githolon 0.100.6 → 0.101.1

package/dist/cli.mjs

@@ -329,6 +329,131 @@ var init_custody_transport = __esm({
   }
 });
 
+// vendor/engine/managed-promotion.ts
+function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
+  if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  if (!report.promotable && !acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "exact history changes under the candidate; provide an acceptanceReason to make that business decision accountable"
+    };
+  }
+  if (!report.atStateRoot || !report.historyHash || !report.reportHash || !report.projection) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "the complete pre-flight report is missing its state, projection, or content proof"
+    };
+  }
+  const provedDomains = report.domains?.length ? report.domains : [report.domain];
+  if (!provedDomains.includes(domain)) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: `the package-wide report does not cover the generated business area '${domain}'`
+    };
+  }
+  const reportEvidence = JSON.parse(JSON.stringify(report));
+  if (Array.isArray(reportEvidence.divergences)) {
+    for (const divergence of reportEvidence.divergences) {
+      if (divergence && typeof divergence === "object") {
+        delete divergence.atCommit;
+      }
+    }
+  }
+  const preflight = {
+    candidateHash,
+    // A package may be reached through any one of its generated domain clients. The
+    // kernel chooses one canonical domain for the private receipt so the exact same
+    // package/history proof has one identity regardless of that entry point.
+    domain: report.domain,
+    atHash: report.atHash,
+    atStateRoot: report.atStateRoot,
+    historyHash: report.historyHash,
+    reportHash: report.reportHash,
+    reportJson: JSON.stringify(reportEvidence),
+    complete: true,
+    evolveOk: true,
+    rawPromotable: report.promotable,
+    projectionEqual: report.projection.equal,
+    replayedIntents: report.replayedIntents,
+    candidateIntents: report.candidateIntents,
+    divergenceCount: report.divergences.length,
+    baselineRoot: report.projection.baselineRoot,
+    candidateRoot: report.projection.candidateRoot,
+    ...!report.promotable && acceptanceReason ? { acceptanceReason } : {}
+  };
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: `${RELEASE_RECEIPT_PREFIX}${report.reportHash}`,
+    payload: {
+      domainHash: candidateHash,
+      ...opts.replaces ? { replaces: opts.replaces } : {},
+      retireReplaced: opts.retireReplaced ?? false,
+      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      preflight
+    }
+  };
+}
+function prepareManagedRestoration(report, currentHash, priorHash, domain, opts = {}) {
+  if (!report.dispositions || typeof report.dispositions !== "object") {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "restoration refused: the exact-history proof did not derive its predecessor dispositions"
+    };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  const prepared = prepareManagedPromotion(report, priorHash, domain, {
+    dispositions: report.dispositions,
+    ...acceptanceReason ? { acceptanceReason } : {}
+  });
+  if (!prepared.ok) {
+    return {
+      ...prepared,
+      stage: prepared.stage === "acceptance" ? "acceptance" : "preflight"
+    };
+  }
+  if (!acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "restoring previous law needs a business reason even when historical outcomes are unchanged"
+    };
+  }
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: prepared.receiptId,
+    payload: {
+      candidateHash: currentHash,
+      priorHash,
+      dispositions: report.dispositions,
+      preflight: prepared.payload.preflight
+    }
+  };
+}
+var RELEASE_RECEIPT_PREFIX;
+var init_managed_promotion = __esm({
+  "vendor/engine/managed-promotion.ts"() {
+    "use strict";
+    RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
+  }
+});
+
 // vendor/engine/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
@@ -360,6 +485,10 @@ __export(engine_exports, {
   countTenantRowsByHome: () => countTenantRowsByHome,
   createEngine: () => createEngine,
   cryptoKeygen: () => cryptoKeygen,
+  cryptoOwnedDeviceRequest: () => cryptoOwnedDeviceRequest,
+  cryptoOwnedPrepareApproval: () => cryptoOwnedPrepareApproval,
+  cryptoOwnedPrepareRecovery: () => cryptoOwnedPrepareRecovery,
+  cryptoOwnedScopeKey: () => cryptoOwnedScopeKey,
   cryptoSealField: () => cryptoSealField,
   cryptoUnwrapKey: () => cryptoUnwrapKey,
   cryptoWrapKey: () => cryptoWrapKey,
@@ -383,6 +512,8 @@ __export(engine_exports, {
   flushDeferredProjections: () => flushDeferredProjections,
   gitdirOf: () => gitdirOf,
   globalAggregates: () => globalAggregates,
+  historyPreflight: () => historyPreflight,
+  historyRestorePreflight: () => historyRestorePreflight,
   importCheckpoint: () => importCheckpoint,
   ingestPackAsCustody: () => ingestPackAsCustody,
   installPayload: () => installPayload,
@@ -405,9 +536,11 @@ __export(engine_exports, {
   packBornChildren: () => packBornChildren,
   packDelta: () => packDelta,
   parseAttestedReadNeed: () => parseAttestedReadNeed,
+  pendingConflictSummary: () => pendingConflictSummary,
   pendingConflicts: () => pendingConflicts,
   placementDirectives: () => placementDirectives,
   projectionStats: () => projectionStats,
+  promotePreflighted: () => promotePreflighted,
   pushCheckpoint: () => pushCheckpoint,
   pushShape: () => pushShape,
   pushStagedCheckpoint: () => pushStagedCheckpoint,
@@ -425,6 +558,7 @@ __export(engine_exports, {
   replicateIntents: () => replicateIntents,
   repoArgOf: () => repoArgOf,
   restoreCheckpointFromCustody: () => restoreCheckpointFromCustody,
+  restorePreviousPreflighted: () => restorePreviousPreflighted,
   scopedReads: () => scopedReads,
   sealAttestationBatches: () => sealAttestationBatches,
   sealHomes: () => sealHomes,
@@ -435,6 +569,7 @@ __export(engine_exports, {
   spatialBboxParams: () => spatialBboxParams,
   spatialWithin: () => spatialWithin,
   stageCheckpoint: () => stageCheckpoint,
+  stagePayload: () => stagePayload,
   stats: () => stats,
   sum: () => sum,
   summaryCloseAgainstHeld: () => summaryCloseAgainstHeld,
@@ -1139,7 +1274,7 @@ async function replicateIntents(eng, ws, ledger, intents, { push = true } = {})
   log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
   return { replicated, skipped, refused };
 }
-async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
+async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main2 = await mainIntentIds(eng, ws);
   const sessions = /* @__PURE__ */ new Map();
   const deadLetters = [];
@@ -1206,8 +1341,8 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
       }
       const cap2 = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
       const _tOffer = Date.now();
-      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
-      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
+      const res = offerAdmit(eng, ws, blob, { defer: false });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: false, ok: res.ok });
       if (res.ok) {
         if (intentId) main2.ids.add(intentId);
         main2.oids.add(res.head);
@@ -1230,7 +1365,6 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
-  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   if (deadLetters.length) {
     try {
       await materializeRefused(eng, ws, ledger, deadLetters);
@@ -1238,8 +1372,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
-  const deferDurability = defer && !summaryCtx;
-  if (admittedTotal && !deferDurability) {
+  if (admittedTotal) {
     const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
     await commitAndPush(eng, ws, ledger);
     sealDone();
@@ -1257,7 +1390,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 async function checkpointStateHash(eng, ws) {
   const rows = query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosSummarySubtotal" }));
@@ -1415,6 +1548,9 @@ function mintId(eng, typeTag) {
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  if (opts.__nomosConflictSnapshots !== void 0 && opts.__nomosConflictSnapshots.length > 0) {
+    capPorts.conflict_snapshots = opts.__nomosConflictSnapshots;
+  }
   if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
   if (opts.principalVerified !== void 0) {
     capPorts.principal = opts.actor ?? "";
@@ -2214,6 +2350,120 @@ async function verifyChain(eng, ws, ledger) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
+function historyPreflight(eng, ws, domain, candidateHash, atHash, dispositions) {
+  return JSON.parse(call(eng.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    branch: BRANCH,
+    queryBytes: b64Json({
+      op: "historyPreflight",
+      domain,
+      candidateHash,
+      atHash,
+      ...dispositions ? { dispositions } : {}
+    })
+  }, eng.STDERR));
+}
+function historyRestorePreflight(eng, ws, domain, currentHash, priorHash, atHash, actor) {
+  return JSON.parse(call(eng.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    branch: BRANCH,
+    queryBytes: b64Json({
+      op: "historyPreflight",
+      domain,
+      candidateHash: priorHash,
+      atHash,
+      restorePreviousOf: currentHash,
+      ackBy: actor
+    })
+  }, eng.STDERR));
+}
+function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng.installedBy || "").trim();
+  if (!actingPrincipal && !opts.authToken) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "promotion needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const atHash = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (!atHash) {
+    return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  }
+  let report;
+  try {
+    report = historyPreflight(eng, ws, domain, candidateHash, atHash, opts.dispositions);
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedPromotion(report, candidateHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const {
+    replaces: _replaces,
+    retireReplaced: _retireReplaced,
+    dispositions: _dispositions,
+    acceptanceReason: _acceptance,
+    ...authorOpts
+  } = opts;
+  const result = author(eng, ws, "nomos", "promoteDomain", prepared.payload, eng.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "promoted", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
+function restorePreviousPreflighted(eng, ws, domain, currentHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng.installedBy || "").trim();
+  if (!actingPrincipal) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "model restoration needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const resolved = currentLaw(eng, ws)[domain];
+  if (resolved !== currentHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "the generated model is no longer current; nothing changed [nomos.rollout.restore-current-changed]"
+    };
+  }
+  const current = qById(eng, ws, `domain-installation:${currentHash}`)[0]?.data;
+  const priorHash = typeof current?.["spec.supersedes"] === "string" ? current["spec.supersedes"] : "";
+  if (!priorHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "this model has no previous model to restore [nomos.rollout.restore-no-previous]"
+    };
+  }
+  const atHash = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (!atHash) return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  let report;
+  try {
+    report = historyRestorePreflight(
+      eng,
+      ws,
+      domain,
+      currentHash,
+      priorHash,
+      atHash,
+      actingPrincipal
+    );
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedRestoration(report, currentHash, priorHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const { acceptanceReason: _acceptance, ...authorOpts } = opts;
+  const result = author(eng, ws, "nomos", "rollbackDomain", prepared.payload, eng.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "restored", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
 async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0, parent = "" } = {}) {
   const incWs = `${ws}__rebirth`;
   try {
@@ -2526,26 +2776,89 @@ async function boot(eng, ws, ledger) {
   );
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
-  if (result.ok === false) {
+  const existing = qById(eng, ws, `domain-installation:${domainHash}`);
+  if (existing.length > 0) {
+    const phase = String(existing[0]?.data?.["status.phase"] ?? "");
+    return {
+      head: kgit.resolveRef(eng, gitdirOf(ws), BRANCH),
+      installation: existing,
+      staged: phase === "Pending",
+      alreadyInstalled: true
+    };
+  }
+  const before = currentLaw(eng, ws);
+  const tenantHashes = [...new Set(Object.values(before).filter(
+    (hash) => typeof hash === "string" && hash !== eng.hashes.bootstrap && hash !== eng.hashes.nomos
+  ))];
+  const upgrade = tenantHashes.length > 0;
+  let supersedes = opts.supersedes?.trim() || void 0;
+  if (supersedes !== void 0 && !tenantHashes.includes(supersedes)) {
     throw new Error(
-      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+      `deploy-predecessor-changed: the client named ${supersedes.slice(0, 12)}\u2026 as the current model, but this workspace no longer serves it. Refresh and deploy again; nothing was committed.`
     );
   }
-  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
-  const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
-  if (keys.length > 0) {
-    const law = installedLaw(eng, ws);
-    const currentLaw2 = law?.currentLaw ?? {};
-    const stale = keys.filter((k) => currentLaw2[k] !== void 0 && currentLaw2[k] !== domainHash);
-    if (stale.length > 0) {
+  if (upgrade && supersedes === void 0) {
+    if (tenantHashes.length === 1) supersedes = tenantHashes[0];
+    else {
       throw new Error(
-        `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+        `deploy-predecessor-ambiguous: this workspace currently serves ${tenantHashes.length} business-model packages. Nomos will not guess which one this candidate follows; use the generated deploy client, which binds the candidate to the current model before staging. Nothing was committed.`
       );
     }
   }
-  await commitAndPush(eng, ws, ledger);
-  return { head: result.head, installation };
+  if (upgrade && dispositions && Object.keys(dispositions).length > 0) {
+    throw new Error(
+      "deploy-manual-evolution-refused: successor deployment no longer accepts caller-chosen schema dispositions. Schema evolution belongs to the candidate model's adoption proof; nothing was committed."
+    );
+  }
+  const directiveId = upgrade ? "stageDomain" : "installDomain";
+  const payload = upgrade ? stagePayload(domainHash, usda, eng.installedBy, supersedes) : installPayload(domainHash, usda, eng.installedBy, dispositions);
+  const result = author(eng, ws, "nomos", directiveId, payload, eng.hashes.nomos, {
+    actor: opts.actor ?? "",
+    ...opts.authToken ? { authToken: opts.authToken } : {}
+  });
+  if (result.ok === false) {
+    unmount(eng, ws);
+    throw new Error(
+      `deploy-refused: ${upgrade ? "staging" : "installing"} ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
+  try {
+    const installation = qById(eng, ws, `domain-installation:${domainHash}`);
+    if (upgrade) {
+      const phase = String(installation[0]?.data?.["status.phase"] ?? "");
+      if (phase !== "Pending") {
+        throw new Error(
+          `deploy-did-not-stage: candidate ${domainHash.slice(0, 12)}\u2026 admitted but its lifecycle phase is '${phase || "missing"}', not Pending. Custody was not pushed.`
+        );
+      }
+      const after = currentLaw(eng, ws);
+      const moved = Object.entries(before).filter(([key, hash]) => after[key] !== hash);
+      if (moved.length > 0 || Object.values(after).includes(domainHash)) {
+        throw new Error(
+          `deploy-activated-candidate: staging ${domainHash.slice(0, 12)}\u2026 changed served law (${moved.map(([key]) => key).join(", ") || "candidate became current"}). Nomos refuses to persist an upgrade that bypassed model.adopt().`
+        );
+      }
+      await commitAndPush(eng, ws, ledger);
+      return { head: result.head, installation, staged: true, supersedes };
+    }
+    const law = installedLaw(eng, ws);
+    const installed = (law?.domains ?? []).find((row) => row?.domainHash === domainHash);
+    const keys = installed?.domainKeys ?? installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
+    if (keys.length > 0) {
+      const currentLaw2 = law?.currentLaw ?? {};
+      const stale = keys.filter((k) => currentLaw2[k] !== domainHash);
+      if (stale.length > 0) {
+        throw new Error(
+          `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+        );
+      }
+    }
+    await commitAndPush(eng, ws, ledger);
+    return { head: result.head, installation, staged: false };
+  } catch (error) {
+    unmount(eng, ws);
+    throw error;
+  }
 }
 function snapshot(eng, ws) {
   const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
@@ -2645,13 +2958,14 @@ function sealAttestationBatches(eng, ws, domain, controllerHash, opts = {}) {
   }
   return outcomes;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, stagePayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoOwnedScopeKey, cryptoOwnedDeviceRequest, cryptoOwnedPrepareApproval, cryptoOwnedPrepareRecovery, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats;
 var init_engine = __esm({
   "vendor/engine/engine.ts"() {
     "use strict";
     init_git_fs();
     init_tree();
     init_custody_transport();
+    init_managed_promotion();
     enc3 = new TextEncoder();
     dec3 = new TextDecoder();
     BRANCH = "main";
@@ -2697,6 +3011,14 @@ var init_engine = __esm({
       }, eng.STDERR)).oid
     };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
+    stagePayload = (hash, usda, installedBy, supersedes) => ({
+      domainHash: hash,
+      packageUsda: usda,
+      installedBy,
+      dependencies: [],
+      ...supersedes ? { supersedes } : {},
+      finalizers: []
+    });
     routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
     SUMMARY_SEP = "";
     summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
@@ -2727,6 +3049,105 @@ var init_engine = __esm({
     check = (eng, ws, object, relation, subject) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "check", object, relation, subject }), branch: BRANCH }, eng.STDERR));
     expand = (eng, ws, object, relation) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "expand", object, relation }), branch: BRANCH }, eng.STDERR));
     cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoSealField", scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) }, eng.STDERR)).envelope;
+    cryptoOwnedScopeKey = (eng, workspace, authorSecret, scope, principal = "", requireSeat = true, record, recordEpoch = 0, recordWrap) => {
+      const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
+      const derived = JSON.parse(call(eng.ex, "query", {
+        queryBytes: b64Json({
+          op: "cryptoOwnedScopeKey",
+          workspace,
+          principal,
+          authorSecret,
+          scope,
+          ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+          ...recordWrap === void 0 ? {} : { recordWrap }
+        })
+      }, eng.STDERR));
+      const ownedKeySubject = String(derived.ownedKeySubject || "");
+      if (!requireSeat) {
+        return {
+          scope: String(derived.scope || scope),
+          epoch: Number(derived.epoch) || 0,
+          key: String(derived.scopeKey || ""),
+          ownedKeySubject,
+          ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+          keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+          principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+        };
+      }
+      if (principal) {
+        let hex = "";
+        for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
+        const object = `nomos-owned-principal:${hex || "00"}`;
+        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
+        const leaves = row?.data?.subjects ?? row?.subjects ?? {};
+        const leaf = (raw) => {
+          if (raw && typeof raw === "object") return raw;
+          try {
+            return typeof raw === "string" ? JSON.parse(raw) : {};
+          } catch {
+            return {};
+          }
+        };
+        const active = Object.entries(leaves).filter(([, raw]) => leaf(raw).status === "active").map(([subject]) => subject);
+        if (active.length === 0 && Object.keys(leaves).length === 0) {
+          return {
+            scope: String(derived.scope || scope),
+            epoch: Number(derived.epoch) || 0,
+            key: String(derived.scopeKey || ""),
+            ownedKeySubject,
+            ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+            keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+            principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+          };
+        }
+        if (!active.includes(ownedKeySubject)) {
+          throw new Error(
+            "this device is waiting for approval \u2014 approve its opaque request on an already-working device"
+          );
+        }
+        const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
+        if (!custody) throw new Error("the approved device has no owned-data handoff");
+        const opened = JSON.parse(call(eng.ex, "query", {
+          queryBytes: b64Json({
+            op: "cryptoOwnedScopeKey",
+            workspace,
+            principal,
+            authorSecret,
+            scope,
+            ownedCustody: custody,
+            ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+            ...recordWrap === void 0 ? {} : { recordWrap }
+          })
+        }, eng.STDERR));
+        return {
+          scope: String(opened.scope || scope),
+          epoch: Number(opened.epoch) || 0,
+          key: String(opened.scopeKey || ""),
+          ownedKeySubject,
+          keyCommitment: typeof opened.keyCommitment === "string" ? opened.keyCommitment : void 0,
+          principalWrappingPublic: typeof opened.principalWrappingPublic === "string" ? opened.principalWrappingPublic : void 0
+        };
+      }
+      return {
+        scope: String(derived.scope || scope),
+        epoch: Number(derived.epoch) || 0,
+        key: String(derived.scopeKey || ""),
+        ownedKeySubject,
+        ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+        keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+        principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+      };
+    };
+    cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(JSON.parse(call(eng.ex, "query", {
+      queryBytes: b64Json({ op: "cryptoOwnedDeviceRequest", workspace, principal, authorSecret, scope })
+    }, eng.STDERR)).request || "");
+    cryptoOwnedPrepareApproval = (eng, args) => JSON.parse(call(eng.ex, "query", {
+      queryBytes: b64Json({ op: "cryptoOwnedPrepareApproval", ...args })
+    }, eng.STDERR));
+    cryptoOwnedPrepareRecovery = (eng, args) => JSON.parse(call(eng.ex, "query", {
+      queryBytes: b64Json({ op: "cryptoOwnedPrepareRecovery", ...args })
+    }, eng.STDERR));
     cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoKeygen" }) }, eng.STDERR));
     authorKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng.STDERR));
     eraCertSign = (eng, args) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "eraCertSign", ...args }) }, eng.STDERR));
@@ -2774,7 +3195,8 @@ var init_engine = __esm({
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
+    pendingConflicts = (eng, ws, principal = "", aggregateType = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts", aggregateType }), principal, branch: BRANCH }, eng.STDERR));
+    pendingConflictSummary = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflictSummary" }), principal, branch: BRANCH }, eng.STDERR));
     spatialBboxParams = (bbox) => {
       const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
       return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
@@ -2820,15 +3242,28 @@ async function fetchJsonCached(url, cacheFile) {
   }
 }
 async function fetchRuntime(cloud, kind = "production") {
-  const cache = join2(configDir(), "runtime");
+  const cache = process.env["NOMOS_OFFLINE_RUNTIME"] || join2(configDir(), "runtime");
   let wasmBytes;
   const wasmName = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
   const wasmUrl = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
   const wasmCache = join2(cache, wasmName);
+  const packagesCache = join2(cache, "packages.json");
+  const refresh = String(process.env["NOMOS_RUNTIME_REFRESH"] || "auto").toLowerCase();
+  if (refresh === "never") {
+    if (!existsSync2(wasmCache) || !existsSync2(packagesCache)) {
+      throw new Error(
+        `offline runtime cache missing at ${cache} (${wasmName} + packages.json); build or warm that exact runtime before running with NOMOS_RUNTIME_REFRESH=never`
+      );
+    }
+    return {
+      wasmBytes: readFileSync(wasmCache),
+      packages: JSON.parse(readFileSync(packagesCache, "utf8"))
+    };
+  }
   const localWasm = process.env["NOMOS_LOCAL_WASM"];
   if (localWasm) {
     const bytes = readFileSync(localWasm);
-    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join2(cache, "packages.json"));
+    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, packagesCache);
     return { wasmBytes: bytes, packages: packages2 };
   }
   try {
@@ -2841,7 +3276,7 @@ async function fetchRuntime(cloud, kind = "production") {
     if (!existsSync2(wasmCache)) throw e;
     wasmBytes = readFileSync(wasmCache);
   }
-  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join2(cache, "packages.json"));
+  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, packagesCache);
   return { wasmBytes, packages };
 }
 function atomicWriteRuntime(target, data) {
@@ -4980,14 +5415,14 @@ function negotiateDeployRoute(caps, opts) {
   if (opts.signed) {
     if (caps.offerLane === false) {
       return {
-        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
-  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
+        fail: `${caps.cloud} cannot accept an authenticated deployment for this workspace \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed because the workspace serves no self-describing gateway.
+  \u2192 target a current Nomos cloud that supports attributed deployment.`
       };
     }
     if (caps.offerLane === true && caps.routesTarget === false) {
       return {
-        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
-  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
+        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so the lifecycle request would 404.
+  \u2192 confirm the workspace is born and its current Nomos controller is installed.`
       };
     }
     if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
@@ -5065,7 +5500,7 @@ function domainKeysOf(body) {
 function packageHashOf(packageUsda) {
   return createHash2("sha256").update(Buffer.from(packageUsda, "utf8")).digest("hex");
 }
-function resolveDeployPlan(domainKeys, currentLaw2, targetHash, opts = {}) {
+function resolveDeployPlan(domainKeys, currentLaw2, targetHash) {
   const decisions = [];
   const priors = /* @__PURE__ */ new Set();
   for (const key of domainKeys) {
@@ -5074,21 +5509,18 @@ function resolveDeployPlan(domainKeys, currentLaw2, targetHash, opts = {}) {
       decisions.push({ key, action: "first" });
     } else if (currentHash === targetHash) {
       decisions.push({ key, currentHash, action: "idempotent" });
-    } else if (opts.keepBeside === true) {
-      decisions.push({ key, currentHash, action: "keep-beside" });
     } else {
-      decisions.push({ key, currentHash, action: "supersedes" });
+      decisions.push({ key, currentHash, action: "successor" });
       priors.add(currentHash);
     }
   }
-  const replaceCandidates = [...priors];
+  const predecessorCandidates = [...priors];
   const idempotent = domainKeys.length > 0 && decisions.every((d) => d.action === "idempotent");
   return {
     decisions,
-    ...replaceCandidates.length > 0 ? { replaces: replaceCandidates[0] } : {},
-    retireReplaced: opts.retireReplaced === true,
+    ...predecessorCandidates.length > 0 ? { supersedes: predecessorCandidates[0] } : {},
     idempotent,
-    replaceCandidates
+    predecessorCandidates
   };
 }
 function describeDeployPlan(plan, targetHash) {
@@ -5097,10 +5529,8 @@ function describeDeployPlan(plan, targetHash) {
     switch (d.action) {
       case "first":
         return `  ${d.key}: ${t} installed (first)`;
-      case "supersedes":
-        return `  ${d.key}: ${t} supersedes ${short(d.currentHash)}${plan.retireReplaced ? " (retired)" : ""}`;
-      case "keep-beside":
-        return `  ${d.key}: ${t} kept beside ${short(d.currentHash)}`;
+      case "successor":
+        return `  ${d.key}: ${t} is the candidate after ${short(d.currentHash)}`;
       case "idempotent":
         return `  ${d.key}: unchanged \u2014 ${t} is already active`;
     }
@@ -5571,7 +6001,7 @@ async function wsCreate(name, opts) {
       return 1;
     }
     out4(`\u2713 createWorkspace '${name}' requested via signed governance offer to ${opts.via} on ${cloud}`);
-    out4(`  the worker provisions it on first touch; deploy is open (kernel-gated)`);
+    out4(`  the worker provisions it on first touch; then run githolon deploy ${name}`);
     out4(`  (want the direct birth instead? drop --via: githolon ws create ${name})`);
     return 0;
   }
@@ -5614,7 +6044,7 @@ async function wsCreate(name, opts) {
   }
   if (opts.principal !== void 0) setPrincipal(opts.principal);
   out4(`\u2713 workspace ${name} created on ${cloud}`);
-  out4(`  deploy is open (kernel-gated): githolon deploy ${name}`);
+  out4(`  deploy its first model: githolon deploy ${name}`);
   return 0;
 }
 async function wsStatus(name, opts) {
@@ -5816,14 +6246,18 @@ async function deploy2(ws, opts) {
   try {
     const body = readDeployBody3(file);
     targetHash = packageHashOf2(body.packageUsda);
-    plan = resolveDeployPlan2(domainKeysOf2(body), currentLaw2, targetHash, {
-      keepBeside: opts.keepBeside === true,
-      retireReplaced: opts.retireReplaced === true
-    });
-  } catch {
-    plan = void 0;
-    targetHash = void 0;
+    plan = resolveDeployPlan2(domainKeysOf2(body), currentLaw2, targetHash);
+  } catch (error) {
+    err4(`deploy '${ws}' needs the current generated deploy body: ${error.message}`);
+    return 1;
+  }
+  if ((plan?.predecessorCandidates.length ?? 0) > 1) {
+    err4(
+      `deploy '${ws}' refused: this candidate spans ${plan.predecessorCandidates.length} different current models; Nomos will not guess one predecessor. Compile one coherent workspace model and try again.`
+    );
+    return 1;
   }
+  let expectsPending = plan !== void 0 && plan.predecessorCandidates.length === 1 && !plan.idempotent;
   const principal = opts.principal ?? activePrincipal();
   const signed = opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
   let phaseSuffix = "";
@@ -5842,8 +6276,14 @@ async function deploy2(ws, opts) {
       return 1;
     }
     const targetHash2 = createHash3("sha256").update(Buffer.from(packageUsda, "utf8")).digest("hex");
+    if (expectsPending && body.dispositions !== void 0 && body.dispositions !== null) {
+      err4(
+        `deploy '${ws}' refused: successor models cannot carry caller-chosen schema dispositions; evolution must be proved by model.adopt(), not smuggled into deployment`
+      );
+      return 1;
+    }
     const { probeCloudCapabilities: probeCloudCapabilities2, negotiateDeployRoute: negotiateDeployRoute2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
-    const route = { domain: "nomos", directiveId: "installDomain" };
+    const route = { domain: "nomos", directiveId: expectsPending ? "stageDomain" : "installDomain" };
     const caps = await probeCloudCapabilities2(cloud, ws, route);
     const refusal = negotiateDeployRoute2(caps, { signed: true, ws, sealedSizeChars: packageUsda.length, route });
     if (refusal !== void 0) {
@@ -5855,17 +6295,16 @@ async function deploy2(ws, opts) {
     let v;
     try {
       const who = resolveGovernancePrincipal2(opts);
-      const installPayload2 = {
+      const lifecyclePayload = {
         domainHash: targetHash2,
         packageUsda,
         installedBy: `user:${who}`,
         dependencies: [],
         finalizers: [],
-        // REPLACE-CURRENT: supersede the prior install per key (unless --keep-beside / first-install / idempotent).
-        ...plan?.replaces !== void 0 ? { replaces: plan.replaces, retireReplaced: plan.retireReplaced } : {},
-        ...body.dispositions !== void 0 && body.dispositions !== null ? { dispositions: body.dispositions } : {}
+        ...expectsPending && plan?.supersedes !== void 0 ? { supersedes: plan.supersedes } : {},
+        ...!expectsPending && body.dispositions !== void 0 && body.dispositions !== null ? { dispositions: body.dispositions } : {}
       };
-      v = await signAndPostOffer2(ws, "nomos", "installDomain", installPayload2, opts);
+      v = await signAndPostOffer2(ws, "nomos", route.directiveId, lifecyclePayload, opts);
     } catch (e) {
       err4(e.message);
       return 1;
@@ -5887,7 +6326,7 @@ async function deploy2(ws, opts) {
       const txt = d ? JSON.stringify(d) : "no body";
       err4(`deploy '${ws}' failed (${r.status}): ${txt}`);
       if (r.status === 401 || r.status === 403 || r.status === 422 || /warrant|signed|signer|unsigned|authorship|forged|relation|installDomain/i.test(txt)) {
-        err4(`  this workspace looks WARRANTED \u2014 re-run with --as <principal> to author a SIGNED install offer`);
+        err4(`  this workspace looks WARRANTED \u2014 re-run with --as <principal> to author a signed lifecycle offer`);
         err4(`  (import the admin signing key first if needed: githolon key import --principal <uid> --secret <key>)`);
       }
       return 1;
@@ -5895,6 +6334,7 @@ async function deploy2(ws, opts) {
     const phase = d.installation?.[0]?.data?.["status.phase"];
     phaseSuffix = phase === "Active" ? " (active)" : typeof phase === "string" ? ` (${phase.toLowerCase()})` : "";
     deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
+    expectsPending = d.staged === true || expectsPending;
   }
   const after = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((ar) => ar.json()).then((ad) => ad.ok === true ? ad : {}).catch(() => ({}));
   const currentHashes = new Set(Object.values(after.currentLaw ?? {}));
@@ -5903,13 +6343,28 @@ async function deploy2(ws, opts) {
   const emitPlan = () => {
     if (plan === void 0 || targetHash === void 0 || plan.decisions.length === 0) return;
     for (const line of describeDeployPlan2(plan, targetHash)) out4(line);
-    if (plan.replaceCandidates.length > 1) {
-      out4(`  \u26A0 the package's keys were active on ${plan.replaceCandidates.length} different installs \u2014 installDomain supersedes one (${plan.replaces.slice(0, 16)}\u2026); this deploy is active for every key.`);
-    }
-    if (!signed && plan.replaces !== void 0 && !opts.keepBeside) {
-      out4(`  note: the OPEN (unsigned) lane installs beside \u2014 the new law is active, and the prior install is effectively superseded but not marked Superseded. Sign with --as <uid> to record the supersession.`);
-    }
   };
+  if (expectsPending && deployedHash !== void 0) {
+    const row = (after.domains ?? []).find((x) => x.domainHash === deployedHash);
+    const unchanged = Object.entries(currentLaw2).every(([key, hash]) => after.currentLaw?.[key] === hash);
+    if (row?.phase !== "Pending" || !unchanged || isCurrent) {
+      err4(`deploy '${ws}' refused its own outcome: a successor must be Pending while the current model keeps serving`);
+      err4(`  observed phase=${row?.phase ?? "missing"}; current law ${unchanged && !isCurrent ? "unchanged" : "changed"}`);
+      return 2;
+    }
+    if (beforeDurableHead !== void 0) {
+      const durableHead = await waitForDurableMainAdvance(cloud, ws, beforeDurableHead);
+      if (durableHead === void 0) {
+        err4(`deploy '${ws}' staged the candidate, but canonical Git main did not advance within 30000ms`);
+        return 2;
+      }
+    }
+    out4(`\u2713 staged ${fileName} \u2192 ${ws} (pending)`);
+    if (plan?.supersedes) out4(`  current model ${plan.supersedes.slice(0, 16)}\u2026 keeps serving`);
+    out4(`  candidate ${deployedHash.slice(0, 16)}\u2026 is in custody but cannot serve yet`);
+    out4(`  next: use the candidate generated client and call model.adopt()`);
+    return 0;
+  }
   if (deployedHash !== void 0 && isCurrent) {
     const wasCurrentBefore = Object.values(currentLaw2).includes(deployedHash);
     if (!wasCurrentBefore && beforeDurableHead !== void 0) {
@@ -6316,6 +6771,39 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
   }
   return done(true, lines);
 }
+function sealOwnedBusinessBirth(eng, payload, encryption, authorSecret, principal) {
+  const key = payload[encryption.keyField];
+  const digest = createHash4("sha256").update(`${encryption.namespace}${String(key)}`).digest("hex");
+  const childWorkspace = `${encryption.namespace}-${digest.slice(0, 40)}`;
+  const scopeKey = cryptoOwnedScopeKey(
+    eng,
+    childWorkspace,
+    authorSecret,
+    encryption.scope,
+    principal,
+    false
+  );
+  const sealed = {
+    [OWNED_KEY_PAYLOAD_FIELD]: scopeKey.ownedKeySubject,
+    ...scopeKey.ownedCustody ? { [OWNED_CUSTODY_PAYLOAD_FIELD]: scopeKey.ownedCustody } : {}
+  };
+  for (const [field, slot] of Object.entries(encryption.fields)) {
+    const value = payload[field];
+    if (value === void 0 || value === null) continue;
+    sealed[field] = cryptoSealField(eng, {
+      scopeKey: scopeKey.key,
+      scope: encryption.scope,
+      epoch: scopeKey.epoch,
+      aggSid: slot.aggSid,
+      fieldSid: slot.fieldSid,
+      plaintext: String(value)
+    });
+  }
+  payload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD] = JSON.stringify(sealed);
+  payload[OWNED_KEY_PAYLOAD_FIELD] = scopeKey.ownedKeySubject;
+  if (scopeKey.ownedCustody) payload[OWNED_CUSTODY_PAYLOAD_FIELD] = scopeKey.ownedCustody;
+  return { childWorkspace, scopeKey };
+}
 function warrantParentForBirth(eng, parentWs, parentDomain, lawHash, genesisOwner, birthActor, dev2, stamp) {
   const authorFrameworkAs = (directiveId, payload, actor) => {
     for (const dom of [parentDomain, "nomos"]) {
@@ -6382,7 +6870,10 @@ function warrantParentForBirth(eng, parentWs, parentDomain, lawHash, genesisOwne
   return { ok: true, attestationVerified: hasDelegation && hasParentAttestation };
 }
 function attestedBirthOffer(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, founder, dev2, verified = true) {
-  const probe = author(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, { actor: founder });
+  const probe = author(eng, parentWs, parentDomain, directiveId, payloadNoCert, lawHash, {
+    actor: founder,
+    authorSecret: dev2.secret
+  });
   if (probe.ok !== false) {
     return { res: probe };
   }
@@ -6489,6 +6980,7 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
       return done(true);
     }
   }
+  const ownedBirth = cb.businessEncryption !== void 0 ? sealOwnedBusinessBirth(eng, payload, cb.businessEncryption, dev2.secret, founder) : void 0;
   const { res } = attestedBirthOffer(
     eng,
     parentWs,
@@ -6603,10 +7095,29 @@ async function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
     return done(false, `the recovered child ${childWs} FAILED verify_chain from its own custody: ${recoveredVerify.error ?? "invalid"}`);
   }
   if (cb.childSeedInstanceId !== void 0) {
-    const recoveredRows = qById(eng, childWs, cb.childSeedInstanceId);
+    const recoveredRows = qById(
+      eng,
+      childWs,
+      cb.childSeedInstanceId,
+      ownedBirth === void 0 ? "" : founder,
+      ownedBirth === void 0 ? [] : [ownedBirth.scopeKey]
+    );
     if (recoveredRows.length < 1) {
       return done(false, `the recovered child ${childWs} verified but its business root ${cb.childSeedInstanceId} was missing`);
     }
+    if (ownedBirth !== void 0 && cb.businessEncryption !== void 0) {
+      if (childWs !== ownedBirth.childWorkspace) {
+        return done(false, `the born child '${childWs}' differs from the deterministic owned-custody address '${ownedBirth.childWorkspace}'`);
+      }
+      const data = recoveredRows[0]?.data ?? {};
+      for (const field of Object.keys(cb.businessEncryption.fields)) {
+        const expected = cb.birthPayload[field];
+        if (expected !== void 0 && data[field] !== expected) {
+          return done(false, `the recovered owned ${cb.businessAggregateId ?? "aggregate"} did not decrypt '${field}' back to its business fact`);
+        }
+      }
+      lines.push(`\u2713 owned custody \u2014 recovered business facts decrypted under the creator's framework-managed device key`);
+    }
   }
   if (cb.businessAggregateId !== void 0) {
     lines.push(`\u2713 persistence + recovery \u2014 evicted, restored from durable custody, and ${cb.businessAggregateId} read back`);
@@ -6870,7 +7381,7 @@ OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every
   console.log(`Run the same generated business proof against Nomos Cloud when ready: githolon proof --live`);
   return 0;
 }
-var keyHashOf, OFFLINE_PROOF_VERIFIER;
+var keyHashOf, OFFLINE_PROOF_VERIFIER, OWNED_KEY_PAYLOAD_FIELD, OWNED_CUSTODY_PAYLOAD_FIELD, BUSINESS_BIRTH_SEED_PAYLOAD_FIELD;
 var init_proof_offline = __esm({
   "src/proof_offline.ts"() {
     "use strict";
@@ -6878,6 +7389,9 @@ var init_proof_offline = __esm({
     init_local_holon();
     keyHashOf = (pubB64) => createHash4("sha256").update(Buffer.from(pubB64, "base64")).digest("hex");
     OFFLINE_PROOF_VERIFIER = "nomos:test-mint";
+    OWNED_KEY_PAYLOAD_FIELD = "__nomos_owned_device_key_subject_7c1f5e";
+    OWNED_CUSTODY_PAYLOAD_FIELD = "__nomos_owned_device_custody_7c1f5e";
+    BUSINESS_BIRTH_SEED_PAYLOAD_FIELD = "__nomos_birth_seed_payload_7c1f5e";
   }
 });
 
@@ -8694,7 +9208,7 @@ export const ${n.pascal} = aggregate("${n.pascal}", {
   status: t.enum(${n.statusesConst}).merge(Lww),
   tags: t.set(t.string()).merge(AddWins),
   customFields: t.map(t.string()).merge(MapOf(Lww)),
-});`;
+}).public();`;
 }
 function domainTemplate(raw) {
   const n = namesFor(raw);
@@ -8766,7 +9280,7 @@ import { z, aggregate, directive, t, Conflict, set } from "@githolon/dsl";
 // Stub target \u2014 in a real domain, import the existing aggregate handle instead.
 export const ${n.pascal} = aggregate("${n.pascal}", {
   label: t.string().merge(Conflict),
-});
+}).public();
 
 /** ${n.camel} \u2014 .mutates the target aggregate. */
 export const ${n.camel} = directive("${n.camel}")
@@ -9481,21 +9995,19 @@ var HELP = {
     examples: ["githolon revoke creation 32c7100e-\u2026", "githolon revoke admin 32c7100e-\u2026"]
   },
   deploy: {
-    usage: "githolon deploy [<ws>] [--as <uid>] [--keep-beside] [--retire-replaced] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. DEFAULT = REPLACE-CURRENT: for each domain\nkey in the package it resolves the workspace's active install (the holon's existing `currentLaw` map)\nand passes it as installDomain's `replaces`, so the old install becomes superseded for that key.\nRe-deploying the SAME hash stays idempotent (never self-superseded).\nTWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer (carrying `replaces`) with that key and relays it; the\n  kernel re-verifies the signature + judges the installDomain relation. Required for warranted platforms.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains installs beside. The new law becomes active,\n  but the prior install is only effectively superseded unless you sign with --as to record Superseded.\nAfter the POST it CONFIRMS the deployed hash is active (exit 2 if committed-but-not-active) and prints\nwhat moved, per key. With no <ws>, the project's `workspace` binding resolves it.\nLifecycle vocabulary: active = served now; superseded = replayable, not served; retired = explicitly withdrawn, replayable, not served.",
+    usage: "githolon deploy [<ws>] [--as <uid>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
+    what: "Put the compiled model in the workspace's verified custody. There is one lifecycle: the first\nmodel becomes active so a blank application can start; every successor stays Pending while the current\nmodel keeps serving. The candidate generated client then runs the exact-history proof through\n`model.adopt()` and either adopts immediately or returns a business-readable decision requiring\n`decision.accept(reason)`. Deployment cannot choose a replacement mode or bypass that proof.\nRe-deploying the same content hash is idempotent. With no <ws>, the project's workspace binding resolves it.",
     flags: [
-      ["--as <uid>", "deploy as this principal via the SIGNED lane (needs its key \u2014 githolon key import; else githolon use)"],
-      ["--keep-beside", "install beside the prior law (the old multi-version default; prior becomes effectively superseded by recency)"],
-      ["--retire-replaced", "supersede via Retired \u2014 the prior install is explicitly withdrawn"],
+      ["--as <uid>", "attribute the deployment to this principal (needs its enrolled signing key)"],
       ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
       ["--cloud <url>", "target cloud"]
     ],
-    examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy co2-platform --as <admin-uid>", "githolon deploy my-ws --keep-beside", "githolon deploy my-ws --retire-replaced"]
+    examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy co2-platform --as <admin-uid>"]
   },
   domains: {
     usage: "githolon domains <status <ws> [--explain-current-interface] | retire <ws> <hashOrKey> [--with <hashOrKey>]>",
-    what: "The INSTALL-LIFECYCLE lane over a workspace's law.\n\u2022 status: per domain KEY, the active hash, then the superseded/retired lineage behind it.\n  Lifecycle vocabulary: active = served now; superseded = replaced by a newer install for the same domain\n  key, replayable, not served; retired = explicitly withdrawn, replayable, not served.\n  --explain-current-interface spells out why active reads/dispatch use only that active map.\n\u2022 retire: mark an install Retired via a signed installDomain offer. The framework retires only as the\n  consequence of installing a SUCCESSOR \u2014 by default the local compiled package (build/*.deploy.json),\n  or --with <hashOrKey> names an already-installed successor. A key the successor does not cover is left\n  with NO active law \u2014 WARNED loudly, never blocked. A key resolves to its active hash; a 64-hex arg is\n  taken as the install hash.",
+    what: "Framework lifecycle inspection and explicit withdrawal.\n\u2022 status: per domain KEY, the active hash, then the superseded/retired lineage behind it.\n  Lifecycle vocabulary: active = served now; superseded = replaced by a newer install for the same domain\n  key, replayable, not served; retired = explicitly withdrawn, replayable, not served.\n  --explain-current-interface spells out why active reads/dispatch use only that active map.\n\u2022 retire: mark an install Retired via a signed installDomain offer. The framework retires only as the\n  consequence of installing a SUCCESSOR \u2014 by default the local compiled package (build/*.deploy.json),\n  or --with <hashOrKey> names an already-installed successor. A key the successor does not cover is left\n  with NO active law \u2014 WARNED loudly, never blocked. A key resolves to its active hash; a 64-hex arg is\n  taken as the install hash.",
     flags: [
       ["--explain-current-interface", "status: also explain the frontier resolution (why the interface is what it is)"],
       ["--with <hashOrKey>", "retire: the retiring successor package \u2014 an already-installed hash or served key"],
@@ -9506,7 +10018,7 @@ var HELP = {
   },
   secret: {
     usage: "githolon secret <set <ws> <push-password> | rotate <ws>> [--cloud <url>]",
-    what: "The git push-password store (~/.holon/credentials.json, 0600) for authenticated git sync to the\ncloud host. The open deploy lane uses no secret. `set` imports a push password you already hold;\n`rotate` is RETIRED (the host holds no ownership credential to rotate \u2014 410). (There is no\npush-to-create birth: a workspace is born by its parent authoring its birth.)",
+    what: "The git push-password store (~/.holon/credentials.json, 0600) for authenticated git sync to the\ncloud host. Deployment has no host secret. `set` imports a push password you already hold;\n`rotate` is RETIRED (the host holds no ownership credential to rotate \u2014 410). (There is no\npush-to-create birth: a workspace is born by its parent authoring its birth.)",
     examples: ["githolon secret set my-ws holon_v1_\u2026"]
   },
   git: {
@@ -10052,15 +10564,13 @@ function cloudArgs(rest) {
   const pos = [];
   const opts = {};
   const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan", "--depth", "--domain", "--directive"];
-  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--keep-beside", "--retire-replaced", "--explain-current-interface", "--dry-run", "--json", "--full"];
+  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--explain-current-interface", "--dry-run", "--json", "--full"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     if (BOOL_FLAGS.includes(a)) {
       if (a === "--sha256") opts.sha256 = true;
       else if (a === "--stamp") opts.stamp = true;
       else if (a === "--clear") opts.clear = true;
-      else if (a === "--keep-beside") opts.keepBeside = true;
-      else if (a === "--retire-replaced") opts.retireReplaced = true;
       else if (a === "--explain-current-interface") opts.explain = true;
       else if (a === "--dry-run") opts.dryRun = true;
       else if (a === "--json") opts.json = true;