@githolon/testing 0.3.0

package/vendor/engine/engine.mjs

@@ -0,0 +1,1370 @@
+// AUTO-SYNCED from cloud/holon-host/src/engine.mjs by testing/build.mjs — DO NOT EDIT HERE.
+// Nomos Cloud — THE ENGINE PLANE (one machinery, two hosts).
+//
+// Everything that touches a resident holon wasm instance + its /work tree lives HERE,
+// extracted from the HolonDO so the 12GiB CONTAINER tier runs the IDENTICAL logic the
+// edge DO runs (the old container worker was a drifting fork — killed). The hosts differ
+// only in what they inject:
+//
+//   * the EDGE host (worker.mjs HolonDO): wasm via the wrangler CompiledWasm import,
+//     replica from the DO id, ledgers minted from env.ARTIFACTS, runs in workerd;
+//   * the HEAVY host (container/holon-worker.mjs): wasm compiled from disk, replica
+//     from the container instance base, ledgers ARRIVE on each op (containers have no
+//     Workers bindings — the control-plane DO mints tokens and sends them), runs in Node.
+//
+// CONTROL PLANE STAYS IN THE DO: ownership secrets, manifest overlays, the DLQ store,
+// quotas/rates, alarms. The engine RETURNS data (e.g. dead-letter entries with intent
+// bytes) and the host persists. Runtime-neutral: workerd + Node 22 (globalThis.crypto,
+// fetch, TextEncoder are the only ambient dependencies).
+import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
+import git from "isomorphic-git";
+import http from "isomorphic-git/http/web";
+import { makeGitFs } from "./git-fs.mjs";
+import { serializeTree } from "./tree.mjs";
+
+const enc = new TextEncoder(), dec = new TextDecoder();
+const BRANCH = "main";
+export const repoArgOf = (ws) => `/work/ws/${ws}`;
+export const gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+
+const unpack = (p) => { const v = typeof p === "bigint" ? p : BigInt(p); return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) }; };
+export async function sha256hex(t) { const b = await crypto.subtle.digest("SHA-256", enc.encode(t)); return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join(""); }
+function osEntropyBuffer(n) { const bytes = new Uint8Array(n * 8); for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length))); const out = new Array(n), T = 2 ** 53; for (let i = 0; i < n; i++) { let z = 0n; for (let b = 7; b >= 0; b--) z = (z << 8n) | BigInt(bytes[i * 8 + b]); out[i] = Number(z >> 11n) / T; } return out; }
+// Emit BigInt values as RAW JSON integers (a 63-bit replica must not round through a JS Number).
+function stringifyBig(o) { return JSON.stringify(o, (_k, v) => (typeof v === "bigint" ? `@@B:${v}@@` : v)).replace(/"@@B:(\d+)@@"/g, "$1"); }
+const log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
+
+function call(ex, mode, fields, STDERR) {
+  const req = enc.encode(JSON.stringify({ mode, ...fields }));
+  const reqPtr = ex.git_holon_alloc(req.length);
+  try {
+    new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
+    const { ptr, len } = unpack(ex.git_holon_call(reqPtr, req.length));
+    try {
+      const e = JSON.parse(dec.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
+      return e.result;
+    } finally { ex.git_holon_dealloc(ptr, len); }
+  } finally { ex.git_holon_dealloc(reqPtr, req.length); }
+}
+
+function seedManifests(m, strings) {
+  m.set("domain_manifests.json", new File(enc.encode(strings.read)));
+  m.set("identity-manifests.json", new File(enc.encode(strings.identity)));
+}
+
+export const installPayload = (hash, usda, installedBy) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [] });
+
+/**
+ * Boot the resident wasm + /work tree. `wasmModule` is a PRECOMPILED WebAssembly.Module
+ * (the host compiles its way); `manifestStrings` = {read, identity} (baked ∪ overlays —
+ * the HOST owns overlay storage and recomputes); `replica` = the host's unique 63-bit id.
+ */
+export async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, manifestStrings, replica, installedBy = "nomos-cloud" }) {
+  const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
+  const root = new Map();
+  seedManifests(root, manifestStrings);
+  root.set("domain.package.usda", new File(enc.encode(bootstrapPkg)));
+  root.set("ws", new Directory(new Map()));
+  const preopen = new PreopenDirectory("/work", root);
+  const STDERR = [];
+  const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {}), ConsoleStdout.lineBuffered((l) => STDERR.push(l)), preopen];
+  const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
+  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
+  const code = wasi.start(inst);
+  if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!inst.exports[n]) throw new Error(`missing export ${n}`);
+  const eng = {
+    ex: inst.exports, preopen, STDERR, seq: 0, replica, hashes,
+    bootstrapPkg, nomosPkg, manifestStrings, installedBy,
+    fs: makeGitFs(preopen, "/work", { File, Directory }),
+    mounted: new Map(),       // ws -> { restored, remoteMain, restoreError }
+    mainIntents: new Map(),   // ws -> { head, ids:Set, oids:Set } (admission idempotence)
+    knownDomainsCache: null,
+  };
+  return eng;
+}
+
+/** Swap the manifest strings (a deploy staged a new overlay) + restage every mount. */
+export function setManifests(eng, strings) {
+  eng.manifestStrings = strings;
+  eng.knownDomainsCache = null;
+  eng.directiveRoutesCache = null;
+  eng.scopedReadsCache = null;
+  eng.placementDirectivesCache = null;
+  eng.tenantTypesCache = null;
+  eng.globalAggregatesCache = null;
+  const root = eng.preopen.dir.contents;
+  seedManifests(root, strings);
+  const wsRoot = root.get("ws");
+  for (const ws of eng.mounted.keys()) {
+    const wsDir = wsRoot.contents.get(ws);
+    if (wsDir) seedManifests(wsDir.contents, strings);
+  }
+}
+
+/** The domains DEPLOYED to this workspace = the effective identity map's keys. */
+export function knownDomains(eng) {
+  if (eng.knownDomainsCache) return eng.knownDomainsCache;
+  eng.knownDomainsCache = new Set(Object.keys(JSON.parse(eng.manifestStrings.identity)));
+  return eng.knownDomainsCache;
+}
+
+// ── TRANSPARENT SHARDING: the WRONG-HOME GATE (the edge bailiff — sharding slice 2) ──
+//
+// The LAW lives in two places the bailiff only READS: the identity manifests'
+// hash-bearing `routes` table (which payload field carries a directive's home, derived
+// at compile from the plan itself), and the coordinator chain's `NomosShardAssignment`
+// rows (the shard map as law-state). The worker DECIDES NOTHING — exactly the quota-law
+// posture: it compares the intent's home against the map and answers with a TYPED
+// refusal naming the correct workspace. Since slice 3a (#41) the CHAIN GATE ITSELF also
+// enforces wrong-home (the law's derived `nomosWrongHome:<directive>` workspace
+// invariants, judged against the shard's own NomosShardIdentity law-state at author,
+// admit AND verify_chain) — this bailiff is RETAINED as defense-in-depth in front of it.
+
+/** directive routes off the effective identity manifests: `${domain} ${directiveId}` → route. */
+export function directiveRoutes(eng) {
+  if (eng.directiveRoutesCache) return eng.directiveRoutesCache;
+  const routes = new Map();
+  let identity = {};
+  try { identity = JSON.parse(eng.manifestStrings.identity); } catch {}
+  for (const [domain, manifestJson] of Object.entries(identity)) {
+    try {
+      const m = typeof manifestJson === "string" ? JSON.parse(manifestJson) : manifestJson;
+      for (const r of (m && m.routes) || []) routes.set(`${domain} ${r.directive}`, r);
+    } catch {}
+  }
+  eng.directiveRoutesCache = routes;
+  return routes;
+}
+
+/** The 48-bit route tag of a home key (must agree byte-for-byte with the client mint). */
+const routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
+/** The tag slot of a kernel-minted id (the UUIDv7 leading 12 hex chars). */
+function routeTagHexOfMintedId(id) {
+  const i = id.indexOf("_");
+  if (i <= 0) return undefined;
+  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();
+  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : undefined;
+}
+
+/**
+ * Judge ONE routed intent against the shard map. `shardRouting` is HOST-INJECTED:
+ * `{ selfLabel, coordinatorWs, assignments() }` — `selfLabel` is this workspace's shard
+ * label (`s<k>`) or null when it IS the coordinator; `assignments()` resolves the
+ * ACTIVE `NomosShardAssignment` rows from the coordinator's law-state. Returns null to
+ * pass, or `{ error, wrongHome?, deadLettered? }`:
+ *   * assigned elsewhere → the TYPED `wrong-home` refusal naming the correct workspace
+ *     (never dead-lettered: a routed client self-heals it);
+ *   * no placement at all → a DEAD-LETTERED jam with the placement remedy (legitimate
+ *     work, never lost — the DLQ discipline).
+ */
+export async function wrongHomeVerdict(shardRouting, route, payload) {
+  const value = payload ? payload[route.key] : undefined;
+  if (typeof value !== "string" || !value) return null; // shape problems are the law's verdict, not the bailiff's
+  const rows = (await shardRouting.assignments()) || [];
+  let assignment = null;
+  if (route.via === "axis") {
+    assignment = rows.find((a) => a.homeKey === value) || null;
+  } else {
+    const tag = routeTagHexOfMintedId(value);
+    if (tag !== undefined) {
+      for (const a of rows) {
+        if ((await routeTagHexOfHomeKey(a.homeKey)) === tag) { assignment = a; break; }
+      }
+    }
+  }
+  if (!assignment) {
+    return {
+      error: `no shard placement for this write's home ('${route.key}': ${value.slice(0, 80)}) — author the derived placement intent (birth<Type>) on the coordinator '${shardRouting.coordinatorWs}' first, then POST /dead-letters/retry`,
+      deadLettered: true,
+    };
+  }
+  // §6 — HOME-MOVING (slice 5): a home mid-handoff accepts NO writes anywhere — the
+  // typed refusal PARKS the work (dead-lettered on both sides, never lost); a routed
+  // client retries it onto the post-split home once the handoff seals.
+  const movingTo = typeof assignment.status === "string" && assignment.status.startsWith("moving:")
+    ? assignment.status.slice("moving:".length)
+    : null;
+  if (movingTo) {
+    return {
+      error: `home-moving: home '${value.slice(0, 80)}' is migrating ${assignment.shard} -> ${movingTo} (shard map v${assignment.mapVersion ?? 1}) — parked; a routed client retries automatically after the handoff seals`,
+      homeMoving: { homeKey: value, from: assignment.shard, target: movingTo, workspace: `${shardRouting.coordinatorWs}--${movingTo}` },
+      deadLettered: true,
+    };
+  }
+  if (shardRouting.selfLabel === assignment.shard) return null;
+  const correct = `${shardRouting.coordinatorWs}--${assignment.shard}`;
+  return {
+    error: `wrong-home: this write's home is assigned to '${correct}' (shard map v${assignment.mapVersion ?? 1}) — the client's shard map is stale; a routed client re-routes and retries automatically`,
+    wrongHome: { workspace: correct, ...(assignment.mapVersion !== undefined ? { mapVersion: assignment.mapVersion } : {}) },
+  };
+}
+
+// ── §5.2 — THE DELTA LANE (sharding slice 3): the shard-side EMITTER machinery ──
+//
+// After a shard's edge admission folds a batch, the HOST authors one coalesced
+// `nomosPropagateSummary` Order into the COORDINATOR's chain: per touched
+// (scoped read, group) the ABSOLUTE subtotal + the covered range's per-intent
+// event deltas as content-addressed evidence. The coordinator's ONE gate
+// adjudicates it (frontier contiguity + held-vs-claimed recomputation — the law
+// in workspace_sharding.ts); the engine here only DERIVES the evidence, with the
+// shard's own projection as the oracle (maintained tallies read before/after each
+// admitted intent — O(touched), never the world).
+
+/** The estate-total bucket separator (must agree with the law's `summaryBucket`). */
+const SUMMARY_SEP = "\u001f";
+const summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
+const splitSummaryKey = (key) => { const i = key.indexOf(SUMMARY_SEP); return [key.slice(0, i), key.slice(i + 1)]; };
+/** The synthetic per-shard row-count read (capacity headroom — the split policy's input). */
+export const NOMOS_SHARD_ROWS_READ = "nomosShardRows";
+// FRAMEWORK aggregates are EXCLUDED from the row-count read (and from deep-verify's
+// recount): identity/receipt rows enter chains through the deploy + receipt legs
+// (never via session admission), so counting them would let the lanes drift. The
+// load metric is TENANT rows — which is what capacity headroom means anyway.
+const FRAMEWORK_AGG_TYPES = new Set([
+  "NomosShardAssignment", "NomosShardIdentity", "NomosHomeReceipt", "NomosShardRegistry",
+  "NomosShardPolicy", "NomosSummarySubtotal", "NomosSummaryFrontier", "NomosDeepVerify",
+  "NomosCheckpointSeal",
+  // CONTROL-PLANE law-state (every chain carries them via installDomain) — never tenant data:
+  "PolicyBundle", "DomainInstallation",
+]);
+
+/** TENANT aggregate types = the read manifest's declared field-kind types minus the
+ *  framework set — the ONE definition all three row-count lanes share (the capture,
+ *  the suffix re-derivation, deep-verify's recount): control-plane rows (PolicyBundle,
+ *  DomainInstallation) and framework law-state never skew the capacity metric. */
+function tenantTypes(eng) {
+  if (eng.tenantTypesCache) return eng.tenantTypesCache;
+  let readManifest = {};
+  try { readManifest = JSON.parse(eng.manifestStrings.read); } catch {}
+  // §5.4 (slice 4): GLOBAL reference data is replicated custody on every shard —
+  // its rows arrive by the reverse lane (replicateIntents — a host leg the §5.2
+  // capture never sees), so counting them as tenant load would let the three
+  // row-count lanes drift (capture vs suffix vs deep-verify recount). Excluded
+  // from the capacity metric on EVERY lane, by the one shared definition here.
+  const globals = globalAggregates(eng);
+  const out = new Set(Object.keys(readManifest.aggregateFieldKinds || {}).filter((t) => !FRAMEWORK_AGG_TYPES.has(t) && !globals.has(t)));
+  eng.tenantTypesCache = out;
+  return out;
+}
+
+/** The derived PLACEMENT directives off the effective identity manifests:
+ *  packed type `site` ⇒ `birthSite` keyed by payload field `siteId` (the law's naming). */
+export function placementDirectives(eng) {
+  if (eng.placementDirectivesCache) return eng.placementDirectivesCache;
+  const out = new Map(); // directiveId -> { axis, keyField }
+  const pascal = (s) => s.replace(/[_\s-]+(\w)/g, (_m, c) => c.toUpperCase()).replace(/^./, (c) => c.toUpperCase());
+  let identity = {};
+  try { identity = JSON.parse(eng.manifestStrings.identity); } catch {}
+  for (const manifestJson of Object.values(identity)) {
+    let m;
+    try { m = typeof manifestJson === "string" ? JSON.parse(manifestJson) : manifestJson; } catch { continue; }
+    for (const t of (m && m.workspaceTypes) || []) {
+      if (!t || t.mode !== "packed") continue;
+      const p = pascal(String(t.id));
+      out.set(`birth${p}`, { axis: t.id, keyField: `${p.length ? p[0].toLowerCase() + p.slice(1) : p}Id` });
+    }
+  }
+  eng.placementDirectivesCache = out;
+  return out;
+}
+
+/** The ESTATE-SCOPED maintained reads off the effective identity manifests.
+ *  SLICE 4: `where` (the canonical predicate, hash-bearing in the manifest) rides
+ *  along — the LIVE capture's oracle is the projection's maintained tally (already
+ *  predicate-aware in the kernel); the SUFFIX re-derivation evaluates it host-side
+ *  ({@link evalCanonicalPred}) so both lanes agree byte-for-byte. */
+export function scopedReads(eng) {
+  if (eng.scopedReadsCache) return eng.scopedReadsCache;
+  const out = [];
+  let identity = {};
+  try { identity = JSON.parse(eng.manifestStrings.identity); } catch {}
+  for (const manifestJson of Object.values(identity)) {
+    let m;
+    try { m = typeof manifestJson === "string" ? JSON.parse(manifestJson) : manifestJson; } catch { continue; }
+    for (const c of (m && m.counts) || []) {
+      if (c && typeof c.scope === "string") out.push({ id: c.id, kind: "count", of: c.of, by: c.by ?? null, ...(c.where ? { where: c.where } : {}) });
+    }
+    for (const s of (m && m.sums) || []) {
+      if (s && typeof s.scope === "string") out.push({ id: s.id, kind: "sum", of: s.of, by: s.by ?? null, field: s.sumField, ...(s.where ? { where: s.where } : {}) });
+    }
+  }
+  eng.scopedReadsCache = out;
+  return out;
+}
+
+/**
+ * Evaluate a canonical count/sum predicate (`predicate.ts` CanonicalPred — eq/ne
+ * clauses + and/or trees) over a host-folded field map. EXACTLY the kernel's
+ * declared semantics: values canonicalize to strings (int fields compare their
+ * decimal form); `eq` over an ABSENT field is FALSE, `ne` over an absent field is
+ * TRUE (unset ≠ any literal — the §7-D symmetry rule). Used ONLY by the suffix
+ * re-derivation fold; the live capture's oracle is the maintained tally itself.
+ */
+export function evalCanonicalPred(pred, get) {
+  if (!pred || typeof pred !== "object") return true;
+  if (pred.kind === "and") return (pred.clauses || []).every((c) => evalCanonicalPred(c, get));
+  if (pred.kind === "or") return (pred.clauses || []).some((c) => evalCanonicalPred(c, get));
+  const raw = get(pred.field);
+  const present = raw !== undefined && raw !== null;
+  const canonical = present ? String(raw) : undefined;
+  if (pred.kind === "eq") return present && canonical === pred.value;
+  if (pred.kind === "ne") return !present || canonical !== pred.value;
+  return true; // an unknown clause kind never silently filters — fail-open here is fail-CLOSED at the gate (values mismatch loudly)
+}
+
+/**
+ * THE GLOBAL (reference-data) AGGREGATES (§5.4, slice 4): the identity manifests'
+ * `workspaceTypes[].globals` — aggregates homed on the COORDINATOR and replicated
+ * DOWNWARD into every shard chain by re-admission (the reverse delta lane).
+ */
+export function globalAggregates(eng) {
+  if (eng.globalAggregatesCache) return eng.globalAggregatesCache;
+  const out = new Set();
+  let identity = {};
+  try { identity = JSON.parse(eng.manifestStrings.identity); } catch {}
+  for (const manifestJson of Object.values(identity)) {
+    let m;
+    try { m = typeof manifestJson === "string" ? JSON.parse(manifestJson) : manifestJson; } catch { continue; }
+    for (const t of (m && m.workspaceTypes) || []) {
+      for (const g of (t && t.globals) || []) if (typeof g === "string") out.add(g);
+    }
+  }
+  eng.globalAggregatesCache = out;
+  return out;
+}
+
+/** Parse an intent blob's sealed events: [{aggregate, ops: Map(field -> {Str|Int})}]. */
+function parseIntentEvents(blob) {
+  let doc;
+  try { doc = JSON.parse(dec.decode(blob)); } catch { return []; }
+  const events = Array.isArray(doc && doc.events) ? doc.events : [];
+  return events.map((ev) => {
+    const sets = new Map();
+    for (const op of ev.ops || []) {
+      const v = op && op.op && op.op.Set;
+      if (v === undefined) continue;
+      if (typeof v.Str === "string") sets.set(op.field, v.Str);
+      else if (typeof v.Int === "number") sets.set(op.field, v.Int);
+    }
+    return { aggregate: String(ev.aggregate || ""), sets };
+  });
+}
+
+const groupOf = (read, data) => {
+  if (read.by === null) return "";
+  const v = data ? data[read.by] : undefined;
+  return v === undefined || v === null ? undefined : String(v);
+};
+const tallyOf = (eng, ws, read, group) =>
+  read.kind === "count" ? count(eng, ws, read.id, group).count : sum(eng, ws, read.id, group).sum;
+
+/**
+ * Begin one admitted intent's summary capture: snapshot the touched aggregates +
+ * the maintained tallies of every CANDIDATE (read, group) BEFORE the fold. The
+ * candidates come from the intent's own sealed ops (new group values ride the
+ * Set ops) plus the pre-state rows (old group values) — bounded by the intent.
+ */
+function beginSummaryCapture(eng, ws, ctx, blob) {
+  const events = parseIntentEvents(blob);
+  if (events.length === 0) return null;
+  const pre = new Map(); // aggregateId -> {type, data} | null
+  const candidates = new Set(); // summaryKey(readId, group)
+  for (const ev of events) {
+    if (!pre.has(ev.aggregate)) {
+      const rows = qById(eng, ws, ev.aggregate);
+      pre.set(ev.aggregate, rows.length ? { type: rows[0].type, data: rows[0].data || {} } : null);
+    }
+    const before = pre.get(ev.aggregate);
+    const evType = ev.sets.get("__type") ?? (before ? before.type : undefined);
+    for (const read of ctx.reads) {
+      if (read.of !== evType) continue;
+      const oldGroup = before ? groupOf(read, before.data) : undefined;
+      if (oldGroup !== undefined) candidates.add(summaryKey(read.id, oldGroup));
+      if (read.by === null) candidates.add(summaryKey(read.id, ""));
+      else if (ev.sets.has(read.by)) candidates.add(summaryKey(read.id, String(ev.sets.get(read.by))));
+    }
+  }
+  // Tally every candidate BEFORE the fold; record the batch-start value once per group.
+  const preTallies = new Map();
+  for (const key of candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const v = tallyOf(eng, ws, read, group);
+    preTallies.set(key, v);
+    if (!ctx.prevs.has(key)) ctx.prevs.set(key, { read, group, value: v });
+  }
+  return { events, pre, candidates, preTallies };
+}
+
+/** Finish the capture AFTER the fold: re-tally, diff, append the evidence event. */
+function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
+  const deltas = [];
+  for (const key of cap.candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const after = tallyOf(eng, ws, read, group);
+    const before = cap.preTallies.get(key) ?? 0;
+    if (after !== before) deltas.push({ readId, group, delta: after - before });
+    ctx.values.set(key, { read, group, value: after });
+  }
+  // The synthetic row-count read: existence flips, with the projection as oracle.
+  // The ABSOLUTE rides relative to the coordinator-held value (the HOST closes it
+  // at emit time — a shard never enumerates its own whole projection per batch).
+  let rowsDelta = 0;
+  for (const [aggregateId, before] of cap.pre) {
+    const rows = qById(eng, ws, aggregateId);
+    const type = rows.length ? rows[0].type : before ? before.type : undefined;
+    if (type === undefined || !tenantTypes(eng).has(type)) continue; // tenant rows only
+    const existsAfter = rows.length > 0;
+    if (!before && existsAfter) rowsDelta += 1;
+    else if (before && !existsAfter) rowsDelta -= 1;
+  }
+  if (rowsDelta !== 0) {
+    deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: rowsDelta });
+    ctx.rowsDelta += rowsDelta;
+  }
+  if (deltas.length > 0) ctx.events.push({ oid, intentId: intentId || "", deltas });
+}
+
+/**
+ * The coalesced delta of one admission batch (null when nothing summarizable moved).
+ * `rowsDelta` rides separately: the HOST closes the `nomosShardRows` absolute against
+ * the coordinator-held value at emit time (held + Σ deltas — the gate re-checks both
+ * halves). The other subtotals' `prev` is the batch-start maintained tally, which
+ * equals the coordinator-held value exactly when the frontier is contiguous — and the
+ * gate refuses otherwise (the suffix re-derivation lane is the remedy).
+ */
+function summaryOfCapture(ctx, fromOid, toOid) {
+  if (ctx.events.length === 0 || !toOid || fromOid === toOid) return null;
+  const subtotals = [];
+  for (const [key, cur] of ctx.values) {
+    const prev = ctx.prevs.get(key);
+    const prevValue = prev ? prev.value : 0;
+    if (cur.value === prevValue) continue; // untouched-in-net — carries nothing
+    subtotals.push({
+      readId: cur.read.id,
+      group: cur.group,
+      kind: cur.read.kind,
+      prev: prevValue,
+      value: cur.value,
+    });
+  }
+  if (subtotals.length === 0 && ctx.rowsDelta === 0) return null;
+  return {
+    fromOid: fromOid || "",
+    toOid,
+    subtotals: subtotals.sort((a, b) => (summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1)),
+    events: ctx.events,
+    rowsDelta: ctx.rowsDelta,
+  };
+}
+
+/**
+ * THE SUFFIX RE-DERIVATION (the frontier-gap self-heal + /summaries/resync): derive
+ * the delta payload for (fromOid → main head] from THE CHAIN ITSELF — a host-side
+ * pure fold of the scoped reads' group/sum fields over every commit since genesis
+ * (Lww in chain order; scoped reads are predicate-free by the compile gate). Used
+ * when the coordinator's recorded frontier does not match a live capture (a lost
+ * emission, DO eviction, an operator resync) — O(chain), explicit, logged.
+ */
+export async function deriveSummarySuffix(eng, ws, fromOid) {
+  const reads = scopedReads(eng);
+  const gitdir = gitdirOf(ws);
+  const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  if (!head) return { ok: false, error: "no local main to derive from" };
+  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
+  commits.reverse(); // genesis → head
+  const state = new Map(); // aggregateId -> { type, fields: Map }
+  const running = new Map(); // summaryKey -> value
+  const bump = (key, d) => running.set(key, (running.get(key) ?? 0) + d);
+  let prevs = null; // snapshot at fromOid
+  let events = [];
+  let inSuffix = fromOid === "" || fromOid === undefined;
+  if (inSuffix) prevs = new Map();
+  let sawFrom = inSuffix;
+  for (const c of commits) {
+    let blob = null;
+    try { blob = (await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" })).blob; } catch {}
+    const deltas = [];
+    let intentId = "";
+    if (blob) {
+      let doc = null;
+      try { doc = JSON.parse(dec.decode(blob)); } catch {}
+      // A STRIKE-BEARING chain (a §6 seal retracted moved history): the incremental
+      // event fold below cannot express the retraction (only the kernel's
+      // strike-correct reprojection can). Answer `strikeBearing` — the caller closes
+      // against the coordinator-HELD values with the PROJECTION as the oracle
+      // (summaryCloseAgainstHeld), exactly the posture the live capture already uses.
+      if (doc && Array.isArray(doc.strikes) && doc.strikes.length > 0) {
+        return { ok: true, strikeBearing: true, head };
+      }
+      intentId = (doc && doc.id) || "";
+      for (const ev of parseIntentEvents(blob)) {
+        const cur = state.get(ev.aggregate) ?? { type: undefined, fields: new Map(), exists: false };
+        const newType = ev.sets.get("__type");
+        if (newType !== undefined) cur.type = newType;
+        const tallyBefore = new Map();
+        for (const read of reads) {
+          if (read.of !== cur.type && read.of !== newType) continue;
+          tallyBefore.set(read.id, contribution(read, cur));
+        }
+        const existedBefore = cur.exists;
+        for (const [f, v] of ev.sets) cur.fields.set(f, v);
+        cur.exists = true;
+        state.set(ev.aggregate, cur);
+        const effType = cur.type ?? newType;
+        if (!existedBefore && effType !== undefined && tenantTypes(eng).has(effType)) {
+          bump(summaryKey(NOMOS_SHARD_ROWS_READ, ""), 1);
+          deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: 1 });
+        }
+        for (const read of reads) {
+          if (read.of !== cur.type) continue;
+          const before = tallyBefore.get(read.id) ?? null;
+          const after = contribution(read, cur);
+          for (const d of contributionDiff(read, before, after)) {
+            bump(summaryKey(d.readId, d.group), d.delta);
+            deltas.push(d);
+          }
+        }
+      }
+    }
+    if (inSuffix && deltas.length) {
+      // Coalesce same-(read,group) deltas within one intent.
+      const byKey = new Map();
+      for (const d of deltas) byKey.set(summaryKey(d.readId, d.group), (byKey.get(summaryKey(d.readId, d.group)) ?? 0) + d.delta);
+      const merged = [...byKey.entries()].filter(([, d]) => d !== 0).map(([k, d]) => {
+        const [readId, group] = splitSummaryKey(k);
+        return { readId, group, delta: d };
+      });
+      if (merged.length) events.push({ oid: c.oid, intentId, deltas: merged });
+    }
+    if (!inSuffix && c.oid === fromOid) { inSuffix = true; sawFrom = true; prevs = new Map(running); }
+  }
+  if (!sawFrom) return { ok: false, error: `fromOid ${String(fromOid).slice(0, 12)} is not on this shard's main — cannot derive the suffix` };
+  const subtotals = [];
+  const keys = new Set([...running.keys(), ...prevs.keys()]);
+  for (const key of keys) {
+    const value = running.get(key) ?? 0;
+    const prev = prevs.get(key) ?? 0;
+    if (value === prev) continue;
+    const [readId, group] = splitSummaryKey(key);
+    const read = reads.find((r) => r.id === readId);
+    subtotals.push({ readId, group, kind: readId === NOMOS_SHARD_ROWS_READ ? "rows" : read ? read.kind : "count", prev, value });
+  }
+  if (subtotals.length === 0) return { ok: true, upToDate: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: fromOid || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => (summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1)),
+      events,
+    },
+  };
+}
+
+/** One read's contribution shape over a host-folded aggregate (suffix derivation only).
+ *  SLICE 4: predicate-aware — a `where`-bearing scoped read contributes only while the
+ *  folded fields satisfy the canonical predicate (same semantics as the kernel's
+ *  maintained tally, so the suffix lane and the live capture agree byte-for-byte). */
+function contribution(read, cur) {
+  if (!cur || !cur.exists || cur.type !== read.of) return null;
+  if (read.where && !evalCanonicalPred(read.where, (f) => cur.fields.get(f))) return null;
+  const group = read.by === null ? "" : cur.fields.has(read.by) ? String(cur.fields.get(read.by)) : undefined;
+  if (group === undefined) return null;
+  if (read.kind === "count") return { group, value: 1 };
+  const raw = cur.fields.get(read.field);
+  return { group, value: typeof raw === "number" ? raw : 0 };
+}
+function contributionDiff(read, before, after) {
+  const out = [];
+  if (before && after && before.group === after.group) {
+    const d = after.value - before.value;
+    if (d !== 0) out.push({ readId: read.id, group: after.group, delta: d });
+    return out;
+  }
+  if (before) out.push({ readId: read.id, group: before.group, delta: -before.value });
+  if (after) out.push({ readId: read.id, group: after.group, delta: after.value });
+  return out.filter((d) => d.delta !== 0);
+}
+
+// ── §6 — THE SHARD LIFECYCLE (slice 5): migration = re-admission, never trust ──
+//
+// The host legs of a split: the TARGET pulls the moving homes' intents off the
+// SOURCE chain and re-admits EACH through its own gate (`apply_intent` — the same
+// primitive the upload birth and edge admission run: plan re-run, byte-compared,
+// invariants judged); the SOURCE then seals the move with ONE law intent that
+// STRIKES the migrated history out of its fold (append-then-strike — nothing is
+// erased; the kernel's strike-correct reprojection sheds the rows so tallies,
+// deep-verify recount and the capacity load all stay honest) and tombstones the
+// receipts as redirects. Subtotals close/open through the SAME §5.2 summary gate.
+
+/** The total projected TENANT row count — the explicit O(rows) audit walk
+ *  (deep-verify's recount and the strike-bearing summary close share it). */
+export function countTenantRows(eng, ws) {
+  let total = 0;
+  for (const type of tenantTypes(eng)) {
+    total += query(eng, ws, "aggregatesByType", JSON.stringify({ __type: type })).length;
+  }
+  return total;
+}
+
+/**
+ * Walk a mounted workspace's main (genesis → head) and collect every NON-STRUCK
+ * intent homed on one of `homeKeys` — judged by the SAME hash-bearing `routes`
+ * table the wrong-home gate reads (`via:"axis"`: the payload field carries the
+ * home key; `via:"id"`: the minted id's route tag). Framework intents (receipts,
+ * identity, seals, installs) carry no route and never match.
+ */
+export async function collectHomedIntents(eng, ws, homeKeys) {
+  const routes = directiveRoutes(eng);
+  const tagOf = new Map(); // route tag hex -> homeKey
+  for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
+  const keySet = new Set(homeKeys);
+  const gitdir = gitdirOf(ws);
+  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
+  commits.reverse(); // genesis → head
+  const docs = [];
+  const strikeParity = new Map(); // intentId -> strike count
+  for (const c of commits) {
+    let doc = null;
+    try {
+      const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      doc = JSON.parse(dec.decode(blob));
+      docs.push({ oid: c.oid, blob, doc });
+    } catch { continue; }
+    for (const target of (doc && Array.isArray(doc.strikes) ? doc.strikes : [])) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    if (!id || (strikeParity.get(id) ?? 0) % 2 === 1) continue; // struck out of the fold
+    const dom = doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
+    const dirId = doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
+    const route = dom && dirId ? routes.get(`${dom} ${dirId}`) : null;
+    if (!route) continue;
+    const value = doc.payload.payload ? doc.payload.payload[route.key] : undefined;
+    if (typeof value !== "string" || !value) continue;
+    let homeKey = null;
+    if (route.via === "axis") homeKey = keySet.has(value) ? value : null;
+    else {
+      const tag = routeTagHexOfMintedId(value);
+      homeKey = tag !== undefined ? tagOf.get(tag) ?? null : null;
+    }
+    if (homeKey !== null) out.push({ oid, id, homeKey, blob });
+  }
+  return out;
+}
+
+/**
+ * MIGRATE the moving homes' intents from `sourceWs`'s chain into THIS workspace
+ * (`ws`, the target) — re-admission through the target's OWN gate, oldest first,
+ * idempotent by intent id (already-sealed intents are skipped, never double-folded).
+ * A LAW refusal jams the move VISIBLY (`refused` returned; the seal never runs over
+ * an incomplete migration — fail-closed). Both workspaces must be mounted.
+ */
+export async function migrateHomes(eng, ws, ledger, sourceWs, homeKeys, { onlyIds = null } = {}) {
+  const wanted = onlyIds ? new Set(onlyIds) : null;
+  const homed = await collectHomedIntents(eng, sourceWs, homeKeys);
+  const main = await mainIntentIds(eng, ws);
+  const migrated = [], skipped = [], refused = [];
+  for (const e of homed) {
+    if (wanted && !wanted.has(e.id)) continue;
+    if (main.ids.has(e.id)) { skipped.push(e.id); continue; }
+    const res = applyIntentBytes(eng, ws, e.blob);
+    if (res.ok) {
+      main.ids.add(e.id); main.oids.add(res.head); main.head = res.head;
+      migrated.push(e.id);
+    } else {
+      refused.push({ intentId: e.id, oid: e.oid.slice(0, 10), error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  if (migrated.length) await commitAndPush(eng, ws, ledger);
+  log("migrate-homes", { ws, from: sourceWs, migrated: migrated.length, skipped: skipped.length, refused: refused.length });
+  return { migrated, skipped, refused };
+}
+
+/**
+ * SEAL the move on the SOURCE shard's own chain: verify the migration's
+ * COMPLETENESS against this chain itself (every live homed intent must be in
+ * `migratedIds` — anything missing is returned and the seal DOES NOT run), then
+ * author `nomosSealHome` (chunked: receipts tombstoned, migrated intents struck)
+ * through the one gate and push durably.
+ */
+export async function sealHomes(eng, ws, ledger, { domain, lawHash, homeKeys, target, migratedIds, sealedAt }) {
+  const have = new Set(migratedIds);
+  const homed = await collectHomedIntents(eng, ws, homeKeys);
+  const missing = homed.filter((e) => !have.has(e.id)).map((e) => e.id);
+  if (missing.length) return { ok: false, missing };
+  const ids = homed.map((e) => e.id);
+  const CHUNK = 1024;
+  let head = null, struck = 0;
+  for (let i = 0; i < Math.max(1, Math.ceil(ids.length / CHUNK)); i++) {
+    const intentIds = ids.slice(i * CHUNK, (i + 1) * CHUNK);
+    const res = author(eng, ws, domain, "nomosSealHome", { homeKeys: [...homeKeys], target, intentIds, sealedAt }, lawHash, { rngDraws: 8 });
+    if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused the seal").slice(0, 400) };
+    head = res.head;
+    struck += intentIds.length;
+  }
+  await commitAndPush(eng, ws, ledger);
+  log("seal-homes", { ws, target, homes: homeKeys.length, struck, head });
+  return { ok: true, head, struck };
+}
+
+/**
+ * CLOSE a shard's subtotals against the coordinator-HELD values with THIS shard's
+ * projection as the oracle — the strike-bearing summary lane (a §6 seal just
+ * re-shaped the fold; the kernel's strike-correct reprojection is the only honest
+ * recomputation). `heldRows` = the coordinator's committed `NomosSummarySubtotal`
+ * rows for this shard (+ its recorded frontier). Returns the `nomosPropagateSummary`
+ * body — prev = held, value = the live maintained tally, evidence = one event at the
+ * chain head carrying the diffs (deep-verify recomputes from the same oracle).
+ */
+export async function summaryCloseAgainstHeld(eng, ws, heldRows, heldFrontier) {
+  const head = await git.resolveRef({ fs: eng.fs, gitdir: gitdirOf(ws), ref: BRANCH }).catch(() => null);
+  if (!head) return { ok: false, error: "no local main to close against" };
+  if (head === heldFrontier) return { ok: true, upToDate: true, head };
+  const subtotals = [];
+  const deltas = [];
+  for (const row of heldRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    const group = typeof d.group === "string" ? d.group : "";
+    const held = typeof d.value === "number" ? d.value : 0;
+    let now;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) now = countTenantRows(eng, ws);
+    else if (d.kind === "sum") now = sum(eng, ws, d.readId, group).sum;
+    else now = count(eng, ws, d.readId, group).count;
+    if (now === held) continue;
+    subtotals.push({ readId: d.readId, group, kind: d.kind === "sum" || d.kind === "rows" ? d.kind : "count", prev: held, value: now });
+    deltas.push({ readId: d.readId, group, delta: now - held });
+  }
+  // Head moved but no tally did (e.g. a seal over an empty home): the frontier must
+  // still advance or the watermark jams forever — the caller amends it with the
+  // declared `nomosAmendSummaryFrontier` primitive (no claims, nothing to recompute).
+  if (subtotals.length === 0) return { ok: true, frontierOnly: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: heldFrontier || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => (summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1)),
+      events: [{ oid: head, intentId: "", deltas }],
+    },
+  };
+}
+
+// ── §5.4 — THE REVERSE LANE (slice 4): global reference data, coordinator → shards ──
+//
+// Aggregates marked `.global(...)` home on the COORDINATOR (the homing walk pins
+// them); their committed intents REPLICATE DOWNWARD into every shard chain by
+// RE-ADMISSION of the SAME sealed bytes (`apply_intent` — plan re-run under the
+// shard's identical law, byte-compared; provenance preserved: author = original
+// author, committer = the shard's kernel). Idempotent by intent id; a shard born
+// later catches up via {@link collectGlobalIntents} at the auto-birth leg.
+
+/**
+ * Walk a mounted workspace's main (genesis → head) and collect every NON-STRUCK
+ * intent whose sealed events touch a GLOBAL aggregate type — the catch-up set a
+ * fresh shard replays at birth, and the audit surface for the reverse lane.
+ */
+export async function collectGlobalIntents(eng, ws) {
+  const globals = globalAggregates(eng);
+  if (globals.size === 0) return [];
+  const gitdir = gitdirOf(ws);
+  const commits = await git.log({ fs: eng.fs, gitdir, ref: BRANCH });
+  commits.reverse(); // genesis → head
+  const typeOf = new Map(); // aggregateId -> __type (set once at creation — types never change)
+  const strikeParity = new Map();
+  const docs = [];
+  for (const c of commits) {
+    let blob = null, doc = null;
+    try {
+      blob = (await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" })).blob;
+      doc = JSON.parse(dec.decode(blob));
+    } catch { continue; }
+    docs.push({ oid: c.oid, blob, doc });
+    for (const target of (doc && Array.isArray(doc.strikes) ? doc.strikes : [])) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    let touches = false;
+    for (const ev of parseIntentEvents(blob)) {
+      const newType = ev.sets.get("__type");
+      if (newType !== undefined && !typeOf.has(ev.aggregate)) typeOf.set(ev.aggregate, newType);
+      const t = newType ?? typeOf.get(ev.aggregate);
+      if (t !== undefined && globals.has(t)) touches = true;
+    }
+    if (!touches || !id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
+    out.push({ oid, id, blob });
+  }
+  return out;
+}
+
+/**
+ * Re-admit carried GLOBAL intents on THIS workspace's chain (a shard, the reverse
+ * lane's receiving leg) — oldest first, idempotent by intent id, durably pushed.
+ * A law refusal jams VISIBLY (`refused` returned) — the shard's gate is never
+ * bypassed; the coordinator's law ≡ the shard's law by construction, so a refusal
+ * here means the laws diverged (redeploy the law, then re-offer).
+ */
+export async function replicateIntents(eng, ws, ledger, intents, { push = true } = {}) {
+  const main = await mainIntentIds(eng, ws);
+  const replicated = [], skipped = [], refused = [];
+  for (const e of intents) {
+    if (e.id && main.ids.has(e.id)) { skipped.push(e.id); continue; }
+    const res = applyIntentBytes(eng, ws, e.blob);
+    if (res.ok) {
+      if (e.id) main.ids.add(e.id);
+      main.oids.add(res.head); main.head = res.head;
+      replicated.push(e.id || res.head);
+    } else {
+      refused.push({ intentId: e.id || "", error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  // push=false is the OFFLINE proof lane only (bench harness — no ledger remote);
+  // every host leg keeps durability-before-ack.
+  if (replicated.length && push) await commitAndPush(eng, ws, ledger);
+  log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
+  return { replicated, skipped, refused };
+}
+
+/**
+ * §5.5 (slice 4) — the CONTENT HASH of the coordinator's committed subtotal state:
+ * sha256 over the canonical (row-id-sorted) projection of every
+ * `NomosSummarySubtotal` row. The ONE definition every checkpoint party shares —
+ * the sealing host claims it, an auditor (deep-verify anchoring, the e2e, any
+ * peer that mounts the chain) recomputes it from law-state and byte-compares.
+ */
+export async function checkpointStateHash(eng, ws) {
+  const rows = query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosSummarySubtotal" }));
+  const canon = rows
+    .map((r) => {
+      const d = r.data || {};
+      return { id: r.id, readId: d.readId, group: d.group, shard: d.shard, kind: d.kind, value: d.value, frontier: d.frontier };
+    })
+    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  return sha256hex(JSON.stringify(canon));
+}
+
+/**
+ * Author one intent on a workspace's chain through ITS OWN gate and push durably —
+ * the generic Order leg (`nomosPropagateSummary` into the coordinator, the
+ * assignment receipt into a shard, the registry row at auto-birth). A LAW refusal
+ * (the gate's typed verdict — frontier-gap, wrong-home, …) returns `{ok:false,
+ * error}`; the caller decides the remedy (re-derive, log, jam visibly).
+ */
+export async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountWorkspace(eng, ws, ledger);
+  let res;
+  try {
+    res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e).slice(0, 500) };
+  }
+  if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
+  await commitAndPush(eng, ws, ledger);
+  return { ok: true, head: res.head };
+}
+
+/**
+ * THE DEEP-VERIFY OP (§5.5 — replay-on-suspicion, made operational): replay-verify
+ * the SHARD's whole chain from genesis (the same wasm `verify_chain` the upload
+ * birth runs), then recompute every coordinator-held subtotal for that shard from
+ * the shard's OWN maintained tallies and byte-compare. `coordinatorRows` is the
+ * coordinator's law-state (`NomosSummarySubtotal` rows for this shard) — the HOST
+ * resolves and passes them (the engine has no cross-workspace reach). Auditors pay
+ * for verification; ordinary reads stay O(1).
+ */
+export async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows) {
+  const replay = await verifyChain(eng, shardWs, shardLedger);
+  if (!replay.valid) {
+    return { verdict: `invalid:${replay.check || "replay"}`, replay, checks: [] };
+  }
+  await mountWorkspace(eng, shardWs, shardLedger);
+  const checks = [];
+  let allMatch = true;
+  for (const row of coordinatorRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    let recomputed;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) {
+      // Total projected rows: enumerate the manifest's aggregate types (an explicit
+      // O(rows) audit walk — never an implicit read cost).
+      recomputed = countTenantRows(eng, shardWs);
+    } else if (d.kind === "sum") {
+      recomputed = sum(eng, shardWs, d.readId, d.group ?? "").sum;
+    } else {
+      recomputed = count(eng, shardWs, d.readId, d.group ?? "").count;
+    }
+    const match = recomputed === d.value;
+    if (!match) allMatch = false;
+    checks.push({ readId: d.readId, group: d.group ?? "", coordinator: d.value, shard: recomputed, match });
+  }
+  const head = await git.resolveRef({ fs: eng.fs, gitdir: gitdirOf(shardWs), ref: BRANCH }).catch(() => null);
+  return {
+    verdict: allMatch ? "verified" : "mismatch",
+    head,
+    intents: replay.intents,
+    plansRerun: replay.plansRerun,
+    checks,
+  };
+}
+
+/** Mount a workspace, restoring its repo from the Artifacts ledger ({remote, headers}). */
+export async function mountWorkspace(eng, ws, ledger) {
+  if (eng.mounted.has(ws)) return eng.mounted.get(ws);
+  const wsContents = new Map();
+  seedManifests(wsContents, eng.manifestStrings);
+  eng.preopen.dir.contents.get("ws").contents.set(ws, new Directory(wsContents));
+  const gitdir = gitdirOf(ws);
+  let restored = false, remoteMain = null, restoreError = null;
+  try {
+    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
+    remoteMain = (info.refs && info.refs.heads && info.refs.heads.main) || null;
+    if (remoteMain) {
+      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
+      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
+      await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
+      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
+      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
+      restored = true;
+    }
+  } catch (e) { restoreError = String((e && e.stack) || e).split("\n").slice(0, 5).join(" | "); }
+  const m = { restored, remoteMain, restoreError };
+  eng.mounted.set(ws, m);
+  return m;
+}
+
+/** Drop a workspace's in-memory state so the next access re-restores from the ledger. */
+export function unmount(eng, ws) {
+  eng.mounted.delete(ws);
+  eng.mainIntents.delete(ws);
+  const wsRoot = eng.preopen.dir.contents.get("ws");
+  if (wsRoot) wsRoot.contents.delete(ws);
+}
+
+function writeWork(eng, name, bytes) { eng.preopen.dir.contents.set(name, new File(bytes)); }
+
+export function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
+  const seq = eng.seq++;
+  // rngDraws: the captured-entropy budget this intent's plan may consume (each minted id
+  // costs 19 draws — see NOMOS_API_SHIM). 64 is the per-write default (3 mints of slack);
+  // a BATCH-creating directive needs 19×creates. COMMIT-ONLY-CONSUMED: only the consumed
+  // prefix is sealed onto the intent, so a generous buffer is request weight, not ledger weight.
+  const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  writeWork(eng, `payload-${seq}.json`, enc.encode(JSON.stringify(payload)));
+  writeWork(eng, `envelope-${seq}.json`, enc.encode(stringifyBig(envelope)));
+  const genesis = !controllerHash;
+  // THE DEFERRED-PROJECTION ACK (#47, sharding slice 7): the read-projection
+  // catch-up (incl. the derive/combine materialize) moves OFF the author ack path
+  // by default — every read op self-heals to head, and the post-ack warm lane
+  // (`warmEngine`, which every host already calls) flushes it eagerly. Pass
+  // `opts.deferProjection: false` to keep the pre-#47 synchronous refresh.
+  const defer = opts.deferProjection !== false;
+  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...(defer ? { deferProjection: true } : {}) }, eng.STDERR));
+  if (defer && res.ok) (eng.pendingProjection ??= new Set()).add(ws);
+  return res;
+}
+
+/** Catch one workspace's read projection up to head NOW (the deferred-ack flush). */
+export function refreshProjection(eng, ws) {
+  return JSON.parse(call(eng.ex, "refresh_projection", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+}
+
+/** Flush every deferred projection refresh (rides the post-ack warm lane). */
+export function flushDeferredProjections(eng) {
+  for (const ws of eng.pendingProjection ?? []) {
+    try { refreshProjection(eng, ws); } catch {}
+  }
+  if (eng.pendingProjection) eng.pendingProjection.clear();
+}
+
+// DURABILITY-BEFORE-ACK: only acked once the write LANDED in the ledger; a failed push
+// unmounts (drops local state) so the next access re-restores from custody.
+export async function commitAndPush(eng, ws, ledger) {
+  try {
+    await git.push({ fs: eng.fs, http, gitdir: gitdirOf(ws), url: ledger.remote, ref: "main", remoteRef: "main", force: false, headers: ledger.headers });
+  } catch (e) {
+    unmount(eng, ws);
+    throw new Error(`ledger push failed — write NOT durable, rolled back to ledger: ${e}`);
+  }
+}
+
+export const qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
+export const query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+export const count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
+export const sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+/** The maintained O(1) min/max read (#47 — the slice-4 extremum hand-back made an RPC).
+ *  `kind` = "min"|"max"; an absent group answers `value: null` (never a fabricated 0). */
+export const extremum = (eng, ws, extremumId, kind, groupKey) => JSON.parse(call(eng.ex, "extremum", { repoArg: repoArgOf(ws), workspace: ws, extremumId, kind, groupKey: groupKey ?? "", branch: BRANCH }, eng.STDERR));
+export const nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
+
+/** Re-admit ONE carried intent (bytes) on local main — the DLQ-retry primitive. */
+export function applyIntentBytes(eng, ws, bytes) {
+  const name = `intent-in-${eng.seq++}.json`;
+  writeWork(eng, name, bytes);
+  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
+}
+
+// Main's recent intent ids + oids, cached by head (admission idempotence + walk boundary).
+async function mainIntentIds(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const head = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  if (!head) return { head: null, ids: new Set(), oids: new Set() };
+  const cached = eng.mainIntents.get(ws);
+  if (cached && cached.head === head) return cached;
+  const ids = new Set(), oids = new Set();
+  for (const c of await git.log({ fs: eng.fs, gitdir, ref: BRANCH, depth: 500 })) {
+    oids.add(c.oid);
+    try {
+      const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      const id = JSON.parse(dec.decode(blob)).id;
+      if (typeof id === "string" && id) ids.add(id);
+    } catch {}
+  }
+  const m = { head, ids, oids };
+  eng.mainIntents.set(ws, m);
+  return m;
+}
+
+/**
+ * EDGE ADMISSION (the one machinery): judge every session/<cid> ref. Structural lane
+ * refusals (control-plane intents, undeployed domains) and domain rejections route per
+ * Jack's law: legitimate work DEAD-LETTERS (returned to the host to persist — the
+ * engine has no durable store), obvious attacks drop. Admitted intents merge to main,
+ * durably push, the branch is consumed.
+ */
+export async function admitAll(eng, ws, ledger, { refuseDomains = [], shardRouting = null } = {}) {
+  const refuse = new Set(refuseDomains);
+  const routes = shardRouting ? directiveRoutes(eng) : null;
+  const gitdir = gitdirOf(ws);
+  const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
+  const sessions = (info.refs && info.refs.heads && info.refs.heads.session) || {};
+  const results = [], deadLetters = [], placements = [], splits = [], globalsOut = [];
+  // §5.4 (slice 4): on the COORDINATOR of a taxonomy that declares `.global(...)`
+  // reference data, every admitted intent touching a global aggregate is surfaced
+  // to the HOST, which replicates the SAME sealed bytes into each shard chain.
+  const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng) : null;
+  // ── §5.2 SUMMARY CAPTURE (slice 3): on a SHARD (selfLabel) whose law declares
+  // estate-scoped reads, derive each admitted intent's per-(read, group) deltas with
+  // the shard's own projection as the oracle (tallies sandwiched around the fold —
+  // O(touched)); the HOST authors the coalesced `nomosPropagateSummary` Order into
+  // the coordinator afterwards. The coordinator's gate re-verifies everything.
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0
+    ? { reads: scopedReads(eng), prevs: new Map(), values: new Map(), events: [], rowsDelta: 0 }
+    : null;
+  const headBefore = summaryCtx ? await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null) : null;
+  for (const [cid, head] of Object.entries(sessions)) {
+    const ref = `refs/heads/session/${cid}`;
+    try {
+      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
+      await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref, singleBranch: true, headers: ledger.headers });
+      const main = await mainIntentIds(eng, ws);
+      const chain = [];
+      for (const c of await git.log({ fs: eng.fs, gitdir, ref: head, depth: 100 })) {
+        if (main.oids.has(c.oid)) break;
+        chain.push(c.oid);
+      }
+      chain.reverse(); // oldest → newest
+      const admitted = [], rejected = [], skipped = [];
+      for (const oid of chain) {
+        try {
+          const { blob } = await git.readBlob({ fs: eng.fs, gitdir, oid, filepath: "intent.json" });
+          let dom = null, intentId = null, dirId = null;
+          try { const doc = JSON.parse(dec.decode(blob)); intentId = typeof doc.id === "string" ? doc.id : null; dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null; dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null; } catch {}
+          // WRITE-AUTHORITY: law (control-plane) intents never ride the session lane —
+          // nor do HOST-FENCED domains (e.g. `workspaces` on root: governance directives
+          // enter ONLY through the admin-gated lane, never open session pushes).
+          if (!dom || dom === "nomos" || dom === "bootstrap" || refuse.has(dom)) {
+            rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses ${dom ? `'${dom}'` : "non-authored"} intents — law deploys go through POST /v1/workspaces/${ws}/domains with the workspace secret` });
+            continue;
+          }
+          // LAW-FENCE part 2: the domain must be DEPLOYED to this workspace. An
+          // undeployed domain's write is the canonical LEGITIMATE JAM — dead-letter.
+          if (!knownDomains(eng).has(dom)) {
+            const error = `domain '${dom}' is not deployed to this workspace — deploy its law (POST /v1/workspaces/${ws}/domains with the workspace secret), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+            continue;
+          }
+          // THE WRONG-HOME GATE (sharding slice 2): a routed directive's home must be
+          // assigned to THIS workspace by the coordinator's law-state shard map.
+          // Misrouted → the typed `wrong-home` refusal naming the correct workspace
+          // (self-healing, never queued); unplaced → a dead-lettered placement jam.
+          if (routes && dom && dirId) {
+            // THE SEAL PEN IS THE BAILIFF'S (slice 5): `nomosSealHome` (strikes the
+            // migrated history out of a source's fold) and `nomosSealHandoff` (flips
+            // the map) are HOST-orchestrated legs of the §6 move — a session-lane
+            // offer of either is an attack on the move lane, refused and DROPPED.
+            if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
+              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' — the §6 handoff seals are authored by the host after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
+              continue;
+            }
+            const route = routes.get(`${dom} ${dirId}`);
+            if (route) {
+              let payloadObj = null;
+              try { payloadObj = JSON.parse(dec.decode(blob)).payload?.payload ?? null; } catch {}
+              const verdict = await wrongHomeVerdict(shardRouting, route, payloadObj);
+              if (verdict) {
+                rejected.push({ oid: oid.slice(0, 10), error: verdict.error, ...(verdict.wrongHome ? { wrongHome: verdict.wrongHome } : {}), ...(verdict.homeMoving ? { homeMoving: verdict.homeMoving } : {}), ...(verdict.deadLettered ? { deadLettered: true } : {}) });
+                if (verdict.deadLettered) deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error: verdict.error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+            }
+            // THE RECEIPT LEG'S BAILIFF (slice 3 — §3): a session-lane assignment
+            // receipt is VERIFIED against the coordinator's shard map before it can
+            // fold (the client authors it optimistically; the map is the law).
+            if (dirId === "nomosReceiveAssignment" && shardRouting) {
+              let p = null;
+              try { p = JSON.parse(dec.decode(blob)).payload?.payload ?? null; } catch {}
+              const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
+              const rows = homeKey ? (await shardRouting.assignments()) || [] : [];
+              const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
+              if (!a) {
+                const error = `assignment receipt for home '${String(homeKey).slice(0, 80)}' has NO placement on the coordinator '${shardRouting.coordinatorWs}' — author the derived placement intent (birth<Type>) first, then POST /dead-letters/retry`;
+                rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+                deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+              if (a.shard !== shardRouting.selfLabel || (p && p.shard !== shardRouting.selfLabel)) {
+                const correct = `${shardRouting.coordinatorWs}--${a.shard}`;
+                rejected.push({
+                  oid: oid.slice(0, 10),
+                  error: `wrong-home: the coordinator's shard map assigns home '${homeKey.slice(0, 80)}' to '${correct}' (not this workspace) — a routed client re-routes and retries automatically`,
+                  wrongHome: { workspace: correct, ...(a.mapVersion !== undefined ? { mapVersion: a.mapVersion } : {}) },
+                });
+                continue;
+              }
+            }
+          }
+          // IDEMPOTENCE: an intent already sealed on main is acknowledged, not re-folded.
+          if (intentId && main.ids.has(intentId)) {
+            skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
+            continue;
+          }
+          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+          const res = applyIntentBytes(eng, ws, blob);
+          if (res.ok) {
+            main.ids.add(intentId); main.oids.add(res.head); main.head = res.head;
+            admitted.push({ oid: oid.slice(0, 10), head: res.head });
+            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
+            // AN ADMITTED PLACEMENT (birth<Type> on the coordinator): surfaced to the
+            // HOST so it can author the assignment RECEIPT into the shard's own chain
+            // (sharding §3 — the receipt leg).
+            if (shardRouting && dirId) {
+              const placement = placementDirectives(eng).get(dirId);
+              if (placement) {
+                let p = null;
+                try { p = JSON.parse(dec.decode(blob)).payload?.payload ?? null; } catch {}
+                const homeKey = p ? p[placement.keyField] : undefined;
+                if (typeof homeKey === "string" && typeof p?.shard === "string") {
+                  placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
+                }
+              }
+              // AN ADMITTED SPLIT (nomosSplitShard on the coordinator, slice 5):
+              // surfaced to the HOST so it can run the §6 migration legs (re-admit
+              // on the target, seal the source, close/open the subtotals, flip the
+              // map) — a session-authored split COMPLETES like a host-authored one.
+              if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
+                let p = null;
+                try { p = JSON.parse(dec.decode(blob)).payload?.payload ?? null; } catch {}
+                if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
+                  splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
+                }
+              }
+            }
+            // AN ADMITTED GLOBAL WRITE (§5.4, slice 4 — coordinator only): the sealed
+            // bytes are surfaced to the HOST, which re-admits them into every shard
+            // chain (the reverse lane — replicated reference data). O(events) per
+            // admitted intent, and only when the law declares `.global(...)`.
+            if (globalsDeclared && globalsDeclared.size > 0) {
+              let touchesGlobal = false;
+              for (const ev of parseIntentEvents(blob)) {
+                const rows = qById(eng, ws, ev.aggregate);
+                const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : undefined);
+                if (t !== undefined && globalsDeclared.has(t)) { touchesGlobal = true; break; }
+              }
+              if (touchesGlobal) globalsOut.push({ intentId: intentId || "", oid: oid.slice(0, 10), blob });
+            }
+          } else {
+            // THE CHAIN GATE'S OWN WRONG-HOME VERDICT (#41): the law's homing invariant
+            // refuses with `wrong-home:<label>` — surface it as the SAME typed refusal
+            // the edge bailiff answers (self-healing, never queued). The bailiff above
+            // remains defense-in-depth; this arm is the gate catching what it can't.
+            const wh = String(res.error || "").match(/wrong-home:(s\d+)/);
+            if (wh) {
+              const coordinator = (shardRouting && shardRouting.coordinatorWs) || (ws.match(/^(.*)--s\d+$/) || [])[1] || ws;
+              rejected.push({
+                oid: oid.slice(0, 10),
+                error: `wrong-home: this write's home is assigned to '${coordinator}--${wh[1]}' — the chain gate's homing invariant refused it; a routed client re-routes and retries automatically`,
+                wrongHome: { workspace: `${coordinator}--${wh[1]}` },
+              });
+              continue;
+            }
+            const error = `${String(res.error || "").slice(0, 300)} — dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+          }
+        } catch (e) {
+          rejected.push({ oid: oid.slice(0, 10), error: String(e).slice(0, 200) });
+        }
+      }
+      if (admitted.length) await commitAndPush(eng, ws, ledger);
+      try { await git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: ref, delete: true, headers: ledger.headers }); } catch {}
+      results.push({ session: cid, admitted, rejected, ...(skipped.length ? { skipped } : {}) });
+    } catch (e) {
+      results.push({ session: cid, error: String(e).slice(0, 200) });
+    }
+  }
+  const newMain = await git.resolveRef({ fs: eng.fs, gitdir, ref: BRANCH }).catch(() => null);
+  log("admit", { ws, sessions: results.length, main: newMain });
+  // The coalesced §5.2 delta of this batch (null when no scoped read moved): the HOST
+  // closes it against the coordinator's recorded frontier and authors the Order.
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
+  return {
+    sessions: results, main: newMain, deadLetters,
+    ...(summary ? { summary } : {}),
+    ...(placements.length ? { placements } : {}),
+    ...(splits.length ? { splits } : {}),
+    ...(globalsOut.length ? { globals: globalsOut } : {}),
+  };
+}
+
+/**
+ * VERIFY AN UPLOADED LEDGER — "the githolon executes and thus validates it". Fresh-mounts
+ * the workspace from custody (never a cached mount — the bytes under judgment are the
+ * ledger's, not memory's) and asks the wasm to replay-verify the WHOLE main chain from
+ * genesis (contiguity → per-intent re-admission with the engine re-run; byte-preserving,
+ * read-only — see wasm_git_holon.rs `verify_chain`). Returns the wasm's verdict object:
+ * `{valid:true, head, intents, plansRerun, controllerHash, installedDomains}` or
+ * `{valid:false, check, error, atIndex?, atCommit?}`. The HOST decides what a refusal
+ * does (archive + refuse to serve); this op never mutates the ledger.
+ */
+export async function verifyChain(eng, ws, ledger) {
+  unmount(eng, ws);
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (!m.restored) {
+    return { valid: false, check: "mount", error: m.restoreError || "no refs/heads/main on the ledger — nothing to verify (push refs/heads/main to deliver a chain first)" };
+  }
+  try {
+    return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  } finally {
+    // The verified (or refused) chain must never linger as a servable mount: serving
+    // re-restores from custody AFTER the host blesses the verdict.
+    unmount(eng, ws);
+  }
+}
+
+/**
+ * Verify the CURRENTLY MOUNTED in-memory chain — no ledger remount. The
+ * LOCAL-FIRST assert: a holon minted offline (`githolon ledger init`) proves its
+ * own validity with the SAME wasm gate the cloud runs before it is ever
+ * pushed. (The cloud lane keeps verifyChain's remount hygiene — it must verify
+ * the LEDGER's bytes, never a hot mount.)
+ */
+export function verifyChainLocal(eng, ws) {
+  return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+}
+
+/**
+ * ARCHIVE A REFUSED UPLOAD: move custody's `refs/heads/main` to
+ * `refs/heads/refused/<label>` (retirement is a move, never an erasure — the refused
+ * bytes stay inspectable; inside refs/heads/ because that is the namespace custody
+ * accepts writes/deletes on) and delete `main` so the workspace reads as unborn again.
+ * Mounts fresh; leaves no mount.
+ */
+export async function archiveRefusedMain(eng, ws, ledger, label) {
+  unmount(eng, ws);
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (!m.restored) { unmount(eng, ws); return { archived: false, error: "no main to archive" }; }
+  const gitdir = gitdirOf(ws);
+  try {
+    await git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: `refs/heads/refused/${label}`, force: true, headers: ledger.headers });
+    await git.push({ fs: eng.fs, http, gitdir, url: ledger.remote, ref: BRANCH, remoteRef: `refs/heads/${BRANCH}`, delete: true, headers: ledger.headers });
+    return { archived: true, ref: `refs/heads/refused/${label}` };
+  } finally {
+    unmount(eng, ws);
+  }
+}
+
+/** Genesis boot: bootstrap → the nomos controller; idempotent when already Active. */
+export async function boot(eng, ws, ledger) {
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (nomosActive(eng, ws)) {
+    return { status: "already-initialized", controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+  }
+  const result = author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, eng.installedBy), "");
+  await commitAndPush(eng, ws, ledger);
+  return { status: "created", head: result.head, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+}
+
+/** Install a tenant package under the nomos controller (validation is the HOST's job). */
+export async function deploy(eng, ws, ledger, usda, domainHash) {
+  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy), eng.hashes.nomos);
+  // THE SHARD-IDENTITY ENSURE (#41 — slice 3a): a taxonomy-bearing law carries the
+  // homing invariant, which judges against the workspace's OWN declared identity
+  // (`NomosShardIdentity`, law-state in the shard's own chain). The worker is the
+  // bailiff: it records the CUSTODY fact (this workspace's name ⇒ its shard label)
+  // through the chain's own gate right after the law lands — attributed, replayable,
+  // idempotent (an Ensure; re-deploys re-assert the same state). Coordinator ⇒ label ""
+  // (no homing claim — the invariant holds vacuously there).
+  try {
+    eng.directiveRoutesCache = null; // the just-staged overlay may add routes
+    const routed = new Set([...directiveRoutes(eng).keys()].map((k) => k.split(" ")[0]));
+    if (routed.size) {
+      const m = ws.match(/^(.*)--(s\d+)$/);
+      const label = m ? m[2] : "";
+      const coordinator = m ? m[1] : ws;
+      const existing = qById(eng, ws, "nomos-shard-identity:self");
+      const current = existing.length ? existing[0].data : null;
+      if (!current || current.label !== label || current.coordinator !== coordinator) {
+        for (const dom of routed) {
+          try {
+            const declared = author(eng, ws, dom, "nomosDeclareShardIdentity", { label, coordinator, declaredAt: new Date().toISOString() }, domainHash);
+            if (declared && declared.ok !== false) break; // one declaration IS the workspace's identity
+          } catch {} // a routed domain owned by an earlier law: its own deploy declared it
+        }
+      }
+    }
+  } catch {}
+  await commitAndPush(eng, ws, ledger);
+  return { head: result.head, installation: qById(eng, ws, `domain-installation:${domainHash}`) };
+}
+
+export function snapshot(eng, ws) {
+  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(ws);
+  return serializeTree(wsDir);
+}
+
+export function stats(eng) {
+  return {
+    mounted: eng.mounted.size,
+    wasmLinearMemMB: +(eng.ex.memory.buffer.byteLength / 1048576).toFixed(1),
+  };
+}
+
+/** Per-branch projection observables (cursor, projectCalls, sqliteBytes — see #37). */
+export const projectionStats = (eng) => JSON.parse(call(eng.ex, "projection_stats", {}, eng.STDERR));
+
+/**
+ * THE POST-ACK WARM LANE (#34): replenish the wasm engine's pristine-sandbox pool
+ * for every law dispatched since the last call. Call AFTER the response is acked —
+ * DO: `ctx.waitUntil(Promise.resolve().then(() => warmEngine(eng)))`; container:
+ * `setImmediate(() => warmEngine(eng))` — so the NEXT write finds its sandbox
+ * already booted (take-use-discard; a sandbox never executes two plans). Cheap
+ * no-op when the pool is already full or nothing was dispatched.
+ */
+export function warmEngine(eng) {
+  flushDeferredProjections(eng); // the deferred-ack projection flush (#47) rides the same lane
+  return JSON.parse(call(eng.ex, "engine_warm", {}, eng.STDERR));
+}