githolon 0.102.5 → 0.103.0

package/dist/compile_mountability_entry.js

@@ -0,0 +1,4146 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/cloud.ts
+import { join } from "node:path";
+import { homedir } from "node:os";
+function cloudBase(flag) {
+  return (flag ?? process.env["NOMOS_CLOUD"] ?? DEFAULT_CLOUD).replace(/\/+$/, "");
+}
+function configDir() {
+  return process.env["HOLON_CONFIG_DIR"] ?? join(homedir(), ".holon");
+}
+var DEFAULT_CLOUD;
+var init_cloud = __esm({
+  "src/cloud.ts"() {
+    "use strict";
+    DEFAULT_CLOUD = "https://nomos.cafe";
+  }
+});
+
+// vendor/engine/git-fs.ts
+function fsErr(code, p) {
+  const e = new Error(`${code}: ${p}`);
+  e.code = code;
+  return e;
+}
+function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
+  const root = preopen.dir;
+  const isDir = (n) => !!n && n.contents instanceof Map;
+  function parts(p) {
+    if (p === mount) return [];
+    if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
+    const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
+    return rel === "" ? [] : rel.split("/");
+  }
+  function resolve2(ps) {
+    let cur = root;
+    for (const part of ps) {
+      if (!isDir(cur)) return null;
+      const next = cur.contents.get(part);
+      if (next === void 0) return null;
+      cur = next;
+    }
+    return cur;
+  }
+  const parent = (ps) => resolve2(ps.slice(0, -1));
+  const leaf = (ps) => ps[ps.length - 1];
+  const promises = {
+    async readFile(p, opts) {
+      const n = resolve2(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (isDir(n)) throw fsErr("EISDIR", p);
+      const data = n.data ?? new Uint8Array(0);
+      const encoding = typeof opts === "string" ? opts : opts && opts.encoding;
+      return encoding ? new TextDecoder().decode(data) : new Uint8Array(data);
+    },
+    async writeFile(p, data) {
+      const ps = parts(p);
+      const par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+      par.contents.set(leaf(ps), new File3(bytes));
+    },
+    async unlink(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
+    },
+    async readdir(p) {
+      const n = resolve2(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (!isDir(n)) throw fsErr("ENOTDIR", p);
+      return [...n.contents.keys()];
+    },
+    async mkdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      if (par.contents.has(leaf(ps))) throw fsErr("EEXIST", p);
+      par.contents.set(leaf(ps), new Directory3(/* @__PURE__ */ new Map()));
+    },
+    async rmdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      par.contents.delete(leaf(ps));
+    },
+    async stat(p) {
+      return promises.lstat(p);
+    },
+    async lstat(p) {
+      const n = resolve2(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      const dir = isDir(n);
+      return {
+        type: dir ? "dir" : "file",
+        mode: dir ? 16384 : 33188,
+        size: dir ? 0 : n.data ? n.data.length : 0,
+        ino: 0,
+        mtimeMs: 0,
+        ctimeMs: 0,
+        uid: 1,
+        gid: 1,
+        dev: 1,
+        isFile: () => !dir,
+        isDirectory: () => dir,
+        isSymbolicLink: () => false
+      };
+    },
+    async readlink(p) {
+      throw fsErr("EINVAL", p);
+    },
+    async symlink() {
+      throw fsErr("EPERM", "symlink unsupported");
+    },
+    async chmod() {
+    }
+  };
+  return { promises };
+}
+var init_git_fs = __esm({
+  "vendor/engine/git-fs.ts"() {
+    "use strict";
+  }
+});
+
+// vendor/engine/tree.ts
+function flatten(dir, prefix, out2) {
+  const children = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  for (const [name, inode] of children) {
+    const path = prefix ? prefix + "/" + name : name;
+    if (inode.contents instanceof Map) {
+      out2.push({ path, dir: true });
+      flatten(inode, path, out2);
+    } else {
+      out2.push({ path, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+    }
+  }
+}
+function serializeTree(workTree) {
+  const entries = [];
+  flatten(workTree, "", entries);
+  const chunks = [];
+  const header = new Uint8Array(4);
+  new DataView(header.buffer).setUint32(0, entries.length, true);
+  chunks.push(header);
+  for (const e of entries) {
+    const pathBytes = enc.encode(e.path);
+    const body = e.dir ? new Uint8Array(0) : e.bytes ?? new Uint8Array(0);
+    const meta = new Uint8Array(9);
+    const dv = new DataView(meta.buffer);
+    dv.setUint8(0, e.dir ? 1 : 0);
+    dv.setUint32(1, pathBytes.length, true);
+    dv.setUint32(5, body.length, true);
+    chunks.push(meta, pathBytes, body);
+  }
+  let total = 0;
+  for (const c of chunks) total += c.length;
+  const out2 = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    out2.set(c, off);
+    off += c.length;
+  }
+  return out2;
+}
+var enc, dec;
+var init_tree = __esm({
+  "vendor/engine/tree.ts"() {
+    "use strict";
+    enc = new TextEncoder();
+    dec = new TextDecoder();
+  }
+});
+
+// vendor/engine/custody-transport.ts
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out2 = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out2.set(c, o);
+    o += c.length;
+  }
+  return out2;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}, fetchImpl = fetch) {
+  const r = await fetchImpl(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}, fetchImpl = fetch) {
+  if (!updates.length) return { ok: true, noop: true };
+  const cmds = [];
+  updates.forEach((u, i) => {
+    const old = u.oldOid || ZERO_OID;
+    const neu = u.newOid || ZERO_OID;
+    const caps = i === 0 ? "\0report-status" : "";
+    cmds.push(pkt(`${old} ${neu} ${u.ref}${caps}
+`));
+  });
+  cmds.push(FLUSH);
+  const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
+  let r;
+  try {
+    r = await fetchImpl(`${remote}/git-receive-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+      body
+    });
+  } catch (error) {
+    throw new Error(`receive-pack transport failed (${body.byteLength} bytes): ${String(error)}`, { cause: error });
+  }
+  const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
+  const unpacked = /unpack ok/.test(txt);
+  const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
+  if (!(r.ok && unpacked && everyRefOk && !/\bng /.test(txt))) {
+    throw new Error(`receive-pack ${r.status}: ${txt.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 200)}`);
+  }
+  return { ok: true };
+}
+var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
+var init_custody_transport = __esm({
+  "vendor/engine/custody-transport.ts"() {
+    "use strict";
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    ZERO_OID = "0".repeat(40);
+    EMPTY_PACK = new Uint8Array([
+      80,
+      65,
+      67,
+      75,
+      0,
+      0,
+      0,
+      2,
+      0,
+      0,
+      0,
+      0,
+      // "PACK", ver 2, 0 objects
+      2,
+      157,
+      8,
+      130,
+      59,
+      216,
+      168,
+      234,
+      181,
+      16,
+      173,
+      106,
+      // sha1(the 12 header bytes)
+      199,
+      92,
+      130,
+      60,
+      253,
+      62,
+      211,
+      30
+    ]);
+    FLUSH = enc2.encode("0000");
+  }
+});
+
+// vendor/engine/managed-promotion.ts
+function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
+  if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  if (!report.promotable && !acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "exact history changes under the candidate; provide an acceptanceReason to make that business decision accountable"
+    };
+  }
+  if (!report.atStateRoot || !report.historyHash || !report.reportHash || !report.projection) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "the complete pre-flight report is missing its state, projection, or content proof"
+    };
+  }
+  const provedDomains = report.domains?.length ? report.domains : [report.domain];
+  if (!provedDomains.includes(domain)) {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: `the package-wide report does not cover the generated business area '${domain}'`
+    };
+  }
+  const reportEvidence = JSON.parse(JSON.stringify(report));
+  if (Array.isArray(reportEvidence.divergences)) {
+    for (const divergence of reportEvidence.divergences) {
+      if (divergence && typeof divergence === "object") {
+        delete divergence.atCommit;
+      }
+    }
+  }
+  const preflight = {
+    candidateHash,
+    // A package may be reached through any one of its generated domain clients. The
+    // kernel chooses one canonical domain for the private receipt so the exact same
+    // package/history proof has one identity regardless of that entry point.
+    domain: report.domain,
+    atHash: report.atHash,
+    atStateRoot: report.atStateRoot,
+    historyHash: report.historyHash,
+    reportHash: report.reportHash,
+    reportJson: JSON.stringify(reportEvidence),
+    complete: true,
+    evolveOk: true,
+    rawPromotable: report.promotable,
+    projectionEqual: report.projection.equal,
+    replayedIntents: report.replayedIntents,
+    candidateIntents: report.candidateIntents,
+    divergenceCount: report.divergences.length,
+    baselineRoot: report.projection.baselineRoot,
+    candidateRoot: report.projection.candidateRoot,
+    ...!report.promotable && acceptanceReason ? { acceptanceReason } : {}
+  };
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: `${RELEASE_RECEIPT_PREFIX}${report.reportHash}`,
+    payload: {
+      domainHash: candidateHash,
+      ...opts.replaces ? { replaces: opts.replaces } : {},
+      retireReplaced: opts.retireReplaced ?? false,
+      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      preflight
+    }
+  };
+}
+function prepareManagedRestoration(report, currentHash, priorHash, domain, opts = {}) {
+  if (!report.dispositions || typeof report.dispositions !== "object") {
+    return {
+      ok: false,
+      stage: "preflight",
+      report,
+      error: "restoration refused: the exact-history proof did not derive its predecessor dispositions"
+    };
+  }
+  const acceptanceReason = opts.acceptanceReason?.trim();
+  const prepared = prepareManagedPromotion(report, priorHash, domain, {
+    dispositions: report.dispositions,
+    ...acceptanceReason ? { acceptanceReason } : {}
+  });
+  if (!prepared.ok) {
+    return {
+      ...prepared,
+      stage: prepared.stage === "acceptance" ? "acceptance" : "preflight"
+    };
+  }
+  if (!acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "restoring previous law needs a business reason even when historical outcomes are unchanged"
+    };
+  }
+  return {
+    ok: true,
+    stage: "ready",
+    report,
+    receiptId: prepared.receiptId,
+    payload: {
+      candidateHash: currentHash,
+      priorHash,
+      dispositions: report.dispositions,
+      preflight: prepared.payload.preflight
+    }
+  };
+}
+var RELEASE_RECEIPT_PREFIX;
+var init_managed_promotion = __esm({
+  "vendor/engine/managed-promotion.ts"() {
+    "use strict";
+    RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
+  }
+});
+
+// vendor/engine/proto/nomos/kernel/v1/kernel_pb.js
+import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
+var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, WorkspaceTargetSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, PageQuerySchema, ByIdQuerySchema, TallyQuerySchema, SpatialQuerySchema, NamedQuerySchema, AuthorizationObjectSchema, AuthorizationSubjectSchema, AuthorizationConsistencySchema, AuthorizationCheckRequestSchema, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, EncodeDocumentRequestSchema, InspectDocumentRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, CheckpointExportRequestSchema, CheckpointImportRequestSchema, CapacityReserveRequestSchema, RestoreMainRequestSchema, NomosValueSchema, NomosStructSchema, QueryOperationSchema, QueryOperation;
+var init_kernel_pb = __esm({
+  "vendor/engine/proto/nomos/kernel/v1/kernel_pb.js"() {
+    "use strict";
+    file_nomos_kernel_v1_kernel = /* @__PURE__ */ fileDesc("Chxub21vcy9rZXJuZWwvdjEva2VybmVsLnByb3RvEg9ub21vcy5rZXJuZWwudjEimAMKC0NhbGxSZXF1ZXN0EhgKEHByb3RvY29sX3ZlcnNpb24YASABKA0SEgoKcmVxdWVzdF9pZBgCIAEoCRIsCgRvcGVuGAogASgLMhwubm9tb3Mua2VybmVsLnYxLk9wZW5SZXF1ZXN0SAASLgoFb2ZmZXIYCyABKAsyHS5ub21vcy5rZXJuZWwudjEuT2ZmZXJSZXF1ZXN0SAASLgoFcXVlcnkYDCABKAsyHS5ub21vcy5rZXJuZWwudjEuUXVlcnlSZXF1ZXN0SAASMAoGb3V0Ym94GA0gASgLMh4ubm9tb3Mua2VybmVsLnYxLk91dGJveFJlcXVlc3RIABIsCgRzeW5jGA4gASgLMhwubm9tb3Mua2VybmVsLnYxLlN5bmNSZXF1ZXN0SAASMgoHY3VzdG9keRgPIAEoCzIfLm5vbW9zLmtlcm5lbC52MS5DdXN0b2R5UmVxdWVzdEgAEiwKBHRlc3QYECABKAsyHC5ub21vcy5rZXJuZWwudjEuVGVzdFJlcXVlc3RIAEILCglvcGVyYXRpb24iywMKDENhbGxSZXNwb25zZRIYChBwcm90b2NvbF92ZXJzaW9uGAEgASgNEhIKCnJlcXVlc3RfaWQYAiABKAkSKwoHZmFpbHVyZRgKIAEoCzIYLm5vbW9zLmtlcm5lbC52MS5GYWlsdXJlSAASLQoEb3BlbhgLIAEoCzIdLm5vbW9zLmtlcm5lbC52MS5PcGVuUmVzcG9uc2VIABIvCgVvZmZlchgMIAEoCzIeLm5vbW9zLmtlcm5lbC52MS5PZmZlclJlc3BvbnNlSAASLwoFcXVlcnkYDSABKAsyHi5ub21vcy5rZXJuZWwudjEuUXVlcnlSZXNwb25zZUgAEjEKBm91dGJveBgOIAEoCzIfLm5vbW9zLmtlcm5lbC52MS5PdXRib3hSZXNwb25zZUgAEi0KBHN5bmMYDyABKAsyHS5ub21vcy5rZXJuZWwudjEuU3luY1Jlc3BvbnNlSAASMwoHY3VzdG9keRgQIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5DdXN0b2R5UmVzcG9uc2VIABItCgR0ZXN0GBEgASgLMh0ubm9tb3Mua2VybmVsLnYxLlRlc3RSZXNwb25zZUgAQgkKB291dGNvbWUiVwoHRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSLQoHZGV0YWlscxgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCI8CgxPcGVuUmVzcG9uc2USLAoGcmVzdWx0GAEgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IsMCCg1PZmZlclJlc3BvbnNlEjIKCGFkbWl0dGVkGAEgASgLMh4ubm9tb3Mua2VybmVsLnYxLk9mZmVyQWRtaXR0ZWRIABIwCgdyZWZ1c2VkGAIgASgLMh0ubm9tb3Mua2VybmVsLnYxLk9mZmVyUmVmdXNlZEgAEjsKDWRlYWRfbGV0dGVyZWQYAyABKAsyIi5ub21vcy5rZXJuZWwudjEuT2ZmZXJEZWFkTGV0dGVyZWRIABI4CgtxdWFyYW50aW5lZBgEIAEoCzIhLm5vbW9zLmtlcm5lbC52MS5PZmZlclF1YXJhbnRpbmVkSAASSgoVYmxvY2tlZF9vbl9kZXBlbmRlbmN5GAUgASgLMikubm9tb3Mua2VybmVsLnYxLk9mZmVyQmxvY2tlZE9uRGVwZW5kZW5jeUgAQgkKB291dGNvbWUiPQoNT2ZmZXJBZG1pdHRlZBIsCgZyZXN1bHQYASABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QilgEKDE9mZmVyUmVmdXNlZBIVCghvZmZlcl9pZBgBIAEoCUgAiAEBEi8KB3JlZnVzYWwYAiABKAsyHi5ub21vcy5rZXJuZWwudjEuS2VybmVsUmVmdXNhbBIxCgtkaWFnbm9zdGljcxgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdEILCglfb2ZmZXJfaWQiegoRT2ZmZXJEZWFkTGV0dGVyZWQSFQoIb2ZmZXJfaWQYASABKAlIAIgBARIOCgZyZWFzb24YAiABKAkSMQoLZGlhZ25vc3RpY3MYAyABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIq4BChBPZmZlclF1YXJhbnRpbmVkEhUKCG9mZmVyX2lkGAEgASgJSACIAQESGQoRYXV0aG9yZWRfbGF3X2hhc2gYAiABKAkSGAoQY3VycmVudF9sYXdfaGFzaBgDIAEoCRIOCgZyZWFzb24YBCABKAkSMQoLZGlhZ25vc3RpY3MYBSABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIoEBChhPZmZlckJsb2NrZWRPbkRlcGVuZGVuY3kSFQoIb2ZmZXJfaWQYASABKAlIAIgBARIOCgZkZXRhaWwYAiABKAkSMQoLZGlhZ25vc3RpY3MYAyABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3RCCwoJX29mZmVyX2lkIoEBCg1LZXJuZWxSZWZ1c2FsEjAKBGNvZGUYASABKA4yIi5ub21vcy5rZXJuZWwudjEuS2VybmVsUmVmdXNhbENvZGUSDwoHbWVzc2FnZRgCIAEoCRItCgdkZXRhaWxzGAMgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IqQCCg1RdWVyeVJlc3BvbnNlEiwKBXZhbHVlGAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWVIABJBChBhcHBsaWNhdGlvbl9qc29uGAIgASgLMiUubm9tb3Mua2VybmVsLnYxLkFwcGxpY2F0aW9uSnNvblZhbHVlSAASSgoTYXV0aG9yaXphdGlvbl9jaGVjaxgKIAEoCzIrLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ2hlY2tSZXNwb25zZUgAEkwKFGF1dGhvcml6YXRpb25fZXhwYW5kGAsgASgLMiwubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBhbmRSZXNwb25zZUgAQggKBnJlc3VsdCIkChRBcHBsaWNhdGlvbkpzb25WYWx1ZRIMCgR1dGY4GAEgASgMIj4KDk91dGJveFJlc3BvbnNlEiwKBnJlc3VsdBgBIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCI8CgxTeW5jUmVzcG9uc2USLAoGcmVzdWx0GAEgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0IkIKD1dvcmtzcGFjZVRhcmdldBIMCgRyZXBvGAEgASgJEhEKCXdvcmtzcGFjZRgCIAEoCRIOCgZicmFuY2gYAyABKAkiTgoLT3BlblJlcXVlc3QSMAoGdGFyZ2V0GAEgASgLMiAubm9tb3Mua2VybmVsLnYxLldvcmtzcGFjZVRhcmdldBINCgVzcGFucxgCIAEoCCJhCg1EaXJlY3RpdmVDYWxsEg4KBmRvbWFpbhgBIAEoCRIRCglkaXJlY3RpdmUYAiABKAkSLQoHcGF5bG9hZBgDIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCLAAgoQQXV0aG9yaW5nT3B0aW9ucxINCgVhY3RvchgBIAEoCRISCgphdXRoX3Rva2VuGAIgASgMEhUKDWF1dGhvcl9zZWNyZXQYAyABKAwSHQoQdmFsaWRfZnJvbV9lcG9jaBgEIAEoBEgAiAEBEh8KEnByaW5jaXBhbF92ZXJpZmllZBgFIAEoCEgBiAEBEgsKA3JuZxgGIAMoARIYChBkZWZlcl9wcm9qZWN0aW9uGAcgASgIEg0KBXNwYW5zGAggASgIEg8KB2RyeV9ydW4YCSABKAgSEAoIc2VxdWVuY2UYCiABKAQSLQoFY2xvY2sYCyABKAsyHi5ub21vcy5rZXJuZWwudjEuQ2FwdHVyZWRDbG9ja0ITChFfdmFsaWRfZnJvbV9lcG9jaEIVChNfcHJpbmNpcGFsX3ZlcmlmaWVkIkoKDUNhcHR1cmVkQ2xvY2sSFwoPcGh5c2ljYWxfbWlsbGlzGAEgASgEEg8KB2xvZ2ljYWwYAiABKA0SDwoHcmVwbGljYRgDIAEoBCLeAwoMT2ZmZXJSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSLgoEY2FsbBgCIAEoCzIeLm5vbW9zLmtlcm5lbC52MS5EaXJlY3RpdmVDYWxsSAASHAoSc2VhbGVkX2NoYW5nZV91c2RhGAcgASgMSAASNAoJYXV0aG9yaW5nGAMgASgLMiEubm9tb3Mua2VybmVsLnYxLkF1dGhvcmluZ09wdGlvbnMSEAoIbGF3X3VzZHoYBCABKAwSMwoMYXR0ZXN0YXRpb25zGAUgAygLMh0ubm9tb3Mua2VybmVsLnYxLkF0dGVzdGVkUmVhZBI9ChJjb25mbGljdF9zbmFwc2hvdHMYBiADKAsyIS5ub21vcy5rZXJuZWwudjEuQ29uZmxpY3RTbmFwc2hvdBIaChJleGVjdXRpb25fbGF3X3VzZHoYCCABKAwSIAoTY29udHJvbGxlcl9sYXdfaGFzaBgJIAEoCUgBiAEBEh0KEGNhbmRpZGF0ZV9jb21taXQYCiABKAlIAogBAUIICgZpbnRlbnRCFgoUX2NvbnRyb2xsZXJfbGF3X2hhc2hCEwoRX2NhbmRpZGF0ZV9jb21taXQikwEKDEF0dGVzdGVkUmVhZBIQCghxdWVyeV9pZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSKwoGcmVzdWx0GAMgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUSEwoLYXR0ZXN0YXRpb24YBCABKAwidQoQQ29uZmxpY3RTbmFwc2hvdBIWCg5hZ2dyZWdhdGVfdHlwZRgBIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAiABKAkSDQoFZmllbGQYAyABKAkSFQoNdGFyZ2V0X3NjaGVtYRgEIAEoCRINCgV0b2tlbhgFIAEoCSLbBQoMUXVlcnlSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSMgoJYXV0aG9yaXR5GAIgASgLMh8ubm9tb3Mua2VybmVsLnYxLlF1ZXJ5QXV0aG9yaXR5Eg0KBXNwYW5zGAMgASgIEioKBHJvd3MYCiABKAsyGi5ub21vcy5rZXJuZWwudjEuUm93c1F1ZXJ5SAASKgoEcGFnZRgLIAEoCzIaLm5vbW9zLmtlcm5lbC52MS5QYWdlUXVlcnlIABIrCgVieV9pZBgMIAEoCzIaLm5vbW9zLmtlcm5lbC52MS5CeUlkUXVlcnlIABI5CgxyZXNvbHZlX3JlZnMYDSABKAsyIS5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZnNRdWVyeUgAEjsKDXJlZl9mcmVzaG5lc3MYDiABKAsyIi5ub21vcy5rZXJuZWwudjEuUmVmRnJlc2huZXNzUXVlcnlIABIsCgVjb3VudBgPIAEoCzIbLm5vbW9zLmtlcm5lbC52MS5UYWxseVF1ZXJ5SAASKgoDc3VtGBAgASgLMhsubm9tb3Mua2VybmVsLnYxLlRhbGx5UXVlcnlIABIwCgdzcGF0aWFsGBEgASgLMh0ubm9tb3Mua2VybmVsLnYxLlNwYXRpYWxRdWVyeUgAEiwKBW5hbWVkGBIgASgLMhsubm9tb3Mua2VybmVsLnYxLk5hbWVkUXVlcnlIABJJChNhdXRob3JpemF0aW9uX2NoZWNrGBMgASgLMioubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25DaGVja1JlcXVlc3RIABJLChRhdXRob3JpemF0aW9uX2V4cGFuZBgUIAEoCzIrLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwYW5kUmVxdWVzdEgAQgcKBXF1ZXJ5IpIBCg5RdWVyeUF1dGhvcml0eRIXCg9wcmluY2lwYWxfY2xhaW0YASABKAkSEgoKYXV0aF90b2tlbhgCIAEoDBIQCghub3dfdW5peBgDIAEoBBIVCg1hdXRob3Jfc2VjcmV0GAQgASgMEioKBGtleXMYBSADKAsyHC5ub21vcy5rZXJuZWwudjEuSW5qZWN0ZWRLZXkiOAoLSW5qZWN0ZWRLZXkSDQoFc2NvcGUYASABKAkSDQoFZXBvY2gYAiABKAQSCwoDa2V5GAMgASgMIlsKCVJvd3NRdWVyeRIKCgJpZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSEQoJcHJpbmNpcGFsGAMgASgJInkKCVBhZ2VRdWVyeRIKCgJpZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSDQoFbGltaXQYAyABKA0SDQoFYWZ0ZXIYBCABKAkSEQoJcHJpbmNpcGFsGAUgASgJIkwKCUJ5SWRRdWVyeRIWCg5hZ2dyZWdhdGVfdHlwZRgBIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAiABKAkSEQoJcHJpbmNpcGFsGAMgASgJIlwKCE5vbW9zUmVmEhEKCXdvcmtzcGFjZRgBIAEoCRIWCg5hZ2dyZWdhdGVfdHlwZRgCIAEoCRIUCgxhZ2dyZWdhdGVfaWQYAyABKAkSDwoHdmVyc2lvbhgEIAEoCSJOChBSZXNvbHZlUmVmc1F1ZXJ5EicKBHJlZnMYASADKAsyGS5ub21vcy5rZXJuZWwudjEuTm9tb3NSZWYSEQoJcHJpbmNpcGFsGAIgASgJIkUKEVJlZkZyZXNobmVzc1F1ZXJ5EjAKBHJlZnMYASADKAsyIi5ub21vcy5rZXJuZWwudjEuUmVmRnJlc2huZXNzQ2hlY2sigAEKEVJlZkZyZXNobmVzc0NoZWNrEikKBnBpbm5lZBgBIAEoCzIZLm5vbW9zLmtlcm5lbC52MS5Ob21vc1JlZhIpCgZzZXJpZXMYAiABKAsyGS5ub21vcy5rZXJuZWwudjEuTm9tb3NSZWYSFQoNY3VycmVudF9maWVsZBgDIAEoCSJcCgpUYWxseVF1ZXJ5EgoKAmlkGAEgASgJEi8KCWFyZ3VtZW50cxgCIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdBIRCglwcmluY2lwYWwYAyABKAkiXgoMU3BhdGlhbFF1ZXJ5EgoKAmlkGAEgASgJEi8KCWFyZ3VtZW50cxgCIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdBIRCglwcmluY2lwYWwYAyABKAkicQoKTmFtZWRRdWVyeRIyCglvcGVyYXRpb24YASABKA4yHy5ub21vcy5rZXJuZWwudjEuUXVlcnlPcGVyYXRpb24SLwoJYXJndW1lbnRzGAIgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0Ii8KE0F1dGhvcml6YXRpb25PYmplY3QSDAoEdHlwZRgBIAEoCRIKCgJpZBgCIAEoCSJUChRBdXRob3JpemF0aW9uU3ViamVjdBIMCgR0eXBlGAEgASgJEgoKAmlkGAIgASgJEhUKCHJlbGF0aW9uGAMgASgJSACIAQFCCwoJX3JlbGF0aW9uIpwBChhSZWxhdGlvbnNoaXBUdXBsZUFkZHJlc3MSNgoIcmVzb3VyY2UYASABKAsyJC5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbk9iamVjdBIQCghyZWxhdGlvbhgCIAEoCRI2CgdzdWJqZWN0GAMgASgLMiUubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25TdWJqZWN0IoEBChhBdXRob3JpemF0aW9uQ29uc2lzdGVuY3kSIwoZY3VycmVudF92ZXJpZmllZF9mcm9udGllchgBIAEoCEgAEhkKD2F0X2xlYXN0X2NvbW1pdBgCIAEoCUgAEhYKDGV4YWN0X2NvbW1pdBgDIAEoCUgAQg0KC3JlcXVpcmVtZW50ImYKHUF1dGhvcml6YXRpb25Db25kaXRpb25Db250ZXh0EhQKDGNvbmRpdGlvbl9pZBgBIAEoCRIvCglhcmd1bWVudHMYAiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3Qi9wIKGUF1dGhvcml6YXRpb25DaGVja1JlcXVlc3QSNgoIcmVzb3VyY2UYASABKAsyJC5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbk9iamVjdBISCgpwZXJtaXNzaW9uGAIgASgJEjYKB3N1YmplY3QYAyABKAsyJS5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvblN1YmplY3QSPgoLY29uc2lzdGVuY3kYBCABKAsyKS5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbkNvbnNpc3RlbmN5Ej8KB2NvbnRleHQYBSADKAsyLi5ub21vcy5rZXJuZWwudjEuQXV0aG9yaXphdGlvbkNvbmRpdGlvbkNvbnRleHQSIAoTZXhwZWN0ZWRfbW9kZWxfaGFzaBgGIAEoCUgAiAEBEhsKE2luY2x1ZGVfZXhwbGFuYXRpb24YByABKAhCFgoUX2V4cGVjdGVkX21vZGVsX2hhc2gi7QIKGkF1dGhvcml6YXRpb25FeHBhbmRSZXF1ZXN0EjYKCHJlc291cmNlGAEgASgLMiQubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25PYmplY3QSEgoKcGVybWlzc2lvbhgCIAEoCRI+Cgtjb25zaXN0ZW5jeRgDIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ29uc2lzdGVuY3kSPwoHY29udGV4dBgEIAMoCzIuLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uQ29uZGl0aW9uQ29udGV4dBIgChNleHBlY3RlZF9tb2RlbF9oYXNoGAUgASgJSACIAQESDQoFbGltaXQYBiABKA0SEgoFYWZ0ZXIYByABKAlIAYgBARIbChNpbmNsdWRlX2V4cGxhbmF0aW9uGAggASgIQhYKFF9leHBlY3RlZF9tb2RlbF9oYXNoQggKBl9hZnRlciK9AQoZUmVsYXRpb25zaGlwVHVwbGVFdmlkZW5jZRI4CgV0dXBsZRgBIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5SZWxhdGlvbnNoaXBUdXBsZUFkZHJlc3MSEAoIdHVwbGVfaWQYAiABKAkSGgoSYXNzZXJ0aW9uX2V2ZW50X2lkGAMgASgJEiAKE3Jldm9jYXRpb25fZXZlbnRfaWQYBCABKAlIAIgBAUIWChRfcmV2b2NhdGlvbl9ldmVudF9pZCLhAwoYQXV0aG9yaXphdGlvbkV4cGxhbmF0aW9uEkYKCW9wZXJhdGlvbhgBIAEoDjIzLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwbGFuYXRpb24uT3BlcmF0aW9uEhAKCHJlbGF0aW9uGAIgASgJEg4KBnJlc3VsdBgDIAEoCBI8CghldmlkZW5jZRgEIAMoCzIqLm5vbW9zLmtlcm5lbC52MS5SZWxhdGlvbnNoaXBUdXBsZUV2aWRlbmNlEjsKCGNoaWxkcmVuGAUgAygLMikubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBsYW5hdGlvbiLfAQoJT3BlcmF0aW9uEhkKFU9QRVJBVElPTl9VTlNQRUNJRklFRBAAEhQKEE9QRVJBVElPTl9ESVJFQ1QQARIeChpPUEVSQVRJT05fQ09NUFVURURfVVNFUlNFVBACEh4KGk9QRVJBVElPTl9UVVBMRV9UT19VU0VSU0VUEAMSEwoPT1BFUkFUSU9OX1VOSU9OEAQSGgoWT1BFUkFUSU9OX0lOVEVSU0VDVElPThAFEhcKE09QRVJBVElPTl9FWENMVVNJT04QBhIXChNPUEVSQVRJT05fQ09ORElUSU9OEAcidwoaQXV0aG9yaXphdGlvbkRlY2lzaW9uQmFzaXMSIAoYYXV0aG9yaXphdGlvbl9tb2RlbF9oYXNoGAEgASgJEiEKGXJlbGF0aW9uc2hpcF9zdGF0ZV9jb21taXQYAiABKAkSFAoMY29udGV4dF9oYXNoGAMgASgMIr4BChpBdXRob3JpemF0aW9uQ2hlY2tSZXNwb25zZRIPCgdhbGxvd2VkGAEgASgIEjoKBWJhc2lzGAIgASgLMisubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25EZWNpc2lvbkJhc2lzEkMKC2V4cGxhbmF0aW9uGAMgASgLMikubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25FeHBsYW5hdGlvbkgAiAEBQg4KDF9leHBsYW5hdGlvbiKDAgobQXV0aG9yaXphdGlvbkV4cGFuZFJlc3BvbnNlEjcKCHN1YmplY3RzGAEgAygLMiUubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25TdWJqZWN0EjoKBWJhc2lzGAIgASgLMisubm9tb3Mua2VybmVsLnYxLkF1dGhvcml6YXRpb25EZWNpc2lvbkJhc2lzEhEKBG5leHQYAyABKAlIAIgBARJDCgtleHBsYW5hdGlvbhgEIAEoCzIpLm5vbW9zLmtlcm5lbC52MS5BdXRob3JpemF0aW9uRXhwbGFuYXRpb25IAYgBAUIHCgVfbmV4dEIOCgxfZXhwbGFuYXRpb24iQQoNT3V0Ym94UmVxdWVzdBIwCgZ0YXJnZXQYASABKAsyIC5ub21vcy5rZXJuZWwudjEuV29ya3NwYWNlVGFyZ2V0ImMKC1N5bmNSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSEQoJZnJvbV9iYXNlGAIgASgJEg8KB3RvX2hlYWQYAyABKAkiUwoLVGVzdFJlcXVlc3QSNwoIc2V0X3Jvb3QYASABKAsyIy5ub21vcy5rZXJuZWwudjEuU2V0VGVzdFJvb3RSZXF1ZXN0SABCCwoJb3BlcmF0aW9uIigKElNldFRlc3RSb290UmVxdWVzdBISCgpwdWJsaWNfa2V5GAEgASgMIj0KDFRlc3RSZXNwb25zZRItCgZyZXN1bHQYASABKAsyHS5ub21vcy5rZXJuZWwudjEuQWNrbm93bGVkZ2VkIoMJCg5DdXN0b2R5UmVxdWVzdBI3CgpwYWNrX2RlbHRhGAogASgLMiEubm9tb3Mua2VybmVsLnYxLlBhY2tEZWx0YVJlcXVlc3RIABI3CgphcHBseV9wYWNrGAsgASgLMiEubm9tb3Mua2VybmVsLnYxLkFwcGx5UGFja1JlcXVlc3RIABI3CgpyZXBvX3N0YXRzGAwgASgLMiEubm9tb3Mua2VybmVsLnYxLlJlcG9TdGF0c1JlcXVlc3RIABI9Cg1pbnRlbnRzX2Fib3ZlGA0gASgLMiQubm9tb3Mua2VybmVsLnYxLkludGVudHNBYm92ZVJlcXVlc3RIABI/Cg5pbnNwZWN0X2NoYW5nZRgOIAEoCzIlLm5vbW9zLmtlcm5lbC52MS5JbnNwZWN0Q2hhbmdlUmVxdWVzdEgAEkEKD2VuY29kZV9kb2N1bWVudBgPIAEoCzImLm5vbW9zLmtlcm5lbC52MS5FbmNvZGVEb2N1bWVudFJlcXVlc3RIABJDChBpbnNwZWN0X2RvY3VtZW50GBAgASgLMicubm9tb3Mua2VybmVsLnYxLkluc3BlY3REb2N1bWVudFJlcXVlc3RIABI1CglyZWFkX2Jsb2IYESABKAsyIC5ub21vcy5rZXJuZWwudjEuUmVhZEJsb2JSZXF1ZXN0SAASOQoLcmVzb2x2ZV9yZWYYEiABKAsyIi5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZlJlcXVlc3RIABI1CglsaXN0X3JlZnMYEyABKAsyIC5ub21vcy5rZXJuZWwudjEuTGlzdFJlZnNSZXF1ZXN0SAASNQoJd3JpdGVfcmVmGBQgASgLMiAubm9tb3Mua2VybmVsLnYxLldyaXRlUmVmUmVxdWVzdEgAEjcKCmRlbGV0ZV9yZWYYFSABKAsyIS5ub21vcy5rZXJuZWwudjEuRGVsZXRlUmVmUmVxdWVzdEgAEkQKEXdyaXRlX21ldGFfY29tbWl0GBYgASgLMicubm9tb3Mua2VybmVsLnYxLldyaXRlTWV0YUNvbW1pdFJlcXVlc3RIABJCChBsYXdfY2xvc3VyZV9pbmZvGBcgASgLMiYubm9tb3Mua2VybmVsLnYxLkxhd0Nsb3N1cmVJbmZvUmVxdWVzdEgAEkUKEWNoZWNrcG9pbnRfZXhwb3J0GBggASgLMigubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRFeHBvcnRSZXF1ZXN0SAASRQoRY2hlY2twb2ludF9pbXBvcnQYGSABKAsyKC5ub21vcy5rZXJuZWwudjEuQ2hlY2twb2ludEltcG9ydFJlcXVlc3RIABJDChBjYXBhY2l0eV9yZXNlcnZlGBogASgLMicubm9tb3Mua2VybmVsLnYxLkNhcGFjaXR5UmVzZXJ2ZVJlcXVlc3RIABI7CgxyZXN0b3JlX21haW4YGyABKAsyIy5ub21vcy5rZXJuZWwudjEuUmVzdG9yZU1haW5SZXF1ZXN0SABCCwoJb3BlcmF0aW9uImgKEFBhY2tEZWx0YVJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCgRoZWFkGAIgASgJSACIAQESEQoEYmFzZRgDIAEoCUgBiAEBEg4KBmJyYW5jaBgEIAEoCUIHCgVfaGVhZEIHCgVfYmFzZSJyChBBcHBseVBhY2tSZXF1ZXN0EgwKBHJlcG8YASABKAkSDgoEcGFjaxgCIAEoDEgAEhoKEHN0YWdlZF9wYWNrX2ZpbGUYBCABKAlIABIRCgRoZWFkGAMgASgJSAGIAQFCCAoGc291cmNlQgcKBV9oZWFkIiAKEFJlcG9TdGF0c1JlcXVlc3QSDAoEcmVwbxgBIAEoCSKsAQoTSW50ZW50c0Fib3ZlUmVxdWVzdBIMCgRyZXBvGAEgASgJEhEKBGhlYWQYAiABKAlIAIgBARIRCgRiYXNlGAMgASgJSAGIAQESDgoGYnJhbmNoGAQgASgJEg0KBWxpbWl0GAUgASgEEhgKEGNvbXBsZXRlX2xvZ2ljYWwYBiABKAgSFgoOY29tcGFjdF9zdG9yZWQYByABKAhCBwoFX2hlYWRCBwoFX2Jhc2UiKwoUSW5zcGVjdENoYW5nZVJlcXVlc3QSEwoLY2hhbmdlX3VzZGEYASABKAwiRgoVRW5jb2RlRG9jdW1lbnRSZXF1ZXN0Ei0KCGRvY3VtZW50GAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUiLwoWSW5zcGVjdERvY3VtZW50UmVxdWVzdBIVCg1kb2N1bWVudF91c2RhGAEgASgMIjoKD1JlYWRCbG9iUmVxdWVzdBIMCgRyZXBvGAEgASgJEgsKA29pZBgCIAEoCRIMCgRwYXRoGAMgASgJIjQKEVJlc29sdmVSZWZSZXF1ZXN0EgwKBHJlcG8YASABKAkSEQoJcmVmZXJlbmNlGAIgASgJIi8KD0xpc3RSZWZzUmVxdWVzdBIMCgRyZXBvGAEgASgJEg4KBnByZWZpeBgCIAEoCSJCCg9Xcml0ZVJlZlJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCglyZWZlcmVuY2UYAiABKAkSDgoGdGFyZ2V0GAMgASgJIjMKEERlbGV0ZVJlZlJlcXVlc3QSDAoEcmVwbxgBIAEoCRIRCglyZWZlcmVuY2UYAiABKAkiKQoITWV0YUZpbGUSDAoEcGF0aBgBIAEoCRIPCgdjb250ZW50GAIgASgMIq4BChZXcml0ZU1ldGFDb21taXRSZXF1ZXN0EgwKBHJlcG8YASABKAkSDwoHcGFyZW50cxgCIAMoCRIoCgVmaWxlcxgDIAMoCzIZLm5vbW9zLmtlcm5lbC52MS5NZXRhRmlsZRIPCgdtZXNzYWdlGAQgASgJEhQKDHRpbWVfc2Vjb25kcxgFIAEoEhIWCglyZWZlcmVuY2UYBiABKAlIAIgBAUIMCgpfcmVmZXJlbmNlIi0KFUxhd0Nsb3N1cmVJbmZvUmVxdWVzdBIUCgxjbG9zdXJlX2ZpbGUYASABKAkihwEKF0NoZWNrcG9pbnRFeHBvcnRSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSIQoUc3RhZ2VkX2Zyb250aWVyX2ZpbGUYAiABKAlIAIgBAUIXChVfc3RhZ2VkX2Zyb250aWVyX2ZpbGUi6QEKF0NoZWNrcG9pbnRJbXBvcnRSZXF1ZXN0EjAKBnRhcmdldBgBIAEoCzIgLm5vbW9zLmtlcm5lbC52MS5Xb3Jrc3BhY2VUYXJnZXQSEgoIZnJvbnRpZXIYAiABKAxIABIeChRzdGFnZWRfZnJvbnRpZXJfZmlsZRgGIAEoCUgAEhMKBmN1cnNvchgDIAEoCUgBiAEBEhcKCnN0YXRlX3Jvb3QYBCABKAlIAogBARINCgVzcGFucxgFIAEoCEIRCg9mcm9udGllcl9zb3VyY2VCCQoHX2N1cnNvckINCgtfc3RhdGVfcm9vdCIxChZDYXBhY2l0eVJlc2VydmVSZXF1ZXN0EhcKD2FnZ3JlZ2F0ZV9jb3VudBgBIAEoBCJUChJSZXN0b3JlTWFpblJlcXVlc3QSMAoGdGFyZ2V0GAEgASgLMiAubm9tb3Mua2VybmVsLnYxLldvcmtzcGFjZVRhcmdldBIMCgRoZWFkGAIgASgJIo0JCg9DdXN0b2R5UmVzcG9uc2USOAoKcGFja19kZWx0YRgKIAEoCzIiLm5vbW9zLmtlcm5lbC52MS5QYWNrRGVsdGFSZXNwb25zZUgAEjgKCmFwcGx5X3BhY2sYCyABKAsyIi5ub21vcy5rZXJuZWwudjEuQXBwbHlQYWNrUmVzcG9uc2VIABI4CgpyZXBvX3N0YXRzGAwgASgLMiIubm9tb3Mua2VybmVsLnYxLlJlcG9TdGF0c1Jlc3BvbnNlSAASPgoNaW50ZW50c19hYm92ZRgNIAEoCzIlLm5vbW9zLmtlcm5lbC52MS5JbnRlbnRzQWJvdmVSZXNwb25zZUgAEkAKDmluc3BlY3RfY2hhbmdlGA4gASgLMiYubm9tb3Mua2VybmVsLnYxLkluc3BlY3RDaGFuZ2VSZXNwb25zZUgAEkIKD2VuY29kZV9kb2N1bWVudBgPIAEoCzInLm5vbW9zLmtlcm5lbC52MS5FbmNvZGVEb2N1bWVudFJlc3BvbnNlSAASRAoQaW5zcGVjdF9kb2N1bWVudBgQIAEoCzIoLm5vbW9zLmtlcm5lbC52MS5JbnNwZWN0RG9jdW1lbnRSZXNwb25zZUgAEjYKCXJlYWRfYmxvYhgRIAEoCzIhLm5vbW9zLmtlcm5lbC52MS5SZWFkQmxvYlJlc3BvbnNlSAASOgoLcmVzb2x2ZV9yZWYYEiABKAsyIy5ub21vcy5rZXJuZWwudjEuUmVzb2x2ZVJlZlJlc3BvbnNlSAASNgoJbGlzdF9yZWZzGBMgASgLMiEubm9tb3Mua2VybmVsLnYxLkxpc3RSZWZzUmVzcG9uc2VIABIyCgl3cml0ZV9yZWYYFCABKAsyHS5ub21vcy5rZXJuZWwudjEuQWNrbm93bGVkZ2VkSAASMwoKZGVsZXRlX3JlZhgVIAEoCzIdLm5vbW9zLmtlcm5lbC52MS5BY2tub3dsZWRnZWRIABJFChF3cml0ZV9tZXRhX2NvbW1pdBgWIAEoCzIoLm5vbW9zLmtlcm5lbC52MS5Xcml0ZU1ldGFDb21taXRSZXNwb25zZUgAEkMKEGxhd19jbG9zdXJlX2luZm8YFyABKAsyJy5ub21vcy5rZXJuZWwudjEuTGF3Q2xvc3VyZUluZm9SZXNwb25zZUgAEkYKEWNoZWNrcG9pbnRfZXhwb3J0GBggASgLMikubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRFeHBvcnRSZXNwb25zZUgAEkYKEWNoZWNrcG9pbnRfaW1wb3J0GBkgASgLMikubm9tb3Mua2VybmVsLnYxLkNoZWNrcG9pbnRJbXBvcnRSZXNwb25zZUgAEkQKEGNhcGFjaXR5X3Jlc2VydmUYGiABKAsyKC5ub21vcy5rZXJuZWwudjEuQ2FwYWNpdHlSZXNlcnZlUmVzcG9uc2VIABI8CgxyZXN0b3JlX21haW4YGyABKAsyJC5ub21vcy5rZXJuZWwudjEuUmVzdG9yZU1haW5SZXNwb25zZUgAQgsKCW9wZXJhdGlvbiIhChFQYWNrRGVsdGFSZXNwb25zZRIMCgRwYWNrGAEgASgMIjwKEUFwcGx5UGFja1Jlc3BvbnNlEhQKDG9iamVjdF9jb3VudBgBIAEoBBIRCglwYWNrX2hhc2gYAiABKAkipwEKEVJlcG9TdGF0c1Jlc3BvbnNlEhMKC3RvdGFsX2J5dGVzGAEgASgEEhQKDG9iamVjdF9ieXRlcxgCIAEoBBIVCg1sb29zZV9vYmplY3RzGAMgASgEEhMKC2xvb3NlX2J5dGVzGAQgASgEEhIKCnBhY2tfZmlsZXMYBSABKAQSEgoKcGFja19ieXRlcxgGIAEoBBITCgtpbmRleF9ieXRlcxgHIAEoBCKWAQoMSW50ZW50UmVjb3JkEgsKA29pZBgBIAEoCRIRCglpbnRlbnRfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEhEKCWRpcmVjdGl2ZRgEIAEoCRITCgtjaGFuZ2VfdXNkYRgFIAEoDBIuCghzZW1hbnRpYxgGIAEoCzIcLm5vbW9zLmtlcm5lbC52MS5Ob21vc1N0cnVjdCJGChRJbnRlbnRzQWJvdmVSZXNwb25zZRIuCgdpbnRlbnRzGAEgAygLMh0ubm9tb3Mua2VybmVsLnYxLkludGVudFJlY29yZCJHChVJbnNwZWN0Q2hhbmdlUmVzcG9uc2USLgoIc2VtYW50aWMYASABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QiLwoWRW5jb2RlRG9jdW1lbnRSZXNwb25zZRIVCg1kb2N1bWVudF91c2RhGAEgASgMIkgKF0luc3BlY3REb2N1bWVudFJlc3BvbnNlEi0KCGRvY3VtZW50GAEgASgLMhsubm9tb3Mua2VybmVsLnYxLk5vbW9zVmFsdWUiLwoQUmVhZEJsb2JSZXNwb25zZRINCgVmb3VuZBgBIAEoCBIMCgRibG9iGAIgASgMIi4KElJlc29sdmVSZWZSZXNwb25zZRIQCgNvaWQYASABKAlIAIgBAUIGCgRfb2lkIisKCVJlZlJlY29yZBIRCglyZWZlcmVuY2UYASABKAkSCwoDb2lkGAIgASgJIjwKEExpc3RSZWZzUmVzcG9uc2USKAoEcmVmcxgBIAMoCzIaLm5vbW9zLmtlcm5lbC52MS5SZWZSZWNvcmQiDgoMQWNrbm93bGVkZ2VkIiYKF1dyaXRlTWV0YUNvbW1pdFJlc3BvbnNlEgsKA29pZBgBIAEoCSKDAQoWTGF3Q2xvc3VyZUluZm9SZXNwb25zZRIQCghpZGVudGl0eRgBIAEoCRIZChFyb290X2xvZ2ljYWxfcGF0aBgCIAEoCRITCgthc3NldF9jb3VudBgDIAEoBBISCgpwcmltX2NvdW50GAQgASgEEhMKC2RvbWFpbl9rZXlzGAUgAygJIu8CChhDaGVja3BvaW50RXhwb3J0UmVzcG9uc2USDQoFZW1wdHkYASABKAgSEwoGY3Vyc29yGAIgASgJSACIAQESEAoIZnJvbnRpZXIYAyABKAwSFwoKc3RhdGVfcm9vdBgEIAEoCUgBiAEBEhIKCnN0YXRlX3RyZWUYBSABKAgSDgoGcGlubmVkGAYgASgIEhsKE3JlYWRfaW5kZXhfc25hcHNob3QYByABKAgSIwobcmVhZF9pbmRleF9zbmFwc2hvdF9wZW5kaW5nGAggASgIEiQKF3JlYWRfaW5kZXhfc3FsaXRlX2J5dGVzGAkgASgESAKIAQESJQoYcmVhZF9pbmRleF9jdXN0b2R5X2J5dGVzGAogASgESAOIAQFCCQoHX2N1cnNvckINCgtfc3RhdGVfcm9vdEIaChhfcmVhZF9pbmRleF9zcWxpdGVfYnl0ZXNCGwoZX3JlYWRfaW5kZXhfY3VzdG9keV9ieXRlcyKeAgoYQ2hlY2twb2ludEltcG9ydFJlc3BvbnNlEhAKCHJlc3RvcmVkGAEgASgIEhMKBnJlYXNvbhgCIAEoCUgAiAEBEhcKD2Zyb250aWVyX3NlZWRlZBgDIAEoCBIlCh1mcm9udGllcl92ZXJpZmljYXRpb25fcGVuZGluZxgEIAEoCBIXCg9hZ2dyZWdhdGVfY291bnQYBSABKAQSKwoFc3BhbnMYBiABKAsyHC5ub21vcy5rZXJuZWwudjEuTm9tb3NTdHJ1Y3QSEwoGY3Vyc29yGAcgASgJSAGIAQESEQoJcmVhZF9vbmx5GAggASgIEhcKD2xhenlfcmVhZF9pbmRleBgJIAEoCEIJCgdfcmVhc29uQgkKB19jdXJzb3IiSgoXQ2FwYWNpdHlSZXNlcnZlUmVzcG9uc2USFwoPYWdncmVnYXRlX2NvdW50GAEgASgEEhYKDnJlc2VydmVkX2J5dGVzGAIgASgEIkMKE1Jlc3RvcmVNYWluUmVzcG9uc2USDAoEaGVhZBgBIAEoCRIQCgh2ZXJpZmllZBgCIAEoCBIMCgR3YWxrGAMgASgJIpsCCgpOb21vc1ZhbHVlEiUKBG51bGwYASABKAsyFS5ub21vcy5rZXJuZWwudjEuTnVsbEgAEhEKB2Jvb2xlYW4YAiABKAhIABIYCg5zaWduZWRfaW50ZWdlchgDIAEoEkgAEhoKEHVuc2lnbmVkX2ludGVnZXIYBCABKARIABIYCg5mbG9hdGluZ19wb2ludBgFIAEoAUgAEg4KBHRleHQYBiABKAlIABIPCgVieXRlcxgHIAEoDEgAEioKBGxpc3QYCCABKAsyGi5ub21vcy5rZXJuZWwudjEuTm9tb3NMaXN0SAASLgoGb2JqZWN0GAkgASgLMhwubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0SABCBgoEa2luZCIGCgROdWxsIjgKCU5vbW9zTGlzdBIrCgZ2YWx1ZXMYASADKAsyGy5ub21vcy5rZXJuZWwudjEuTm9tb3NWYWx1ZSKTAQoLTm9tb3NTdHJ1Y3QSOAoGZmllbGRzGAEgAygLMigubm9tb3Mua2VybmVsLnYxLk5vbW9zU3RydWN0LkZpZWxkc0VudHJ5GkoKC0ZpZWxkc0VudHJ5EgsKA2tleRgBIAEoCRIqCgV2YWx1ZRgCIAEoCzIbLm5vbW9zLmtlcm5lbC52MS5Ob21vc1ZhbHVlOgI4ASrpEgoRS2VybmVsUmVmdXNhbENvZGUSIwofS0VSTkVMX1JFRlVTQUxfQ09ERV9VTlNQRUNJRklFRBAAEiUKIUtFUk5FTF9SRUZVU0FMX0NPREVfQkFEX1NJR05BVFVSRRABEiQKIEtFUk5FTF9SRUZVU0FMX0NPREVfVU5BVVRIT1JJWkVEEAISJwojS0VSTkVMX1JFRlVTQUxfQ09ERV9QT0xJQ1lfRElTQUJMRUQQAxIqCiZLRVJORUxfUkVGVVNBTF9DT0RFX1VOQ0VSVElGSUVEX1BPTElDWRAEEiMKH0tFUk5FTF9SRUZVU0FMX0NPREVfUkVGRVJFTlRJQUwQBRIvCitLRVJORUxfUkVGVVNBTF9DT0RFX1BPSU5UX1NUQVRFX1VOQVZBSUxBQkxFEAYSJAogS0VSTkVMX1JFRlVTQUxfQ09ERV9DQVBfRVhDRUVERUQQBxItCilLRVJORUxfUkVGVVNBTF9DT0RFX0NBUF9DT1VOVF9VTkFWQUlMQUJMRRAIEikKJUtFUk5FTF9SRUZVU0FMX0NPREVfRVZJREVOQ0VfVU5CQUNLRUQQCRImCiJLRVJORUxfUkVGVVNBTF9DT0RFX09SUEhBTl9SRUNFSVBUEAoSNgoyS0VSTkVMX1JFRlVTQUxfQ09ERV9SRUNFSVBUX09OX1RFUk1JTkFMX09CTElHQVRJT04QCxIiCh5LRVJORUxfUkVGVVNBTF9DT0RFX05PVF9NSU5URUQQDBIoCiRLRVJORUxfUkVGVVNBTF9DT0RFX0RPTUFJTl9MSUZFQ1lDTEUQDRIpCiVLRVJORUxfUkVGVVNBTF9DT0RFX1RZUEVfVEFHX01JU01BVENIEA4SLAooS0VSTkVMX1JFRlVTQUxfQ09ERV9SRVRJUkVEX1JFQURfU1VSRkFDRRAPEjAKLEtFUk5FTF9SRUZVU0FMX0NPREVfQ1JPU1NfV09SS1NQQUNFX0RFQ0xJTkVEEBASKwonS0VSTkVMX1JFRlVTQUxfQ09ERV9BR0dSRUdBVEVfSU5WQVJJQU5UEBESKwonS0VSTkVMX1JFRlVTQUxfQ09ERV9XT1JLU1BBQ0VfSU5WQVJJQU5UEBISLgoqS0VSTkVMX1JFRlVTQUxfQ09ERV9DQVBUVVJFRF9SRUFEX0NPTkZMSUNUEBMSMgouS0VSTkVMX1JFRlVTQUxfQ09ERV9DT05GTElDVF9TTkFQU0hPVF9SRVFVSVJFRBAUEjQKMEtFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfVU5ERUNMQVJFRBAVEjEKLUtFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfSU5WQUxJRBAWEi8KK0tFUk5FTF9SRUZVU0FMX0NPREVfQ09ORkxJQ1RfU05BUFNIT1RfU1RBTEUQFxIwCixLRVJORUxfUkVGVVNBTF9DT0RFX0NBUFRVUkVEX1JFQURfVU5ERUNMQVJFRBAYEi0KKUtFUk5FTF9SRUZVU0FMX0NPREVfQ0FQVFVSRURfUkVBRF9QUklWQVRFEBkSMAosS0VSTkVMX1JFRlVTQUxfQ09ERV9BVFRFU1RFRF9SRUFEX1VOREVDTEFSRUQQGhIzCi9LRVJORUxfUkVGVVNBTF9DT0RFX0FUVEVTVEVEX1JFQURfVU5UUlVTVEVEX0tFWRAbEjYKMktFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9VTlRSVVNURURfU09VUkNFEBwSLAooS0VSTkVMX1JFRlVTQUxfQ09ERV9BVFRFU1RFRF9SRUFEX0ZPUkdFRBAdEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9TVEFMRRAeEi4KKktFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9PVkVSU0laRRAfEjcKM0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNURURfUkVBRF9ESVNIT05PUkVEX1NPVVJDRRAgEjUKMUtFUk5FTF9SRUZVU0FMX0NPREVfRVFVSVZPQ0FUSU9OX0VWSURFTkNFX0lOVkFMSUQQIRIzCi9LRVJORUxfUkVGVVNBTF9DT0RFX0FUVEVTVEFUSU9OX1JFQ0VJUFRfSU5WQUxJRBAiEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfS0VZX1JPU1RFUl9NSVNNQVRDSBAjEi8KK0tFUk5FTF9SRUZVU0FMX0NPREVfS0VZX0VQT0NIX05PVF9NT05PVE9OSUMQJBIpCiVLRVJORUxfUkVGVVNBTF9DT0RFX1dSSVRFX0VQT0NIX1NUQUxFECUSLQopS0VSTkVMX1JFRlVTQUxfQ09ERV9FTlZFTE9QRV9TSURfTUlTTUFUQ0gQJhIyCi5LRVJORUxfUkVGVVNBTF9DT0RFX1JFVk9LRURfTUVNQkVSX1JFU1VSUkVDVEVEECcSKAokS0VSTkVMX1JFRlVTQUxfQ09ERV9GT1JHRURfUFJJTkNJUEFMECgSKAokS0VSTkVMX1JFRlVTQUxfQ09ERV9PV05FRF9LRVlfQU5DSE9SECkSJgoiS0VSTkVMX1JFRlVTQUxfQ09ERV9PV05FRF9SRUNPVkVSWRAqEiwKKEtFUk5FTF9SRUZVU0FMX0NPREVfU1VSRkFDRURfQkFTSVNfQUhFQUQQKxIyCi5LRVJORUxfUkVGVVNBTF9DT0RFX1NJR05FUl9FUE9DSF9PVVRfT0ZfV0lORE9XECwSJgoiS0VSTkVMX1JFRlVTQUxfQ09ERV9FVk9MVkVfUkVGVVNFRBAtEisKJ0tFUk5FTF9SRUZVU0FMX0NPREVfQVRURVNUQVRJT05fSU5WQUxJRBAuEi0KKUtFUk5FTF9SRUZVU0FMX0NPREVfUEFSRU5UX0RJRF9OT1RfQVRURVNUEC8SKQolS0VSTkVMX1JFRlVTQUxfQ09ERV9DRVJUX0NIQUlOX0JST0tFThAwEioKJktFUk5FTF9SRUZVU0FMX0NPREVfTk9UX1JPT1RFRF9BVF9ST09UEDESKgomS0VSTkVMX1JFRlVTQUxfQ09ERV9ERUxFR0FUSU9OX0lOVkFMSUQQMhIlCiFLRVJORUxfUkVGVVNBTF9DT0RFX1BMQU5fUkVKRUNURUQQMyqFDAoOUXVlcnlPcGVyYXRpb24SHwobUVVFUllfT1BFUkFUSU9OX1VOU1BFQ0lGSUVEEAASHAoYUVVFUllfT1BFUkFUSU9OX0VYVFJFTVVNEAESJQohUVVFUllfT1BFUkFUSU9OX1BFTkRJTkdfQ09ORkxJQ1RTEAISLAooUVVFUllfT1BFUkFUSU9OX1BFTkRJTkdfQ09ORkxJQ1RfU1VNTUFSWRADEiAKHFFVRVJZX09QRVJBVElPTl9SRUFEX1BPU1RVUkUQBBIfChtRVUVSWV9PUEVSQVRJT05fQ1VSUkVOVF9MQVcQBRIjCh9RVUVSWV9PUEVSQVRJT05fSU5URVJGQUNFX09GRkVSEAYSJwojUVVFUllfT1BFUkFUSU9OX1JFTEFUSU9OX0dBVEVfT0ZGRVIQBxIdChlRVUVSWV9PUEVSQVRJT05fU0NFTkVfTEFXEAgSIQodUVVFUllfT1BFUkFUSU9OX0lOU1RBTExFRF9MQVcQCRIcChhRVUVSWV9PUEVSQVRJT05fREVTQ1JJQkUQChIgChxRVUVSWV9PUEVSQVRJT05fS0VSTkVMX1NUQU1QEAsSIwofUVVFUllfT1BFUkFUSU9OX0RFVkVMT1BFUl9TUEFOUxAMEikKJVFVRVJZX09QRVJBVElPTl9ERUNMQVJFRF9DQVBBQklMSVRJRVMQDRIdChlRVUVSWV9PUEVSQVRJT05fUkVBRElORVNTEA4SJAogUVVFUllfT1BFUkFUSU9OX1BST0pFQ1RJT05fU1RBVFMQDxIlCiFRVUVSWV9PUEVSQVRJT05fTUVNT1JZX0RST1BfUFJPQkUQEBIYChRRVUVSWV9PUEVSQVRJT05fV0FSTRAREhsKF1FVRVJZX09QRVJBVElPTl9SRUZSRVNIEBISIAocUVVFUllfT1BFUkFUSU9OX1ZFUklGWV9DSEFJThATEiUKIVFVRVJZX09QRVJBVElPTl9ISVNUT1JZX1BSRUZMSUdIVBAUEhkKFVFVRVJZX09QRVJBVElPTl9ST1VURRAVEhgKFFFVRVJZX09QRVJBVElPTl9NSU5UEBYSIQodUVVFUllfT1BFUkFUSU9OX0NSWVBUT19LRVlHRU4QFxIlCiFRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX1NFQUxfRklFTEQQGBIsCihRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX0JMSU5EX0lOREVYX1RPS0VOEBkSKgomUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9TQ09QRV9LRVkQGhIvCitRVUVSWV9PUEVSQVRJT05fQ1JZUFRPX09XTkVEX0RFVklDRV9SRVFVRVNUEBsSMQotUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9QUkVQQVJFX0FQUFJPVkFMEBwSMQotUVVFUllfT1BFUkFUSU9OX0NSWVBUT19PV05FRF9QUkVQQVJFX1JFQ09WRVJZEB0SIwofUVVFUllfT1BFUkFUSU9OX0NSWVBUT19XUkFQX0tFWRAeEiUKIVFVRVJZX09QRVJBVElPTl9DUllQVE9fVU5XUkFQX0tFWRAfEiEKHVFVRVJZX09QRVJBVElPTl9BVVRIT1JfS0VZR0VOECASJAogUVVFUllfT1BFUkFUSU9OX0FUVEVTVEFUSU9OX1NJR04QIRIgChxRVUVSWV9PUEVSQVRJT05fUkVDRUlQVF9QQVRIECISHQoZUVVFUllfT1BFUkFUSU9OX0NFUlRfU0lHThAjEiUKIVFVRVJZX09QRVJBVElPTl9CSVJUSF9UUlVTVF9TVEFURRAkEiEKHVFVRVJZX09QRVJBVElPTl9FUkFfQ0VSVF9TSUdOECUSKAokUVVFUllfT1BFUkFUSU9OX0RFTEVHQVRJT05fQ0VSVF9TSUdOECYSKQolUVVFUllfT1BFUkFUSU9OX0NBTk9OSUNBTElaRV9GUk9OVElFUhAnEisKJ1FVRVJZX09QRVJBVElPTl9DQU5PTklDQUxJWkVfUFJPSkVDVElPThAoMlkKEk5vbW9zS2VybmVsU2VydmljZRJDCgRDYWxsEhwubm9tb3Mua2VybmVsLnYxLkNhbGxSZXF1ZXN0Gh0ubm9tb3Mua2VybmVsLnYxLkNhbGxSZXNwb25zZWIGcHJvdG8z");
+    CallRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 0);
+    CallResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 1);
+    WorkspaceTargetSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 15);
+    DirectiveCallSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 17);
+    AuthoringOptionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 18);
+    CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 19);
+    OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 20);
+    QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 23);
+    QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 24);
+    InjectedKeySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 25);
+    RowsQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 26);
+    PageQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 27);
+    ByIdQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 28);
+    TallyQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 33);
+    SpatialQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 34);
+    NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 35);
+    AuthorizationObjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 36);
+    AuthorizationSubjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 37);
+    AuthorizationConsistencySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 39);
+    AuthorizationCheckRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 41);
+    AuthorizationExpandRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 42);
+    OutboxRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 48);
+    SyncRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 49);
+    TestRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
+    SetTestRootRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+    CustodyRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
+    PackDeltaRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
+    ApplyPackRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 55);
+    RepoStatsRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 56);
+    IntentsAboveRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
+    InspectChangeRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 58);
+    EncodeDocumentRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 59);
+    InspectDocumentRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 60);
+    ReadBlobRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 61);
+    ResolveRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 62);
+    ListRefsRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 63);
+    WriteRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
+    DeleteRefRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 65);
+    WriteMetaCommitRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 67);
+    LawClosureInfoRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 68);
+    CheckpointExportRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 69);
+    CheckpointImportRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 70);
+    CapacityReserveRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 71);
+    RestoreMainRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 72);
+    NomosValueSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 93);
+    NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 96);
+    QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 1);
+    QueryOperation = /* @__PURE__ */ tsEnum(QueryOperationSchema);
+  }
+});
+
+// vendor/engine/engine.ts
+var engine_exports = {};
+__export(engine_exports, {
+  NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
+  admitAll: () => admitAll,
+  admitIntentOffers: () => admitIntentOffers,
+  applyIntentBytes: () => applyIntentBytes,
+  archiveRefusedMain: () => archiveRefusedMain,
+  attestationSign: () => attestationSign,
+  author: () => author,
+  authorEphemeral: () => authorEphemeral,
+  authorKeygen: () => authorKeygen,
+  authorOn: () => authorOn,
+  backupHead: () => backupHead,
+  backupToCustody: () => backupToCustody,
+  boot: () => boot,
+  certSign: () => certSign,
+  check: () => check,
+  checkpointStateHash: () => checkpointStateHash,
+  clearCheckpointRefs: () => clearCheckpointRefs,
+  closureInstallPayload: () => closureInstallPayload,
+  collectGlobalIntents: () => collectGlobalIntents,
+  collectHomedIntents: () => collectHomedIntents,
+  commitAndPush: () => commitAndPush,
+  count: () => count,
+  countRemoteCommits: () => countRemoteCommits,
+  countTenantRows: () => countTenantRows,
+  countTenantRowsByHome: () => countTenantRowsByHome,
+  createEngine: () => createEngine,
+  cryptoKeygen: () => cryptoKeygen,
+  cryptoOwnedDeviceRequest: () => cryptoOwnedDeviceRequest,
+  cryptoOwnedPrepareApproval: () => cryptoOwnedPrepareApproval,
+  cryptoOwnedPrepareRecovery: () => cryptoOwnedPrepareRecovery,
+  cryptoOwnedScopeKey: () => cryptoOwnedScopeKey,
+  cryptoSealField: () => cryptoSealField,
+  cryptoUnwrapKey: () => cryptoUnwrapKey,
+  cryptoWrapKey: () => cryptoWrapKey,
+  currentLaw: () => currentLaw,
+  declaredCapabilities: () => declaredCapabilities,
+  deepVerifyShard: () => deepVerifyShard,
+  delegationCertSign: () => delegationCertSign,
+  deleteRefusedRef: () => deleteRefusedRef,
+  deriveSummarySuffix: () => deriveSummarySuffix,
+  describe: () => describe,
+  directiveRoutes: () => directiveRoutes,
+  emitOutbox: () => emitOutbox,
+  eraCertSign: () => eraCertSign,
+  evalCanonicalPred: () => evalCanonicalPred,
+  evolveDryRun: () => evolveDryRun,
+  expand: () => expand,
+  exportCheckpoint: () => exportCheckpoint,
+  extremum: () => extremum,
+  flushDeferredProjections: () => flushDeferredProjections,
+  gitdirOf: () => gitdirOf,
+  globalAggregates: () => globalAggregates,
+  historyPreflight: () => historyPreflight,
+  historyRestorePreflight: () => historyRestorePreflight,
+  importCheckpoint: () => importCheckpoint,
+  importCustodyObjects: () => importCustodyObjects,
+  ingestPackAsCustody: () => ingestPackAsCustody,
+  installedLaw: () => installedLaw,
+  isWarranted: () => isWarranted,
+  kernelStamp: () => kernelStamp,
+  kgit: () => kgit,
+  lawParity: () => lawParity,
+  ledgerStats: () => ledgerStats,
+  listRefusedRefs: () => listRefusedRefs,
+  materializeRefused: () => materializeRefused,
+  memoryDropProbe: () => memoryDropProbe,
+  migrateHomes: () => migrateHomes,
+  mintId: () => mintId,
+  mountEphemeralWorkspace: () => mountEphemeralWorkspace,
+  mountWorkspace: () => mountWorkspace,
+  nomosActive: () => nomosActive,
+  offerAdmit: () => offerAdmit,
+  offerIntent: () => offerIntent,
+  outboxRefExists: () => outboxRefExists,
+  packBornChildren: () => packBornChildren,
+  packDelta: () => packDelta,
+  pendingConflictSummary: () => pendingConflictSummary,
+  pendingConflicts: () => pendingConflicts,
+  placementDirectives: () => placementDirectives,
+  projectionStats: () => projectionStats,
+  promotePreflighted: () => promotePreflighted,
+  pushCheckpoint: () => pushCheckpoint,
+  pushShape: () => pushShape,
+  pushStagedCheckpoint: () => pushStagedCheckpoint,
+  qById: () => qById,
+  query: () => query,
+  queryEphemeral: () => queryEphemeral,
+  queryPage: () => queryPage,
+  queryProfile: () => queryProfile,
+  reactorScan: () => reactorScan,
+  readCheckpointBlob: () => readCheckpointBlob,
+  readPosture: () => readPosture,
+  readShape: () => readShape,
+  readiness: () => readiness,
+  rebirthCompact: () => rebirthCompact,
+  reconcileBornPacks: () => reconcileBornPacks,
+  refreshProjection: () => refreshProjection,
+  refusedSummary: () => refusedSummary,
+  replicateIntents: () => replicateIntents,
+  repoArgOf: () => repoArgOf,
+  reserveKernelCapacity: () => reserveKernelCapacity,
+  restoreCheckpointFromCustody: () => restoreCheckpointFromCustody,
+  restorePreviousPreflighted: () => restorePreviousPreflighted,
+  sceneLaw: () => sceneLaw,
+  scopedReads: () => scopedReads,
+  sealHomes: () => sealHomes,
+  servePack: () => servePack,
+  setTestKRoot: () => setTestKRoot,
+  sha256hex: () => sha256hex,
+  snapshot: () => snapshot,
+  spatialBboxParams: () => spatialBboxParams,
+  spatialWithin: () => spatialWithin,
+  stageCheckpoint: () => stageCheckpoint,
+  stageLawClosure: () => stageLawClosure,
+  stats: () => stats,
+  sum: () => sum,
+  summaryCloseAgainstHeld: () => summaryCloseAgainstHeld,
+  syncCandidate: () => syncCandidate,
+  unmount: () => unmount,
+  verifyChain: () => verifyChain,
+  verifyChainLocal: () => verifyChainLocal,
+  warmEngine: () => warmEngine,
+  warmKernelCaches: () => warmKernelCaches,
+  workspaceGenesis: () => workspaceGenesis,
+  writeCheckpointObjects: () => writeCheckpointObjects,
+  writeOutboxRef: () => writeOutboxRef,
+  writeRefusedRef: () => writeRefusedRef,
+  wrongHomeVerdict: () => wrongHomeVerdict
+});
+import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+async function sha256hex(t) {
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
+  return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+function osEntropyBuffer(n) {
+  const bytes = new Uint8Array(n * 8);
+  for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
+  const out2 = new Array(n), T = 2 ** 53;
+  for (let i = 0; i < n; i++) {
+    let z = 0n;
+    for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
+    out2[i] = Number(z >> 11n) / T;
+  }
+  return out2;
+}
+function callProto(ex, operation, STDERR) {
+  const requestId = `adapter-${++protoRequestSequence}`;
+  const request = create(CallRequestSchema, {
+    protocolVersion: PROTO_ABI_VERSION,
+    requestId,
+    operation
+  });
+  const bytes = toBinary(CallRequestSchema, request);
+  const requestPtr = ex.git_holon_alloc(bytes.length) >>> 0;
+  try {
+    new Uint8Array(ex.memory.buffer, requestPtr, bytes.length).set(bytes);
+    let packed;
+    try {
+      packed = ex.git_holon_call_proto(requestPtr, bytes.length);
+    } catch (error) {
+      const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
+      throw new Error(`${String(error?.stack || error)}${tail}`);
+    }
+    const { ptr, len } = unpack(packed);
+    try {
+      const responseBytes = new Uint8Array(ex.memory.buffer, ptr, len).slice();
+      const response = fromBinary(CallResponseSchema, responseBytes);
+      if (response.protocolVersion !== PROTO_ABI_VERSION) {
+        throw new Error(`kernel protobuf ABI ${response.protocolVersion}; expected ${PROTO_ABI_VERSION}`);
+      }
+      if (response.requestId !== requestId) {
+        throw new Error(`kernel protobuf response id ${response.requestId || "<empty>"}; expected ${requestId}`);
+      }
+      if (response.outcome.case === "failure") {
+        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      }
+      return response;
+    } finally {
+      ex.git_holon_dealloc(ptr, len);
+    }
+  } finally {
+    ex.git_holon_dealloc(requestPtr, bytes.length);
+  }
+}
+function protoValue(value) {
+  if (value === null || value === void 0) {
+    return create(NomosValueSchema, { kind: { case: "null", value: {} } });
+  }
+  if (typeof value === "boolean") {
+    return create(NomosValueSchema, { kind: { case: "boolean", value } });
+  }
+  if (typeof value === "bigint") {
+    return value < 0n ? create(NomosValueSchema, { kind: { case: "signedInteger", value } }) : create(NomosValueSchema, { kind: { case: "unsignedInteger", value } });
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("NomosValue numbers must be finite");
+    if (Number.isSafeInteger(value)) {
+      return value < 0 ? create(NomosValueSchema, { kind: { case: "signedInteger", value: BigInt(value) } }) : create(NomosValueSchema, { kind: { case: "unsignedInteger", value: BigInt(value) } });
+    }
+    return create(NomosValueSchema, { kind: { case: "floatingPoint", value } });
+  }
+  if (typeof value === "string") {
+    return create(NomosValueSchema, { kind: { case: "text", value } });
+  }
+  if (value instanceof Uint8Array) {
+    return create(NomosValueSchema, { kind: { case: "bytes", value } });
+  }
+  if (Array.isArray(value)) {
+    return create(NomosValueSchema, {
+      kind: { case: "list", value: { values: value.map(protoValue) } }
+    });
+  }
+  if (typeof value === "object") {
+    return create(NomosValueSchema, {
+      kind: { case: "object", value: protoStruct(value) }
+    });
+  }
+  throw new Error(`unsupported NomosValue type: ${typeof value}`);
+}
+function protoStruct(value) {
+  return create(NomosStructSchema, {
+    fields: Object.fromEntries(Object.entries(value).map(([key, field]) => [key, protoValue(field)]))
+  });
+}
+function jsValue(value) {
+  if (!value) return void 0;
+  switch (value.kind.case) {
+    case "null":
+      return null;
+    case "boolean":
+    case "floatingPoint":
+    case "text":
+    case "bytes":
+      return value.kind.value;
+    case "signedInteger":
+    case "unsignedInteger": {
+      const integer = value.kind.value;
+      return integer >= BigInt(Number.MIN_SAFE_INTEGER) && integer <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(integer) : integer;
+    }
+    case "list":
+      return value.kind.value.values.map(jsValue);
+    case "object":
+      return jsStruct(value.kind.value);
+    default:
+      return void 0;
+  }
+}
+function jsStruct(value) {
+  if (!value) return {};
+  return Object.fromEntries(Object.entries(value.fields).map(([key, field]) => [key, jsValue(field)]));
+}
+function unreachableOfferOutcome(value) {
+  throw new Error(`kernel returned an unsupported offer outcome: ${String(value)}`);
+}
+function offerResult(response) {
+  const outcome = response.outcome;
+  switch (outcome.case) {
+    case "admitted": {
+      const value = jsStruct(outcome.value.result);
+      return {
+        ok: true,
+        outcome: "admitted",
+        ...typeof value.head === "string" ? { head: value.head } : {},
+        ...value.intentOut !== void 0 ? { intentOut: value.intentOut } : {},
+        created: Array.isArray(value.created) ? value.created : [],
+        affected: Array.isArray(value.affected) ? value.affected : [],
+        born: Array.isArray(value.born) ? value.born : [],
+        birthOutcomes: Array.isArray(value.birthOutcomes) ? value.birthOutcomes : [],
+        ...value.kernelSpans !== void 0 ? { kernelSpans: value.kernelSpans } : {},
+        ...value.dryRun === true ? { dryRun: true } : {}
+      };
+    }
+    case "refused": {
+      const refusal = outcome.value.refusal;
+      if (!refusal) throw new Error("kernel returned an offer refusal without its typed refusal");
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "refused",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        refusal: {
+          code: refusal.code,
+          message: refusal.message,
+          details: jsStruct(refusal.details)
+        },
+        error: refusal.message,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "deadLettered": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "deadLettered",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        reason: outcome.value.reason,
+        error: outcome.value.reason,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "quarantined": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "quarantined",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        authoredLawHash: outcome.value.authoredLawHash,
+        currentLawHash: outcome.value.currentLawHash,
+        reason: outcome.value.reason,
+        error: outcome.value.reason,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case "blockedOnDependency": {
+      const diagnostics = jsStruct(outcome.value.diagnostics);
+      return {
+        ok: false,
+        outcome: "blockedOnDependency",
+        ...outcome.value.offerId !== void 0 ? { offerId: outcome.value.offerId } : {},
+        detail: outcome.value.detail,
+        error: outcome.value.detail,
+        ...diagnostics.kernelSpans !== void 0 ? { kernelSpans: diagnostics.kernelSpans } : {}
+      };
+    }
+    case void 0:
+      throw new Error("kernel returned an empty offer outcome");
+    default:
+      return unreachableOfferOutcome(outcome);
+  }
+}
+function applicationQueryProto(eng, ws, query2, options = {}) {
+  const response = callProto(eng.ex, {
+    case: "query",
+    value: create(QueryRequestSchema, {
+      target: protoTarget(ws, options.branch ?? BRANCH),
+      authority: protoAuthority(
+        options.principal,
+        options.keys,
+        options.authToken,
+        options.nowUnix,
+        options.authorSecret
+      ),
+      spans: options.spans ?? false,
+      query: query2
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "query") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for application query`);
+  }
+  const result = response.outcome.value.result;
+  if (result.case === "applicationJson") {
+    return JSON.parse(dec3.decode(result.value.utf8));
+  }
+  if (result.case === "value") return jsValue(result.value);
+  throw new Error(`kernel returned ${result.case || "empty"} for application query`);
+}
+function namedQueryProto(eng, ws, operation, arguments_ = {}, options = {}) {
+  return applicationQueryProto(eng, ws, {
+    case: "named",
+    value: create(NamedQuerySchema, { operation, arguments: protoStruct(arguments_) })
+  }, options);
+}
+function custodyProto(eng, operation) {
+  return custodyProtoWith(eng.ex, operation, eng.STDERR);
+}
+function custodyProtoWith(ex, operation, STDERR) {
+  const response = callProto(ex, {
+    case: "custody",
+    value: create(CustodyRequestSchema, { operation })
+  }, STDERR);
+  if (response.outcome.case !== "custody" || !response.outcome.value.operation.case) {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for custody request`);
+  }
+  return response.outcome.value.operation;
+}
+function custodyProtoCase(eng, operation, expected) {
+  const result = custodyProto(eng, operation);
+  if (result.case !== expected) {
+    throw new Error(`kernel returned custody.${result.case || "empty"}; expected custody.${expected}`);
+  }
+  return result.value;
+}
+function workspaceGenesis(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head) throw new Error(`workspaceGenesis: workspace '${ws}' has no main custody`);
+  const first = kgit.intentsAbove(eng, gitdir, head, "", 0, true)[0];
+  if (!first?.oid) throw new Error(`workspaceGenesis: workspace '${ws}' has an empty main custody`);
+  return first.oid;
+}
+async function createEngine({ wasmModule, bootstrapLawUsdz, nomosLawUsdz, replica, installedBy = "nomos-cloud" }) {
+  const assertUsdz = (name, bytes) => {
+    if (!(bytes instanceof Uint8Array) || bytes.length < 4 || bytes[0] !== 80 || bytes[1] !== 75 || bytes[2] !== 3 || bytes[3] !== 4) {
+      throw new Error(`${name} must be opaque USDZ bytes`);
+    }
+  };
+  assertUsdz("bootstrapLawUsdz", bootstrapLawUsdz);
+  assertUsdz("nomosLawUsdz", nomosLawUsdz);
+  const root = /* @__PURE__ */ new Map();
+  root.set("bootstrap.law.usdz", new File(bootstrapLawUsdz));
+  root.set("nomos.law.usdz", new File(nomosLawUsdz));
+  root.set("ws", new Directory(/* @__PURE__ */ new Map()));
+  const preopen = new PreopenDirectory("/work", root);
+  const STDERR = [];
+  const streamKernelStderr = globalThis.process?.env?.NOMOS_WASM_STDERR === "1";
+  const pushStderr = (l) => {
+    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
+    STDERR.push(l);
+    if (streamKernelStderr) console.error(`[nomos-kernel-stderr] ${l}`);
+  };
+  const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
+  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
+  const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
+  const wasiImports = unsignedWasiPointers(wasi.wasiImport);
+  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasiImports });
+  const code = wasi.start(inst);
+  if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
+  const instExports = inst.exports;
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call_proto"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
+  const ex = instExports;
+  const closureInfo = (closureFile) => {
+    const response = custodyProtoWith(ex, {
+      case: "lawClosureInfo",
+      value: create(LawClosureInfoRequestSchema, { closureFile })
+    }, STDERR);
+    if (response.case !== "lawClosureInfo") {
+      throw new Error(`kernel returned custody.${response.case || "empty"}; expected custody.lawClosureInfo`);
+    }
+    return response.value;
+  };
+  const bootstrapInfo = closureInfo("/work/bootstrap.law.usdz");
+  const nomosInfo = closureInfo("/work/nomos.law.usdz");
+  if (!bootstrapInfo.identity) throw new Error("bootstrap USDA closure refused: missing identity");
+  if (!nomosInfo.identity) throw new Error("Nomos USDA closure refused: missing identity");
+  const hashes = { bootstrap: bootstrapInfo.identity, nomos: nomosInfo.identity };
+  const eng = {
+    ex,
+    preopen,
+    STDERR,
+    seq: 0,
+    replica,
+    hashes,
+    bootstrapLawUsdz,
+    nomosLawUsdz,
+    installedBy,
+    fs: makeGitFs(preopen, "/work", { File, Directory }),
+    mounted: /* @__PURE__ */ new Map(),
+    // ws -> { restored, remoteMain, restoreError }
+    mainIntents: /* @__PURE__ */ new Map()
+    // ws -> { head, ids:Set, oids:Set } (admission idempotence)
+  };
+  return eng;
+}
+function directiveRoutes(eng) {
+  return /* @__PURE__ */ new Map();
+}
+function routeTagHexOfMintedId(id) {
+  const i = id.indexOf("_");
+  if (i <= 0) return void 0;
+  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();
+  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : void 0;
+}
+async function wrongHomeVerdict(shardRouting, route, payload) {
+  const value = payload ? payload[route.key] : void 0;
+  if (typeof value !== "string" || !value) return null;
+  const rows = await shardRouting.assignments() || [];
+  let assignment = null;
+  if (route.via === "axis") {
+    assignment = rows.find((a) => a.homeKey === value) || null;
+  } else {
+    const tag = routeTagHexOfMintedId(value);
+    if (tag !== void 0) {
+      for (const a of rows) {
+        if (await routeTagHexOfHomeKey(String(a.homeKey)) === tag) {
+          assignment = a;
+          break;
+        }
+      }
+    }
+  }
+  if (!assignment) {
+    return {
+      error: `no shard placement for this write's home ('${route.key}': ${value.slice(0, 80)}) \u2014 author the derived placement intent (birth<Type>) on the coordinator '${shardRouting.coordinatorWs}' first, then POST /dead-letters/retry`,
+      deadLettered: true
+    };
+  }
+  const movingTo = typeof assignment.status === "string" && assignment.status.startsWith("moving:") ? assignment.status.slice("moving:".length) : null;
+  if (movingTo) {
+    return {
+      error: `home-moving: home '${value.slice(0, 80)}' is migrating ${assignment.shard} -> ${movingTo} (shard map v${assignment.mapVersion ?? 1}) \u2014 parked; a routed client retries automatically after the handoff seals`,
+      homeMoving: { homeKey: value, from: assignment.shard, target: movingTo, workspace: `${shardRouting.coordinatorWs}--${movingTo}` },
+      deadLettered: true
+    };
+  }
+  if (shardRouting.selfLabel === assignment.shard) return null;
+  const correct = `${shardRouting.coordinatorWs}--${assignment.shard}`;
+  return {
+    error: `wrong-home: this write's home is assigned to '${correct}' (shard map v${assignment.mapVersion ?? 1}) \u2014 the client's shard map is stale; a routed client re-routes and retries automatically`,
+    wrongHome: { workspace: correct, ...assignment.mapVersion !== void 0 ? { mapVersion: assignment.mapVersion } : {} }
+  };
+}
+function tenantTypes(eng) {
+  return /* @__PURE__ */ new Set();
+}
+function placementDirectives(eng) {
+  return /* @__PURE__ */ new Map();
+}
+function scopedReads(eng) {
+  return [];
+}
+function evalCanonicalPred(pred, get) {
+  if (!pred || typeof pred !== "object") return true;
+  if (pred.kind === "and") return (pred.clauses || []).every((c) => evalCanonicalPred(c, get));
+  if (pred.kind === "or") return (pred.clauses || []).some((c) => evalCanonicalPred(c, get));
+  const raw = get(pred.field);
+  const present = raw !== void 0 && raw !== null;
+  const canonical = present ? String(raw) : void 0;
+  if (pred.kind === "eq") return present && canonical === pred.value;
+  if (pred.kind === "ne") return !present || canonical !== pred.value;
+  return true;
+}
+function globalAggregates(eng) {
+  return /* @__PURE__ */ new Set();
+}
+function parseIntentEvents(doc) {
+  const rawEvents = doc?.events;
+  const events = Array.isArray(rawEvents) ? rawEvents : [];
+  return events.map((ev) => {
+    const sets = /* @__PURE__ */ new Map();
+    for (const op of ev.ops || []) {
+      const v = op && op.op && op.op.Set;
+      if (v === void 0) continue;
+      if (typeof v.Str === "string") sets.set(op.field, v.Str);
+      else if (typeof v.Int === "number") sets.set(op.field, v.Int);
+    }
+    return { aggregate: String(ev.aggregate || ""), sets };
+  });
+}
+function beginSummaryCapture(eng, ws, ctx, doc) {
+  const events = parseIntentEvents(doc);
+  if (events.length === 0) return null;
+  const pre = /* @__PURE__ */ new Map();
+  const candidates = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (!pre.has(ev.aggregate)) {
+      const rows = qById(eng, ws, ev.aggregate);
+      pre.set(ev.aggregate, rows.length ? { type: rows[0].type, data: rows[0].data || {} } : null);
+    }
+    const before = pre.get(ev.aggregate);
+    const evType = ev.sets.get("__type") ?? (before ? before.type : void 0);
+    for (const read of ctx.reads) {
+      if (read.of !== evType) continue;
+      const oldGroup = before ? groupOf(read, before.data) : void 0;
+      if (oldGroup !== void 0) candidates.add(summaryKey(read.id, oldGroup));
+      if (read.by === null) candidates.add(summaryKey(read.id, ""));
+      else if (ev.sets.has(read.by)) candidates.add(summaryKey(read.id, String(ev.sets.get(read.by))));
+    }
+  }
+  const preTallies = /* @__PURE__ */ new Map();
+  for (const key of candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const v = tallyOf(eng, ws, read, group);
+    preTallies.set(key, v);
+    if (!ctx.prevs.has(key)) ctx.prevs.set(key, { read, group, value: v });
+  }
+  return { events, pre, candidates, preTallies };
+}
+function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
+  const deltas = [];
+  for (const key of cap.candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const after = tallyOf(eng, ws, read, group);
+    if (isExtremumRead(read)) {
+      const before = cap.preTallies.has(key) ? cap.preTallies.get(key) : null;
+      if (after !== before) {
+        deltas.push({ readId, group, delta: after });
+        if (!extremumMonotone(read, before, after)) ctx.rederived.add(key);
+      }
+    } else {
+      const before = cap.preTallies.get(key) ?? 0;
+      if (after !== before) deltas.push({ readId, group, delta: after - before });
+    }
+    ctx.values.set(key, { read, group, value: after });
+  }
+  let rowsDelta = 0;
+  for (const [aggregateId, before] of cap.pre) {
+    const rows = qById(eng, ws, aggregateId);
+    const type = rows.length ? rows[0].type : before ? before.type : void 0;
+    if (type === void 0 || !tenantTypes(eng).has(type)) continue;
+    const existsAfter = rows.length > 0;
+    const flip = !before && existsAfter ? 1 : before && !existsAfter ? -1 : 0;
+    if (flip === 0) continue;
+    rowsDelta += flip;
+    const homeKey = ctx.homeKeySet && ctx.homeKeySet.has(aggregateId) ? aggregateId : ctx.homeTags ? ctx.homeTags.get(routeTagHexOfMintedId(aggregateId) ?? "") : void 0;
+    if (homeKey !== void 0) {
+      deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: flip });
+      ctx.rowsByHome.set(homeKey, (ctx.rowsByHome.get(homeKey) ?? 0) + flip);
+    }
+  }
+  if (rowsDelta !== 0) {
+    deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: rowsDelta });
+    ctx.rowsDelta += rowsDelta;
+  }
+  if (deltas.length > 0) ctx.events.push({ oid, intentId: intentId || "", deltas });
+}
+function summaryOfCapture(ctx, fromOid, toOid) {
+  if (ctx.events.length === 0 || !toOid || fromOid === toOid) return null;
+  const touched = /* @__PURE__ */ new Set();
+  for (const ev of ctx.events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
+  const subtotals = [];
+  for (const [key, cur] of ctx.values) {
+    const extremum2 = isExtremumRead(cur.read);
+    const prev = ctx.prevs.get(key);
+    const prevValue = prev ? prev.value : extremum2 ? null : 0;
+    if (cur.value === prevValue && !touched.has(key)) continue;
+    subtotals.push({
+      readId: cur.read.id,
+      group: cur.group,
+      kind: cur.read.kind,
+      prev: prevValue,
+      value: cur.value,
+      ...extremum2 && ctx.rederived.has(key) ? { rederived: true } : {}
+    });
+  }
+  if (subtotals.length === 0 && ctx.rowsDelta === 0 && ctx.rowsByHome.size === 0) return null;
+  return {
+    fromOid: fromOid || "",
+    toOid,
+    subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+    events: ctx.events,
+    rowsDelta: ctx.rowsDelta,
+    // SLICE 8: the exact per-home row deltas — the adapter closes each against the
+    // coordinator-held per-home subtotal exactly like the "" grand total.
+    rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
+  };
+}
+async function deriveSummarySuffix(eng, ws, fromOid) {
+  const reads = scopedReads(eng);
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head) return { ok: false, error: "no local main to derive from" };
+  const commits = kgit.intentsAbove(eng, gitdir, head);
+  const state = /* @__PURE__ */ new Map();
+  const running = /* @__PURE__ */ new Map();
+  const bump = (key, d) => running.set(key, (running.get(key) ?? 0) + d);
+  const extRows = /* @__PURE__ */ new Map();
+  const extRunning = /* @__PURE__ */ new Map();
+  const extRederived = /* @__PURE__ */ new Set();
+  const extBucketRows = (key) => {
+    let m = extRows.get(key);
+    if (!m) {
+      m = /* @__PURE__ */ new Map();
+      extRows.set(key, m);
+    }
+    return m;
+  };
+  const recomputeExt = (read, key) => {
+    let v = null;
+    const m = extRows.get(key);
+    if (m) for (const x of m.values()) v = v === null ? x : read.kind === "min" ? Math.min(v, x) : Math.max(v, x);
+    return v;
+  };
+  const homeKeySet = /* @__PURE__ */ new Set();
+  const homeTags = /* @__PURE__ */ new Map();
+  let prevs = null;
+  let extPrevs = null;
+  let events = [];
+  let inSuffix = fromOid === "" || fromOid === void 0;
+  if (inSuffix) {
+    prevs = /* @__PURE__ */ new Map();
+    extPrevs = /* @__PURE__ */ new Map();
+  }
+  let sawFrom = inSuffix;
+  for (const c of commits) {
+    let blob = null;
+    try {
+      blob = bytesFromB64(c.changeB64);
+    } catch {
+    }
+    const deltas = [];
+    let intentId = "";
+    if (blob) {
+      const doc = c.intent;
+      if (doc && Array.isArray(doc.strikes) && doc.strikes.length > 0) {
+        return { ok: true, strikeBearing: true, head };
+      }
+      intentId = doc && doc.id || "";
+      for (const ev of parseIntentEvents(doc)) {
+        const cur = state.get(ev.aggregate) ?? { type: void 0, fields: /* @__PURE__ */ new Map(), exists: false };
+        const newType = ev.sets.get("__type");
+        if (newType !== void 0) cur.type = newType;
+        const tallyBefore = /* @__PURE__ */ new Map();
+        for (const read of reads) {
+          if (read.of !== cur.type && read.of !== newType) continue;
+          tallyBefore.set(read.id, contribution(read, cur));
+        }
+        const existedBefore = cur.exists;
+        for (const [f, v] of ev.sets) cur.fields.set(f, v);
+        cur.exists = true;
+        state.set(ev.aggregate, cur);
+        const effType = cur.type ?? newType;
+        if (effType === "NomosHomeReceipt") {
+          const hk = cur.fields.get("homeKey");
+          if (typeof hk === "string" && hk && !homeKeySet.has(hk)) {
+            homeKeySet.add(hk);
+            homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+          }
+        }
+        if (!existedBefore && effType !== void 0 && tenantTypes(eng).has(effType)) {
+          bump(summaryKey(NOMOS_SHARD_ROWS_READ, ""), 1);
+          deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: 1 });
+          const homeKey = homeKeySet.has(ev.aggregate) ? ev.aggregate : homeTags.get(routeTagHexOfMintedId(ev.aggregate) ?? "");
+          if (homeKey !== void 0) {
+            bump(summaryKey(NOMOS_SHARD_ROWS_READ, homeKey), 1);
+            deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: 1 });
+          }
+        }
+        for (const read of reads) {
+          if (read.of !== cur.type) continue;
+          const before = tallyBefore.get(read.id) ?? null;
+          const after = contribution(read, cur);
+          if (isExtremumRead(read)) {
+            const touchedBuckets = /* @__PURE__ */ new Set();
+            if (before) {
+              const bk = summaryKey(read.id, before.group);
+              if (!after || after.group !== before.group) extBucketRows(bk).delete(ev.aggregate);
+              touchedBuckets.add(bk);
+            }
+            if (after) {
+              const ak = summaryKey(read.id, after.group);
+              extBucketRows(ak).set(ev.aggregate, after.value);
+              touchedBuckets.add(ak);
+            }
+            for (const bk of touchedBuckets) {
+              const ov = extRunning.has(bk) ? extRunning.get(bk) ?? null : null;
+              const nv = recomputeExt(read, bk);
+              if (nv === ov) continue;
+              extRunning.set(bk, nv);
+              if (inSuffix) {
+                if (!extremumMonotone(read, ov, nv)) extRederived.add(bk);
+                const [, group] = splitSummaryKey(bk);
+                deltas.push({ readId: read.id, group, delta: nv, __extremum: true });
+              }
+            }
+          } else {
+            for (const d of contributionDiff(read, before, after)) {
+              bump(summaryKey(d.readId, d.group), d.delta ?? 0);
+              deltas.push(d);
+            }
+          }
+        }
+      }
+    }
+    if (inSuffix && deltas.length) {
+      const byKey = /* @__PURE__ */ new Map();
+      const extLast = /* @__PURE__ */ new Map();
+      for (const d of deltas) {
+        const k = summaryKey(d.readId, d.group);
+        if (d.__extremum) extLast.set(k, d.delta);
+        else byKey.set(k, (byKey.get(k) ?? 0) + d.delta);
+      }
+      const merged = [...byKey.entries()].filter(([, d]) => d !== 0).map(([k, d]) => {
+        const [readId, group] = splitSummaryKey(k);
+        return { readId, group, delta: d };
+      });
+      for (const [k, v] of extLast) {
+        const [readId, group] = splitSummaryKey(k);
+        merged.push({ readId, group, delta: v });
+      }
+      if (merged.length) events.push({ oid: c.oid, intentId, deltas: merged });
+    }
+    if (!inSuffix && c.oid === fromOid) {
+      inSuffix = true;
+      sawFrom = true;
+      prevs = new Map(running);
+      extPrevs = new Map(extRunning);
+    }
+  }
+  if (!sawFrom) return { ok: false, error: `fromOid ${String(fromOid).slice(0, 12)} is not on this shard's main \u2014 cannot derive the suffix` };
+  if (!prevs) prevs = /* @__PURE__ */ new Map();
+  const touched = /* @__PURE__ */ new Set();
+  for (const ev of events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
+  const subtotals = [];
+  const keys = /* @__PURE__ */ new Set([...running.keys(), ...prevs.keys()]);
+  for (const key of keys) {
+    const value = running.get(key) ?? 0;
+    const prev = prevs.get(key) ?? 0;
+    if (value === prev && !touched.has(key)) continue;
+    const [readId, group] = splitSummaryKey(key);
+    const read = reads.find((r) => r.id === readId);
+    subtotals.push({ readId, group, kind: readId === NOMOS_SHARD_ROWS_READ ? "rows" : read ? read.kind : "count", prev, value });
+  }
+  const extKeys = /* @__PURE__ */ new Set([...extRunning.keys(), ...extPrevs ? extPrevs.keys() : []]);
+  for (const key of extKeys) {
+    const value = extRunning.has(key) ? extRunning.get(key) : null;
+    const prev = extPrevs && extPrevs.has(key) ? extPrevs.get(key) : null;
+    if (value === prev && !touched.has(key)) continue;
+    const [readId, group] = splitSummaryKey(key);
+    const read = reads.find((r) => r.id === readId);
+    if (!read) continue;
+    subtotals.push({ readId, group, kind: read.kind, prev, value, ...extRederived.has(key) ? { rederived: true } : {} });
+  }
+  if (subtotals.length === 0) return { ok: true, upToDate: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: fromOid || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+      events
+    }
+  };
+}
+function contribution(read, cur) {
+  if (!cur || !cur.exists || cur.type !== read.of) return null;
+  if (read.where && !evalCanonicalPred(read.where, (f) => cur.fields.get(f))) return null;
+  const group = read.by === null ? "" : cur.fields.has(read.by) ? String(cur.fields.get(read.by)) : void 0;
+  if (group === void 0) return null;
+  if (read.kind === "count") return { group, value: 1 };
+  const raw = cur.fields.get(read.field);
+  if (isExtremumRead(read) && typeof raw !== "number") return null;
+  return { group, value: typeof raw === "number" ? raw : 0 };
+}
+function contributionDiff(read, before, after) {
+  const out2 = [];
+  if (before && after && before.group === after.group) {
+    const d = after.value - before.value;
+    if (d !== 0) out2.push({ readId: read.id, group: after.group, delta: d });
+    return out2;
+  }
+  if (before) out2.push({ readId: read.id, group: before.group, delta: -before.value });
+  if (after) out2.push({ readId: read.id, group: after.group, delta: after.value });
+  return out2.filter((d) => d.delta !== 0);
+}
+function countTenantRows(eng, ws) {
+  let total = 0;
+  for (const type of tenantTypes(eng)) {
+    total += query(eng, ws, "aggregatesByType", JSON.stringify({ __type: type })).length;
+  }
+  return total;
+}
+async function countTenantRowsByHome(eng, ws, homeKeys) {
+  const keySet = new Set(homeKeys);
+  const tagOf = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
+  const out2 = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) out2.set(hk, 0);
+  for (const type of tenantTypes(eng)) {
+    for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: type }))) {
+      const id = String(r.id || "");
+      const hk = keySet.has(id) ? id : tagOf.get(routeTagHexOfMintedId(id) ?? "");
+      if (hk !== void 0) out2.set(hk, (out2.get(hk) ?? 0) + 1);
+    }
+  }
+  return out2;
+}
+async function collectHomedIntents(eng, ws, homeKeys) {
+  const routes = directiveRoutes(eng);
+  const tagOf = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey(hk), hk);
+  const keySet = new Set(homeKeys);
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng, gitdir, head) : [];
+  const docs = [];
+  const strikeParity = /* @__PURE__ */ new Map();
+  for (const c of commits) {
+    let doc = null;
+    try {
+      const blob = bytesFromB64(c.changeB64);
+      doc = c.intent;
+      docs.push({ oid: c.oid, blob, doc });
+    } catch {
+      continue;
+    }
+    for (const target of doc && Array.isArray(doc.strikes) ? doc.strikes : []) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out2 = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    if (!id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
+    const dom = doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
+    const dirId = doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
+    const route = dom && dirId ? routes.get(`${dom} ${dirId}`) : null;
+    if (!route) continue;
+    const value = doc.payload.payload ? doc.payload.payload[route.key] : void 0;
+    if (typeof value !== "string" || !value) continue;
+    let homeKey = null;
+    if (route.via === "axis") homeKey = keySet.has(value) ? value : null;
+    else {
+      const tag = routeTagHexOfMintedId(value);
+      homeKey = tag !== void 0 ? tagOf.get(tag) ?? null : null;
+    }
+    if (homeKey !== null) out2.push({ oid, id, homeKey, blob });
+  }
+  return out2;
+}
+async function migrateHomes(eng, ws, ledger, sourceWs, homeKeys, { onlyIds = null } = {}) {
+  const wanted = onlyIds ? new Set(onlyIds) : null;
+  const homed = await collectHomedIntents(eng, sourceWs, homeKeys);
+  const main = await mainIntentIds(eng, ws);
+  const migrated = [], skipped = [], refused = [];
+  for (const e of homed) {
+    if (wanted && !wanted.has(e.id)) continue;
+    if (main.ids.has(e.id)) {
+      skipped.push(e.id);
+      continue;
+    }
+    const res = offerAdmit(eng, ws, e.blob);
+    if (res.ok) {
+      main.ids.add(e.id);
+      main.oids.add(res.head);
+      main.head = res.head;
+      migrated.push(e.id);
+    } else {
+      refused.push({ intentId: e.id, oid: e.oid.slice(0, 10), error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  if (migrated.length) await commitAndPush(eng, ws, ledger);
+  log("migrate-homes", { ws, from: sourceWs, migrated: migrated.length, skipped: skipped.length, refused: refused.length });
+  return { migrated, skipped, refused };
+}
+async function sealHomes(eng, ws, ledger, { domain, lawHash, homeKeys, target, migratedIds, sealedAt }) {
+  const have = new Set(migratedIds);
+  const homed = await collectHomedIntents(eng, ws, homeKeys);
+  const missing = homed.filter((e) => !have.has(e.id)).map((e) => e.id);
+  if (missing.length) return { ok: false, missing };
+  const ids = homed.map((e) => e.id);
+  const CHUNK = 1024;
+  let head = null, struck = 0;
+  for (let i = 0; i < Math.max(1, Math.ceil(ids.length / CHUNK)); i++) {
+    const intentIds = ids.slice(i * CHUNK, (i + 1) * CHUNK);
+    const res = author(eng, ws, domain, "nomosSealHome", { homeKeys: [...homeKeys], target, intentIds, sealedAt }, lawHash, { rngDraws: 8 });
+    if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused the seal").slice(0, 400) };
+    head = res.head;
+    struck += intentIds.length;
+  }
+  await commitAndPush(eng, ws, ledger);
+  log("seal-homes", { ws, target, homes: homeKeys.length, struck, head });
+  return { ok: true, head, struck };
+}
+async function summaryCloseAgainstHeld(eng, ws, heldRows, heldFrontier) {
+  const head = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (!head) return { ok: false, error: "no local main to close against" };
+  if (head === heldFrontier) return { ok: true, upToDate: true, head };
+  const subtotals = [];
+  const deltas = [];
+  const heldHomes = heldRows.map((row) => row.data || row).filter((d) => d.readId === NOMOS_SHARD_ROWS_READ && typeof d.group === "string" && d.group !== "").map((d) => d.group);
+  const byHome = heldHomes.length ? await countTenantRowsByHome(eng, ws, heldHomes) : /* @__PURE__ */ new Map();
+  for (const row of heldRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    const group = typeof d.group === "string" ? d.group : "";
+    if (d.kind === "min" || d.kind === "max") {
+      const heldVal = d.empty === 1 || typeof d.value !== "number" ? null : d.value;
+      const nowVal = extremum(eng, ws, d.readId, d.kind, group).value;
+      if (nowVal === heldVal) continue;
+      subtotals.push({ readId: d.readId, group, kind: d.kind, prev: heldVal, value: nowVal, rederived: true });
+      deltas.push({ readId: d.readId, group, delta: nowVal });
+      continue;
+    }
+    const held = typeof d.value === "number" ? d.value : 0;
+    let now;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) now = group === "" ? countTenantRows(eng, ws) : byHome.get(group) ?? 0;
+    else if (d.kind === "sum") now = sum(eng, ws, d.readId, group).sum;
+    else now = count(eng, ws, d.readId, group).count;
+    if (now === held) continue;
+    subtotals.push({ readId: d.readId, group, kind: d.kind === "sum" || d.kind === "rows" ? d.kind : "count", prev: held, value: now });
+    deltas.push({ readId: d.readId, group, delta: now - held });
+  }
+  if (subtotals.length === 0) return { ok: true, frontierOnly: true, head };
+  return {
+    ok: true,
+    head,
+    payload: {
+      fromOid: heldFrontier || "",
+      toOid: head,
+      subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+      events: [{ oid: head, intentId: "", deltas }]
+    }
+  };
+}
+async function collectGlobalIntents(eng, ws) {
+  const globals = globalAggregates(eng);
+  if (globals.size === 0) return [];
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  const commits = head ? kgit.intentsAbove(eng, gitdir, head) : [];
+  const typeOf = /* @__PURE__ */ new Map();
+  const strikeParity = /* @__PURE__ */ new Map();
+  const docs = [];
+  for (const c of commits) {
+    let blob = null, doc = null;
+    try {
+      blob = bytesFromB64(c.changeB64);
+      doc = c.intent;
+    } catch {
+      continue;
+    }
+    docs.push({ oid: c.oid, blob, doc });
+    for (const target of doc && Array.isArray(doc.strikes) ? doc.strikes : []) {
+      strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
+    }
+  }
+  const out2 = [];
+  for (const { oid, blob, doc } of docs) {
+    const id = doc && typeof doc.id === "string" ? doc.id : null;
+    let touches = false;
+    for (const ev of parseIntentEvents(doc)) {
+      const newType = ev.sets.get("__type");
+      if (newType !== void 0 && !typeOf.has(ev.aggregate)) typeOf.set(ev.aggregate, newType);
+      const t = newType ?? typeOf.get(ev.aggregate);
+      if (t !== void 0 && globals.has(t)) touches = true;
+    }
+    if (!touches || !id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
+    out2.push({ oid, id, blob });
+  }
+  return out2;
+}
+async function replicateIntents(eng, ws, ledger, intents, { push = true } = {}) {
+  const main = await mainIntentIds(eng, ws);
+  const replicated = [], skipped = [], refused = [];
+  for (const e of intents) {
+    if (e.id && main.ids.has(e.id)) {
+      skipped.push(e.id);
+      continue;
+    }
+    const res = offerAdmit(eng, ws, e.blob);
+    if (res.ok) {
+      if (e.id) main.ids.add(e.id);
+      main.oids.add(res.head);
+      main.head = res.head;
+      replicated.push(e.id || res.head);
+    } else {
+      refused.push({ intentId: e.id || "", error: String(res.error || "").slice(0, 300) });
+    }
+  }
+  if (replicated.length && push) await commitAndPush(eng, ws, ledger);
+  log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
+  return { replicated, skipped, refused };
+}
+async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
+  const main = await mainIntentIds(eng, ws);
+  const sessions = /* @__PURE__ */ new Map();
+  const deadLetters = [];
+  let admittedTotal = 0;
+  const born = [];
+  const birthOutcomes = [];
+  const timings = { spans: [], intents: 0, sessions: 0 };
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const gitdir0 = gitdirOf(ws);
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir0, BRANCH) : null;
+  const t0 = Date.now();
+  let seq = 0;
+  const span = (name, kind, depth = 1, extra = {}) => {
+    const s0 = Date.now();
+    return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
+  };
+  for (const offer of Array.isArray(offers) ? offers : []) {
+    const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
+    const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
+    sessions.set(cid, rec);
+    const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
+    let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+    try {
+      if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
+      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+        continue;
+      }
+      const doc = offer?.intent ?? kgit.inspectChange(eng, blob);
+      const intentId = typeof doc?.id === "string" ? doc.id : null;
+      const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
+      const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
+      const oid = String(offer?.oid || intentId || "").slice(0, 10);
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent \u2014 governance enters its own admin lane" });
+        continue;
+      }
+      if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+        const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+        continue;
+      }
+      if (intentId && main.ids.has(intentId)) {
+        rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
+        continue;
+      }
+      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, doc) : null;
+      const _tOffer = Date.now();
+      const res = offerAdmit(eng, ws, blob, { defer: false });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: false, ok: res.ok });
+      if (res.ok) {
+        if (intentId) main.ids.add(intentId);
+        main.oids.add(res.head);
+        main.head = res.head;
+        rec.admitted.push({ oid, head: res.head });
+        admittedTotal += 1;
+        if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
+        if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
+        if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1" && Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) {
+          log("offer-birth-outcomes", { ws, outcomes: res.birthOutcomes });
+        }
+        if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId);
+      } else {
+        if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1") {
+          log("offer-admit-refused", {
+            ws,
+            domain: dom,
+            directiveId: dirId,
+            error: String(res.error || "").slice(0, 2e3)
+          });
+        }
+        const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+      }
+    } catch (e) {
+      if (typeof process !== "undefined" && process.env?.NOMOS_TEST_DIAGNOSTICS === "1") {
+        log("offer-admit-threw", {
+          ws,
+          error: String(e).slice(0, 2e3)
+        });
+      }
+      rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
+    } finally {
+      done();
+    }
+  }
+  timings.sessions = sessions.size;
+  timings.intents = admittedTotal;
+  if (deadLetters.length) {
+    try {
+      await materializeRefused(eng, ws, ledger, deadLetters);
+    } catch (e) {
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  if (admittedTotal) {
+    const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
+    await commitAndPush(eng, ws, ledger);
+    sealDone();
+  }
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng, ws, clientBase ?? "");
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch {
+    }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  const bornPacked = born.length ? packBornChildren(eng, born) : born;
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+}
+async function checkpointStateHash(eng, ws) {
+  const rows = query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosSummarySubtotal" }));
+  const canon = rows.map((r) => {
+    const d = r.data || {};
+    return { id: r.id, readId: d.readId, group: d.group, shard: d.shard, kind: d.kind, value: d.value, frontier: d.frontier };
+  }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  return sha256hex(JSON.stringify(canon));
+}
+async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountWorkspace(eng, ws, ledger);
+  let res;
+  try {
+    res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
+  } catch (e) {
+    return { ok: false, error: String(e?.message || e).slice(0, 500) };
+  }
+  if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
+  await commitAndPush(eng, ws, ledger);
+  const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng, res.born) : res.born;
+  return { ok: true, head: res.head, born: bornPacked ?? [], birthOutcomes: res.birthOutcomes ?? [] };
+}
+async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows) {
+  const replay = await verifyChain(eng, shardWs, shardLedger);
+  if (!replay.valid) {
+    return { verdict: `invalid:${replay.check || "replay"}`, replay, checks: [] };
+  }
+  await mountWorkspace(eng, shardWs, shardLedger);
+  const checks = [];
+  let allMatch = true;
+  const heldHomes = coordinatorRows.map((row) => row.data || row).filter((d) => d.readId === NOMOS_SHARD_ROWS_READ && typeof d.group === "string" && d.group !== "").map((d) => d.group);
+  const byHome = heldHomes.length ? await countTenantRowsByHome(eng, shardWs, heldHomes) : /* @__PURE__ */ new Map();
+  for (const row of coordinatorRows) {
+    const d = row.data || row;
+    if (typeof d.readId !== "string") continue;
+    const group = d.group ?? "";
+    if (d.kind === "min" || d.kind === "max") {
+      const heldVal = d.empty === 1 || typeof d.value !== "number" ? null : d.value;
+      const recomputed2 = extremum(eng, shardWs, d.readId, d.kind, group).value;
+      const match2 = recomputed2 === heldVal;
+      if (!match2) allMatch = false;
+      checks.push({ readId: d.readId, group, kind: d.kind, coordinator: heldVal, shard: recomputed2, match: match2 });
+      continue;
+    }
+    let recomputed;
+    if (d.readId === NOMOS_SHARD_ROWS_READ) {
+      recomputed = group === "" ? countTenantRows(eng, shardWs) : byHome.get(group) ?? 0;
+    } else if (d.kind === "sum") {
+      recomputed = sum(eng, shardWs, d.readId, group).sum;
+    } else {
+      recomputed = count(eng, shardWs, d.readId, group).count;
+    }
+    const match = recomputed === d.value;
+    if (!match) allMatch = false;
+    checks.push({ readId: d.readId, group, coordinator: d.value, shard: recomputed, match });
+  }
+  const head = kgit.resolveRef(eng, gitdirOf(shardWs), BRANCH);
+  return {
+    verdict: allMatch ? "verified" : "mismatch",
+    head,
+    intents: replay.intents,
+    plansRerun: replay.plansRerun,
+    checks
+  };
+}
+function stageWorkspaceDir(eng, ws) {
+  const wsContents = /* @__PURE__ */ new Map();
+  dirOf(eng.preopen.dir.contents.get("ws")).contents.set(ws, new Directory(wsContents));
+}
+async function mountWorkspace(eng, ws, ledger) {
+  if (eng.mounted.has(ws)) return eng.mounted.get(ws);
+  stageWorkspaceDir(eng, ws);
+  const gitdir = gitdirOf(ws);
+  let restored = false, remoteMain = null, restoreError = null;
+  try {
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main", writeRef: false });
+    if (remoteMain) {
+      const mounted = kgit.restoreMain(eng, ws, remoteMain);
+      if (!mounted.verified || mounted.head !== remoteMain) {
+        throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
+      }
+      restored = true;
+    }
+  } catch (e) {
+    restoreError = String(e?.stack || e).split("\n").slice(0, 5).join(" | ");
+  }
+  const m = { restored, remoteMain, restoreError };
+  eng.mounted.set(ws, m);
+  return m;
+}
+function assertAuthored(res, what) {
+  if (!res || res.ok === false) throw new Error(`${what}: ${String(res && res.error || "law refused the intent").slice(0, 500)}`);
+  return res;
+}
+async function mountEphemeralWorkspace(eng, ws, { domainHash = "", lawUsdz } = {}) {
+  let m = eng.mounted.get(ws);
+  if (!m) {
+    stageWorkspaceDir(eng, ws);
+    m = { restored: false, remoteMain: null, restoreError: null, ephemeral: true };
+    eng.mounted.set(ws, m);
+  }
+  if (!nomosActive(eng, ws)) {
+    assertAuthored(
+      author(eng, ws, "bootstrap", "installDomain", closureInstallPayload(eng.hashes.nomos, eng.installedBy), "", { lawUsdz: eng.nomosLawUsdz, deferProjection: false, rngDraws: 8 }),
+      `ephemeral workspace '${ws}' bootstrap`
+    );
+  }
+  if (domainHash && lawUsdz && qById(eng, ws, `domain-installation:${domainHash}`).length === 0) {
+    assertAuthored(
+      author(eng, ws, "nomos", "installDomain", closureInstallPayload(domainHash, eng.installedBy), eng.hashes.nomos, { lawUsdz, deferProjection: false, rngDraws: 8 }),
+      `ephemeral workspace '${ws}' installDomain(${domainHash.slice(0, 12)})`
+    );
+  }
+  return m;
+}
+async function authorEphemeral(eng, ws, mountOpts, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountEphemeralWorkspace(eng, ws, mountOpts);
+  return author(eng, ws, domain, directiveId, payload, lawHash, { deferProjection: false, ...opts });
+}
+async function queryEphemeral(eng, ws, mountOpts, queryId, paramsJson, principal = "", keys = []) {
+  await mountEphemeralWorkspace(eng, ws, mountOpts);
+  return query(eng, ws, queryId, paramsJson, principal, keys);
+}
+function unmount(eng, ws) {
+  eng.mounted.delete(ws);
+  eng.mainIntents.delete(ws);
+  const wsRoot = dirOf(eng.preopen.dir.contents.get("ws"));
+  if (wsRoot) wsRoot.contents.delete(ws);
+}
+function writeWork(eng, name, bytes) {
+  eng.preopen.dir.contents.set(name, new File(bytes));
+}
+function stageLawClosure(eng, lawUsdz, label = "candidate-law") {
+  const name = `${label.replace(/[^A-Za-z0-9._-]/g, "_")}.law.usdz`;
+  writeWork(eng, name, lawUsdz);
+  return custodyProtoCase(eng, {
+    case: "lawClosureInfo",
+    value: create(LawClosureInfoRequestSchema, { closureFile: `/work/${name}` })
+  }, "lawClosureInfo");
+}
+function currentLaw(eng, ws) {
+  const out2 = namedQueryProto(eng, ws, QueryOperation.CURRENT_LAW);
+  return out2.keyMap || {};
+}
+function installedLaw(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.INSTALLED_LAW);
+}
+function sceneLaw(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.SCENE_LAW);
+}
+function kernelStamp(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.KERNEL_STAMP);
+}
+function declaredCapabilities(eng, ws) {
+  const out2 = namedQueryProto(eng, ws, QueryOperation.DECLARED_CAPABILITIES);
+  return out2.capabilities || [];
+}
+function reactorScan(eng, ws) {
+  const response = callProto(eng.ex, {
+    case: "outbox",
+    value: create(OutboxRequestSchema, { target: protoTarget(ws) })
+  }, eng.STDERR);
+  if (response.outcome.case !== "outbox") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for outbox request`);
+  }
+  return jsStruct(response.outcome.value.result);
+}
+function evolveDryRun(eng, ws, lawUsdz, domainHash, dispositions = null) {
+  const before = currentLaw(eng, ws);
+  const tenantHashes = [...new Set(Object.values(before).filter(
+    (hash) => typeof hash === "string" && hash !== eng.hashes.bootstrap && hash !== eng.hashes.nomos
+  ))];
+  const upgrade = tenantHashes.length > 0;
+  const supersedes = upgrade && tenantHashes.length === 1 ? tenantHashes[0] : void 0;
+  if (upgrade && supersedes === void 0) {
+    return { admits: false, detail: `deploy-predecessor-ambiguous: workspace serves ${tenantHashes.length} business models` };
+  }
+  const payload = closureInstallPayload(domainHash, eng.installedBy, {
+    ...supersedes ? { supersedes } : {},
+    ...!upgrade && dispositions ? { dispositions } : {}
+  });
+  const r = author(eng, ws, "nomos", upgrade ? "stageDomain" : "installDomain", payload, eng.hashes.nomos, {
+    lawUsdz,
+    dryRun: true,
+    deferProjection: false
+  });
+  return r.ok ? { admits: true } : { admits: false, detail: r.error };
+}
+function mintId(eng, typeTag) {
+  const out2 = namedQueryProto(eng, "root", QueryOperation.MINT, { typeTag, nowMillis: Date.now() });
+  return out2.id;
+}
+function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
+  const seq = eng.seq++;
+  const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  const genesis = !controllerHash;
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error(`directive ${domain}/${directiveId} payload must be an object`);
+  }
+  const defer = opts.deferProjection !== false;
+  const offerOnce = () => {
+    const response = callProto(eng.ex, {
+      case: "offer",
+      value: create(OfferRequestSchema, {
+        target: protoTarget(ws),
+        intent: {
+          case: "call",
+          value: create(DirectiveCallSchema, {
+            domain,
+            directive: directiveId,
+            payload: protoStruct(payload)
+          })
+        },
+        authoring: create(AuthoringOptionsSchema, {
+          actor: opts.actor ?? "",
+          authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+          authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+          validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+          rng: capPorts.rng,
+          deferProjection: !opts.dryRun && defer,
+          spans: opts.spans ?? false,
+          dryRun: opts.dryRun ?? false,
+          sequence: BigInt(seq),
+          clock: create(CapturedClockSchema, {
+            physicalMillis: BigInt(capPorts.clock.physical),
+            logical: capPorts.clock.logical,
+            replica: BigInt(capPorts.clock.replica)
+          })
+        }),
+        lawUsdz: opts.lawUsdz ?? new Uint8Array(),
+        executionLawUsdz: genesis && domain === "bootstrap" && directiveId === "installDomain" ? eng.bootstrapLawUsdz : new Uint8Array(),
+        controllerLawHash: genesis ? "" : controllerHash,
+        conflictSnapshots: (opts.__nomosConflictSnapshots ?? []).map((snapshot2) => ({
+          aggregateType: snapshot2.aggregateType,
+          aggregateId: snapshot2.aggregateId,
+          field: snapshot2.field,
+          targetSchema: snapshot2.targetSchema,
+          token: snapshot2.token
+        }))
+      })
+    }, eng.STDERR);
+    if (response.outcome.case !== "offer") {
+      throw new Error(`kernel returned ${response.outcome.case || "empty"} for offer request`);
+    }
+    return offerResult(response.outcome.value);
+  };
+  const res = offerOnce();
+  if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  return res;
+}
+function setTestKRoot(eng, kRootPublicB64) {
+  const response = callProto(eng.ex, {
+    case: "test",
+    value: create(TestRequestSchema, {
+      operation: {
+        case: "setRoot",
+        value: create(SetTestRootRequestSchema, { publicKey: bytesFromB64(kRootPublicB64) })
+      }
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "test") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for test control`);
+  }
+  return { ok: true };
+}
+function refreshProjection(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.REFRESH, {}, { spans: true });
+}
+function flushDeferredProjections(eng) {
+  for (const ws of eng.pendingProjection ?? []) {
+    const _t = Date.now();
+    let diagnostics = null;
+    try {
+      const refreshed = refreshProjection(eng, ws);
+      diagnostics = { timingsUs: refreshed?.timingsUs ?? null, kernelSpans: refreshed?.kernelSpans ?? null };
+    } catch {
+    }
+    const ms = Date.now() - _t;
+    const debugPerf = typeof process !== "undefined" && !!process.env?.NOMOS_DEBUG_PERF;
+    if (ms >= 100 || debugPerf) {
+      log("flush-projection-ms", { ws, ms, ...diagnostics ? diagnostics : {} });
+    }
+  }
+  if (eng.pendingProjection) eng.pendingProjection.clear();
+}
+function exportCheckpoint(eng, ws) {
+  const response = custodyProtoCase(eng, {
+    case: "checkpointExport",
+    value: create(CheckpointExportRequestSchema, {
+      target: create(WorkspaceTargetSchema, { repo: repoArgOf(ws), workspace: ws, branch: BRANCH })
+    })
+  }, "checkpointExport");
+  return {
+    ok: true,
+    empty: response.empty,
+    ...response.cursor ? { cursor: response.cursor } : {},
+    ...response.frontier.length ? { frontier: b64Bytes(response.frontier), bytes: response.frontier.length } : {},
+    ...response.stateRoot ? { stateRoot: response.stateRoot } : {},
+    stateTree: response.stateTree,
+    pinned: response.pinned,
+    readIndexSnapshot: response.readIndexSnapshot,
+    readIndexSnapshotPending: response.readIndexSnapshotPending,
+    ...response.readIndexSqliteBytes !== void 0 ? { readIndexSqliteBytes: Number(response.readIndexSqliteBytes) } : {},
+    ...response.readIndexCustodyBytes !== void 0 ? { readIndexCustodyBytes: Number(response.readIndexCustodyBytes) } : {}
+  };
+}
+function importCheckpoint(eng, ws, blobB64, frontierB64, stateRoot, spans = false, cursor = null) {
+  const response = custodyProtoCase(eng, {
+    case: "checkpointImport",
+    value: create(CheckpointImportRequestSchema, {
+      target: create(WorkspaceTargetSchema, { repo: repoArgOf(ws), workspace: ws, branch: BRANCH }),
+      frontierSource: frontierB64 ? { case: "frontier", value: bytesFromB64(frontierB64) } : { case: void 0 },
+      cursor: cursor || void 0,
+      stateRoot: stateRoot || void 0,
+      spans
+    })
+  }, "checkpointImport");
+  return {
+    ok: true,
+    restored: response.restored,
+    ...response.reason ? { reason: response.reason } : {},
+    frontierSeeded: response.frontierSeeded,
+    frontierVerificationPending: response.frontierVerificationPending,
+    aggregates: Number(response.aggregateCount),
+    ...response.spans ? { kernelSpans: jsStruct(response.spans) } : {},
+    ...response.cursor ? { cursor: response.cursor } : {},
+    readOnly: response.readOnly,
+    lazyReadIndex: response.lazyReadIndex
+  };
+}
+function reserveKernelCapacity(eng, aggregateCount) {
+  const response = custodyProtoCase(eng, {
+    case: "capacityReserve",
+    value: create(CapacityReserveRequestSchema, { aggregateCount: BigInt(aggregateCount) })
+  }, "capacityReserve");
+  return {
+    ok: true,
+    aggregateCount: Number(response.aggregateCount),
+    reservedBytes: Number(response.reservedBytes)
+  };
+}
+async function streamAll(stream) {
+  const chunks = [];
+  const reader = stream.getReader();
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  let len = 0;
+  for (const c of chunks) len += c.length;
+  const out2 = new Uint8Array(len);
+  let at = 0;
+  for (const c of chunks) {
+    out2.set(c, at);
+    at += c.length;
+  }
+  return out2;
+}
+async function gzip(bytes) {
+  const cs = new CompressionStream("gzip");
+  return streamAll(new Response(Uint8Array.from(bytes).buffer).body.pipeThrough(cs));
+}
+async function gunzip(bytes) {
+  const ds = new DecompressionStream("gzip");
+  return streamAll(new Response(Uint8Array.from(bytes).buffer).body.pipeThrough(ds));
+}
+async function writeCheckpointObjects(eng, ws, ex, lawHash) {
+  const gitdir = gitdirOf(ws);
+  const files = [];
+  let rawLen = 0, gzLen = 0;
+  if (ex.blob) {
+    const gz = await gzip(enc3.encode(ex.blob));
+    rawLen = ex.blob.length;
+    gzLen = gz.length;
+    files.push({ path: "checkpoint", bytes: gz });
+  }
+  let fgzLen = 0;
+  if (ex.frontier) {
+    const fgz = await gzip(enc3.encode(ex.frontier));
+    fgzLen = fgz.length;
+    files.push({ path: "frontier", bytes: fgz });
+  }
+  files.push({ path: "meta", bytes: enc3.encode(JSON.stringify({ cursor: ex.cursor, bytes: ex.bytes ?? 0, lawHash, codec: "gzip", raw: rawLen, stored: gzLen, frontierStored: fgzLen, ...ex.stateRoot ? { stateRoot: ex.stateRoot } : {} })) });
+  const ref = CKPT_REF(lawHash);
+  const commitOid = kgit.writeMetaCommit(eng, gitdir, { parents: [], files, message: `checkpoint ${ws} @${String(ex.cursor).slice(0, 16)}`, timeSecs: 0, ref });
+  return { ref, commitOid };
+}
+async function readCheckpointBlob(eng, ws, commitOid) {
+  const gitdir = gitdirOf(ws);
+  let codec = "gzip";
+  let stateRoot = null;
+  let cursor = null;
+  try {
+    const m = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, commitOid, "meta") ?? new Uint8Array()));
+    codec = m.codec ?? "gzip";
+    stateRoot = m.stateRoot ?? null;
+    cursor = m.cursor ?? null;
+  } catch {
+  }
+  const dezip = async (b) => dec3.decode(codec === "gzip" ? await gunzip(b) : b);
+  let blob = null;
+  try {
+    const b = kgit.readBlob(eng, gitdir, commitOid, "checkpoint");
+    if (b) blob = await dezip(b);
+  } catch {
+  }
+  let frontier = null;
+  try {
+    const f = kgit.readBlob(eng, gitdir, commitOid, "frontier");
+    if (f) frontier = await dezip(f);
+  } catch {
+  }
+  return { blob, frontier, stateRoot, cursor };
+}
+async function lawParity(eng, ws, lawHash) {
+  if (lawHash) return lawHash;
+  try {
+    const map = currentLaw(eng, ws) || {};
+    return await sha256hex(JSON.stringify(Object.entries(map).sort()));
+  } catch {
+    return null;
+  }
+}
+async function pushCheckpoint(eng, ws, ledger, lawHash) {
+  try {
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
+    if (!lawHash) return { pushed: false, reason: "no-law" };
+    const gitdir = gitdirOf(ws);
+    const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
+    eng._ckptPushed ??= /* @__PURE__ */ new Map();
+    if (head && eng._ckptPushed.get(ws) === `${lawHash}:${head}`) {
+      return { pushed: false, reason: "unchanged" };
+    }
+    const ex = exportCheckpoint(eng, ws);
+    if (!ex || ex.empty || !ex.ok || !ex.blob) return { pushed: false, reason: ex && ex.empty ? "empty" : "no-blob" };
+    const tag = `${lawHash}:${ex.cursor}`;
+    if (eng._ckptPushed.get(ws) === tag) return { pushed: false, reason: "unchanged" };
+    const { ref } = await writeCheckpointObjects(eng, ws, ex, lawHash);
+    await custodyPush(eng, ws, ledger, { remoteRef: ref });
+    eng._ckptPushed.set(ws, tag);
+    return { pushed: true, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
+  } catch (e) {
+    return { pushed: false, reason: String(e?.message || e).slice(0, 160) };
+  }
+}
+async function stageCheckpoint(eng, ws, lawHash) {
+  try {
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
+    if (!lawHash) return null;
+    eng._ckptPushed ??= /* @__PURE__ */ new Map();
+    const ex = exportCheckpoint(eng, ws);
+    if (!ex || ex.empty || !ex.ok || !ex.blob) return null;
+    const tag = `${lawHash}:${ex.cursor}`;
+    if (eng._ckptPushed.get(ws) === tag) return null;
+    const { ref } = await writeCheckpointObjects(eng, ws, ex, lawHash);
+    return { ref, tag, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
+  } catch {
+    return null;
+  }
+}
+async function pushStagedCheckpoint(eng, ws, ledger, staged) {
+  if (!staged || !staged.ref) return { pushed: false };
+  await custodyPush(eng, ws, ledger, { remoteRef: staged.ref });
+  (eng._ckptPushed ??= /* @__PURE__ */ new Map()).set(ws, staged.tag);
+  return { pushed: true, cursor: staged.cursor, bytes: staged.bytes };
+}
+async function clearCheckpointRefs(ledger) {
+  const headers = ledger.headers || {};
+  const refs = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: "refs/meta/checkpoint/" });
+  const deleted = [];
+  for (const ref of Object.keys(refs)) {
+    try {
+      await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref, oldOid: refs[ref], newOid: ZERO_OID }] }));
+      deleted.push(ref);
+    } catch {
+    }
+  }
+  return deleted;
+}
+async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
+  try {
+    const mounted = eng.mounted.get(ws);
+    if (mounted?.checkpoint?.restored) {
+      return { restored: false, reason: "already-mounted-checkpoint" };
+    }
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
+    if (!lawHash) return { restored: false, reason: "no-law" };
+    const ref = CKPT_REF(lawHash);
+    const serverRefs = await custodyLsRefs(ledger, ref);
+    const foundOid = serverRefs[ref];
+    if (!foundOid) return { restored: false, reason: "absent" };
+    await custodyFetch(eng, ws, ledger, { remoteRef: ref });
+    const { blob, frontier, stateRoot, cursor } = await readCheckpointBlob(eng, ws, foundOid);
+    const r = importCheckpoint(eng, ws, blob, frontier, stateRoot, false, cursor);
+    if (r && r.restored === true && r.cursor) {
+      eng._ckptPushed ??= /* @__PURE__ */ new Map();
+      eng._ckptPushed.set(ws, `${lawHash}:${r.cursor}`);
+    }
+    return { restored: r && r.restored === true, frontierSeeded: r && r.frontierSeeded === true, cursor: r && r.cursor, reason: r && r.reason };
+  } catch (e) {
+    return { restored: false, reason: String(e?.message || e).slice(0, 160) };
+  }
+}
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
+    try {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+    }
+  }
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
+}
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null, writeRef = true } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) {
+    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    if (pk) applyPackInto(eng, ws, pk, tip);
+  }
+  if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+  const headers = ledger.headers || {};
+  const remoteRefFull = fullRef(remoteRef);
+  let remote;
+  try {
+    remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  } catch (error) {
+    throw new Error(`custody receive-pack advertisement failed for ${remoteRefFull}: ${String(error)}`, { cause: error });
+  }
+  const oldOid = remote[remoteRefFull] || ZERO_OID;
+  if (del) {
+    if (oldOid === ZERO_OID) return;
+    return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: ZERO_OID }] }));
+  }
+  const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
+  if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
+  if (tgt === oldOid) return;
+  let pack = null;
+  if (!pointer) {
+    pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
+    if (!pack) pack = packDelta(eng, ws, "", tgt);
+  }
+  const packBytes = pack?.byteLength ?? 0;
+  try {
+    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  } catch (error) {
+    throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
+  }
+}
+async function commitAndPush(eng, ws, ledger) {
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+  } catch (e) {
+    unmount(eng, ws);
+    const cause = e instanceof Error ? e.cause : void 0;
+    const detail = cause === void 0 ? String(e) : `${e}; cause: ${String(cause)}`;
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${detail}`, { cause: e });
+  }
+}
+async function pushShape(eng, ws, ledger) {
+  try {
+    const st = projectionStats(eng, ws);
+    const bytes = st && (st.sqliteBytes ?? st.bytes);
+    if (bytes == null) return;
+    const gitdir = gitdirOf(ws);
+    const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
+    if (!head) return;
+    const newRef = `refs/meta/shape/b${bytes}`;
+    eng._lastShapeRef ??= /* @__PURE__ */ new Map();
+    if (eng._lastShapeRef.get(ws) === newRef) return;
+    kgit.writeRef(eng, gitdir, newRef, head);
+    await custodyPush(eng, ws, ledger, { remoteRef: newRef, pointer: true });
+    const prev = eng._lastShapeRef.get(ws);
+    if (prev && prev !== newRef) {
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: prev, del: true });
+      } catch {
+      }
+    }
+    eng._lastShapeRef.set(ws, newRef);
+  } catch {
+  }
+}
+async function readShape(ledger) {
+  try {
+    const refs = await custodyLsRefs(ledger, "refs/meta/shape/");
+    let best = null;
+    for (const ref of Object.keys(refs)) {
+      const m = /refs\/meta\/shape\/b(\d+)$/.exec(ref);
+      if (m) {
+        const bytes = +m[1];
+        if (!best || bytes > best.bytes) best = { bytes };
+      }
+    }
+    return best;
+  } catch {
+    return null;
+  }
+}
+function describe(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.DESCRIBE, { workspace: ws });
+}
+function packDelta(eng, ws, base, head) {
+  try {
+    return custodyProtoCase(eng, {
+      case: "packDelta",
+      value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, head })
+    }, "packDelta").pack;
+  } catch {
+    return null;
+  }
+}
+function servePack(eng, ws, base = "") {
+  let head = null;
+  try {
+    head = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  } catch {
+  }
+  let r;
+  try {
+    const pack = custodyProtoCase(eng, {
+      case: "packDelta",
+      value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, branch: BRANCH })
+    }, "packDelta").pack;
+    r = { ok: true, packB64: b64Bytes(pack), bytes: pack.length };
+  } catch (e) {
+    const msg = String(e);
+    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    if (base && /reached root|before base|not an ancestor|request a full pack|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+      try {
+        const pack = custodyProtoCase(eng, {
+          case: "packDelta",
+          value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), branch: BRANCH })
+        }, "packDelta").pack;
+        const full = { ok: true, packB64: b64Bytes(pack), bytes: pack.length };
+        if (full && full.ok === true && typeof full.packB64 === "string") {
+          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
+        }
+      } catch {
+      }
+    }
+    throw e;
+  }
+  if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
+  return { packB64: r.packB64, bytes: r.bytes, ...head ? { head } : {} };
+}
+function packBornChildren(eng, born) {
+  if (!Array.isArray(born) || !born.length) return born;
+  return born.map((b) => {
+    const child = b && typeof b.workspace === "string" ? b.workspace : null;
+    const head = b && typeof b.head === "string" ? b.head : null;
+    if (!child || !/^[0-9a-f]{40}$/i.test(head || "")) {
+      log("born-pack-skipped", { workspace: child, head, reason: "malformed born entry" });
+      return b;
+    }
+    try {
+      const pack = packDelta(eng, child, "", head);
+      if (!pack || !pack.length) {
+        log("born-pack-empty", { workspace: child, head });
+        return b;
+      }
+      return { ...b, packB64: b64Bytes(pack), packBytes: pack.length };
+    } catch (e) {
+      log("born-pack-failed", { workspace: child, head, error: String(e).slice(0, 200) });
+      return b;
+    }
+  });
+}
+function reconcileBornPacks(eng, children) {
+  const born = [];
+  const missing = [];
+  for (const child of Array.isArray(children) ? children : []) {
+    if (typeof child !== "string" || !child) continue;
+    const head = kgit.resolveRef(eng, gitdirOf(child), BRANCH);
+    if (!head || !/^[0-9a-f]{40}$/i.test(head)) {
+      missing.push(child);
+      continue;
+    }
+    const pack = packDelta(eng, child, "", head);
+    if (!pack || !pack.length) {
+      missing.push(child);
+      continue;
+    }
+    born.push({ workspace: child, head, packB64: b64Bytes(pack), packBytes: pack.length });
+  }
+  return { born, missing };
+}
+async function ingestPackAsCustody(eng, ws, packBytes, head) {
+  if (!packBytes || !packBytes.length) throw new Error(`ingestPackAsCustody: empty pack for '${ws}'`);
+  if (!/^[0-9a-f]{40}$/i.test(head || "")) throw new Error(`ingestPackAsCustody: bad head '${head}' for '${ws}'`);
+  unmount(eng, ws);
+  stageWorkspaceDir(eng, ws);
+  const gitdir = gitdirOf(ws);
+  await custodySkeleton(eng, gitdir);
+  applyPackInto(eng, ws, packBytes, head);
+  const restored = kgit.restoreMain(eng, ws, head);
+  if (!restored.verified || restored.head !== head) {
+    throw new Error(`ingestPackAsCustody: kernel refused '${ws}' at ${head}`);
+  }
+  eng.mounted.set(ws, { restored: true, remoteMain: head, restoreError: null });
+  return { ok: true, head: kgit.resolveRef(eng, gitdir, "refs/heads/main") };
+}
+function offerIntent(eng, ws, bytes, opts = {}) {
+  const seq = eng.seq++;
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  const response = callProto(eng.ex, {
+    case: "offer",
+    value: create(OfferRequestSchema, {
+      target: protoTarget(ws, String(branch)),
+      intent: { case: "sealedChangeUsda", value: bytes },
+      authoring: create(AuthoringOptionsSchema, {
+        sequence: BigInt(seq),
+        deferProjection,
+        spans: !!opts?.spans
+      }),
+      candidateCommit: typeof opts?.candidateCommit === "string" ? opts.candidateCommit : void 0
+    })
+  }, eng.STDERR);
+  if (response.outcome.case !== "offer") {
+    throw new Error(`kernel returned ${response.outcome.case || "empty"} for sealed offer request`);
+  }
+  return offerResult(response.outcome.value);
+}
+function offerAdmit(eng, ws, bytes, opts = {}) {
+  return offerIntent(eng, ws, bytes, opts);
+}
+function applyIntentBytes(eng, ws, bytes, opts = {}) {
+  return offerAdmit(eng, ws, bytes, opts);
+}
+async function mainIntentIds(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head) return { head: null, ids: /* @__PURE__ */ new Set(), oids: /* @__PURE__ */ new Set() };
+  const cached = eng.mainIntents.get(ws);
+  if (cached && cached.head === head) return cached;
+  const ids = /* @__PURE__ */ new Set(), oids = /* @__PURE__ */ new Set();
+  for (const c of kgit.intentsAbove(eng, gitdir, head, "", 500)) {
+    oids.add(c.oid);
+    try {
+      const id = c.id;
+      if (typeof id === "string" && id) ids.add(id);
+    } catch {
+    }
+  }
+  const m = { head, ids, oids };
+  eng.mainIntents.set(ws, m);
+  return m;
+}
+async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
+  const routes = shardRouting ? directiveRoutes(eng) : null;
+  const gitdir = gitdirOf(ws);
+  const H = () => ({ ...ledger.headers || {} });
+  const _t0 = Date.now();
+  let _fetchMs = 0, _sealMs = 0, _intents = 0;
+  const _spans = [];
+  let _traceSeq = 0;
+  const _span = (name, kind, depth = 1, extra = {}) => {
+    const t0 = Date.now();
+    return (end = {}) => {
+      const t1 = Date.now();
+      _spans.push({ id: `admit-${_t0}-${_traceSeq++}`, track: "cloud", name, kind, depth, t0, t1, ...extra, ...end });
+    };
+  };
+  const sessionRefPrefix = "refs/heads/session/";
+  const sessions = {};
+  const _scanDone = _span("scan session refs", "cscan", 1);
+  for (const [ref, oid] of Object.entries(await custodyLsRefs(ledger, sessionRefPrefix))) {
+    if (ref.startsWith(sessionRefPrefix) && oid) sessions[ref.slice(sessionRefPrefix.length)] = oid;
+  }
+  _scanDone({ sessions: Object.keys(sessions).length });
+  const _scanMs = Date.now() - _t0;
+  const results = [], deadLetters = [], placements = [], splits = [], globalsOut = [];
+  const consumed = [];
+  let totalAdmitted = 0;
+  const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng) : null;
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  const canDeferProjection = !summaryCtx && !(globalsDeclared && globalsDeclared.size > 0);
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir, BRANCH) : null;
+  for (const [cid, head] of Object.entries(sessions)) {
+    const ref = `refs/heads/session/${cid}`;
+    const shortCid = cid.length > 14 ? `${cid.slice(0, 14)}...` : cid;
+    const _sessionDone = _span(`session ${shortCid}`, "csession", 1, { client: cid });
+    try {
+      const _fetchDone = _span(`fetch ${shortCid}`, "cfetch", 2, { client: cid });
+      const _f = Date.now();
+      try {
+        const localMain = kgit.resolveRef(eng, gitdir, BRANCH);
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
+        } catch (thinErr) {
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr?.message || thinErr).slice(0, 160) });
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
+        }
+      } finally {
+        _fetchMs += Date.now() - _f;
+        _fetchDone();
+      }
+      const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
+      const main = await mainIntentIds(eng, ws);
+      const recent = kgit.intentsAbove(eng, gitdir, head ?? "", "", 100);
+      const chain = [];
+      for (let i = recent.length - 1; i >= 0; i--) {
+        if (main.oids.has(recent[i].oid)) break;
+        chain.push(recent[i]);
+      }
+      chain.reverse();
+      _walkDone({ intents: chain.length });
+      const admitted = [], rejected = [], skipped = [];
+      const _gateDone = _span(`gate+fold ${shortCid}`, "cgate", 2, { client: cid, intents: chain.length });
+      for (const c of chain) {
+        const oid = c.oid;
+        try {
+          const blob = bytesFromB64(c.changeB64);
+          const doc = c.intent;
+          const intentId = typeof c.id === "string" ? c.id : null;
+          const dom = typeof c.domain === "string" ? c.domain : null;
+          const dirId = typeof c.directiveId === "string" ? c.directiveId : null;
+          if (!dom) {
+            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent \u2014 governance enters its own admin lane" });
+            continue;
+          }
+          if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+            const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+            continue;
+          }
+          if (routes && dom && dirId) {
+            if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
+              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' \u2014 the \xA76 handoff seals are authored by the adapter after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
+              continue;
+            }
+            const route = routes.get(`${dom} ${dirId}`);
+            if (route) {
+              const payloadObj = doc?.payload?.payload ?? null;
+              const verdict2 = await wrongHomeVerdict(shardRouting, route, payloadObj);
+              if (verdict2) {
+                rejected.push({ oid: oid.slice(0, 10), error: verdict2.error, ...verdict2.wrongHome ? { wrongHome: verdict2.wrongHome } : {}, ...verdict2.homeMoving ? { homeMoving: verdict2.homeMoving } : {}, ...verdict2.deadLettered ? { deadLettered: true } : {} });
+                if (verdict2.deadLettered) deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error: verdict2.error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+            }
+            if (dirId === "nomosReceiveAssignment" && shardRouting) {
+              const p = doc?.payload?.payload ?? null;
+              const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
+              const rows = homeKey ? await shardRouting.assignments() || [] : [];
+              const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
+              if (!a) {
+                const error = `assignment receipt for home '${String(homeKey).slice(0, 80)}' has NO placement on the coordinator '${shardRouting.coordinatorWs}' \u2014 author the derived placement intent (birth<Type>) first, then POST /dead-letters/retry`;
+                rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+                deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+              if (a.shard !== shardRouting.selfLabel || p && p.shard !== shardRouting.selfLabel) {
+                const correct = `${shardRouting.coordinatorWs}--${a.shard}`;
+                rejected.push({
+                  oid: oid.slice(0, 10),
+                  error: `wrong-home: the coordinator's shard map assigns home '${homeKey.slice(0, 80)}' to '${correct}' (not this workspace) \u2014 a routed client re-routes and retries automatically`,
+                  wrongHome: { workspace: correct, ...a.mapVersion !== void 0 ? { mapVersion: a.mapVersion } : {} }
+                });
+                continue;
+              }
+            }
+          }
+          if (intentId && main.ids.has(intentId)) {
+            skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
+            continue;
+          }
+          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, doc) : null;
+          const verdict = offerIntent(eng, ws, blob, {
+            defer: canDeferProjection,
+            // The session commit is inert custody. Passing its content address lets the kernel recover
+            // typed auxiliary assets (notably a USDA law closure) bound by the sealed intent. The kernel
+            // authenticates the closure and runs the same offer gate; the adapter interprets nothing.
+            candidateCommit: oid
+          });
+          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.error };
+          if (res.ok) {
+            if (intentId) main.ids.add(intentId);
+            main.oids.add(res.head);
+            main.head = res.head;
+            admitted.push({ oid: oid.slice(0, 10), head: res.head });
+            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId ?? "");
+            if (shardRouting && dirId) {
+              const placement = placementDirectives(eng).get(dirId);
+              if (placement) {
+                const p = doc?.payload?.payload ?? null;
+                const homeKey = p ? p[String(placement.keyField)] : void 0;
+                if (typeof homeKey === "string" && typeof p?.shard === "string") {
+                  placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
+                }
+              }
+              if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
+                const p = doc?.payload?.payload ?? null;
+                if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
+                  splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
+                }
+              }
+            }
+            if (globalsDeclared && globalsDeclared.size > 0) {
+              let touchesGlobal = false;
+              for (const ev of parseIntentEvents(doc)) {
+                const rows = qById(eng, ws, ev.aggregate);
+                const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : void 0);
+                if (t !== void 0 && globalsDeclared.has(t)) {
+                  touchesGlobal = true;
+                  break;
+                }
+              }
+              if (touchesGlobal) globalsOut.push({ intentId: intentId || "", oid: oid.slice(0, 10), blob });
+            }
+          } else {
+            const wh = String(res.error || "").match(/wrong-home:(s\d+)/);
+            if (wh) {
+              const coordinator = shardRouting && shardRouting.coordinatorWs || (ws.match(/^(.*)--s\d+$/) || [])[1] || ws;
+              rejected.push({
+                oid: oid.slice(0, 10),
+                error: `wrong-home: this write's home is assigned to '${coordinator}--${wh[1]}' \u2014 the chain gate's homing invariant refused it; a routed client re-routes and retries automatically`,
+                wrongHome: { workspace: `${coordinator}--${wh[1]}` }
+              });
+              continue;
+            }
+            const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+          }
+        } catch (e) {
+          rejected.push({ oid: oid.slice(0, 10), error: String(e).slice(0, 200) });
+        }
+      }
+      _gateDone({ admitted: admitted.length, rejected: rejected.length, skipped: skipped.length });
+      _intents += admitted.length;
+      totalAdmitted += admitted.length;
+      consumed.push({ cid, ref });
+      results.push({ session: cid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+    } catch (e) {
+      results.push({ session: cid, error: String(e).slice(0, 200) });
+    } finally {
+      _sessionDone();
+    }
+  }
+  if (canDeferProjection && totalAdmitted) {
+    const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
+    try {
+      refreshProjection(eng, ws);
+    } catch (e) {
+      log("admit-projection-flush-failed", { ws, error: String(e).slice(0, 200) });
+    } finally {
+      _projDone();
+    }
+  }
+  let unparkedSessions = /* @__PURE__ */ new Set();
+  if (deadLetters.length) {
+    try {
+      unparkedSessions = (await materializeRefused(eng, ws, ledger, deadLetters)).unparkedSessions;
+    } catch (e) {
+      unparkedSessions = new Set(deadLetters.map((dl) => dl.session).filter(Boolean));
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const prunable = unparkedSessions.size ? consumed.filter((c) => !unparkedSessions.has(c.cid)) : consumed;
+  const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
+  const deferDurability = defer && !hasCoordination;
+  let _sealed = true;
+  if (totalAdmitted && !deferDurability) {
+    const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
+    const _s = Date.now();
+    try {
+      await commitAndPush(eng, ws, ledger);
+    } catch (e) {
+      _sealed = false;
+      log("admit-batch-push-failed", { ws, sessions: consumed.length, admitted: totalAdmitted, error: String(e).slice(0, 200) });
+    } finally {
+      _sealMs += Date.now() - _s;
+      _sealDone();
+    }
+  }
+  if (_sealed && !deferDurability) {
+    for (const { ref } of prunable) {
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+      } catch {
+      }
+    }
+  }
+  const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
+  log("admit", { ws, sessions: results.length, main: newMain });
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
+  const _total = Date.now() - _t0;
+  const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
+  return {
+    sessions: results,
+    main: newMain,
+    deadLetters,
+    timings,
+    ...summary ? { summary } : {},
+    ...placements.length ? { placements } : {},
+    ...splits.length ? { splits } : {},
+    ...globalsOut.length ? { globals: globalsOut } : {},
+    // The adapter's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
+    // un-backed-up commits and `consumed` are the session branches to delete AFTER the push lands.
+    ...deferDurability && totalAdmitted ? { deferred: true, consumed: prunable, admitted: totalAdmitted } : {}
+  };
+}
+async function backupHead(eng, ws, ledger, head) {
+  if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
+  if (!head) return { ok: false, error: "no head" };
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    return { ok: true, head };
+  } catch (e) {
+    return { ok: false, error: String(e?.message || e).slice(0, 200), head };
+  }
+}
+async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
+  if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
+  const gitdir = gitdirOf(ws);
+  let head = null;
+  head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head) return { ok: false, error: "no local main" };
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+  } catch (e) {
+    return { ok: false, error: String(e).slice(0, 200), head };
+  }
+  for (const { ref } of consumed) {
+    try {
+      await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+    } catch {
+    }
+  }
+  return { ok: true, head };
+}
+async function verifyChain(eng, ws, ledger) {
+  unmount(eng, ws);
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (!m.restored) {
+    return { valid: false, check: "mount", error: m.restoreError || "no refs/heads/main on the ledger \u2014 nothing to verify (push refs/heads/main to deliver a chain first)" };
+  }
+  try {
+    return namedQueryProto(eng, ws, QueryOperation.VERIFY_CHAIN);
+  } finally {
+    unmount(eng, ws);
+  }
+}
+function verifyChainLocal(eng, ws) {
+  return namedQueryProto(eng, ws, QueryOperation.VERIFY_CHAIN);
+}
+function historyPreflight(eng, ws, domain, candidateHash, atHash, dispositions) {
+  return namedQueryProto(eng, ws, QueryOperation.HISTORY_PREFLIGHT, {
+    domain,
+    candidateHash,
+    atHash,
+    ...dispositions ? { dispositions } : {}
+  });
+}
+function historyRestorePreflight(eng, ws, domain, currentHash, priorHash, atHash, actor) {
+  return namedQueryProto(eng, ws, QueryOperation.HISTORY_PREFLIGHT, {
+    domain,
+    candidateHash: priorHash,
+    atHash,
+    restorePreviousOf: currentHash,
+    ackBy: actor
+  });
+}
+function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng.installedBy || "").trim();
+  if (!actingPrincipal && !opts.authToken) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "promotion needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const atHash = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (!atHash) {
+    return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  }
+  let report;
+  try {
+    report = historyPreflight(eng, ws, domain, candidateHash, atHash, opts.dispositions);
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedPromotion(report, candidateHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const {
+    replaces: _replaces,
+    retireReplaced: _retireReplaced,
+    dispositions: _dispositions,
+    acceptanceReason: _acceptance,
+    ...authorOpts
+  } = opts;
+  const result = author(eng, ws, "nomos", "promoteDomain", prepared.payload, eng.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "promoted", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
+function restorePreviousPreflighted(eng, ws, domain, currentHash, opts = {}) {
+  const actingPrincipal = opts.actor?.trim() || String(eng.installedBy || "").trim();
+  if (!actingPrincipal) {
+    return {
+      ok: false,
+      stage: "identity",
+      error: "model restoration needs the stateful client's current principal so its business decision is attributable"
+    };
+  }
+  const resolved = currentLaw(eng, ws)[domain];
+  if (resolved !== currentHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "the generated model is no longer current; nothing changed [nomos.rollout.restore-current-changed]"
+    };
+  }
+  const current = qById(eng, ws, `domain-installation:${currentHash}`)[0]?.data;
+  const priorHash = typeof current?.["spec.supersedes"] === "string" ? current["spec.supersedes"] : "";
+  if (!priorHash) {
+    return {
+      ok: false,
+      stage: "preflight",
+      error: "this model has no previous model to restore [nomos.rollout.restore-no-previous]"
+    };
+  }
+  const atHash = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (!atHash) return { ok: false, stage: "preflight", error: "workspace has no history to prove" };
+  let report;
+  try {
+    report = historyRestorePreflight(
+      eng,
+      ws,
+      domain,
+      currentHash,
+      priorHash,
+      atHash,
+      actingPrincipal
+    );
+  } catch (error) {
+    return { ok: false, stage: "preflight", error: String(error?.message || error) };
+  }
+  const prepared = prepareManagedRestoration(report, currentHash, priorHash, domain, opts);
+  if (!prepared.ok) return prepared;
+  const { acceptanceReason: _acceptance, ...authorOpts } = opts;
+  const result = author(eng, ws, "nomos", "rollbackDomain", prepared.payload, eng.hashes.nomos, {
+    ...authorOpts,
+    ...actingPrincipal ? { actor: actingPrincipal } : {}
+  });
+  return result.ok ? { ...result, stage: "restored", report, receiptId: prepared.receiptId } : { ...result, stage: "admission", report, receiptId: prepared.receiptId };
+}
+async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0, parent = "" } = {}) {
+  const incWs = `${ws}__rebirth`;
+  try {
+    const mounted = eng.mounted.get(ws) ?? await mountWorkspace(eng, ws, ledger || { remote: "https://unborn.invalid/", headers: {} });
+    const srcGitdir = gitdirOf(ws);
+    const oldHead = kgit.resolveRef(eng, srcGitdir, BRANCH) || mounted.remoteMain || "";
+    if (!/^[0-9a-f]{40}$/i.test(oldHead)) return { ok: false, error: `'${ws}' has no refs/heads/main to rebirth \u2014 nothing to compact` };
+    const sealed = kgit.intentsAbove(eng, srcGitdir, oldHead, "", 0);
+    if (!Array.isArray(sealed) || !sealed.length) return { ok: false, error: `'${ws}' main carries no intents to replay` };
+    unmount(eng, incWs);
+    await mountEphemeralWorkspace(eng, incWs, {});
+    const isGenesisBootstrapInstall = (c) => c.domain === "bootstrap" && c.directiveId === "installDomain";
+    const transformState = (sealedBytes, _ctx) => sealedBytes;
+    const carried = [];
+    const parkedIntents = [];
+    const parkedBlobs = [];
+    let idx = -1, lastCarriedIdx = -1, firstParkedIdx = -1;
+    for (const c of sealed) {
+      idx++;
+      if (isGenesisBootstrapInstall(c)) continue;
+      let bytes;
+      try {
+        bytes = transformState(bytesFromB64(c.changeB64), { oid: c.oid, incWs });
+      } catch {
+        parkedIntents.push({ oid: c.oid, reason: "undecodable intent blob" });
+        parkedBlobs.push(bytesFromB64(c.changeB64));
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+        continue;
+      }
+      const r = applyIntentBytes(eng, incWs, bytes, { defer: false });
+      if (r && r.ok) {
+        carried.push(c.oid);
+        lastCarriedIdx = idx;
+      } else {
+        parkedIntents.push({ oid: c.oid, reason: String(r && r.error || "refused").slice(0, 200) });
+        parkedBlobs.push(bytes);
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+      }
+    }
+    const scarShape = parkedIntents.length === 0 ? "none" : firstParkedIdx > lastCarriedIdx ? "tail" : "mid-chain";
+    const incGitdir = gitdirOf(incWs);
+    const head = kgit.resolveRef(eng, incGitdir, BRANCH);
+    if (!/^[0-9a-f]{40}$/i.test(head || "")) {
+      unmount(eng, incWs);
+      return { ok: false, error: `the incarnation folded no intents (all ${sealed.length} refused \u2014 all parked-to-be, nothing to serve)`, parked: parkedIntents.length, parkedIntents };
+    }
+    const incChain = kgit.intentsAbove(eng, incGitdir, head, "", 0);
+    const genesisOid = incChain.length ? incChain[0].oid : head;
+    let parkedRef = "";
+    let parkedTip = "";
+    if (parkedBlobs.length) {
+      parkedRef = `refs/heads/parked/rebirth/${supersededAt || Date.now()}`;
+      let parentOid = head;
+      for (let i = 0; i < parkedBlobs.length; i++) {
+        parentOid = kgit.writeMetaCommit(eng, incGitdir, {
+          parents: [parentOid],
+          files: [{ path: "change.usda", bytes: parkedBlobs[i] }],
+          message: `unreplayed: ${parkedIntents[i].oid.slice(0, 12)} \u2014 ${parkedIntents[i].reason.slice(0, 120)}`,
+          timeSecs: 0,
+          ref: i === parkedBlobs.length - 1 ? parkedRef : ""
+        });
+      }
+      parkedTip = parentOid;
+    }
+    const verdict = verifyChainLocal(eng, incWs);
+    const verified = verdict && verdict.valid === true;
+    if (ws !== "root" && !isWarranted(eng, incWs)) {
+      unmount(eng, incWs);
+      return {
+        ok: false,
+        error: `the incarnation carries no GenesisWarrant (${carried.length} carried, ${parkedIntents.length} parked) \u2014 refusing to swap to a bootstrap-only holon`,
+        verified,
+        carried: carried.length,
+        parked: parkedIntents.length,
+        parkedIntents,
+        scarShape
+      };
+    }
+    let packB64 = "";
+    let parkedPackB64 = "";
+    if (verified) {
+      const pack = packDelta(eng, incWs, "", head);
+      if (pack && pack.length) packB64 = b64Bytes(pack);
+      if (parkedTip) {
+        const ppack = packDelta(eng, incWs, head, parkedTip);
+        if (ppack && ppack.length) parkedPackB64 = b64Bytes(ppack);
+        if (!parkedPackB64) {
+          unmount(eng, incWs);
+          return { ok: false, error: "parked intents exist but produced no parked pack \u2014 refusing (parked work must never be lost)", parked: parkedIntents.length };
+        }
+      }
+    }
+    unmount(eng, incWs);
+    if (verified && !packB64) return { ok: false, error: "the incarnation self-verified but produced no pack", verified: true };
+    return {
+      ok: true,
+      packB64,
+      head,
+      genesisOid,
+      verified,
+      ...verified ? {} : { verifyError: verdict && verdict.error || "verify_chain returned invalid" },
+      carried: carried.length,
+      parked: parkedIntents.length,
+      parkedIntents,
+      scarShape,
+      ...parkedTip ? { parkedRef, parkedTip, parkedPackB64 } : {},
+      // rebornFrom = the SUPERSEDED chain's genesis oid (the old ancestry the reborn holon descends
+      // from). Surfaced for the worker's status contract; NOT re-authored IN-CHAIN here (stamping it
+      // onto birthCloud would re-sign the record → the operator key, the CLI lane).
+      rebornFrom: sealed[0].oid,
+      parent,
+      reason,
+      supersededAt
+    };
+  } catch (e) {
+    try {
+      unmount(eng, incWs);
+    } catch {
+    }
+    return { ok: false, error: String(e?.message || e).slice(0, 300) };
+  }
+}
+async function archiveRefusedMain(eng, ws, ledger, label) {
+  unmount(eng, ws);
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (!m.restored) {
+    unmount(eng, ws);
+    return { archived: false, error: "no main to archive" };
+  }
+  const gitdir = gitdirOf(ws);
+  try {
+    await custodyPush(eng, ws, ledger, { localRef: "refs/heads/main", remoteRef: `refs/heads/refused/${label}`, pointer: true });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", del: true });
+    return { archived: true, ref: `refs/heads/refused/${label}` };
+  } finally {
+    unmount(eng, ws);
+  }
+}
+async function writeRefusedRef(eng, ws, dl) {
+  const gitdir = gitdirOf(ws);
+  const blob = dl.blob instanceof Uint8Array ? dl.blob : enc3.encode(String(dl.blob || ""));
+  const refForStamp = refusedRefName(dl.intentId || dl.oid);
+  let parkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
+    if (prevOid) {
+      const prevBytes = kgit.readBlob(eng, gitdir, prevOid, "verdict.usda");
+      const prev = prevBytes ? kgit.inspectDocument(eng, prevBytes) : null;
+      if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
+    }
+  } catch {
+  }
+  const verdict = kgit.encodeDocument(eng, {
+    offerId: dl.intentId || null,
+    oid: dl.oid || null,
+    domain: dl.domain || null,
+    directiveId: dl.directiveId || null,
+    session: dl.session || null,
+    parkedAt,
+    verdict: { reason: String(dl.error || "refused") }
+  });
+  const ref = refusedRefName(dl.intentId || dl.oid);
+  kgit.writeMetaCommit(eng, gitdir, {
+    parents: [],
+    files: [{ path: "change.usda", bytes: blob }, { path: "verdict.usda", bytes: verdict }],
+    message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} \u2014 ${String(dl.error || "").slice(0, 120)}`,
+    timeSecs: 0,
+    ref
+  });
+  return ref;
+}
+async function listRefusedRefs(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  const out2 = [];
+  for (const { ref, oid } of refs) {
+    try {
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.usda") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng, gitdir, oid, "change.usda") ?? new Uint8Array();
+      const v = kgit.inspectDocument(eng, vb);
+      out2.push({ ref, ...v, changeB64: b64Bytes(ib) });
+    } catch {
+    }
+  }
+  return out2;
+}
+async function refusedSummary(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  let count2 = 0, latestParkedAt = null;
+  for (const { oid } of refs) {
+    try {
+      const bytes = kgit.readBlob(eng, gitdir, oid, "verdict.usda");
+      if (!bytes) continue;
+      const v = kgit.inspectDocument(eng, bytes);
+      count2++;
+      if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
+    } catch {
+    }
+  }
+  return { count: count2, latestParkedAt };
+}
+async function materializeRefused(eng, ws, ledger, deadLetters) {
+  const refs = [];
+  const unparkedSessions = /* @__PURE__ */ new Set();
+  for (const dl of deadLetters || []) {
+    try {
+      const ref = await writeRefusedRef(eng, ws, dl);
+      await custodyPush(eng, ws, ledger, { remoteRef: ref });
+      refs.push(ref);
+    } catch (e) {
+      if (dl && dl.session) unparkedSessions.add(dl.session);
+      log("refused-ref-materialize-failed", { ws, intentId: dl?.intentId, error: String(e).slice(0, 200) });
+    }
+  }
+  return { refs, unparkedSessions };
+}
+async function deleteRefusedRef(eng, ws, ledger, offerId) {
+  const gitdir = gitdirOf(ws);
+  const ref = refusedRefName(offerId);
+  try {
+    kgit.deleteRef(eng, gitdir, ref);
+  } catch {
+  }
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+  } catch (e) {
+    log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+  }
+  return ref;
+}
+async function outboxRefExists(eng, ws, requestId) {
+  return !!kgit.resolveRef(eng, gitdirOf(ws), outboxRefName(requestId));
+}
+async function writeOutboxRef(eng, ws, rec) {
+  const gitdir = gitdirOf(ws);
+  const orderBlob = enc3.encode(JSON.stringify(rec.order ?? {}));
+  const delivery = enc3.encode(JSON.stringify({
+    requestId: rec.requestId || null,
+    capability: rec.capability || null,
+    url: rec.url || null,
+    status: rec.status || "delivered",
+    httpStatus: rec.httpStatus ?? null
+  }));
+  const ref = outboxRefName(rec.requestId);
+  kgit.writeMetaCommit(eng, gitdir, {
+    parents: [],
+    files: [{ path: "order.json", bytes: orderBlob }, { path: "delivery.json", bytes: delivery }],
+    message: `outbox: ${rec.capability || "?"} \u2192 ${String(rec.url || "?").slice(0, 80)}`,
+    timeSecs: 0,
+    ref
+  });
+  return ref;
+}
+async function emitOutbox(eng, ws, ledger) {
+  const orders = (() => {
+    try {
+      return reactorScan(eng, ws);
+    } catch {
+      return [];
+    }
+  })();
+  if (!Array.isArray(orders) || orders.length === 0) return { delivered: [], skipped: 0, errors: 0 };
+  const byType = /* @__PURE__ */ new Map();
+  for (const c of declaredCapabilities(eng, ws)) if (c && c.aggregateId) byType.set(c.aggregateId, c);
+  const gitdir = gitdirOf(ws);
+  const delivered = [];
+  let skipped = 0, errors = 0;
+  for (const order of orders) {
+    const cap = byType.get(order.taskType);
+    if (!cap || !cap.endpoint) {
+      skipped++;
+      continue;
+    }
+    if (await outboxRefExists(eng, ws, order.requestId)) {
+      skipped++;
+      continue;
+    }
+    try {
+      const res = await fetch(cap.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-nomos-capability": cap.capability, "x-nomos-workspace": ws },
+        body: JSON.stringify({ capability: cap.capability, requestId: order.requestId, taskType: order.taskType, params: order.params, scheduledAt: order.scheduledAt, deadlineAt: order.deadlineAt }),
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (!res.ok) {
+        errors++;
+        log("outbox-deliver-non2xx", { ws, requestId: order.requestId, url: cap.endpoint, status: res.status });
+        continue;
+      }
+      const ref = await writeOutboxRef(eng, ws, { requestId: order.requestId, capability: cap.capability, url: cap.endpoint, order, status: "delivered", httpStatus: res.status });
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: ref });
+      } catch (e) {
+        log("outbox-ref-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+      }
+      delivered.push(order.requestId);
+    } catch (e) {
+      errors++;
+      log("outbox-deliver-failed", { ws, requestId: order.requestId, url: cap.endpoint, error: String(e).slice(0, 200) });
+    }
+  }
+  if (delivered.length || errors) log("outbox", { ws, delivered: delivered.length, skipped, errors });
+  return { delivered, skipped, errors };
+}
+async function boot(eng, ws, ledger) {
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (nomosActive(eng, ws)) {
+    if (ws !== "root" && !isWarranted(eng, ws)) {
+      throw new Error(
+        `unwarranted-workspace: '${ws}' is booted but its genesis never landed a GenesisWarrant \u2014 an era-0 workspace is born ONLY by its parent's warranted+attested birth. This is a host-authored/legacy orphan and will not serve (author its birth on its parent to bring it into the holarchy lawfully).`
+      );
+    }
+    return { status: "already-initialized", head: m.remoteMain ?? void 0, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+  }
+  throw new Error(
+    `unborn-workspace: '${ws}' has no genesis and the host does not create workspaces \u2014 author its birth on its PARENT (birthChild/birthHome/an estate .births()); the parent's offer-effect materializes it in custody, then it serves from here. (root self-adopts via _ensureRootGenesis; this is not that path.)`
+  );
+}
+function snapshot(eng, ws) {
+  const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
+  return serializeTree(wsDir);
+}
+function stats(eng) {
+  return {
+    mounted: eng.mounted.size,
+    wasmLinearMemMB: +(eng.ex.memory.buffer.byteLength / 1048576).toFixed(1)
+  };
+}
+async function ledgerStats(eng, ws, ledger = null) {
+  const gitdir = gitdirOf(ws);
+  let head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head && ledger?.remote) {
+    try {
+      await custodySkeleton(eng, gitdir);
+      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main", writeRef: false });
+      if (!remoteMain) return { head: null, commits: 0 };
+      kgit.restoreMain(eng, ws, remoteMain);
+      head = kgit.resolveRef(eng, gitdir, BRANCH);
+      const mounted2 = eng.mounted.get(ws);
+      if (mounted2) {
+        mounted2.restored = true;
+        mounted2.remoteMain = remoteMain;
+        mounted2.restoreError = null;
+      }
+    } catch {
+    }
+  }
+  if (!head) return { head: null, commits: 0 };
+  const mounted = eng.mounted.get(ws);
+  if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
+  const commits = kgit.intentsAbove(eng, gitdir, head).length;
+  const out2 = { head, commits };
+  if (mounted) mounted.ledgerStats = out2;
+  return out2;
+}
+async function countRemoteCommits(eng, ledger) {
+  const head = (await custodyLsRefs(ledger, "refs/heads/main"))["refs/heads/main"] || null;
+  if (!head) return { head: null, commits: 0 };
+  const scratch = "__ledgercount__";
+  try {
+    stageWorkspaceDir(eng, scratch);
+    await custodySkeleton(eng, gitdirOf(scratch));
+    await custodyFetch(eng, scratch, ledger, { remoteRef: "refs/heads/main", writeRef: false });
+    const commits = kgit.intentsAbove(eng, gitdirOf(scratch), head).length;
+    return { head, commits };
+  } finally {
+    try {
+      dirOf(eng.preopen.dir.contents.get("ws")).contents.delete(scratch);
+    } catch {
+    }
+  }
+}
+function warmEngine(eng, opts = {}) {
+  flushDeferredProjections(eng);
+  return warmKernelCaches(eng, opts);
+}
+function warmKernelCaches(eng, opts = {}) {
+  const workspace = opts.workspace ?? "root";
+  return namedQueryProto(eng, workspace, QueryOperation.WARM, {
+    ...opts.workspace ? { repoArg: repoArgOf(workspace), workspace, packCustody: true } : {},
+    ...opts.compareStateProjections ? { compareStateProjections: true } : {},
+    ...opts.requestedDomain ? { requestedDomain: opts.requestedDomain } : {},
+    ...opts.requestedDirective ? { requestedDirective: opts.requestedDirective } : {},
+    ...opts.requestedPackage ? { requestedPackage: opts.requestedPackage } : {},
+    ...opts.interactiveOnly ? { interactiveOnly: true } : {}
+  });
+}
+var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, importCustodyObjects, syncCandidate, custodyLsRefs, queryArguments, queryAuthorityOptions, qById, query, queryPage, queryProfile, authorizationAddress, authorizationSubject, currentAuthorizationFrontier, check, expand, cryptoSealField, cryptoOwnedScopeKey, cryptoOwnedDeviceRequest, cryptoOwnedPrepareApproval, cryptoOwnedPrepareRecovery, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats, memoryDropProbe, readiness;
+var init_engine = __esm({
+  "vendor/engine/engine.ts"() {
+    "use strict";
+    init_git_fs();
+    init_tree();
+    init_custody_transport();
+    init_managed_promotion();
+    init_kernel_pb();
+    enc3 = new TextEncoder();
+    dec3 = new TextDecoder();
+    BRANCH = "main";
+    PROTO_ABI_VERSION = 1;
+    protoRequestSequence = 0;
+    RESULT_PACK_INLINE_MAX = 256 * 1024;
+    dirOf = (n) => n;
+    repoArgOf = (ws) => `/work/ws/${ws}`;
+    gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+    unpack = (p) => {
+      const v = BigInt.asUintN(64, typeof p === "bigint" ? p : BigInt(p));
+      return { ptr: Number(v >> 32n & 0xffffffffn), len: Number(v & 0xffffffffn) };
+    };
+    unsignedWasiPointers = (imports) => {
+      const pointerArgs = {
+        args_sizes_get: [0, 1],
+        args_get: [0, 1],
+        environ_sizes_get: [0, 1],
+        environ_get: [0, 1],
+        clock_res_get: [1],
+        clock_time_get: [2],
+        fd_fdstat_get: [1],
+        fd_filestat_get: [1],
+        fd_pread: [1, 4],
+        fd_prestat_get: [1],
+        fd_prestat_dir_name: [1],
+        fd_pwrite: [1, 4],
+        fd_read: [1, 3],
+        fd_readdir: [1, 4],
+        fd_seek: [3],
+        fd_tell: [1],
+        fd_write: [1, 3],
+        path_create_directory: [1],
+        path_filestat_get: [2, 4],
+        path_filestat_set_times: [2],
+        path_link: [2, 5],
+        path_open: [2, 8],
+        path_readlink: [1, 3, 5],
+        path_remove_directory: [1],
+        path_rename: [1, 4],
+        path_symlink: [0, 3],
+        path_unlink_file: [1],
+        poll_oneoff: [0, 1],
+        random_get: [0]
+      };
+      for (const [name, indexes] of Object.entries(pointerArgs)) {
+        const original = imports[name];
+        if (typeof original !== "function") continue;
+        imports[name] = (...args) => {
+          for (const index of indexes) args[index] = args[index] >>> 0;
+          return original(...args);
+        };
+      }
+      return imports;
+    };
+    log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
+    protoTarget = (ws = "root", branch = BRANCH) => create(WorkspaceTargetSchema, {
+      repo: repoArgOf(ws),
+      workspace: ws,
+      branch
+    });
+    protoAuthority = (principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => create(QueryAuthoritySchema, {
+      principalClaim: principal,
+      authToken: authToken ? enc3.encode(authToken) : new Uint8Array(),
+      nowUnix: BigInt(nowUnix),
+      authorSecret: authorSecret ? bytesFromB64(authorSecret) : new Uint8Array(),
+      keys: keys.map((key) => create(InjectedKeySchema, {
+        scope: key.scope,
+        epoch: BigInt(key.epoch),
+        key: bytesFromB64(key.key)
+      }))
+    });
+    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    kgit = {
+      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+      resolveRef: (eng, gitdir, ref) => custodyProtoCase(eng, {
+        case: "resolveRef",
+        value: create(ResolveRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref })
+      }, "resolveRef").oid ?? "",
+      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+      readBlob: (eng, gitdir, oid, path) => {
+        const result = custodyProtoCase(eng, {
+          case: "readBlob",
+          value: create(ReadBlobRequestSchema, { repo: repoArgOfGitdir(gitdir), oid, path })
+        }, "readBlob");
+        return result.found ? result.blob : null;
+      },
+      // intentsAbove → [{ oid, changeB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0, completeLogical = false) => custodyProtoCase(eng, {
+        case: "intentsAbove",
+        value: create(IntentsAboveRequestSchema, {
+          repo: repoArgOfGitdir(gitdir),
+          head: head || void 0,
+          base: base || void 0,
+          branch: BRANCH,
+          limit: BigInt(limit),
+          completeLogical
+        })
+      }, "intentsAbove").intents.map((intent) => ({
+        oid: intent.oid,
+        id: intent.intentId,
+        domain: intent.domain,
+        directiveId: intent.directive,
+        changeB64: b64Bytes(intent.changeUsda),
+        intent: jsStruct(intent.semantic)
+      })),
+      // inspectChange → compact semantic view decoded by the kernel; the adapter never parses USDA.
+      inspectChange: (eng, bytes) => jsStruct(custodyProtoCase(eng, {
+        case: "inspectChange",
+        value: create(InspectChangeRequestSchema, { changeUsda: bytes })
+      }, "inspectChange").semantic),
+      // Open structured custody sidecars are USDA too. The kernel owns their syntax and validation;
+      // the adapter only relays transient values and opaque bytes.
+      encodeDocument: (eng, value) => custodyProtoCase(eng, {
+        case: "encodeDocument",
+        value: create(EncodeDocumentRequestSchema, { document: protoValue(value) })
+      }, "encodeDocument").documentUsda,
+      inspectDocument: (eng, bytes) => jsValue(custodyProtoCase(eng, {
+        case: "inspectDocument",
+        value: create(InspectDocumentRequestSchema, { documentUsda: bytes })
+      }, "inspectDocument").document),
+      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+      listRefs: (eng, gitdir, prefix) => custodyProtoCase(eng, {
+        case: "listRefs",
+        value: create(ListRefsRequestSchema, { repo: repoArgOfGitdir(gitdir), prefix })
+      }, "listRefs").refs.map(({ reference, oid }) => ({ ref: reference, oid })),
+      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+      writeRef: (eng, gitdir, ref, value) => {
+        custodyProtoCase(eng, {
+          case: "writeRef",
+          value: create(WriteRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref, target: value })
+        }, "writeRef");
+        return { ok: true };
+      },
+      // restoreMain → promote already-imported custody only after the kernel re-admits the complete chain.
+      // Unlike writeRef this is allowed to establish an absent main; it can never advance an existing one.
+      restoreMain: (eng, ws, head) => custodyProtoCase(eng, {
+        case: "restoreMain",
+        value: create(RestoreMainRequestSchema, {
+          target: create(WorkspaceTargetSchema, { repo: repoArgOf(ws), workspace: ws, branch: BRANCH }),
+          head
+        })
+      }, "restoreMain"),
+      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+      deleteRef: (eng, gitdir, ref) => {
+        custodyProtoCase(eng, {
+          case: "deleteRef",
+          value: create(DeleteRefRequestSchema, { repo: repoArgOfGitdir(gitdir), reference: ref })
+        }, "deleteRef");
+        return { ok: true };
+      },
+      // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
+      applyPack: (eng, ws, packBytes) => applyPackInto(eng, ws, packBytes),
+      // repoStats → kernel-owned physical custody accounting (host never walks Git's loose/pack layout).
+      repoStats: (eng, ws) => {
+        const stats2 = custodyProtoCase(eng, {
+          case: "repoStats",
+          value: create(RepoStatsRequestSchema, { repo: repoArgOf(ws) })
+        }, "repoStats");
+        return {
+          ok: true,
+          totalBytes: Number(stats2.totalBytes),
+          objectBytes: Number(stats2.objectBytes),
+          looseObjects: Number(stats2.looseObjects),
+          looseBytes: Number(stats2.looseBytes),
+          packFiles: Number(stats2.packFiles),
+          packBytes: Number(stats2.packBytes),
+          indexBytes: Number(stats2.indexBytes)
+        };
+      },
+      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => custodyProtoCase(eng, {
+        case: "writeMetaCommit",
+        value: create(WriteMetaCommitRequestSchema, {
+          repo: repoArgOfGitdir(gitdir),
+          parents,
+          files: files.map((file) => ({ path: file.path, content: file.bytes })),
+          message,
+          timeSeconds: BigInt(timeSecs),
+          reference: ref || void 0
+        })
+      }, "writeMetaCommit").oid
+    };
+    closureInstallPayload = (hash, installedBy, options = {}) => ({
+      domainHash: hash,
+      installedBy,
+      dependencies: [],
+      ...options.supersedes ? { supersedes: options.supersedes } : {},
+      ...options.dispositions ? { dispositions: options.dispositions } : {},
+      finalizers: []
+    });
+    routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
+    SUMMARY_SEP = "";
+    summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
+    splitSummaryKey = (key) => {
+      const i = key.indexOf(SUMMARY_SEP);
+      return [key.slice(0, i), key.slice(i + 1)];
+    };
+    NOMOS_SHARD_ROWS_READ = "nomosShardRows";
+    groupOf = (read, data) => {
+      if (read.by === null) return "";
+      const v = data ? data[read.by] : void 0;
+      return v === void 0 || v === null ? void 0 : String(v);
+    };
+    tallyOf = (eng, ws, read, group) => read.kind === "count" ? count(eng, ws, read.id, group).count : read.kind === "sum" ? sum(eng, ws, read.id, group).sum : extremum(eng, ws, read.id, read.kind, group).value;
+    isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
+    extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
+    CKPT_REF = (lawHash) => `refs/meta/checkpoint/${lawHash}`;
+    pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
+    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+    applyPackInto = (eng, ws, pack, head = null) => {
+      if (!pack || !pack.length) return;
+      custodyProtoCase(eng, {
+        case: "applyPack",
+        value: create(ApplyPackRequestSchema, {
+          repo: repoArgOf(ws),
+          source: { case: "pack", value: pack },
+          head: head || void 0
+        })
+      }, "applyPack");
+    };
+    importCustodyObjects = (eng, ws, pack, head) => applyPackInto(eng, ws, pack, head);
+    syncCandidate = (eng, ws, fromBase, toHead) => (() => {
+      const response = callProto(eng.ex, {
+        case: "sync",
+        value: create(SyncRequestSchema, { target: protoTarget(ws), fromBase, toHead })
+      }, eng.STDERR);
+      if (response.outcome.case !== "sync") {
+        throw new Error(`kernel returned ${response.outcome.case || "empty"} for sync request`);
+      }
+      return jsStruct(response.outcome.value.result);
+    })();
+    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+    queryArguments = (paramsJson) => {
+      const value = JSON.parse(paramsJson || "{}");
+      if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("query arguments must be a JSON object");
+      }
+      return value;
+    };
+    queryAuthorityOptions = (principal, keys, authToken, nowUnix, authorSecret) => ({ principal, keys, authToken, nowUnix, authorSecret });
+    qById = (eng, ws, id, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "byId",
+      value: create(ByIdQuerySchema, { aggregateId: id, principal })
+    }, queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "rows",
+      value: create(RowsQuerySchema, { id: queryId, arguments: protoStruct(queryArguments(paramsJson)), principal })
+    }, queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret));
+    queryPage = (eng, ws, queryId, paramsJson, page = {}, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "page",
+      value: create(PageQuerySchema, {
+        id: queryId,
+        arguments: protoStruct(queryArguments(paramsJson)),
+        limit: page.pageSize ?? 100,
+        after: page.cursor ?? "",
+        principal
+      })
+    }, queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret));
+    queryProfile = (eng, ws, queryId, paramsJson, principal = "", keys = [], authToken = "", nowUnix = 0, authorSecret = "") => {
+      const value = applicationQueryProto(eng, ws, {
+        case: "rows",
+        value: create(RowsQuerySchema, { id: queryId, arguments: protoStruct(queryArguments(paramsJson)), principal })
+      }, { ...queryAuthorityOptions(principal, keys, authToken, nowUnix, authorSecret), spans: true });
+      const profile = namedQueryProto(eng, ws, QueryOperation.DEVELOPER_SPANS);
+      return { ok: true, value, kernelSpans: profile.kernelSpans };
+    };
+    authorizationAddress = (address) => {
+      const colon = address.indexOf(":");
+      if (colon <= 0 || colon === address.length - 1) throw new Error(`invalid authorization address '${address}'`);
+      return { type: address.slice(0, colon), id: address.slice(colon + 1) };
+    };
+    authorizationSubject = (address) => {
+      const hash = address.lastIndexOf("#");
+      const object = authorizationAddress(hash < 0 ? address : address.slice(0, hash));
+      return create(AuthorizationSubjectSchema, {
+        ...object,
+        relation: hash < 0 ? void 0 : address.slice(hash + 1)
+      });
+    };
+    currentAuthorizationFrontier = () => create(AuthorizationConsistencySchema, {
+      requirement: { case: "currentVerifiedFrontier", value: true }
+    });
+    check = (eng, ws, object, relation, subject) => {
+      const response = callProto(eng.ex, {
+        case: "query",
+        value: create(QueryRequestSchema, {
+          target: protoTarget(ws),
+          query: {
+            case: "authorizationCheck",
+            value: create(AuthorizationCheckRequestSchema, {
+              resource: create(AuthorizationObjectSchema, authorizationAddress(object)),
+              permission: relation,
+              subject: authorizationSubject(subject),
+              consistency: currentAuthorizationFrontier()
+            })
+          }
+        })
+      }, eng.STDERR);
+      if (response.outcome.case !== "query" || response.outcome.value.result.case !== "authorizationCheck") {
+        throw new Error(`kernel returned ${response.outcome.case || "empty"} for authorization check`);
+      }
+      return { ok: true, allowed: response.outcome.value.result.value.allowed, basis: response.outcome.value.result.value.basis };
+    };
+    expand = (eng, ws, object, relation) => {
+      const response = callProto(eng.ex, {
+        case: "query",
+        value: create(QueryRequestSchema, {
+          target: protoTarget(ws),
+          query: {
+            case: "authorizationExpand",
+            value: create(AuthorizationExpandRequestSchema, {
+              resource: create(AuthorizationObjectSchema, authorizationAddress(object)),
+              permission: relation,
+              consistency: currentAuthorizationFrontier(),
+              limit: 1e4
+            })
+          }
+        })
+      }, eng.STDERR);
+      if (response.outcome.case !== "query" || response.outcome.value.result.case !== "authorizationExpand") {
+        throw new Error(`kernel returned ${response.outcome.case || "empty"} for authorization expand`);
+      }
+      return {
+        ok: true,
+        subjects: response.outcome.value.result.value.subjects.map((value) => `${value.type}:${value.id}${value.relation ? `#${value.relation}` : ""}`),
+        basis: response.outcome.value.result.value.basis,
+        next: response.outcome.value.result.value.next
+      };
+    };
+    cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_SEAL_FIELD, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }).envelope;
+    cryptoOwnedScopeKey = (eng, workspace, authorSecret, scope, principal = "", requireSeat = true, record, recordEpoch = 0, recordWrap) => {
+      const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
+      const derived = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
+        custodyWorkspace: workspace,
+        principal,
+        authorSecret,
+        scope,
+        ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+        ...recordWrap === void 0 ? {} : { recordWrap }
+      });
+      const ownedKeySubject = String(derived.ownedKeySubject || "");
+      if (!requireSeat) {
+        return {
+          scope: String(derived.scope || scope),
+          epoch: Number(derived.epoch) || 0,
+          key: String(derived.scopeKey || ""),
+          ownedKeySubject,
+          ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+          keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+          principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+        };
+      }
+      if (principal) {
+        let hex = "";
+        for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
+        const object = `nomos-owned-principal:${hex || "00"}`;
+        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
+        const leaves = row?.data?.subjects ?? row?.subjects ?? {};
+        const leaf = (raw) => {
+          if (raw && typeof raw === "object") return raw;
+          try {
+            return typeof raw === "string" ? JSON.parse(raw) : {};
+          } catch {
+            return {};
+          }
+        };
+        const active = Object.entries(leaves).filter(([, raw]) => leaf(raw).status === "active").map(([subject]) => subject);
+        if (active.length === 0 && Object.keys(leaves).length === 0) {
+          return {
+            scope: String(derived.scope || scope),
+            epoch: Number(derived.epoch) || 0,
+            key: String(derived.scopeKey || ""),
+            ownedKeySubject,
+            ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+            keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+            principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+          };
+        }
+        if (!active.includes(ownedKeySubject)) {
+          throw new Error(
+            "this device is waiting for approval \u2014 approve its opaque request on an already-working device"
+          );
+        }
+        const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
+        if (!custody) throw new Error("the approved device has no owned-data handoff");
+        const opened = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
+          workspace,
+          principal,
+          authorSecret,
+          scope,
+          ownedCustody: custody,
+          ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
+          ...recordWrap === void 0 ? {} : { recordWrap }
+        });
+        return {
+          scope: String(opened.scope || scope),
+          epoch: Number(opened.epoch) || 0,
+          key: String(opened.scopeKey || ""),
+          ownedKeySubject,
+          keyCommitment: typeof opened.keyCommitment === "string" ? opened.keyCommitment : void 0,
+          principalWrappingPublic: typeof opened.principalWrappingPublic === "string" ? opened.principalWrappingPublic : void 0
+        };
+      }
+      return {
+        scope: String(derived.scope || scope),
+        epoch: Number(derived.epoch) || 0,
+        key: String(derived.scopeKey || ""),
+        ownedKeySubject,
+        ownedCustody: typeof derived.ownedCustody === "string" ? derived.ownedCustody : void 0,
+        keyCommitment: typeof derived.keyCommitment === "string" ? derived.keyCommitment : void 0,
+        principalWrappingPublic: typeof derived.principalWrappingPublic === "string" ? derived.principalWrappingPublic : void 0
+      };
+    };
+    cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
+      workspace,
+      principal,
+      authorSecret,
+      scope
+    }).request || "");
+    cryptoOwnedPrepareApproval = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_APPROVAL, args);
+    cryptoOwnedPrepareRecovery = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_RECOVERY, args);
+    cryptoKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_KEYGEN);
+    authorKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation.AUTHOR_KEYGEN);
+    eraCertSign = (eng, args) => namedQueryProto(eng, "root", QueryOperation.ERA_CERT_SIGN, args);
+    delegationCertSign = (eng, { secret, grantorId, relation, subject, epoch, certChain }) => namedQueryProto(eng, "root", QueryOperation.DELEGATION_CERT_SIGN, { secret, grantorId, relation, subject, epoch, ...certChain ? { certChain } : {} });
+    attestationSign = (eng, { secret, asserterWorkspace, object, relation, subject, attestedAt }) => namedQueryProto(eng, asserterWorkspace, QueryOperation.ATTESTATION_SIGN, { secret, asserterWorkspace, object, relation, subject, attestedAt });
+    certSign = (eng, {
+      child,
+      founder,
+      verified,
+      parentKey,
+      parentId,
+      epoch,
+      secret,
+      verifiedVia,
+      idpToken,
+      capturedClock,
+      authProviderIssuer,
+      authProviderJwks,
+      authProviderAudience
+    }) => namedQueryProto(eng, "root", QueryOperation.CERT_SIGN, {
+      child,
+      founder,
+      verified,
+      parentKey,
+      parentId,
+      epoch,
+      secret,
+      // forwarded only when present (the op reads them optionally; absent ⇒ classic cert bytes).
+      ...verifiedVia !== void 0 ? { verifiedVia } : {},
+      ...idpToken !== void 0 ? { idpToken } : {},
+      ...capturedClock !== void 0 ? { capturedClock } : {},
+      ...authProviderIssuer !== void 0 ? { authProviderIssuer } : {},
+      ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
+      ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
+    }).cert;
+    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+    cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
+    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.READ_POSTURE,
+      {},
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    count = (eng, ws, countId, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "count",
+      value: create(TallyQuerySchema, { id: countId, arguments: protoStruct({ groupKey: groupKey ?? null }), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    sum = (eng, ws, sumId, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "sum",
+      value: create(TallyQuerySchema, { id: sumId, arguments: protoStruct({ groupKey: groupKey ?? null }), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    pendingConflicts = (eng, ws, principal = "", aggregateType = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.PENDING_CONFLICTS,
+      { aggregateType },
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    pendingConflictSummary = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.PENDING_CONFLICT_SUMMARY,
+      {},
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    spatialBboxParams = (bbox) => {
+      const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
+      return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
+    };
+    spatialWithin = (eng, ws, spatialId, bbox, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => applicationQueryProto(eng, ws, {
+      case: "spatial",
+      value: create(SpatialQuerySchema, { id: spatialId, arguments: protoStruct(spatialBboxParams(bbox)), principal })
+    }, queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret));
+    extremum = (eng, ws, extremumId, kind, groupKey, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
+      eng,
+      ws,
+      QueryOperation.EXTREMUM,
+      { extremumId, kind, groupKey: groupKey ?? "" },
+      queryAuthorityOptions(principal, [], authToken, nowUnix, authorSecret)
+    );
+    nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
+    refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+    outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+    GENESIS_WARRANT_ID = "genesis-warrant:self";
+    isWarranted = (eng, ws) => qById(eng, ws, GENESIS_WARRANT_ID).length > 0;
+    projectionStats = (eng, ws) => namedQueryProto(eng, ws || "root", QueryOperation.PROJECTION_STATS);
+    memoryDropProbe = (eng, ws) => namedQueryProto(eng, ws, QueryOperation.MEMORY_DROP_PROBE);
+    readiness = (eng, ws) => namedQueryProto(eng, ws, QueryOperation.READINESS);
+  }
+});
+
+// src/local_holon.ts
+var local_holon_exports = {};
+__export(local_holon_exports, {
+  fetchRuntime: () => fetchRuntime,
+  holonEngine: () => holonEngine,
+  inspectLawArchive: () => inspectLawArchive,
+  mountFresh: () => mountFresh,
+  printVerdict: () => printVerdict,
+  readLawArchive: () => readLawArchive,
+  readTreeFromDisk: () => readTreeFromDisk,
+  refreshRuntimeDir: () => refreshRuntimeDir,
+  sealedIntentOf: () => sealedIntentOf,
+  selectedRuntimeDir: () => selectedRuntimeDir,
+  writeTreeToDisk: () => writeTreeToDisk
+});
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join as join2, resolve } from "node:path";
+import { File as File2, Directory as Directory2 } from "@bjorn3/browser_wasi_shim";
+async function fetchBytesCached(url, cacheFile) {
+  try {
+    const r = await fetch(url);
+    if (!r.ok) throw new Error(`${url} \u2192 ${r.status}`);
+    const bytes = new Uint8Array(await r.arrayBuffer());
+    mkdirSync(dirname(cacheFile), { recursive: true });
+    writeFileSync(cacheFile, bytes);
+    return bytes;
+  } catch (e) {
+    if (existsSync(cacheFile)) return new Uint8Array(readFileSync(cacheFile));
+    throw e;
+  }
+}
+function selectedRuntimeDir() {
+  return process.env["NOMOS_CANDIDATE_RUNTIME"] || process.env["NOMOS_OFFLINE_RUNTIME"] || join2(configDir(), "runtime");
+}
+async function fetchRuntime(cloud, kind = "production") {
+  const cache = selectedRuntimeDir();
+  let wasmBytes;
+  const wasmName = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmUrl = kind === "test-mint" ? "holon-testmint.wasm" : "holon.wasm";
+  const wasmCache = join2(cache, wasmName);
+  const bootstrapCache = join2(cache, "bootstrap.law.usdz");
+  const nomosCache = join2(cache, "nomos.law.usdz");
+  const refresh = String(
+    process.env["NOMOS_RUNTIME_REFRESH"] || (process.env["NOMOS_CANDIDATE_RUNTIME"] ? "never" : "auto")
+  ).toLowerCase();
+  if (refresh === "never") {
+    if (!existsSync(wasmCache) || !existsSync(bootstrapCache) || !existsSync(nomosCache)) {
+      throw new Error(
+        `offline runtime cache missing at ${cache} (${wasmName} + bootstrap.law.usdz + nomos.law.usdz); build or warm that exact runtime before running with NOMOS_RUNTIME_REFRESH=never`
+      );
+    }
+    return {
+      wasmBytes: new Uint8Array(readFileSync(wasmCache)),
+      bootstrapLawUsdz: new Uint8Array(readFileSync(bootstrapCache)),
+      nomosLawUsdz: new Uint8Array(readFileSync(nomosCache))
+    };
+  }
+  const localWasm = process.env["NOMOS_LOCAL_WASM"];
+  if (localWasm) {
+    const bytes = new Uint8Array(readFileSync(localWasm));
+    const [bootstrapLawUsdz2, nomosLawUsdz2] = await Promise.all([
+      fetchBytesCached(`${cloud}/v1/runtime/bootstrap.law.usdz`, bootstrapCache),
+      fetchBytesCached(`${cloud}/v1/runtime/nomos.law.usdz`, nomosCache)
+    ]);
+    return { wasmBytes: bytes, bootstrapLawUsdz: bootstrapLawUsdz2, nomosLawUsdz: nomosLawUsdz2 };
+  }
+  try {
+    const r = await fetch(`${cloud}/v1/runtime/${wasmUrl}`);
+    if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
+    wasmBytes = new Uint8Array(await r.arrayBuffer());
+    mkdirSync(cache, { recursive: true });
+    writeFileSync(wasmCache, wasmBytes);
+  } catch (e) {
+    if (!existsSync(wasmCache)) throw e;
+    wasmBytes = new Uint8Array(readFileSync(wasmCache));
+  }
+  const [bootstrapLawUsdz, nomosLawUsdz] = await Promise.all([
+    fetchBytesCached(`${cloud}/v1/runtime/bootstrap.law.usdz`, bootstrapCache),
+    fetchBytesCached(`${cloud}/v1/runtime/nomos.law.usdz`, nomosCache)
+  ]);
+  return { wasmBytes, bootstrapLawUsdz, nomosLawUsdz };
+}
+function atomicWriteRuntime(target, data) {
+  const tmp = `${target}.tmp-${Math.random().toString(16).slice(2)}${Math.random().toString(16).slice(2)}`;
+  writeFileSync(tmp, data);
+  renameSync(tmp, target);
+}
+function runtimeDirIsWarm(runtimeDir) {
+  try {
+    const w = statSync(join2(runtimeDir, "holon.wasm")).mtimeMs;
+    const t = statSync(join2(runtimeDir, "holon-testmint.wasm")).mtimeMs;
+    const b = statSync(join2(runtimeDir, "bootstrap.law.usdz")).mtimeMs;
+    const n = statSync(join2(runtimeDir, "nomos.law.usdz")).mtimeMs;
+    return Date.now() - Math.min(w, t, b, n) < RUNTIME_FRESH_MS;
+  } catch {
+    return false;
+  }
+}
+async function refreshRuntimeDir(cloud, runtimeDir) {
+  const candidate = process.env["NOMOS_CANDIDATE_RUNTIME"];
+  if (candidate && resolve(runtimeDir) === resolve(candidate)) return false;
+  const mode = String(process.env["NOMOS_RUNTIME_REFRESH"] || "auto").toLowerCase();
+  if (mode === "never") return false;
+  if (mode !== "always") {
+    if (_refreshedDirsThisProcess.has(runtimeDir)) return false;
+    if (runtimeDirIsWarm(runtimeDir)) return false;
+  }
+  try {
+    const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
+    if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
+    const wasmBytes = new Uint8Array(await r.arrayBuffer());
+    const testmint = await fetch(`${cloud}/v1/runtime/holon-testmint.wasm`);
+    if (!testmint.ok) throw new Error(`test-mint runtime wasm \u2192 ${testmint.status}`);
+    const testmintBytes = new Uint8Array(await testmint.arrayBuffer());
+    const bootstrap = await fetch(`${cloud}/v1/runtime/bootstrap.law.usdz`);
+    if (!bootstrap.ok) throw new Error(`bootstrap law \u2192 ${bootstrap.status}`);
+    const bootstrapBytes = new Uint8Array(await bootstrap.arrayBuffer());
+    const nomos = await fetch(`${cloud}/v1/runtime/nomos.law.usdz`);
+    if (!nomos.ok) throw new Error(`Nomos law \u2192 ${nomos.status}`);
+    const nomosBytes = new Uint8Array(await nomos.arrayBuffer());
+    mkdirSync(runtimeDir, { recursive: true });
+    atomicWriteRuntime(join2(runtimeDir, "holon.wasm"), wasmBytes);
+    atomicWriteRuntime(join2(runtimeDir, "holon-testmint.wasm"), testmintBytes);
+    atomicWriteRuntime(join2(runtimeDir, "bootstrap.law.usdz"), bootstrapBytes);
+    atomicWriteRuntime(join2(runtimeDir, "nomos.law.usdz"), nomosBytes);
+    _refreshedDirsThisProcess.add(runtimeDir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readLawArchive(lawUsdzFile) {
+  if (!lawUsdzFile.endsWith(".law.usdz")) {
+    throw new Error(`${lawUsdzFile} is not a canonical .law.usdz archive`);
+  }
+  if (!existsSync(lawUsdzFile)) {
+    throw new Error(`law archive not found: ${lawUsdzFile} \u2014 run \`githolon compile\` first`);
+  }
+  const bytes = new Uint8Array(readFileSync(lawUsdzFile));
+  if (bytes.byteLength < 4 || bytes[0] !== 80 || bytes[1] !== 75 || bytes[2] !== 3 || bytes[3] !== 4) {
+    throw new Error(`${lawUsdzFile} is not a USDZ ZIP archive`);
+  }
+  return bytes;
+}
+function inspectLawArchive(eng, lawUsdzFile) {
+  const lawUsdz = readLawArchive(lawUsdzFile);
+  const staged = stageLawClosure(eng, lawUsdz, lawUsdzFile.split(/[\\/]/).pop() ?? "candidate-law");
+  if (!/^[0-9a-f]{64}$/.test(staged.identity)) {
+    throw new Error(`kernel returned invalid law closure identity for ${lawUsdzFile}`);
+  }
+  return {
+    identity: staged.identity,
+    domainKeys: staged.domainKeys,
+    rootLogicalPath: staged.rootLogicalPath,
+    assetCount: staged.assetCount,
+    primCount: staged.primCount,
+    lawUsdz
+  };
+}
+function writeTreeToDisk(dir, diskPath) {
+  mkdirSync(diskPath, { recursive: true });
+  for (const [name, inode] of dir.contents) {
+    const p = join2(diskPath, name);
+    if (inode.contents instanceof Map) writeTreeToDisk(inode, p);
+    else writeFileSync(p, inode.data ?? new Uint8Array(0));
+  }
+}
+function readTreeFromDisk(diskPath) {
+  const contents = /* @__PURE__ */ new Map();
+  for (const name of readdirSync(diskPath)) {
+    const p = join2(diskPath, name);
+    if (statSync(p).isDirectory()) contents.set(name, readTreeFromDisk(p));
+    else contents.set(name, new File2(readFileSync(p)));
+  }
+  return new Directory2(contents);
+}
+async function holonEngine(cloud, installedBy, runtimeKind = "production", suppliedRuntime) {
+  const runtime = suppliedRuntime ?? await fetchRuntime(cloud, runtimeKind);
+  const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
+  const eng = await createEngine({
+    wasmModule: await WebAssembly.compile(runtime.wasmBytes),
+    bootstrapLawUsdz: runtime.bootstrapLawUsdz,
+    nomosLawUsdz: runtime.nomosLawUsdz,
+    replica,
+    installedBy
+  });
+  return { eng, runtime };
+}
+async function mountFresh(eng, ws) {
+  await mountWorkspace(eng, ws, { remote: "https://unborn.invalid/", headers: {} });
+}
+function sealedIntentOf(eng, ws, res) {
+  if (typeof res.intentOut !== "string") return void 0;
+  const f = eng.preopen.dir.contents.get("ws").contents.get(ws)?.contents.get(res.intentOut);
+  if (f === void 0 || !(f.data instanceof Uint8Array)) return void 0;
+  try {
+    return kgit.inspectChange(eng, f.data);
+  } catch {
+    return void 0;
+  }
+}
+function printVerdict(v) {
+  if (v["valid"] === true) {
+    out(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    return true;
+  }
+  err(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  return false;
+}
+var out, err, RUNTIME_FRESH_MS, _refreshedDirsThisProcess;
+var init_local_holon = __esm({
+  "src/local_holon.ts"() {
+    "use strict";
+    init_engine();
+    init_cloud();
+    out = (s) => void process.stdout.write(s + "\n");
+    err = (s) => void process.stderr.write("error: " + s + "\n");
+    RUNTIME_FRESH_MS = 15 * 60 * 1e3;
+    _refreshedDirsThisProcess = /* @__PURE__ */ new Set();
+  }
+});
+
+// src/compile_mountability_entry.ts
+init_cloud();
+
+// src/mountability.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync } from "node:fs";
+import { join as join3 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readKeyProofUsda, writeKeyProofUsda } from "@githolon/dsl/compile-proof";
+async function assertCompiledMountable(cwd, cloud) {
+  const buildDir = join3(cwd, "build");
+  if (!existsSync2(buildDir)) return { ok: true, checked: [] };
+  const laws = readdirSync2(buildDir).filter((f) => f.endsWith(".law.usdz"));
+  if (laws.length === 0) return { ok: true, checked: [] };
+  let mount;
+  let engine;
+  try {
+    mount = await Promise.resolve().then(() => (init_local_holon(), local_holon_exports));
+    engine = await Promise.resolve().then(() => (init_engine(), engine_exports));
+  } catch {
+    return { ok: true, checked: [], skipped: "the vendored kernel engine is not present \u2014 mountability gate skipped (compile still emitted the package)" };
+  }
+  const { fetchRuntime: fetchRuntime2, holonEngine: holonEngine2, inspectLawArchive: inspectLawArchive2, mountFresh: mountFresh2 } = mount;
+  const { author: author2, closureInstallPayload: closureInstallPayload2 } = engine;
+  const candidates = [];
+  for (const f of laws) {
+    const lawUsdzFile = join3(buildDir, f);
+    candidates.push({
+      lawUsdz: new Uint8Array(readFileSync2(lawUsdzFile)),
+      lawUsdzFile,
+      name: f.replace(/\.law\.usdz$/, "")
+    });
+  }
+  if (candidates.length === 0) return { ok: true, checked: [] };
+  const runtime = await fetchRuntime2(cloud);
+  const proofHash = createHash("sha256").update("nomos.mountability-proof.v1\0").update(readFileSync2(fileURLToPath(import.meta.url))).update(runtime.wasmBytes).update(runtime.bootstrapLawUsdz).update(runtime.nomosLawUsdz);
+  for (const candidate of candidates) {
+    proofHash.update("\0").update(candidate.name).update("\0").update(candidate.lawUsdz);
+  }
+  const proofKey = proofHash.digest("hex");
+  const proofPath = join3(buildDir, ".nomos-mountability-proof.usda");
+  const retiredJsonProof = join3(buildDir, ".nomos-mountability-proof.json");
+  if (existsSync2(retiredJsonProof)) {
+    rmSync(retiredJsonProof, { force: true });
+  }
+  if (readKeyProofUsda(proofPath, "nomos.mountability-proof.v1") === proofKey) {
+    return { ok: true, checked: candidates.map((candidate) => candidate.name), cached: true };
+  }
+  const checked = [];
+  for (const { lawUsdzFile, name } of candidates) {
+    const ws = `mountcheck-${name}`.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 100);
+    try {
+      const { eng } = await holonEngine2(cloud, `${ws}-eng`, "production", runtime);
+      const { identity, lawUsdz } = inspectLawArchive2(eng, lawUsdzFile);
+      await mountFresh2(eng, ws);
+      const framework = author2(
+        eng,
+        ws,
+        "bootstrap",
+        "installDomain",
+        closureInstallPayload2(eng.hashes.nomos, `${ws}-eng`),
+        "",
+        { lawUsdz: eng.nomosLawUsdz }
+      );
+      if (framework && framework.ok === false) {
+        return {
+          ok: false,
+          checked,
+          error: `${name}: incoherent runtime bundle \u2014 the selected kernel refused its bundled Nomos framework law before tenant law was mounted: ${framework.error ?? "framework install refused"}`
+        };
+      }
+      const r = author2(
+        eng,
+        ws,
+        "nomos",
+        "installDomain",
+        {
+          domainHash: identity,
+          installedBy: `${ws}-eng`,
+          dependencies: [],
+          finalizers: []
+        },
+        eng.hashes.nomos,
+        { lawUsdz }
+      );
+      if (r && r.ok === false) {
+        return { ok: false, checked, error: `${name}: the read router REFUSED the compiled law at mount \u2014 ${r.error ?? "install refused"}` };
+      }
+      checked.push(name);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return { ok: false, checked, error: `${name}: the compiled package is NOT mountable on the real kernel \u2014 ${msg}` };
+    }
+  }
+  writeKeyProofUsda(proofPath, "nomos.mountability-proof.v1", proofKey);
+  return { ok: true, checked };
+}
+
+// src/compile_mountability_entry.ts
+async function assertPublicCompileMountable(cwd) {
+  return assertCompiledMountable(cwd, cloudBase());
+}
+export {
+  assertPublicCompileMountable
+};