  *  SLICE 4: `where` (the canonical predicate, hash-bearing in the manifest) rides
  *  along — the LIVE capture's oracle is the projection's maintained tally (already
- *  predicate-aware in the kernel); the SUFFIX re-derivation evaluates it host-side
+ *  predicate-aware in the kernel); the SUFFIX re-derivation evaluates it adapter-side
  *  ({@link evalCanonicalPred}) so both lanes agree byte-for-byte. */
 export function scopedReads(eng) {
   void eng;
@@ -242,7 +291,7 @@ export function scopedReads(eng) {
 
 /**
  * Evaluate a canonical count/sum predicate (`predicate.ts` CanonicalPred — eq/ne
- * clauses + and/or trees) over a host-folded field map. EXACTLY the kernel's
+ * clauses + and/or trees) over a adapter-folded field map. EXACTLY the kernel's
  * declared semantics: values canonicalize to strings (int fields compare their
  * decimal form); `eq` over an ABSENT field is FALSE, `ne` over an absent field is
  * TRUE (unset ≠ any literal — the §7-D symmetry rule). Used ONLY by the suffix
@@ -365,7 +414,7 @@ function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
     ctx.values.set(key, { read, group, value: after });
   }
   // The synthetic row-count read: existence flips, with the projection as oracle.
-  // The ABSOLUTE rides relative to the coordinator-held value (the HOST closes it
+  // The ABSOLUTE rides relative to the coordinator-held value (the ADAPTER closes it
   // at emit time — a shard never enumerates its own whole projection per batch).
   // SLICE 8 — EXACT PER-HOME SUBTOTALS: each flip is also attributed to its HOME
   // (the row id's route tag, or the row id itself for an axis root) so the split
@@ -396,7 +445,7 @@ function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
 
 /**
  * The coalesced delta of one admission batch (null when nothing summarizable moved).
- * `rowsDelta` rides separately: the HOST closes the `nomosShardRows` absolute against
+ * `rowsDelta` rides separately: the ADAPTER closes the `nomosShardRows` absolute against
  * the coordinator-held value at emit time (held + Σ deltas — the gate re-checks both
  * halves). The other subtotals' `prev` is the batch-start maintained tally, which
  * equals the coordinator-held value exactly when the frontier is contiguous — and the
@@ -431,7 +480,7 @@ function summaryOfCapture(ctx, fromOid, toOid) {
     subtotals: subtotals.sort((a, b) => (summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1)),
     events: ctx.events,
     rowsDelta: ctx.rowsDelta,
-    // SLICE 8: the exact per-home row deltas — the host closes each against the
+    // SLICE 8: the exact per-home row deltas — the adapter closes each against the
     // coordinator-held per-home subtotal exactly like the "" grand total.
     rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))),
   };
@@ -439,7 +488,7 @@ function summaryOfCapture(ctx, fromOid, toOid) {
 
 /**
  * THE SUFFIX RE-DERIVATION (the frontier-gap self-heal + /summaries/resync): derive
- * the delta payload for (fromOid → main head] from THE CHAIN ITSELF — a host-side
+ * the delta payload for (fromOid → main head] from THE CHAIN ITSELF — a adapter-side
  * pure fold of the scoped reads' group/sum fields over every commit since genesis
  * (Lww in chain order; scoped reads are predicate-free by the compile gate). Used
  * when the coordinator's recorded frontier does not match a live capture (a lost
@@ -448,10 +497,9 @@ function summaryOfCapture(ctx, fromOid, toOid) {
 export async function deriveSummarySuffix(eng, ws, fromOid) {
   const reads = scopedReads(eng);
   const gitdir = gitdirOf(ws);
-  const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
   if (!head) return { ok: false, error: "no local main to derive from" };
-  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
-  commits.reverse(); // genesis → head
+  const commits = kgit.intentsAbove(eng, gitdir, head); // [{oid, intentB64}] genesis → head
   const state = new Map(); // aggregateId -> { type, fields: Map }
   const running = new Map(); // summaryKey -> value (ADDITIVE kinds)
   const bump = (key, d) => running.set(key, (running.get(key) ?? 0) + d);
@@ -481,7 +529,7 @@ export async function deriveSummarySuffix(eng, ws, fromOid) {
   let sawFrom = inSuffix;
   for (const c of commits) {
     let blob = null;
-    try { blob = (await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" })).blob; } catch {}
+    try { blob = bytesFromB64(c.intentB64); } catch {}
     const deltas = [];
     let intentId = "";
     if (blob) {
@@ -628,7 +676,7 @@ export async function deriveSummarySuffix(eng, ws, fromOid) {
   };
 }
 
-/** One read's contribution shape over a host-folded aggregate (suffix derivation only).
+/** One read's contribution shape over a adapter-folded aggregate (suffix derivation only).
  *  SLICE 4: predicate-aware — a `where`-bearing scoped read contributes only while the
  *  folded fields satisfy the canonical predicate (same semantics as the kernel's
  *  maintained tally, so the suffix lane and the live capture agree byte-for-byte). */
@@ -658,7 +706,7 @@ function contributionDiff(read, before, after) {
 
 // ── §6 — THE SHARD LIFECYCLE (slice 5): migration = re-admission, never trust ──
 //
-// The host legs of a split: the TARGET pulls the moving homes' intents off the
+// The adapter legs of a split: the TARGET pulls the moving homes' intents off the
 // SOURCE chain and re-admits EACH through its own gate (`apply_intent` — the same
 // primitive the upload birth and edge admission run: plan re-run, byte-compared,
 // invariants judged); the SOURCE then seals the move with ONE law intent that
@@ -710,14 +758,14 @@ export async function collectHomedIntents(eng, ws, homeKeys) {
   for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
   const keySet = new Set(homeKeys);
   const gitdir = gitdirOf(ws);
-  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
-  commits.reverse(); // genesis → head
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng, gitdir, head) : []; // [{oid, intentB64}] genesis → head
   const docs = [];
   const strikeParity = new Map(); // intentId -> strike count
   for (const c of commits) {
     let doc = null;
     try {
-      const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      const blob = bytesFromB64(c.intentB64);
       doc = JSON.parse(dec.decode(blob));
       docs.push({ oid: c.oid, blob, doc });
     } catch { continue; }
@@ -761,7 +809,7 @@ export async function migrateHomes(eng, ws, ledger, sourceWs, homeKeys, { onlyId
   for (const e of homed) {
     if (wanted && !wanted.has(e.id)) continue;
     if (main.ids.has(e.id)) { skipped.push(e.id); continue; }
-    const res = applyIntentBytes(eng, ws, e.blob);
+    const res = offerAdmit(eng, ws, e.blob);
     if (res.ok) {
       main.ids.add(e.id); main.oids.add(res.head); main.head = res.head;
       migrated.push(e.id);
@@ -811,7 +859,7 @@ export async function sealHomes(eng, ws, ledger, { domain, lawHash, homeKeys, ta
  * chain head carrying the diffs (deep-verify recomputes from the same oracle).
  */
 export async function summaryCloseAgainstHeld(eng, ws, heldRows, heldFrontier) {
-  const head = await git.resolveRef({ fs: eng.fs, gitdir: gitdirOf(ws), ref: BRANCH }).catch(() => null);
+  const head = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
   if (!head) return { ok: false, error: "no local main to close against" };
   if (head === heldFrontier) return { ok: true, upToDate: true, head };
   const subtotals = [];
@@ -880,15 +928,15 @@ export async function collectGlobalIntents(eng, ws) {
   const globals = globalAggregates(eng);
   if (globals.size === 0) return [];
   const gitdir = gitdirOf(ws);
-  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
-  commits.reverse(); // genesis → head
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng, gitdir, head) : []; // [{oid, intentB64}] genesis → head
   const typeOf = new Map(); // aggregateId -> __type (set once at creation — types never change)
   const strikeParity = new Map();
   const docs = [];
   for (const c of commits) {
     let blob = null, doc = null;
     try {
-      blob = (await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" })).blob;
+      blob = bytesFromB64(c.intentB64);
       doc = JSON.parse(dec.decode(blob));
     } catch { continue; }
     docs.push({ oid: c.oid, blob, doc });
@@ -924,7 +972,7 @@ export async function replicateIntents(eng, ws, ledger, intents, { push = true }
   const replicated = [], skipped = [], refused = [];
   for (const e of intents) {
     if (e.id && main.ids.has(e.id)) { skipped.push(e.id); continue; }
-    const res = applyIntentBytes(eng, ws, e.blob);
+    const res = offerAdmit(eng, ws, e.blob);
     if (res.ok) {
       if (e.id) main.ids.add(e.id);
       main.oids.add(res.head); main.head = res.head;
@@ -934,7 +982,7 @@ export async function replicateIntents(eng, ws, ledger, intents, { push = true }
     }
   }
   // push=false is the OFFLINE proof lane only (bench harness — no ledger remote);
-  // every host leg keeps durability-before-ack.
+  // every adapter leg keeps durability-before-ack.
   if (replicated.length && push) await commitAndPush(eng, ws, ledger);
   log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
   return { replicated, skipped, refused };
@@ -942,18 +990,37 @@ export async function replicateIntents(eng, ws, ledger, intents, { push = true }
 
 /**
  * Open browser/session lane without a client-side Artifacts receive-pack: the
- * client offers the exact intent bytes it authored locally; the host applies the
+ * client offers the exact intent bytes it authored locally; the adapter applies the
  * same structural fences as session admission, folds accepted bytes, and seals
  * main once. This is still untrusted work: owner-only/control-plane/receipt
  * writes are refused or dead-lettered exactly like session refs.
  */
-export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains = [], receiptFence = null } = {}) {
+export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains = [], receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
   const refuse = new Set(refuseDomains);
   const main = await mainIntentIds(eng, ws);
   const sessions = new Map();
   const deadLetters = [];
   let admittedTotal = 0;
   const timings = { spans: [], intents: 0, sessions: 0 };
+  // THE §5.2 SUMMARY CAPTURE on the OFFER LANE (offers are the only source of intents — this lane is the one
+  // admit, routed workspaces included). A shard (selfLabel set) with scoped reads captures the per-batch
+  // subtotal delta the same way the session-branch lane does; the adapter then closes it onto the coordinator
+  // (`_postAdmissionHooks` → `_emitSummary`). Null on an unsharded/coordinator/read-free batch (zero cost).
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0
+    ? { reads: scopedReads(eng), prevs: new Map(), values: new Map(), events: [], rowsDelta: 0, rederived: new Set(), rowsByHome: new Map(), homeTags: new Map(), homeKeySet: new Set() }
+    : null;
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) { log("home-tag-table-error", { ws, error: String(e).slice(0, 200) }); }
+  }
+  const gitdir0 = gitdirOf(ws);
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir0, BRANCH) : null;
   const t0 = Date.now(); let seq = 0;
   const span = (name, kind, depth = 1, extra = {}) => {
     const s0 = Date.now();
@@ -977,8 +1044,15 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
       const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
       const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
       const oid = String(offer?.oid || intentId || "").slice(0, 10);
-      if (!dom || dom === "nomos" || dom === "bootstrap" || refuse.has(dom)) {
-        rec.rejected.push({ oid, error: `session lane refuses ${dom ? `'${dom}'` : "non-authored"} intents — law deploys go through POST /v1/workspaces/${ws}/domains with the workspace secret` });
+      // THE GATE DECIDES (offer-kernel doctrine — OFFER_KERNEL_ARCHITECTURE.dot): the adapter does NOT
+      // pre-filter control-plane (`nomos`/`bootstrap`) intents by domain string — that was the adapter
+      // "choosing admission", which the doctrine forbids. An install/governance offer rides the SAME lane;
+      // the kernel gate refuses an author who lacks the declared relation (installDomain.requiresRelationGate
+      // = {relation:"installDomain", object:"workspace:self"}), so an unauthorized control-plane write is a
+      // TYPED GATE refusal, not a adapter verdict. Only `!dom` (malformed) and the explicit per-workspace
+      // `refuse` fence (root's `workspaces` governance lane) stay — those are structural, not authority.
+      if (!dom || refuse.has(dom)) {
+        rec.rejected.push({ oid, error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
         continue;
       }
       if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
@@ -991,12 +1065,22 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
         rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
         continue;
       }
-      const res = applyIntentBytes(eng, ws, blob);
+      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+      // DEFERRED-PROJECTION ACK on the OFFER lane (#47). The per-intent read-projection refresh
+      // (~220ms on a fat ledger) is the warm-sync hot-path waste: the fold IS the correctness step,
+      // the projection only feeds READS, and every read op self-heals to head. So we ACK on the fold
+      // and let the post-ack warm lane (`flushDeferredProjections`, marked below) catch the projection
+      // up — exactly as the session lane (admitAll) already does. A summaryCtx (§5.2) batch keeps the
+      // synchronous refresh: its scoped-read capture re-derives off committed projection state.
+      const _tOffer = Date.now();
+      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
       if (res.ok) {
         if (intentId) main.ids.add(intentId);
         main.oids.add(res.head); main.head = res.head;
         rec.admitted.push({ oid, head: res.head });
         admittedTotal += 1;
+        if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
       } else {
         const error = `${String(res.error || "").slice(0, 300)} — dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
         rec.rejected.push({ oid, error, deadLettered: true });
@@ -1010,22 +1094,53 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
-  if (admittedTotal) {
+  // The deferred projection (above) is flushed by the post-ack warm lane — register this ws so
+  // `flushDeferredProjections` catches it up after we've ACKed. (summaryCtx never deferred.)
+  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= new Set()).add(ws);
+  // OFFER-KERNEL P1.2b: refusals on the offer lane become git-custody facts too (pushed inline,
+  // before the seal that unmounts on failure). Runs even when nothing admitted — a cycle can be
+  // pure refusals.
+  if (deadLetters.length) { try { await materializeRefused(eng, ws, ledger, deadLetters); } catch (e) { log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) }); } }
+  // GIT OFF THE HOT PATH. The fold above is the whole correctness step — the client said "btw I did
+  // this", we re-executed it, resident main is now truth. We ACK on that. Custody (Artifacts) is a
+  // write-behind MIRROR, never on the hot path: when `defer` is set the adapter backs the captured head
+  // up off-lane (server.mjs custodyWriteBehind → backupHead), coalesced to one push in flight. The
+  // CONTAINER IS THE SOLE WRITER of main, so the mirror needs no pull-back — it just FF-pushes the
+  // snapshot. A summaryCtx (§5.2) batch still seals durable-before-ack (its follow-ups depend on it).
+  const deferDurability = defer && !summaryCtx;
+  if (admittedTotal && !deferDurability) {
     const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
     await commitAndPush(eng, ws, ledger);
     sealDone();
   }
   const gitdir = gitdirOf(ws);
-  const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => main.head);
-  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0) });
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings };
+  const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
+  // The coalesced §5.2 delta of this batch (null when no scoped read moved) — the adapter closes it onto the
+  // coordinator (`_postAdmissionHooks` → `_emitSummary`), exactly as the session-branch lane does.
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
+  // RESULT-PACK PIGGYBACK (settle perf): the offer RE-SEALS the intent onto main (a NEW commit oid the
+  // client lacks), so the client otherwise makes a SECOND round-trip (GET /pack?have=base) just to pull
+  // what this admit produced — the ~500ms "prefetch" phase. Since we already hold every object, carry that
+  // exact delta (base→head) BACK in the offer response so the client applies it with zero extra network.
+  // Bounded: only inline a small delta (a normal write is one commit + tree); a far-behind client's large
+  // delta falls back to GET /pack (no worse than today). The kernel odb has `head` post-fold even under
+  // deferred durability (custody push is write-behind; the objects are resident), so this is available now.
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng, ws, clientBase);
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch { /* fall back to the client's own GET /pack */ }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings, ...(summary ? { summary } : {}), ...(resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}), ...(deferDurability && admittedTotal && head ? { deferred: true, head } : {}) };
 }
 
 /**
  * §5.5 (slice 4) — the CONTENT HASH of the coordinator's committed subtotal state:
  * sha256 over the canonical (row-id-sorted) projection of every
  * `NomosSummarySubtotal` row. The ONE definition every checkpoint party shares —
- * the sealing host claims it, an auditor (deep-verify anchoring, the e2e, any
+ * the sealing adapter claims it, an auditor (deep-verify anchoring, the e2e, any
  * peer that mounts the chain) recomputes it from law-state and byte-compares.
  */
 export async function checkpointStateHash(eng, ws) {
@@ -1064,7 +1179,7 @@ export async function authorOn(eng, ws, ledger, domain, directiveId, payload, la
  * the SHARD's whole chain from genesis (the same wasm `verify_chain` the upload
  * birth runs), then recompute every coordinator-held subtotal for that shard from
  * the shard's OWN maintained tallies and byte-compare. `coordinatorRows` is the
- * coordinator's law-state (`NomosSummarySubtotal` rows for this shard) — the HOST
+ * coordinator's law-state (`NomosSummarySubtotal` rows for this shard) — the ADAPTER
  * resolves and passes them (the engine has no cross-workspace reach). Auditors pay
  * for verification; ordinary reads stay O(1).
  */
@@ -1111,7 +1226,7 @@ export async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows
     if (!match) allMatch = false;
     checks.push({ readId: d.readId, group, coordinator: d.value, shard: recomputed, match });
   }
-  const head = await git.resolveRef({ fs: eng.fs, gitdir: gitdirOf(shardWs), ref: BRANCH }).catch(() => null);
+  const head = kgit.resolveRef(eng, gitdirOf(shardWs), BRANCH);
   return {
     verdict: allMatch ? "verified" : "mismatch",
     head,
@@ -1131,34 +1246,22 @@ export async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
   stageWorkspaceDir(eng, ws);
   const gitdir = gitdirOf(ws);
-  let restored = false, remoteMain = null, restoreError = null, checkpoint = null;
+  let restored = false, remoteMain = null, restoreError = null;
   try {
-    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-    remoteMain = (info.refs && info.refs.heads && info.refs.heads.main) || null;
+    // COLD MOUNT, kernel-native: write the bare skeleton (plain fs), then GET /pack the whole `main` history
+    // via raw smart-HTTP and let the kernel's gix apply_pack ingest it (kept PACKED) — zero isomorphic-git.
+    // NO CHECKPOINT. A derived projection snapshot is NEVER trusted — it can corrupt and wedge the holon (it
+    // did), which violates the law: truth is the replayable ledger, nothing derived is load-bearing. The
+    // resident holon folds `main` ONCE on its first read and stays WARM in RAM thereafter — no cold-fold in
+    // the hot path because the bailiff keeps it resident.
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
     if (remoteMain) {
-      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      const ckpt = await discoverCheckpointFromCustody(ledger).catch(() => null);
-      let shallowOk = false;
-      if (ckpt?.cursor && ckpt.frontier) {
-        const steps = [32, 96, 256, 1024];
-        for (let i = 0; i < steps.length; i++) {
-          const depth = steps[i], relative = i > 0;
-          await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, depth, relative, headers: ledger.headers });
-          if (await git.readCommit({ fs: eng.fs, gitdir, oid: ckpt.cursor }).then(() => true, () => false)) { shallowOk = true; break; }
-        }
-      }
-      if (!shallowOk) await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
-      if (shallowOk && ckpt?.blob) {
-        const r = importCheckpoint(eng, ws, ckpt.blob, ckpt.frontier);
-        checkpoint = { restored: !!(r && r.restored), frontierSeeded: !!(r && r.frontierSeeded), cursor: r && r.cursor ? r.cursor : ckpt.cursor, ref: ckpt.ref };
-      }
+      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
       restored = true;
     }
   } catch (e) { restoreError = String((e && e.stack) || e).split("\n").slice(0, 5).join(" | "); }
-  const m = { restored, remoteMain, restoreError, checkpoint };
+  const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
   return m;
 }
@@ -1169,9 +1272,9 @@ function assertAuthored(res, what) {
 }
 
 /**
- * Mount a host-ephemeral workspace. It is still a normal WASI GitHolon under
- * `/work/ws/<name>`; the host behavior is what differs: no custody restore, no
- * Artifacts push, and the whole chain dies with the resident host.
+ * Mount a adapter-ephemeral workspace. It is still a normal WASI GitHolon under
+ * `/work/ws/<name>`; the adapter behavior is what differs: no custody restore, no
+ * Artifacts push, and the whole chain dies with the resident adapter.
  */
 export async function mountEphemeralWorkspace(eng, ws, { domainHash = "", packageUsda = "" } = {}) {
   let m = eng.mounted.get(ws);
@@ -1195,13 +1298,13 @@ export async function mountEphemeralWorkspace(eng, ws, { domainHash = "", packag
   return m;
 }
 
-/** Author into a host-ephemeral workspace and leave the resulting head in memory only. */
+/** Author into a adapter-ephemeral workspace and leave the resulting head in memory only. */
 export async function authorEphemeral(eng, ws, mountOpts, domain, directiveId, payload, lawHash, opts = {}) {
   await mountEphemeralWorkspace(eng, ws, mountOpts);
   return author(eng, ws, domain, directiveId, payload, lawHash, { deferProjection: false, ...opts });
 }
 
-/** Query a host-ephemeral workspace, mounting/installing its package first if needed. */
+/** Query a adapter-ephemeral workspace, mounting/installing its package first if needed. */
 export async function queryEphemeral(eng, ws, mountOpts, queryId, paramsJson, principal = "", keys = []) {
   await mountEphemeralWorkspace(eng, ws, mountOpts);
   return query(eng, ws, queryId, paramsJson, principal, keys);
@@ -1220,18 +1323,44 @@ function writeWork(eng, name, bytes) { eng.preopen.dir.contents.set(name, new Fi
 /** THE CURRENT LAW PER DOMAIN KEY — the holon's OWN resolution (`refresh_key_map`,
  * the map the verify walk and every dispatch use: latest Active install per key
  * by install stamp). Returns `{ "<domainKey>": "<currentHash>", … }`. status uses
- * THIS instead of re-deriving recency host-side from deploy order. */
+ * THIS instead of re-deriving recency adapter-side from deploy order. */
 export function currentLaw(eng, ws) {
-  const out = JSON.parse(call(eng.ex, "current_law", { repoArg: repoArgOf(ws), branch: BRANCH }, eng.STDERR));
+  const out = JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "currentLaw" }), branch: BRANCH }, eng.STDERR));
   return out.keyMap || {};
 }
 
+/** THE CAPABILITY DECLARATION READ (Full-A — capability_marketplace.md §4): the holon
+ * surfaces every CURRENTLY-INSTALLED domain's `nomosCapabilities` law key (the impure-
+ * capability quartets sealed into the law). The deploy lane relays these as a "declared —
+ * bind it or obligations wait" notice WITHOUT reaching into root law-state. Returns
+ * `[{capability, domain, aggregateId, obligation, complete, fail, block, deadLetter, tasksQueryId}]`. */
+export function declaredCapabilities(eng, ws) {
+  const out = JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "declaredCapabilities" }), branch: BRANCH }, eng.STDERR));
+  return out.capabilities || [];
+}
+
+/** THE REACTOR SCAN (the kernel's existing "orders to emit"): every impure-capability
+ * obligation at status:'requested', as `[{taskType, requestId, scheduledAt, deadlineAt, params}]`.
+ * The bailiff outbox loop reads this + joins each taskType to its declared endpoint. */
+export function reactorScan(eng, ws) {
+  // THE OUTBOX VERB (one of the seven): the holon's obligations-to-emit. The adapter reads its emit-queue
+  // through `outbox`, never the pre-doctrine `reactor_scan` (which survives behind legacy-adapter-api for tools).
+  return JSON.parse(call(eng.ex, "outbox", { repoArg: repoArgOf(ws), branch: BRANCH }, eng.STDERR));
+}
+
 /** THE EVOLVE DRY-RUN (managed_rollout.md slice 1 — "would this upgrade admit?"):
  * the evolve gate's pure judgment over the mounted workspace's folded state and a
  * CANDIDATE package, without installing. Returns {admits} or {admits:false,
  * domain, detail} — byte-identical to the refusal the real install would meet. */
 export function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
-  return JSON.parse(call(eng.ex, "evolve_dryrun", { repoArg: repoArgOf(ws), branch: BRANCH, bundle: usda, hash: domainHash, ...(dispositions ? { dispositions } : {}) }, eng.STDERR));
+  // "WOULD THIS UPGRADE ADMIT?" is `offer` with the commit withheld (the offer-kernel dry-run): the SAME
+  // `author(nomos/installDomain, <candidate package + dispositions>)` a real deploy runs, with dryRun:true.
+  // The candidate rides the payload (packageUsda) exactly as a live install carries it — no inline-queryBytes
+  // bundle, no separate verb. The full admission gate runs (incl. the #58 evolve gate, which reads the bundle
+  // from the intent's own events); the commit never happens. The verdict normalizes to the {admits} shape the
+  // evolve-dryrun callers consume — `Ok` ⇒ admits; a refusal carries the gate's own reason (the evolve detail).
+  const r = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { dryRun: true, deferProjection: false });
+  return r.ok ? { admits: true } : { admits: false, detail: r.error };
 }
 
 /** THE FRONT-DOOR MINT (engine plane): reserve a kernel-minted typed id
@@ -1255,26 +1384,39 @@ export function author(eng, ws, domain, directiveId, payload, controllerHash, op
   // THE DEFERRED-PROJECTION ACK (#47, sharding slice 7): the read-projection
   // catch-up (incl. the derive/combine materialize) moves OFF the author ack path
   // by default — every read op self-heals to head, and the post-ack warm lane
-  // (`warmEngine`, which every host already calls) flushes it eagerly. Pass
+  // (`warmEngine`, which every adapter already calls) flushes it eagerly. Pass
   // `opts.deferProjection: false` to keep the pre-#47 synchronous refresh.
   const defer = opts.deferProjection !== false;
   // authorSecret (warrant-flip): the author's client-held ed25519 device secret (b64), injected for THIS
   // local author ONLY so the wasm author door mints the signed-author attestation + self-verifies. Absent
   // on a legacy/unwarranted author (the door's legacy fast path); a warranted workspace REQUIRES it.
-  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...(opts.authorSecret ? { authorSecret: opts.authorSecret } : {}), ...(defer ? { deferProjection: true } : {}) }, eng.STDERR));
+  // THE ONE EFFECTFUL VERB: authoring is `offer` of a PAYLOAD intent (a `directiveId` present ⇒ the holon
+  // plans it, drawing fresh captured ports from the envelope). The structured verdict normalizes back to the
+  // {ok, head, intentOut} shape every caller consumes — `author` is no longer a adapter verb (it dissolved into
+  // offer; the wasm `author` arm survives for the bench/CLI behind legacy-adapter-api until P8).
+  // DRY-RUN (offer-kernel): `offer` with the commit withheld — run the plan + full gate, get the verdict,
+  // commit nothing. This is the home of the old `evolve_dryrun` verb (see `evolveDryRun`). Never defers
+  // projection (no commit to flush).
+  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...(opts.authorSecret ? { authorSecret: opts.authorSecret } : {}), ...(opts.dryRun ? { dryRun: true } : (defer ? { deferProjection: true } : {})) }, eng.STDERR));
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut }
+    : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error }
+    : v; // defensive: a non-verdict shape passes through unchanged
   if (defer && res.ok) (eng.pendingProjection ??= new Set()).add(ws);
   return res;
 }
 
-/** Catch one workspace's read projection up to head NOW (the deferred-ack flush). */
+/** Catch one workspace's read projection up to head NOW (the deferred-ack flush). P3: rides the
+ *  `query` verb (op:"refresh") — a non-effectful maintenance read, not a top-level adapter verb. */
 export function refreshProjection(eng, ws) {
-  return JSON.parse(call(eng.ex, "refresh_projection", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "refresh" }), branch: BRANCH }, eng.STDERR));
 }
 
 /** Flush every deferred projection refresh (rides the post-ack warm lane). */
 export function flushDeferredProjections(eng) {
   for (const ws of eng.pendingProjection ?? []) {
+    const _t = Date.now();
     try { refreshProjection(eng, ws); } catch {}
+    log("flush-projection-ms", { ws, ms: Date.now() - _t });
   }
   if (eng.pendingProjection) eng.pendingProjection.clear();
 }
@@ -1285,24 +1427,24 @@ export function flushDeferredProjections(eng) {
 // the DO under load). The checkpoint persists the folded projection (cursor + every table) so a
 // cold mount RESTORES it and the first read folds only tip−cursor (O(delta)).
 
-/** Export `ws`'s projection-at-head to a base64 blob the HOST persists. Returns
+/** Export `ws`'s projection-at-head to a base64 blob the ADAPTER persists. Returns
  *  `{cursor, blob, bytes}` (or `{empty:true}` for an unborn branch). */
 export function exportCheckpoint(eng, ws) {
   return JSON.parse(call(eng.ex, "checkpoint_export", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
 }
 
 /** Restore a checkpoint blob into the pool BEFORE the first read on a cold mount (no-op if the pool
- *  is already warm). The HOST restores ONLY a blob whose stored lawHash matches the workspace's
+ *  is already warm). The ADAPTER restores ONLY a blob whose stored lawHash matches the workspace's
  *  CURRENT law (schema parity); a mismatched/absent blob costs at most a cold fold, never a wrong read. */
 export function importCheckpoint(eng, ws, blobB64, frontierB64) {
   return JSON.parse(call(eng.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64, ...(frontierB64 ? { frontier: frontierB64 } : {}) }, eng.STDERR));
 }
 
-// ── CHECKPOINT IN CUSTODY (the host-agnostic cold-mount; compute placement is beneath the contract) ──
+// ── CHECKPOINT IN CUSTODY (the adapter-agnostic cold-mount; compute placement is beneath the contract) ──
 // The folded projection is a fact ABOUT the chain — so carry it IN custody (a git ref), not in some
-// host's private storage the NEXT host can't reach. The ephemeral heavy container has no ctx.storage;
+// adapter's private storage the NEXT adapter can't reach. The ephemeral heavy container has no ctx.storage;
 // a DO checkpoint is invisible to it; so root (heavy) re-folds O(chain) on every cold start. Put the
-// checkpoint where every peer already looks — the ledger — and ANY host restores it O(delta): the git
+// checkpoint where every peer already looks — the ledger — and ANY adapter restores it O(delta): the git
 // carries its own folded state. Keyed by the CURRENT law hash (schema parity): a law upgrade orphans
 // the old checkpoint (the next reader cold-folds once, re-publishes under the new hash). Best-effort &
 // post-ack — a missing/stale checkpoint costs at most one cold fold, never a wrong read; main is truth.
@@ -1310,7 +1452,7 @@ const CKPT_REF = (lawHash) => `refs/meta/checkpoint/${lawHash}`;
 const CKPT_AUTHOR = { name: "nomos", email: "nomos@holon", timestamp: 0, timezoneOffset: 0 };
 
 // A serialized SQLite projection is mostly FREE PAGES (the fold DELETEs+reinserts per commit) — it
-// gzips ~30×. We compress the b64 export host-side before it enters custody: the ledger meters pushed
+// gzips ~30×. We compress the b64 export adapter-side before it enters custody: the ledger meters pushed
 // bytes against the workspace quota, and a cold peer fetches less. Runtime-neutral (CompressionStream
 // is in Node 18+ and workerd). The `meta` blob records the codec so a future format stays readable.
 async function streamAll(stream) {
@@ -1329,36 +1471,6 @@ async function gunzip(bytes) {
   return streamAll(new Response(bytes).body.pipeThrough(ds));
 }
 
-async function discoverCheckpointFromCustody(ledger) {
-  const freshHeaders = () => ({ ...(ledger.headers || {}) });
-  const refs = ((await git.listServerRefs({ http, url: ledger.remote, headers: freshHeaders(), prefix: "refs/meta/checkpoint/", protocolVersion: 2 })) || [])
-    .filter((r) => r.ref && r.ref.startsWith("refs/meta/checkpoint/") && r.oid);
-  if (!refs.length) return null;
-  const root = new Map();
-  root.set("ckpt", new Directory(new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const fs = makeGitFs(preopen, "/work", { File, Directory });
-  const gitdir = "/work/ckpt/nomos.git";
-  await git.init({ fs, gitdir, bare: true, defaultBranch: BRANCH });
-  await git.addRemote({ fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-  const readFile = async (oid, filepath) => { try { return (await git.readBlob({ fs, gitdir, oid, filepath })).blob; } catch { return null; } };
-  for (let i = refs.length - 1; i >= 0 && i >= refs.length - 3; i--) {
-    const { ref, oid } = refs[i];
-    try {
-      await git.fetch({ fs, http, gitdir, remote: "origin", ref, singleBranch: true, depth: 1, headers: freshHeaders() });
-      const gz = await readFile(oid, "checkpoint");
-      if (!gz) continue;
-      let meta = {}; try { const mb = await readFile(oid, "meta"); if (mb) meta = JSON.parse(dec.decode(mb)); } catch {}
-      const codec = meta.codec ?? "gzip";
-      const blob = dec.decode(codec === "gzip" ? await gunzip(gz) : gz);
-      const fgz = await readFile(oid, "frontier");
-      const frontier = fgz ? dec.decode(codec === "gzip" ? await gunzip(fgz) : fgz) : null;
-      return { ref, oid, cursor: meta.cursor || null, blob, frontier };
-    } catch { /* try an older checkpoint */ }
-  }
-  return null;
-}
-
 /** Wrap an exported checkpoint into git objects under `refs/meta/checkpoint/<lawHash>` (LOCAL only —
  *  no network). The ref points at a parentless commit whose tree carries `checkpoint` (the b64 blob)
  *  and `meta` ({cursor,bytes,lawHash}). Returns {ref, commitOid}. Separated from the push so the
@@ -1366,26 +1478,21 @@ async function discoverCheckpointFromCustody(ledger) {
 export async function writeCheckpointObjects(eng, ws, ex, lawHash) {
   const gitdir = gitdirOf(ws);
   const gz = await gzip(enc.encode(ex.blob));
-  const blobOid = await git.writeBlob({ fs: eng.fs, gitdir, blob: gz });
   // THE FOLD FRONTIER (the gate's Workspace state @cursor) rides ALONGSIDE the projection so a cold mount
   // can AUTHOR on a shallow clone (the projection alone is a read-collapsed view the gate can't fold from).
   // Era-safe: pre-this-era exports carry no `ex.frontier`, so the `frontier` file is simply absent and a
   // reader falls back to a full clone (writes need full history). Gzipped like the projection blob.
-  const tree = [
-    { mode: "100644", path: "checkpoint", oid: blobOid, type: "blob" },
-  ];
+  const files = [{ path: "checkpoint", bytes: gz }];
   let fgzLen = 0;
   if (ex.frontier) {
     const fgz = await gzip(enc.encode(ex.frontier));
     fgzLen = fgz.length;
-    tree.push({ mode: "100644", path: "frontier", oid: await git.writeBlob({ fs: eng.fs, gitdir, blob: fgz }), type: "blob" });
+    files.push({ path: "frontier", bytes: fgz });
   }
-  const metaOid = await git.writeBlob({ fs: eng.fs, gitdir, blob: enc.encode(JSON.stringify({ cursor: ex.cursor, bytes: ex.bytes ?? 0, lawHash, codec: "gzip", raw: ex.blob.length, stored: gz.length, frontierStored: fgzLen })) });
-  tree.push({ mode: "100644", path: "meta", oid: metaOid, type: "blob" });
-  const tree_ = await git.writeTree({ fs: eng.fs, gitdir, tree });
-  const commitOid = await git.writeCommit({ fs: eng.fs, gitdir, commit: { tree: tree_, parent: [], author: CKPT_AUTHOR, committer: CKPT_AUTHOR, message: `checkpoint ${ws} @${String(ex.cursor).slice(0, 16)}` } });
+  files.push({ path: "meta", bytes: enc.encode(JSON.stringify({ cursor: ex.cursor, bytes: ex.bytes ?? 0, lawHash, codec: "gzip", raw: ex.blob.length, stored: gz.length, frontierStored: fgzLen })) });
   const ref = CKPT_REF(lawHash);
-  await git.writeRef({ fs: eng.fs, gitdir, ref, value: commitOid, force: true });
+  // ONE kernel call: blobs→tree→parentless commit→force ref. Fixed timeSecs ⇒ deterministic (idempotent).
+  const commitOid = kgit.writeMetaCommit(eng, gitdir, { parents: [], files, message: `checkpoint ${ws} @${String(ex.cursor).slice(0, 16)}`, timeSecs: 0, ref });
   return { ref, commitOid };
 }
 
@@ -1395,17 +1502,17 @@ export async function writeCheckpointObjects(eng, ws, ex, lawHash) {
  *  pre-this-era checkpoint (no `frontier` file). */
 export async function readCheckpointBlob(eng, ws, commitOid) {
   const gitdir = gitdirOf(ws);
-  const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid: commitOid, filepath: "checkpoint" });
+  const blob = kgit.readBlob(eng, gitdir, commitOid, "checkpoint");
   let codec = "gzip";
-  try { codec = JSON.parse(dec.decode((await git.readBlob({ fs: eng.fs, gitdir, oid: commitOid, filepath: "meta" })).blob)).codec ?? "gzip"; } catch {}
+  try { codec = JSON.parse(dec.decode(kgit.readBlob(eng, gitdir, commitOid, "meta"))).codec ?? "gzip"; } catch {}
   const dezip = async (b) => dec.decode(codec === "gzip" ? await gunzip(b) : b);
   let frontier = null;
-  try { frontier = await dezip((await git.readBlob({ fs: eng.fs, gitdir, oid: commitOid, filepath: "frontier" })).blob); } catch { /* pre-this-era: no frontier */ }
+  try { const f = kgit.readBlob(eng, gitdir, commitOid, "frontier"); if (f) frontier = await dezip(f); } catch { /* pre-this-era: no frontier */ }
   return { blob: await dezip(blob), frontier };
 }
 
 /** The checkpoint's schema-parity key: a hash of the workspace's CURRENT law map (every installed
- *  domain). The HOST passes nothing — the engine derives it from the chain (bailiff). A law upgrade
+ *  domain). The ADAPTER passes nothing — the engine derives it from the chain (bailiff). A law upgrade
  *  changes the map → a new key → the old checkpoint is orphaned (the next reader cold-folds once and
  *  re-publishes). An explicit `lawHash` (the DO's existing govHash callers, tests) overrides. */
 export async function lawParity(eng, ws, lawHash) {
@@ -1423,7 +1530,7 @@ export async function pushCheckpoint(eng, ws, ledger, lawHash) {
     lawHash = await lawParity(eng, ws, lawHash);
     if (!lawHash) return { pushed: false, reason: "no-law" };
     const gitdir = gitdirOf(ws);
-    const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: "refs/heads/main" }).catch(() => null);
+    const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
     eng._ckptPushed ??= new Map();
     if (head && eng._ckptPushed.get(ws) === `${lawHash}:${head}`) {
       return { pushed: false, reason: "unchanged" };
@@ -1433,12 +1540,66 @@ export async function pushCheckpoint(eng, ws, ledger, lawHash) {
     const tag = `${lawHash}:${ex.cursor}`;
     if (eng._ckptPushed.get(ws) === tag) return { pushed: false, reason: "unchanged" };
     const { ref } = await writeCheckpointObjects(eng, ws, ex, lawHash);
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref, remoteRef: ref, force: true, headers: ledger.headers }));
+    await custodyPush(eng, ws, ledger, { remoteRef: ref }); // new checkpoint commit → ships its objects
     eng._ckptPushed.set(ws, tag);
     return { pushed: true, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
   } catch (e) { return { pushed: false, reason: String((e && e.message) || e).slice(0, 160) }; }
 }
 
+// ── WRITE-BEHIND CHECKPOINT (the cold-fold-on-remount fix) ─────────────────────────────────────────
+// THE BUG this kills: with write-behind custody on, we mirrored only the LEDGER (the commits), never the
+// CHECKPOINT (the folded projection). So a re-mounted/evicted holon found no checkpoint and RE-FOLDED the
+// whole chain on its first admit — O(chain), ~5.7ms/intent, ~9s on a 1635-intent ledger. "Warm" was a lie:
+// mount restored the git bytes but not the folded truth. These two halves let the write-behind lane persist
+// the checkpoint the SAME way it persists the ledger — export under the wasm lock (brief, O(delta) on a warm
+// holon), push off the lock — so a cold mount restores O(1) and admits one intent in O(delta). Cold ≈ warm.
+
+/** STAGE a checkpoint LOCALLY (wasm export + git object write). The caller MUST hold the wasm serialize
+ *  lock (exportCheckpoint re-enters the engine). Returns {ref, tag, cursor, bytes} ready to push, or null
+ *  when there is nothing to persist (no law / empty / unchanged since the last push). */
+export async function stageCheckpoint(eng, ws, lawHash) {
+  try {
+    lawHash = await lawParity(eng, ws, lawHash);
+    if (!lawHash) return null;
+    eng._ckptPushed ??= new Map();
+    const ex = exportCheckpoint(eng, ws);
+    if (!ex || ex.empty || !ex.ok || !ex.blob) return null;
+    const tag = `${lawHash}:${ex.cursor}`;
+    if (eng._ckptPushed.get(ws) === tag) return null; // already mirrored this cursor
+    const { ref } = await writeCheckpointObjects(eng, ws, ex, lawHash);
+    return { ref, tag, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
+  } catch { return null; }
+}
+
+/** PUSH a staged checkpoint to custody. Network only — the caller must NOT hold the wasm lock (the staged
+ *  git objects are immutable once written, so the push is race-free against concurrent admits). */
+export async function pushStagedCheckpoint(eng, ws, ledger, staged) {
+  if (!staged || !staged.ref) return { pushed: false };
+  await custodyPush(eng, ws, ledger, { remoteRef: staged.ref });
+  (eng._ckptPushed ??= new Map()).set(ws, staged.tag);
+  return { pushed: true, cursor: staged.cursor, bytes: staged.bytes };
+}
+
+/** RECOVERY: delete EVERY `refs/meta/checkpoint/*` on the ledger. A corrupt checkpoint wedges cold
+ *  mount (the restore traps before the holon can serve); deleting it makes the next mount re-fold
+ *  from `main` (content-addressed, intact) and write a fresh checkpoint on the next write. Pushes the
+ *  ref deletion to the RAW Artifacts remote with the ledger's own write token (no per-ref gate there
+ *  — the gate is the worker's git PROXY, not custody). Returns the deleted ref names. */
+export async function clearCheckpointRefs(ledger) {
+  const headers = ledger.headers || {};
+  // A ref deletion ships NO objects + needs NO local repo: the receive-pack advertisement gives each ref's
+  // current oid (the deletion command's old-oid), and pushPack sends the empty pack — pure custody transport.
+  const refs = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: "refs/meta/checkpoint/" });
+  const deleted = [];
+  for (const ref of Object.keys(refs)) {
+    try {
+      await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref, oldOid: refs[ref], newOid: ZERO_OID }] }));
+      deleted.push(ref);
+    } catch { /* best-effort cleanup */ }
+  }
+  return deleted;
+}
+
 /** Restore ws's projection from custody BEFORE the first read on a cold mount: ls-remote the law's
  *  checkpoint ref, shallow-fetch ONLY that commit (O(checkpoint), never O(chain)), import it. No-op if
  *  absent or the law drifted. Returns {restored, cursor?, reason?}. */
@@ -1451,13 +1612,12 @@ export async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
     lawHash = await lawParity(eng, ws, lawHash);
     if (!lawHash) return { restored: false, reason: "no-law" };
     const ref = CKPT_REF(lawHash);
-    const freshHeaders = () => ({ ...(ledger.headers || {}) });
-    const serverRefs = await git.listServerRefs({ http, url: ledger.remote, headers: freshHeaders(), prefix: ref, protocolVersion: 2 });
-    const found = (serverRefs || []).find((r) => r.ref === ref);
-    if (!found || !found.oid) return { restored: false, reason: "absent" };
-    const gitdir = gitdirOf(ws);
-    await git.fetch({ fs: eng.fs, http, gitdir, url: ledger.remote, ref, singleBranch: true, depth: 1, headers: freshHeaders() });
-    const { blob, frontier } = await readCheckpointBlob(eng, ws, found.oid);
+    const serverRefs = await custodyLsRefs(ledger, ref);
+    const foundOid = serverRefs[ref];
+    if (!foundOid) return { restored: false, reason: "absent" };
+    // Fetch ONLY the checkpoint commit (parentless → O(checkpoint), never O(chain)) into ws's repo + apply_pack.
+    await custodyFetch(eng, ws, ledger, { remoteRef: ref });
+    const { blob, frontier } = await readCheckpointBlob(eng, ws, foundOid);
     const r = importCheckpoint(eng, ws, blob, frontier);
     if (r && r.restored === true && r.cursor) {
       eng._ckptPushed ??= new Map();
@@ -1467,17 +1627,72 @@ export async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
   } catch (e) { return { restored: false, reason: String((e && e.message) || e).slice(0, 160) }; }
 }
 
-// Serialize a push through the host's per-repo lane when present (the DO threads `ledger.pushLane`); the
+// Serialize a push through the adapter's per-repo lane when present (the DO threads `ledger.pushLane`); the
 // container has none and serializes on its own chain. The point: ONE receive-pack to a given Artifacts repo
 // at a time — a detached checkpoint/shape push can never race the admit's main push (concurrent receive-packs
 // were corrupting/500ing the custody store). All same-repo pushes below funnel through here.
 const pushVia = (ledger, fn) => (ledger && ledger.pushLane ? ledger.pushLane(fn) : fn());
 
+// ── DUMB-PIPE CUSTODY (raw smart-HTTP via custody-transport; the KERNEL builds/ingests every pack). ──
+// These replace isomorphic-git's getRemoteInfo/listServerRefs/init/addRemote/fetch/push. The adapter only
+// shuttles bytes: ls-refs to learn a tip, fetchPack→apply_pack to ingest, packDelta→pushPack to emit.
+const fullRef = (r) => (r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`);
+const applyPackInto = (eng, ws, pack) => {
+  if (!pack || !pack.length) return;
+  const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
+  if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+};
+// Build the bare-repo skeleton (plain fs) so gix can open the repo BEFORE any objects land — mirrors the
+// client: gix init_bare trips wasi getcwd, so write HEAD/objects/refs directly. Idempotent.
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
+    try { await p.mkdir(`${gitdir}${d}`); } catch (e) { if (e && e.code !== "EEXIST") throw e; }
+  }
+  try { await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}\n`); } catch {}
+  try { await p.writeFile(`${gitdir}/config`, "[core]\n\trepositoryformatversion = 0\n\tbare = true\n"); } catch {}
+}
+// ls-remote (upload-pack) → { fullRefName: oid }.
+const custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+// Fetch `remoteRef`'s history into ws's repo (have=what we hold), apply_pack it, point `localRef` at the tip.
+// Returns the tip oid (null if the remote lacks the ref). `intoWs` lets a caller ingest into a different repo.
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+// Push a local ref to custody (advance / force / delete). The kernel builds the pack base(remoteOld)..new;
+// a delete or no-op sends the empty pack. Funnels through the per-repo push lane (serialised receive-packs).
+// `pointer`: the target oid is ALREADY in custody (a ref that points at an existing commit — shape/rename),
+// so send the EMPTY pack (a pure ref update, no objects). `newOid` overrides resolving a local ref.
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null } = {}) {
+  const headers = ledger.headers || {};
+  const remoteRefFull = fullRef(remoteRef);
+  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  const oldOid = remote[remoteRefFull] || ZERO_OID;
+  if (del) {
+    if (oldOid === ZERO_OID) return; // already gone
+    return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: ZERO_OID }] }));
+  }
+  const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
+  if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
+  if (tgt === oldOid) return; // up to date
+  // pointer ⇒ no objects (already in custody). Else: FF advance ⇒ delta base..new (minimal); non-ancestor
+  // (force) ⇒ pack_delta returns null → full pack.
+  let pack = null;
+  if (!pointer) { pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null; if (!pack) pack = packDelta(eng, ws, "", tgt); }
+  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+}
+
 // DURABILITY-BEFORE-ACK: only acked once the write LANDED in the ledger; a failed push
 // unmounts (drops local state) so the next access re-restores from custody.
 export async function commitAndPush(eng, ws, ledger) {
   try {
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir: gitdirOf(ws), url: ledger.remote, ref: "main", remoteRef: "main", force: false, headers: ledger.headers }));
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
   } catch (e) {
     unmount(eng, ws);
     throw new Error(`ledger push failed — write NOT durable, rolled back to ledger: ${e}`);
@@ -1498,15 +1713,15 @@ export async function pushShape(eng, ws, ledger) {
     const bytes = st && (st.sqliteBytes ?? st.bytes);
     if (bytes == null) return;
     const gitdir = gitdirOf(ws);
-    const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: "refs/heads/main" }).catch(() => null);
+    const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
     if (!head) return;
     const newRef = `refs/meta/shape/b${bytes}`;
     eng._lastShapeRef ??= new Map();
     if (eng._lastShapeRef.get(ws) === newRef) return;
-    await git.writeRef({ fs: eng.fs, gitdir, ref: newRef, value: head, force: true });
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: newRef, remoteRef: newRef, force: true, headers: ledger.headers }));
+    kgit.writeRef(eng, gitdir, newRef, head);
+    await custodyPush(eng, ws, ledger, { remoteRef: newRef, pointer: true }); // points at head (already in custody)
     const prev = eng._lastShapeRef.get(ws);
-    if (prev && prev !== newRef) { try { await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: prev, remoteRef: prev, delete: true, headers: ledger.headers })); } catch { /* leftover refs are harmless: the reader takes max(bytes) */ } }
+    if (prev && prev !== newRef) { try { await custodyPush(eng, ws, ledger, { remoteRef: prev, del: true }); } catch { /* leftover refs are harmless: the reader takes max(bytes) */ } }
     eng._lastShapeRef.set(ws, newRef);
   } catch { /* best-effort; placement self-heals */ }
 }
@@ -1515,30 +1730,33 @@ export async function pushShape(eng, ws, ledger) {
 // Returns {bytes} (the max, in case a restart left a stale ref) or null (no shape yet).
 export async function readShape(ledger) {
   try {
-    const refs = await git.listServerRefs({ http, url: ledger.remote, headers: { ...(ledger.headers || {}) }, prefix: "refs/meta/shape/", protocolVersion: 2 });
+    const refs = await custodyLsRefs(ledger, "refs/meta/shape/");
     let best = null;
-    for (const r of refs || []) {
-      const m = /refs\/meta\/shape\/b(\d+)$/.exec(r.ref || "");
+    for (const ref of Object.keys(refs)) {
+      const m = /refs\/meta\/shape\/b(\d+)$/.exec(ref);
       if (m) { const bytes = +m[1]; if (!best || bytes > best.bytes) best = { bytes }; }
     }
     return best;
   } catch { return null; }
 }
 
-// READ VISIBILITY (slice 5.1): the host STAMPS the presented `principal` onto the
-// read RPC (an impure identity read — never a host DECISION); the githolon gates the
+// READ VISIBILITY (slice 5.1): the adapter STAMPS the presented `principal` onto the
+// read RPC (an impure identity read — never a adapter DECISION); the githolon gates the
 // read against its OWN folded role-bindings and returns `{ok:false, error:"read-
 // forbidden:..."}` for a private type the principal may not read. Absent/"" principal
 // is the pre-5.1 wire — public reads are byte-identical.
 // `keys` (slice 6) = the reader's injected scope keys [{scope, epoch, key(b64)}], resolved
-// host-side (X25519 unwrap). Threaded into the read RPC; the wasm AEAD-opens envelope fields.
-export const qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
-export const query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+// adapter-side (X25519 unwrap). Threaded into the read RPC; the wasm AEAD-opens envelope fields.
+// EVERY adapter read rides the opaque `query` verb (offer-kernel P2): the kernel's rpc_query_bytes dispatches
+// by `op` to the read handler + decides the gate; the adapter never calls a typed read RPC. (The typed arms
+// survive behind `legacy-adapter-api` until P8 deletes them; no caller reaches them after this.)
+export const qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
+export const query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
 // THE ZANZIBAR CHECK/EXPAND (governance authz spine): a pure, replay-deterministic authority probe
 // over the projected relations table. `check` → { ok, allowed:bool }; `expand` → { ok, subjects:[...] }.
 // No principal/keys: relation facts are public authority state (admin/creator/platformCreator/capability).
-export const check = (eng, ws, object, relation, subject) => JSON.parse(call(eng.ex, "check", { repoArg: repoArgOf(ws), workspace: ws, object, relation, subject, branch: BRANCH }, eng.STDERR));
-export const expand = (eng, ws, object, relation) => JSON.parse(call(eng.ex, "expand", { repoArg: repoArgOf(ws), workspace: ws, object, relation, branch: BRANCH }, eng.STDERR));
+export const check = (eng, ws, object, relation, subject) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "check", object, relation, subject }), branch: BRANCH }, eng.STDERR));
+export const expand = (eng, ws, object, relation) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "expand", object, relation }), branch: BRANCH }, eng.STDERR));
 // THE AUTHOR-SIDE SEAL (slice 6): encrypt a plaintext field value into the on-chain envelope
 // (XChaCha isn't in WebCrypto, so the client calls the wasm; the scope key is injected, never on chain).
 // The SLOT IDENTITY is the #58 STABLE SID (rename-safety): the caller resolves (type,field)→sid
@@ -1547,11 +1765,11 @@ export const expand = (eng, ws, object, relation) => JSON.parse(call(eng.ex, "ex
 export const cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) =>
   JSON.parse(call(eng.ex, "crypto_seal_field", { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }, eng.STDERR)).envelope;
 // The client X25519 crypto (slice 6): keygen (device identity), wrap (committer → recipient pubkey),
-// unwrap (reader's device secret → scope key). The secret stays client/host-side, never on chain.
+// unwrap (reader's device secret → scope key). The secret stays client/adapter-side, never on chain.
 export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "crypto_keygen", {}, eng.STDERR));
 
 // AUTHOR DEVICE KEY (warrant-flip, identity_keys.md) — mint an ed25519 signing keypair IN the holon
-// (`author_keygen`); the secret stays client-side (here: the test/host injects it back as `authorSecret`
+// (`author_keygen`); the secret stays client-side (here: the test/adapter injects it back as `authorSecret`
 // on the author call). Returns { ok, secret, public } (both base64). `author_sign` is the lower-level
 // standalone signer; the author DOOR signs internally from the injected secret, so callers use `author`.
 export const authorKeygen = (eng) => JSON.parse(call(eng.ex, "author_keygen", {}, eng.STDERR));
@@ -1564,39 +1782,95 @@ export const attestationSign = (eng, { secret, asserterWorkspace, object, relati
 export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "crypto_wrap_key", { recipientPub, scopeKey }, eng.STDERR));
 export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
 // THE READ-POSTURE PROBE (slice 5.1): the githolon's own verdict on whether the
-// workspace is private + whether `principal` may read ALL of it — the host relays it
-// to gate the BULK reads (snapshot, git clone, count/sum) it cannot gate per-row-type.
-export const readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "read_posture", { repoArg: repoArgOf(ws), workspace: ws, principal, branch: BRANCH }, eng.STDERR));
-export const count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
-export const sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
-/** The maintained O(1) min/max read (#47 — the slice-4 extremum hand-back made an RPC).
- *  `kind` = "min"|"max"; an absent group answers `value: null` (never a fabricated 0). */
-export const extremum = (eng, ws, extremumId, kind, groupKey) => JSON.parse(call(eng.ex, "extremum", { repoArg: repoArgOf(ws), workspace: ws, extremumId, kind, groupKey: groupKey ?? "", branch: BRANCH }, eng.STDERR));
+// workspace is private + whether `principal` may read ALL of it — the adapter relays it
+// to gate the WHOLE-LEDGER reads (snapshot, git clone) it cannot serve partially.
+export const readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture" }), principal, branch: BRANCH }, eng.STDERR));
+// count/sum/extremum are GATED IN THE KERNEL (it knows each tally's `of` type + the read-visibility): the
+// adapter STAMPS the verified `principal` and relays the holon's verdict — it runs NO gate of its own. They ride
+// the opaque `query` verb (P2): `op` selects the handler; extremum's own `kind` stays its min/max selector.
+export const count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+export const sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+/** The maintained O(1) min/max read (#47). `kind` = "min"|"max"; an absent group answers `value: null`
+ *  (never a fabricated 0). Kernel-gated; rides the `query` verb (`op:"extremum"`, `kind` = min/max). */
+export const extremum = (eng, ws, extremumId, kind, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "extremum", extremumId, kind, groupKey: groupKey ?? "" }), principal, branch: BRANCH }, eng.STDERR));
+// GIT OFF THE HOT PATH: the KERNEL builds the conformant delta packfile (gix-pack); the adapter is dumb
+// plumbing (frames pkt-lines + POSTs). Returns the pack bytes (Uint8Array), or null if the kernel
+// couldn't produce a delta (base not an ancestor / head==base) — the adapter then falls back to a standard
+// main-ref push (backupToCustody). NO isomorphic-git, NO negotiation: the sole writer knows its delta.
+export function packDelta(eng, ws, base, head) {
+  try {
+    const r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), base, head }, eng.STDERR));
+    if (!r || r.ok !== true || typeof r.packB64 !== "string") return null;
+    return Uint8Array.from(atob(r.packB64), (c) => c.charCodeAt(0));
+  } catch { return null; }
+}
+
+// THE SERVING-LANE PACK (kernel-native clone/pull, replacing isomorphic-git fetch). `base` empty ⇒ a FULL
+// pack of all reachable from main (fresh clone); `base` = the client's known head ⇒ the incremental delta.
+// The kernel resolves main itself. Returns `{ packB64, bytes }` (base64 so it rides the container JSON op).
+export function servePack(eng, ws, base = "") {
+  let r;
+  try {
+    r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
+  } catch (e) {
+    // UP TO DATE: the client's `have` already IS main → nothing to send. A clean empty response, not an error.
+    if (/nothing to pack|head == base/.test(String(e))) return { packB64: "", bytes: 0, upToDate: true };
+    throw e;
+  }
+  if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
+  return { packB64: r.packB64, bytes: r.bytes };
+}
 export const nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
 // E2E crypto linkage probe (the encryption arc): run the wrap→unwrap + field seal→open
 // INSIDE the deployable wasm. Pure — no workspace, no chain. Returns {wrapHandoff, fieldAead}.
-export const cryptoSelftest = (eng) => JSON.parse(call(eng.ex, "crypto_selftest", { repoArg: "/work/none" }, eng.STDERR));
 
-/** Re-admit ONE carried intent (bytes) on local main — the DLQ-retry primitive. */
-export function applyIntentBytes(eng, ws, bytes) {
-  const name = `intent-in-${eng.seq++}.json`;
+// THE OFFER ADMISSION VERB (offer-kernel migration P1): admit a SEALED intent into `branch`
+// through the one gate and return the STRUCTURED VERDICT — `{ok:true, outcome:"admitted", head}`
+// or `{ok:true, outcome:"refused", offerId, verdict:{reason}}`. The adapter's admit lane migrates
+// onto this off `apply_intent` over the P1 slices; `defer` carries the batch-projection-defer.
+export function offerIntent(eng, ws, bytes, opts) {
+  const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
-  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
+  const deferProjection = !!(opts && opts.defer);
+  const branch = (opts && opts.branch) || BRANCH;
+  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+}
+
+/**
+ * RE-ADMIT sealed bytes through the OFFER verb (offer-kernel P1.2 — the one effectful move), normalized to
+ * the `{ok, head, error}` shape every adapter admit lane consumes. The adapter carries the bytes; the HOLON
+ * adjudicates — `admitted` → the new head; `refused` → the gate's own verdict reason. This is how EVERY adapter
+ * re-admission speaks `offer` (session admit, shard migrate, global replicate, DLQ retry); `apply_intent` is
+ * retired from the adapter (the wasm arm survives behind `legacy-adapter-api` only until P8 deletes it).
+ */
+export function offerAdmit(eng, ws, bytes, opts) {
+  const v = offerIntent(eng, ws, bytes, opts);
+  return v.outcome === "admitted"
+    ? { ok: true, head: v.head }
+    : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+
+/** Re-admit ONE carried intent (bytes) on local main — through the ONE effectful verb `offer` (no
+ *  apply_intent back door). Normalized to the legacy {ok, head, error} shape every caller (bench, CLI
+ *  replay, examples, DLQ retry) consumes. `defer` rides through to offer's batch-projection-defer. */
+export function applyIntentBytes(eng, ws, bytes, opts) {
+  return offerAdmit(eng, ws, bytes, opts);
 }
 
 // Main's recent intent ids + oids, cached by head (admission idempotence + walk boundary).
 async function mainIntentIds(eng, ws) {
   const gitdir = gitdirOf(ws);
-  const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
   if (!head) return { head: null, ids: new Set(), oids: new Set() };
   const cached = eng.mainIntents.get(ws);
   if (cached && cached.head === head) return cached;
   const ids = new Set(), oids = new Set();
-  for (const c of await git.log({ fs: eng.fs, gitdir, ref: BRANCH, depth: 500 })) {
+  // Main is a linear chain of intent commits (the container appends, never merges), so the recent intent
+  // commits ARE the recent main commits — the bounded idempotence window + walk boundary (was git.log depth 500).
+  for (const c of kgit.intentsAbove(eng, gitdir, head, "", 500)) {
     oids.add(c.oid);
     try {
-      const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
-      const id = JSON.parse(dec.decode(blob)).id;
+      const id = JSON.parse(dec.decode(bytesFromB64(c.intentB64))).id;
       if (typeof id === "string" && id) ids.add(id);
     } catch {}
   }
@@ -1608,14 +1882,21 @@ async function mainIntentIds(eng, ws) {
 /**
  * EDGE ADMISSION (the one machinery): judge every session/<cid> ref. Structural lane
  * refusals (control-plane intents, undeployed domains) and domain rejections route per
- * Jack's law: legitimate work DEAD-LETTERS (returned to the host to persist — the
+ * Jack's law: legitimate work DEAD-LETTERS (returned to the adapter to persist — the
  * engine has no durable store), obvious attacks drop. Admitted intents merge to main,
  * durably push, the branch is consumed.
  */
-export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFence = null, shardRouting = null, sessionRefs = null, defer = false } = {}) {
+export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFence = null, shardRouting = null, defer = false } = {}) {
   const refuse = new Set(refuseDomains);
   const routes = shardRouting ? directiveRoutes(eng) : null;
   const gitdir = gitdirOf(ws);
+  // FRESH HEADER COPY PER GIT OP. isomorphic-git's `discover` MUTATES the headers object it's given
+  // (a v2 op stamps `Git-Protocol: version=2` in). Sharing one object across a v2 listServerRefs and a
+  // v1 git.fetch made the fetch send `version=2`, the server answered v2, isomorphic-git parsed it as
+  // v1 → undefined refs → `TypeError: ...reading 'size'` on EVERY session fetch. A fresh copy per call
+  // makes that leak impossible no matter what mutated `ledger.headers` upstream. (Same pattern as the
+  // checkpoint/shape scans' `freshHeaders()`.)
+  const H = () => ({ ...(ledger.headers || {}) });
   // FLAME-GRAPH EDGE TIMINGS — coarse per-stage wall-clock the client stitches into the cross-tier trace.
   const _t0 = Date.now(); let _fetchMs = 0, _sealMs = 0, _intents = 0;
   const _spans = []; let _traceSeq = 0;
@@ -1628,29 +1909,16 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
   };
   const sessionRefPrefix = "refs/heads/session/";
   const sessions = {};
-  const indexedRefs = sessionRefs && typeof sessionRefs === "object" ? sessionRefs : null;
-  const _scanDone = _span(indexedRefs ? "scan session index" : "scan session refs", "cscan", 1);
-  if (indexedRefs) {
-    const entries = Array.isArray(indexedRefs)
-      ? indexedRefs.map((r) => [String(r?.session || r?.cid || r?.client || ""), String(r?.head || r?.oid || "")])
-      : Object.entries(indexedRefs).map(([cid, head]) => [cid, String(head || "")]);
-    for (const [cid, head] of entries) {
-      if (/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(cid) && /^[0-9a-f]{40}$/.test(head)) sessions[cid] = head;
-    }
-  } else {
-    const refs = await git.listServerRefs({
-      http,
-      url: ledger.remote,
-      headers: ledger.headers,
-      prefix: sessionRefPrefix,
-      protocolVersion: 2,
-    });
-    for (const r of refs || []) {
-      const ref = typeof r?.ref === "string" ? r.ref : "";
-      const oid = typeof r?.oid === "string" ? r.oid : "";
-      if (!ref.startsWith(sessionRefPrefix) || !oid) continue;
-      sessions[ref.slice(sessionRefPrefix.length)] = oid;
-    }
+  const _scanDone = _span("scan session refs", "cscan", 1);
+  // CUSTODY IS THE ONLY SOURCE. The adapter keeps NO session index — there is no adapter-held head to
+  // diverge from the ledger. Every admit lists the workspace's own session refs (listServerRefs)
+  // and admits exactly what is durably there. (The earlier adapter "session-offer index" let a
+  // client's CLAIMED head outlive the push that never durably landed; admit then chased an oid
+  // custody never had → NotFoundError on every tick → the client's work stranded forever. The
+  // cure is not a better cache — it is no cache: the adapter holds no authority, the ledger does.)
+  //
+  for (const [ref, oid] of Object.entries(await custodyLsRefs(ledger, sessionRefPrefix))) {
+    if (ref.startsWith(sessionRefPrefix) && oid) sessions[ref.slice(sessionRefPrefix.length)] = oid;
   }
   _scanDone({ sessions: Object.keys(sessions).length });
   const _scanMs = Date.now() - _t0;
@@ -1661,16 +1929,22 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
   const consumed = []; let totalAdmitted = 0;
   // §5.4 (slice 4): on the COORDINATOR of a taxonomy that declares `.global(...)`
   // reference data, every admitted intent touching a global aggregate is surfaced
-  // to the HOST, which replicates the SAME sealed bytes into each shard chain.
+  // to the ADAPTER, which replicates the SAME sealed bytes into each shard chain.
   const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng) : null;
   // ── §5.2 SUMMARY CAPTURE (slice 3): on a SHARD (selfLabel) whose law declares
   // estate-scoped reads, derive each admitted intent's per-(read, group) deltas with
   // the shard's own projection as the oracle (tallies sandwiched around the fold —
-  // O(touched)); the HOST authors the coalesced `nomosPropagateSummary` Order into
+  // O(touched)); the ADAPTER authors the coalesced `nomosPropagateSummary` Order into
   // the coordinator afterwards. The coordinator's gate re-verifies everything.
   const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0
     ? { reads: scopedReads(eng), prevs: new Map(), values: new Map(), events: [], rowsDelta: 0, rederived: new Set(), rowsByHome: new Map(), homeTags: new Map(), homeKeySet: new Set() }
     : null;
+  // BATCH ADMIT (the flame fix): defer the per-intent projection catch-up + frontier write
+  // to ONE flush after the whole cycle — UNLESS a per-intent projection read is required
+  // mid-loop: §5.2 summary capture (reads pre/post tallies around each fold) or §5.4 global
+  // surfacing (qById per admitted intent). Those keep the synchronous per-intent path. The
+  // common case (no sharding) gets the batch: N×(SQLite catch-up + checkpoint write) → 1.
+  const canDeferProjection = !summaryCtx && !(globalsDeclared && globalsDeclared.size > 0);
   if (summaryCtx) {
     // SLICE 8 — the per-home attribution table, off the shard's OWN receipts
     // (law-state: which homes this chain owns). A row id whose route-tag slot
@@ -1685,50 +1959,54 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
       }
     } catch (e) { log("home-tag-table-error", { ws, error: String(e).slice(0, 200) }); }
   }
-  const headBefore = summaryCtx ? await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null) : null;
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir, BRANCH) : null;
   for (const [cid, head] of Object.entries(sessions)) {
     const ref = `refs/heads/session/${cid}`;
     const shortCid = cid.length > 14 ? `${cid.slice(0, 14)}...` : cid;
     const _sessionDone = _span(`session ${shortCid}`, "csession", 1, { client: cid });
     try {
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
       const _fetchDone = _span(`fetch ${shortCid}`, "cfetch", 2, { client: cid });
       const _f = Date.now();
       try {
-        // THIN-FETCH (the 40s→0.5s fix): a `singleBranch` fetch sets isomorphic-git's have-set to
-        // [the fetched ref] ONLY. The edge holds no local session ref yet ⇒ it offers ZERO haves ⇒ the
-        // server re-ships the ENTIRE history (O(chain): measured ~10MB/40s for a 1-commit delta).
-        // Pre-seed the local session ref to OUR main head so the negotiation offers main as a have and the
-        // server sends only the delta above the common ancestor (~1KB/0.5s). main is append-only, so the
-        // client's fork point is always an ancestor of our head — the thin pack is always sound.
-        const localMain = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
-        if (localMain) { try { await git.writeRef({ fs: eng.fs, gitdir, ref, value: localMain, force: true }); } catch {} }
-        await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref, singleBranch: true, headers: ledger.headers });
+        // THIN-FETCH (the 40s→0.5s fix): pass our main head as the `have` so the server sends ONLY the delta
+        // above the common ancestor (the kernel's apply_pack ingests it). main is append-only, so the client's
+        // fork point is always an ancestor of our head — the thin pack is sound. A failed thin fetch is an
+        // optimization miss, never load-bearing: fall back to a clean full fetch so work is never stranded.
+        const localMain = kgit.resolveRef(eng, gitdir, BRANCH);
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
+        } catch (thinErr) {
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr && thinErr.message || thinErr).slice(0, 160) });
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
+        }
       } finally {
         _fetchMs += Date.now() - _f;
         _fetchDone();
       }
       const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
       const main = await mainIntentIds(eng, ws);
+      // The session's NEW intents: walk the session tip newest→oldest, stop at the first commit already on
+      // main (the fork point), reverse to oldest→newest. intentsAbove returns {oid, intentB64} so the gate
+      // loop reads the intent straight off the walk (no per-oid readBlob).
+      const recent = kgit.intentsAbove(eng, gitdir, head, "", 100);
       const chain = [];
-      for (const c of await git.log({ fs: eng.fs, gitdir, ref: head, depth: 100 })) {
-        if (main.oids.has(c.oid)) break;
-        chain.push(c.oid);
-      }
+      for (let i = recent.length - 1; i >= 0; i--) { if (main.oids.has(recent[i].oid)) break; chain.push(recent[i]); }
       chain.reverse(); // oldest → newest
       _walkDone({ intents: chain.length });
       const admitted = [], rejected = [], skipped = [];
       const _gateDone = _span(`gate+fold ${shortCid}`, "cgate", 2, { client: cid, intents: chain.length });
-      for (const oid of chain) {
+      for (const c of chain) {
+        const oid = c.oid;
         try {
-          const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid, filepath: "intent.json" });
+          const blob = bytesFromB64(c.intentB64);
           let dom = null, intentId = null, dirId = null;
           try { const doc = JSON.parse(dec.decode(blob)); intentId = typeof doc.id === "string" ? doc.id : null; dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null; dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null; } catch {}
-          // WRITE-AUTHORITY: law (control-plane) intents never ride the session lane —
-          // nor do HOST-FENCED domains (e.g. `workspaces` on root: governance directives
-          // enter ONLY through the admin-gated lane, never open session pushes).
-          if (!dom || dom === "nomos" || dom === "bootstrap" || refuse.has(dom)) {
-            rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses ${dom ? `'${dom}'` : "non-authored"} intents — law deploys go through POST /v1/workspaces/${ws}/domains with the workspace secret` });
+          // THE GATE DECIDES (offer-kernel doctrine): no adapter domain-string filter for control-plane —
+          // an install/governance offer rides the SAME lane and the kernel gate refuses an author lacking
+          // the declared relation (a TYPED gate refusal, not a adapter verdict). Only `!dom` (malformed) and
+          // the explicit `refuse` fence (root's `workspaces` governance lane) stay — structural, not authority.
+          if (!dom || refuse.has(dom)) {
+            rejected.push({ oid: oid.slice(0, 10), error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
             continue;
           }
           // THE RECEIPT FENCE (capability_marketplace.md slice 1.5 — the ratified
@@ -1752,10 +2030,10 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
           if (routes && dom && dirId) {
             // THE SEAL PEN IS THE BAILIFF'S (slice 5): `nomosSealHome` (strikes the
             // migrated history out of a source's fold) and `nomosSealHandoff` (flips
-            // the map) are HOST-orchestrated legs of the §6 move — a session-lane
+            // the map) are ADAPTER-orchestrated legs of the §6 move — a session-lane
             // offer of either is an attack on the move lane, refused and DROPPED.
             if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
-              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' — the §6 handoff seals are authored by the host after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
+              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' — the §6 handoff seals are authored by the adapter after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
               continue;
             }
             const route = routes.get(`${dom} ${dirId}`);
@@ -1801,13 +2079,21 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
             continue;
           }
           const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
-          const res = applyIntentBytes(eng, ws, blob);
+          // OFFER-KERNEL P1.2: edge re-admission runs through the `offer` verb (the doctrine's one
+          // effectful move) over the SAME admit_core gate. The structured verdict is normalized
+          // back to the {ok, head, error} the outcome handling below consumes; the refused/parked
+          // ref-custody (replacing the JS DLQ) is the next sub-slice — for now refusals still
+          // dead-letter exactly as before (the verdict reason IS the gate's refusal reason).
+          const verdict = offerIntent(eng, ws, blob, { defer: canDeferProjection });
+          const res = verdict.outcome === "admitted"
+            ? { ok: true, head: verdict.head }
+            : { ok: false, error: verdict.verdict?.reason ?? verdict.error ?? "the offer was refused" };
           if (res.ok) {
             main.ids.add(intentId); main.oids.add(res.head); main.head = res.head;
             admitted.push({ oid: oid.slice(0, 10), head: res.head });
             if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
             // AN ADMITTED PLACEMENT (birth<Type> on the coordinator): surfaced to the
-            // HOST so it can author the assignment RECEIPT into the shard's own chain
+            // ADAPTER so it can author the assignment RECEIPT into the shard's own chain
             // (sharding §3 — the receipt leg).
             if (shardRouting && dirId) {
               const placement = placementDirectives(eng).get(dirId);
@@ -1820,9 +2106,9 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
                 }
               }
               // AN ADMITTED SPLIT (nomosSplitShard on the coordinator, slice 5):
-              // surfaced to the HOST so it can run the §6 migration legs (re-admit
+              // surfaced to the ADAPTER so it can run the §6 migration legs (re-admit
               // on the target, seal the source, close/open the subtotals, flip the
-              // map) — a session-authored split COMPLETES like a host-authored one.
+              // map) — a session-authored split COMPLETES like a adapter-authored one.
               if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
                 let p = null;
                 try { p = JSON.parse(dec.decode(blob)).payload?.payload ?? null; } catch {}
@@ -1832,7 +2118,7 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
               }
             }
             // AN ADMITTED GLOBAL WRITE (§5.4, slice 4 — coordinator only): the sealed
-            // bytes are surfaced to the HOST, which re-admits them into every shard
+            // bytes are surfaced to the ADAPTER, which re-admits them into every shard
             // chain (the reverse lane — replicated reference data). O(events) per
             // admitted intent, and only when the law declares `.global(...)`.
             if (globalsDeclared && globalsDeclared.size > 0) {
@@ -1880,13 +2166,26 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
       _sessionDone();
     }
   }
+  // THE DEFERRED-PROJECTION FLUSH (batch admit): the per-intent applies skipped the SQLite
+  // catch-up + frontier write; flush ONCE here — refresh_projection folds every new commit in
+  // a single incremental catch-up and walks the deferred heads to advance the verified frontier.
+  if (canDeferProjection && totalAdmitted) {
+    const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
+    try { refreshProjection(eng, ws); } catch (e) { log("admit-projection-flush-failed", { ws, error: String(e).slice(0, 200) }); }
+    finally { _projDone(); }
+  }
+  // OFFER-KERNEL P1.2b: materialize this cycle's refusals as git-custody facts (refs/heads/refused/*),
+  // pushed inline — BEFORE the main seal, which unmounts on failure (a refusal fact must not be lost to
+  // an unrelated main-push failure). The holon's verdict recorded as a HOLON FACT that syncs + survives
+  // eviction; the adapter's ctx.storage DLQ is retired in favour of these.
+  if (deadLetters.length) { try { await materializeRefused(eng, ws, ledger, deadLetters); } catch (e) { log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) }); } }
   // THE BATCH SEAL — one receive-pack for the whole admit cycle. A failed push unmounts (engine.unmount drops
   // the ws fs); we then SKIP the branch deletes so every offered intent re-admits next cycle (idempotent by
   // id). On success, delete the consumed session branches (best-effort cleanup; a stale branch is a harmless
   // re-fetch). Single-client workspaces were already one push/cycle; this collapses collaborative bursts.
-  // THE BAILIFF SEAM: when the HOST asked us to `defer` (the open session admit lane on a
+  // THE BAILIFF SEAM: when the ADAPTER asked us to `defer` (the open session admit lane on a
   // non-coordinator workspace), we DO NOT push or delete consumed branches inline — the fold
-  // is already on resident main (truth), and the host backs it up to custody off the critical
+  // is already on resident main (truth), and the adapter backs it up to custody off the critical
   // path (engine.backupToCustody, debounced + coalesced). This is sound because the SESSION
   // BRANCHES are themselves durable in custody (the durable inbox) and admit is idempotent by
   // intent id: a crash before backup just re-derives the SAME sealed main from the same offers.
@@ -1909,12 +2208,12 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
   }
   if (_sealed && !deferDurability) {
     for (const { ref } of consumed) {
-      try { await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: ref, delete: true, headers: ledger.headers })); } catch {}
+      try { await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true }); } catch {}
     }
   }
-  const newMain = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
   log("admit", { ws, sessions: results.length, main: newMain });
-  // The coalesced §5.2 delta of this batch (null when no scoped read moved): the HOST
+  // The coalesced §5.2 delta of this batch (null when no scoped read moved): the ADAPTER
   // closes it against the coordinator's recorded frontier and authors the Order.
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
   const _total = Date.now() - _t0;
@@ -1926,29 +2225,48 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
     ...(placements.length ? { placements } : {}),
     ...(splits.length ? { splits } : {}),
     ...(globalsOut.length ? { globals: globalsOut } : {}),
-    // The host's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
+    // The adapter's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
     // un-backed-up commits and `consumed` are the session branches to delete AFTER the push lands.
     ...(deferDurability && totalAdmitted ? { deferred: true, consumed, admitted: totalAdmitted } : {}),
   };
 }
 
+// WRITE-BEHIND CUSTODY MIRROR (git off the hot path). Push a CAPTURED head snapshot to custody main —
+// NOT the live `main` ref (re-resolving it would chase a moving target under concurrent folds, the bug
+// that stormed the old debounced backup). The container is the SOLE writer of main, so custody is a
+// pure FF mirror: no pull-back, no reconciliation. Read-only on eng.fs except a transient backup ref
+// (a different key from anything a fold touches; the head's objects are immutable). NEVER unmounts on
+// failure — the resident holon stays truth and the client can re-offer (worst case: the mirror lags).
+export async function backupHead(eng, ws, ledger, head) {
+  if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
+  if (!head) return { ok: false, error: "no head" };
+  try {
+    // Push EXACTLY the captured `head` (not live main, which moves under concurrent folds) to custody main —
+    // the kernel builds the delta remoteOld..head; no local tmp ref needed (custodyPush names the oid).
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    return { ok: true, head };
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e).slice(0, 200), head };
+  }
+}
+
 // THE BAILIFF'S BACKUP — push resident main to custody when quiet, NEVER on a write's critical
 // path and NEVER destructive. Unlike commitAndPush (durability-before-ack: unmounts on failure),
-// a failed backup leaves the resident holon mounted and the session branches intact, so the host
+// a failed backup leaves the resident holon mounted and the session branches intact, so the adapter
 // just retries on the next quiet tick. Append-only main means an off-lock push of an older head
 // concurrent with a fresh fold is always a sound fast-forward subset (the newer head backs up next).
 export async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
   if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
   const gitdir = gitdirOf(ws);
   let head = null;
-  try { head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }); } catch { return { ok: false, error: "no local main" }; }
+  head = kgit.resolveRef(eng, gitdir, BRANCH); if (!head) return { ok: false, error: "no local main" };
   try {
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: BRANCH, force: false, headers: ledger.headers }));
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
   } catch (e) {
     return { ok: false, error: String(e).slice(0, 200), head };
   }
   for (const { ref } of consumed) {
-    try { await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: ref, delete: true, headers: ledger.headers })); } catch {}
+    try { await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true }); } catch {}
   }
   return { ok: true, head };
 }
@@ -1960,7 +2278,7 @@ export async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
  * genesis (contiguity → per-intent re-admission with the engine re-run; byte-preserving,
  * read-only — see wasm_git_holon.rs `verify_chain`). Returns the wasm's verdict object:
  * `{valid:true, head, intents, plansRerun, controllerHash, installedDomains}` or
- * `{valid:false, check, error, atIndex?, atCommit?}`. The HOST decides what a refusal
+ * `{valid:false, check, error, atIndex?, atCommit?}`. The ADAPTER decides what a refusal
  * does (archive + refuse to serve); this op never mutates the ledger.
  */
 export async function verifyChain(eng, ws, ledger) {
@@ -1970,10 +2288,12 @@ export async function verifyChain(eng, ws, ledger) {
     return { valid: false, check: "mount", error: m.restoreError || "no refs/heads/main on the ledger — nothing to verify (push refs/heads/main to deliver a chain first)" };
   }
   try {
-    return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+    // P4: chain verification rides the `query` verb (op:"verifyChain") — a read-only verdict, not a
+    // top-level adapter verb. The adapter still relays the verdict (archive-on-refuse, bless-on-valid) = custody.
+    return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
   } finally {
     // The verified (or refused) chain must never linger as a servable mount: serving
-    // re-restores from custody AFTER the host blesses the verdict.
+    // re-restores from custody AFTER the adapter blesses the verdict.
     unmount(eng, ws);
   }
 }
@@ -1986,7 +2306,8 @@ export async function verifyChain(eng, ws, ledger) {
  * the LEDGER's bytes, never a hot mount.)
  */
 export function verifyChainLocal(eng, ws) {
-  return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  // P4: rides the `query` verb (op:"verifyChain") — a read-only verdict.
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
 
 /**
@@ -2002,14 +2323,169 @@ export async function archiveRefusedMain(eng, ws, ledger, label) {
   if (!m.restored) { unmount(eng, ws); return { archived: false, error: "no main to archive" }; }
   const gitdir = gitdirOf(ws);
   try {
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: `refs/heads/refused/${label}`, force: true, headers: ledger.headers }));
-    await pushVia(ledger, () => git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: `refs/heads/${BRANCH}`, delete: true, headers: ledger.headers }));
+    // main's objects are already in custody → a pure pointer (empty pack) to refused/<label>, then drop main.
+    await custodyPush(eng, ws, ledger, { localRef: "refs/heads/main", remoteRef: `refs/heads/refused/${label}`, pointer: true });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", del: true });
     return { archived: true, ref: `refs/heads/refused/${label}` };
   } finally {
     unmount(eng, ws);
   }
 }
 
+/** A refused-offer id sanitized to a git ref path component (the offerId is the intent id). */
+const refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+
+/**
+ * OFFER-KERNEL P1.2b: materialize a REFUSED offer as a HOLON FACT in git custody — a commit on
+ * `refs/heads/refused/<offerId>` carrying { intent.json, verdict.json } (the holon's verdict, NOT
+ * adapter mail). A quarantine branch is OUTSIDE the verified ledger (commit-closure doesn't bind it),
+ * so the adapter writes it as CUSTODY — the DECISION was the holon's (`offer` → `refused`), the adapter
+ * only records it. The ref SYNCS (a client pulls refs/heads/refused/* to see its dead-lettered
+ * work) and survives DO eviction. Deterministic (CKPT_AUTHOR timestamp 0) ⇒ idempotent: re-refusing
+ * the same intent rewrites the same commit. `dl` is the admitAll dead-letter
+ * `{ intentId, oid, error, blob, domain, directiveId }`.
+ */
+export async function writeRefusedRef(eng, ws, dl) {
+  const gitdir = gitdirOf(ws);
+  const blob = dl.blob instanceof Uint8Array ? dl.blob : enc.encode(String(dl.blob || ""));
+  const verdict = enc.encode(JSON.stringify({
+    offerId: dl.intentId || null, oid: dl.oid || null,
+    domain: dl.domain || null, directiveId: dl.directiveId || null,
+    verdict: { reason: String(dl.error || "refused") },
+  }));
+  const ref = refusedRefName(dl.intentId || dl.oid);
+  kgit.writeMetaCommit(eng, gitdir, {
+    parents: [], files: [{ path: "intent.json", bytes: blob }, { path: "verdict.json", bytes: verdict }],
+    message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} — ${String(dl.error || "").slice(0, 120)}`,
+    timeSecs: 0, ref,
+  });
+  return ref;
+}
+
+/** Read the refused-offer facts back: refs/heads/refused/* → [{ ref, offerId, domain, directiveId,
+ *  verdict, intentB64 }]. The git-custody source for GET /dead-letters + the retry lane (P1.2b.2). */
+export async function listRefusedRefs(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/"); // [{ ref, oid }] — oid in hand, no resolveRef
+  const out = [];
+  for (const { ref, oid } of refs) {
+    try {
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json");
+      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json");
+      const v = JSON.parse(dec.decode(vb));
+      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
+    } catch { /* a partial/corrupt refused ref is skipped (the reader is best-effort) */ }
+  }
+  return out;
+}
+
+/**
+ * OFFER-KERNEL P1.2b: turn an admit cycle's refusals into git-custody facts. Each dead-letter is
+ * written as `refs/heads/refused/<offerId>` ({intent.json, verdict.json}) and PUSHED to custody so
+ * it SYNCS to clients + survives DO eviction — replacing the adapter-mail DLQ (`ctx.storage`). Called
+ * inline from the admit lanes: refusals are EXCEPTIONAL (off the admit hot path), so the inline push
+ * is cheap and makes the fact durable even on the deferred-seal lane (where main's push is debounced).
+ * Best-effort per ref (a failed write/push is logged, never aborts the cycle — the session branch is
+ * still durable, so the refusal re-materializes next cycle, idempotently). Returns the pushed refs.
+ */
+export async function materializeRefused(eng, ws, ledger, deadLetters) {
+  const gitdir = gitdirOf(ws);
+  const refs = [];
+  for (const dl of deadLetters || []) {
+    try {
+      const ref = await writeRefusedRef(eng, ws, dl);
+      await custodyPush(eng, ws, ledger, { remoteRef: ref }); // new refused commit → ships its objects
+      refs.push(ref);
+    } catch (e) {
+      log("refused-ref-materialize-failed", { ws, intentId: dl?.intentId, error: String(e).slice(0, 200) });
+    }
+  }
+  return refs;
+}
+
+/** Drop a refused-offer fact (retry succeeded, or an explicit discard): delete the local ref + push
+ *  the delete to custody so the quarantine branch is gone everywhere. Best-effort. */
+export async function deleteRefusedRef(eng, ws, ledger, offerId) {
+  const gitdir = gitdirOf(ws);
+  const ref = refusedRefName(offerId);
+  try { kgit.deleteRef(eng, gitdir, ref); } catch {}
+  try { await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true }); }
+  catch (e) { log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) }); }
+  return ref;
+}
+
+// ── THE OUTBOX (capability_offers_https.md — offer-kernel P6, slice 1) ─────────────────────
+// A capability is a holon at a URL; an obligation is offered to it as an HTTPS POST. The kernel
+// already surfaces the orders (reactorScan = obligations at status:'requested'); the capability's
+// endpoint rides the law (declaredCapabilities). The BAILIFF joins them and POSTs — pure transport,
+// it decides nothing (the holon decided by admitting the obligation; the law named the endpoint).
+// A delivered order is recorded as refs/heads/outbox/<requestId> (the delivery marker + custody;
+// idempotent — a delivered order is never re-POSTed). The receipt lane (slice 2) closes the
+// obligation; the credential lane (slice 3) forwards the caller's packet.
+
+/** A requestId sanitized to a git ref path component. */
+const outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+
+/** Has this order already been delivered? (the outbox ref is the delivered marker — idempotency). */
+export async function outboxRefExists(eng, ws, requestId) {
+  return !!kgit.resolveRef(eng, gitdirOf(ws), outboxRefName(requestId));
+}
+
+/** Record a delivered order as a git-custody fact: a commit on refs/heads/outbox/<requestId>
+ *  carrying { order.json, delivery.json }. Deterministic CKPT_AUTHOR ⇒ idempotent. */
+export async function writeOutboxRef(eng, ws, rec) {
+  const gitdir = gitdirOf(ws);
+  const orderBlob = enc.encode(JSON.stringify(rec.order ?? {}));
+  const delivery = enc.encode(JSON.stringify({
+    requestId: rec.requestId || null, capability: rec.capability || null, url: rec.url || null,
+    status: rec.status || "delivered", httpStatus: rec.httpStatus ?? null,
+  }));
+  const ref = outboxRefName(rec.requestId);
+  kgit.writeMetaCommit(eng, gitdir, {
+    parents: [], files: [{ path: "order.json", bytes: orderBlob }, { path: "delivery.json", bytes: delivery }],
+    message: `outbox: ${rec.capability || "?"} → ${String(rec.url || "?").slice(0, 80)}`,
+    timeSecs: 0, ref,
+  });
+  return ref;
+}
+
+/**
+ * THE BAILIFF OUTBOX LOOP: scan the kernel's requested orders, join each to its declared
+ * capability endpoint, and POST the obligation as an HTTPS offer. Best-effort + idempotent
+ * (a delivered order has an outbox ref and is skipped). Runs on the engine plane (DO edge OR
+ * heavy container — both have `fetch` + the ledger). Returns `{delivered:[requestId], skipped, errors}`.
+ * The adapter decides nothing: the obligation (a holon admission) is the emit decision; the endpoint
+ * is law. NO receipt handling yet (slice 2) — POSTing is delivery, the obligation stays 'requested'.
+ */
+export async function emitOutbox(eng, ws, ledger) {
+  const orders = (() => { try { return reactorScan(eng, ws); } catch { return []; } })();
+  if (!Array.isArray(orders) || orders.length === 0) return { delivered: [], skipped: 0, errors: 0 };
+  const byType = new Map();
+  for (const c of declaredCapabilities(eng, ws)) if (c && c.aggregateId) byType.set(c.aggregateId, c);
+  const gitdir = gitdirOf(ws);
+  const delivered = []; let skipped = 0, errors = 0;
+  for (const order of orders) {
+    const cap = byType.get(order.taskType);
+    if (!cap || !cap.endpoint) { skipped++; continue; } // no destination — rests at 'requested'
+    if (await outboxRefExists(eng, ws, order.requestId)) { skipped++; continue; } // already delivered
+    try {
+      const res = await fetch(cap.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-nomos-capability": cap.capability, "x-nomos-workspace": ws },
+        body: JSON.stringify({ capability: cap.capability, requestId: order.requestId, taskType: order.taskType, params: order.params, scheduledAt: order.scheduledAt, deadlineAt: order.deadlineAt }),
+        signal: AbortSignal.timeout(30000),
+      });
+      if (!res.ok) { errors++; log("outbox-deliver-non2xx", { ws, requestId: order.requestId, url: cap.endpoint, status: res.status }); continue; }
+      const ref = await writeOutboxRef(eng, ws, { requestId: order.requestId, capability: cap.capability, url: cap.endpoint, order, status: "delivered", httpStatus: res.status });
+      try { await custodyPush(eng, ws, ledger, { remoteRef: ref }); }
+      catch (e) { log("outbox-ref-push-failed", { ws, ref, error: String(e).slice(0, 200) }); }
+      delivered.push(order.requestId);
+    } catch (e) { errors++; log("outbox-deliver-failed", { ws, requestId: order.requestId, url: cap.endpoint, error: String(e).slice(0, 200) }); }
+  }
+  if (delivered.length || errors) log("outbox", { ws, delivered: delivered.length, skipped, errors });
+  return { delivered, skipped, errors };
+}
+
 /** Genesis boot: bootstrap → the nomos controller; idempotent when already Active. */
 export async function boot(eng, ws, ledger) {
   const m = await mountWorkspace(eng, ws, ledger);
@@ -2021,17 +2497,25 @@ export async function boot(eng, ws, ledger) {
   return { status: "created", head: result.head, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
 }
 
-/** Install a tenant package under the nomos controller (validation is the HOST's job). */
+/** Install a tenant package under the nomos controller (validation is the ADAPTER's job). */
 export async function deploy(eng, ws, ledger, usda, domainHash, dispositions) {
   // THE EVOLVE-GATE ANSWER LANE (#58): `dispositions` ({retired, retyped, rebinds,
   // ackBy}) ride the committed installDomain payload — IN-HISTORY facts the one gate
   // adjudicates the stable-id diff against. Absent for the common (non-destructive)
   // upgrade; the gate's typed refusal names the remedy when one is needed.
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos);
-  // Shard identity used to be inferred from host-side taxonomy. That is retired:
+  // ATOMICITY: VALIDATE the post-install projection BEFORE committing to custody. The install's
+  // read manifest is re-derived on this read; if it cannot fold (e.g. a divergent read-projection
+  // declaration the kernel refuses), this THROWS — and because we have NOT yet pushed, custody
+  // stays clean (the durable source of truth never holds an unfoldable install; the in-memory mount
+  // is evicted + re-mounted from clean custody on the error). A bad install must FAIL CLOSED, never
+  // persist in the chain. (Was: commitAndPush THEN qById — a fold failure left the install pushed,
+  // wedging every later fold. See read-manifest-evolution-gap.)
+  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
+  // Shard identity used to be inferred from adapter-side taxonomy. That is retired:
   // if sharding needs declaration, the holon must derive and author it itself.
   await commitAndPush(eng, ws, ledger);
-  return { head: result.head, installation: qById(eng, ws, `domain-installation:${domainHash}`) };
+  return { head: result.head, installation };
 }
 
 export function snapshot(eng, ws) {
@@ -2048,18 +2532,15 @@ export function stats(eng) {
 
 export async function ledgerStats(eng, ws, ledger = null) {
   const gitdir = gitdirOf(ws);
-  let head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  let head = kgit.resolveRef(eng, gitdir, BRANCH);
   if (!head && ledger?.remote) {
     try {
-      const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-      const remoteMain = (info.refs && info.refs.heads && info.refs.heads[BRANCH]) || null;
+      // Cold: build the skeleton + pull main into the KERNEL's odb (custodyFetch → apply_pack), then resolve.
+      await custodySkeleton(eng, gitdir);
+      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
       if (!remoteMain) return { head: null, commits: 0 };
-      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: BRANCH }).catch(() => {});
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: BRANCH, singleBranch: true, headers: ledger.headers });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: `refs/heads/${BRANCH}`, value: remoteMain, force: true });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: `ref: refs/heads/${BRANCH}`, force: true, symbolic: true });
-      head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+      kgit.writeRef(eng, gitdir, "HEAD", `ref: refs/heads/${BRANCH}`);
+      head = kgit.resolveRef(eng, gitdir, BRANCH);
       const mounted = eng.mounted.get(ws);
       if (mounted) {
         mounted.restored = true;
@@ -2071,32 +2552,32 @@ export async function ledgerStats(eng, ws, ledger = null) {
   if (!head) return { head: null, commits: 0 };
   const mounted = eng.mounted.get(ws);
   if (mounted?.ledgerStats?.head === head) return mounted.ledgerStats;
-  const commits = (await git.log({ fs: eng.fs, gitdir, ref: head, depth: 10000000 })).length;
+  // The chain is a linear sequence of intent commits, so intent-commit count == commit count.
+  const commits = kgit.intentsAbove(eng, gitdir, head).length;
   const out = { head, commits };
   if (mounted) mounted.ledgerStats = out;
   return out;
 }
 
-export async function countRemoteCommits(ledger) {
-  const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-  const head = (info.refs && info.refs.heads && info.refs.heads[BRANCH]) || null;
+export async function countRemoteCommits(eng, ledger) {
+  const head = (await custodyLsRefs(ledger, "refs/heads/main"))["refs/heads/main"] || null;
   if (!head) return { head: null, commits: 0 };
-  const root = new Map();
-  root.set("count", new Directory(new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const fs = makeGitFs(preopen, "/work", { File, Directory });
-  const gitdir = "/work/count/nomos.git";
-  await git.init({ fs, gitdir, bare: true, defaultBranch: BRANCH });
-  await git.addRemote({ fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-  await git.fetch({ fs, http, gitdir, remote: "origin", ref: BRANCH, singleBranch: true, headers: ledger.headers });
-  await git.writeRef({ fs, gitdir, ref: `refs/heads/${BRANCH}`, value: head, force: true });
-  await git.writeRef({ fs, gitdir, ref: "HEAD", value: `ref: refs/heads/${BRANCH}`, force: true, symbolic: true });
-  const commits = (await git.log({ fs, gitdir, ref: head, depth: 10000000 })).length;
-  return { head, commits };
+  // Count without mounting the workspace: pull main into a SCRATCH dir under the KERNEL's own odb (the adapter
+  // has no repo — the kernel ingests the pack via apply_pack + walks it), then tear the scratch dir down.
+  const scratch = "__ledgercount__";
+  try {
+    stageWorkspaceDir(eng, scratch);
+    await custodySkeleton(eng, gitdirOf(scratch));
+    await custodyFetch(eng, scratch, ledger, { remoteRef: "refs/heads/main" });
+    const commits = kgit.intentsAbove(eng, gitdirOf(scratch), head).length;
+    return { head, commits };
+  } finally {
+    try { eng.preopen.dir.contents.get("ws").contents.delete(scratch); } catch {}
+  }
 }
 
 /** Per-branch projection observables (cursor, projectCalls, sqliteBytes — see #37). */
-export const projectionStats = (eng, ws) => JSON.parse(call(eng.ex, "projection_stats", ws ? { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH } : {}, eng.STDERR));
+export const projectionStats = (eng, ws) => JSON.parse(call(eng.ex, "query", ws ? { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "projectionStats" }), branch: BRANCH } : { queryBytes: b64Json({ op: "projectionStats" }) }, eng.STDERR));
 
 /**
  * THE POST-ACK WARM LANE (#34): replenish the wasm engine's pristine-sandbox pool
@@ -2108,5 +2589,7 @@ export const projectionStats = (eng, ws) => JSON.parse(call(eng.ex, "projection_
  */
 export function warmEngine(eng) {
   flushDeferredProjections(eng); // the deferred-ack projection flush (#47) rides the same lane
-  return JSON.parse(call(eng.ex, "engine_warm", {}, eng.STDERR));
+  // P3: the pristine-pool warm rides the `query` verb (op:"warm") — a non-effectful maintenance read,
+  // not a top-level adapter verb. Still post-ack (the adapter calls warmEngine off the write critical path).
+  return JSON.parse(call(eng.ex, "query", { repoArg: "/work", workspace: "root", queryBytes: b64Json({ op: "warm" }), branch: BRANCH }, eng.STDERR));
 }