githolon 0.105.13 → 0.105.14

package/dist/full-cli.mjs

@@ -1055,9 +1055,9 @@ function activityKey(kind, slot) {
   return `activity.${kind}.${slot}`;
 }
 function templateVars(template) {
-  const out13 = [];
-  for (const m of template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)) out13.push(m[1]);
-  return out13;
+  const out14 = [];
+  for (const m of template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)) out14.push(m[1]);
+  return out14;
 }
 function payloadFieldNames(schema) {
   const def = schema?._def ?? schema?.def;
@@ -2987,15 +2987,15 @@ var init_git_fs = __esm({
 });
 
 // ../cloud/web-client/src/_adapter/tree.ts
-function flatten(dir, prefix, out13) {
+function flatten(dir, prefix, out14) {
   const children = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
   for (const [name, inode] of children) {
     const path2 = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
-      out13.push({ path: path2, dir: true });
-      flatten(inode, path2, out13);
+      out14.push({ path: path2, dir: true });
+      flatten(inode, path2, out14);
     } else {
-      out13.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+      out14.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
     }
   }
 }
@@ -3018,13 +3018,13 @@ function serializeTree(workTree) {
   }
   let total = 0;
   for (const c of chunks) total += c.length;
-  const out13 = new Uint8Array(total);
+  const out14 = new Uint8Array(total);
   let off = 0;
   for (const c of chunks) {
-    out13.set(c, off);
+    out14.set(c, off);
     off += c.length;
   }
-  return out13;
+  return out14;
 }
 function deserializeTree(bytes, { File: File4, Directory: Directory4 }) {
   const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
@@ -4280,13 +4280,13 @@ var init_kernel_provider_wasm = __esm({
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out13 = new Uint8Array(n);
+  const out14 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out13.set(c, o);
+    out14.set(c, o);
     o += c.length;
   }
-  return out13;
+  return out14;
 }
 function pkt(payload) {
   const body = typeof payload === "string" ? enc3.encode(payload) : payload;
@@ -4490,7 +4490,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -4506,7 +4506,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -4593,7 +4592,7 @@ function compatible(client, workspace) {
   return { ok: missing.length === 0 && incompatible.length === 0, missing, incompatible };
 }
 function memberVerdicts(client, workspace) {
-  const out13 = {};
+  const out14 = {};
   const cDirs = client && client.directives || {};
   const wDirs = workspace && workspace.directives || {};
   const cAggs = client && client.aggregates || {};
@@ -4601,7 +4600,7 @@ function memberVerdicts(client, workspace) {
   for (const [did, cShape] of Object.entries(cDirs)) {
     const wShape = wDirs[did];
     if (!wShape) {
-      out13[did] = { ok: false, reason: `directive '${did}' is not installed on the workspace` };
+      out14[did] = { ok: false, reason: `directive '${did}' is not installed on the workspace` };
       continue;
     }
     const cf = cShape.fields || {};
@@ -4616,13 +4615,13 @@ function memberVerdicts(client, workspace) {
       const w = wf[f];
       if (w && w.kind !== c.kind) reasons.push(`field '${f}' kind ${c.kind} \u2260 workspace ${w.kind}`);
     }
-    out13[did] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
+    out14[did] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
   }
   for (const [sid, cAgg] of Object.entries(cAggs)) {
     const label = cAgg.label || sid;
     const wAgg = wAggs[sid];
     if (!wAgg) {
-      out13[label] = { ok: false, reason: `aggregate '${label}' is not served by the workspace` };
+      out14[label] = { ok: false, reason: `aggregate '${label}' is not served by the workspace` };
       continue;
     }
     const cFields = cAgg.fields || {};
@@ -4633,9 +4632,9 @@ function memberVerdicts(client, workspace) {
       if (!w) reasons.push(`field '${label}.${c.label || fsid}' is not served`);
       else if (w.kind !== c.kind) reasons.push(`field '${label}.${c.label || fsid}' read kind ${c.kind} \u2260 workspace ${w.kind}`);
     }
-    out13[label] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
+    out14[label] = reasons.length ? { ok: false, reason: reasons.join("; ") } : { ok: true };
   }
-  return out13;
+  return out14;
 }
 function interfaceDomains(byDomain) {
   const map = byDomain && typeof byDomain === "object" ? byDomain : {};
@@ -4645,17 +4644,17 @@ function interfaceDomains(byDomain) {
   );
 }
 function mergeDomainInterfaces(byDomain, onlyDomains) {
-  const out13 = { directives: {}, aggregates: {} };
+  const out14 = { directives: {}, aggregates: {} };
   const map = byDomain && typeof byDomain === "object" ? byDomain : {};
   const entries = map.directives ? [[String(map.domain ?? "?"), map]] : Object.entries(map);
   for (const [domain, value] of entries) {
     if (onlyDomains !== void 0 && !onlyDomains.has(domain)) continue;
     if (!value || typeof value !== "object") continue;
     const di = value;
-    Object.assign(out13.directives, di.directives || {});
-    Object.assign(out13.aggregates, di.aggregates || {});
+    Object.assign(out14.directives, di.directives || {});
+    Object.assign(out14.aggregates, di.aggregates || {});
   }
-  return out13;
+  return out14;
 }
 var init_shape_compat = __esm({
   "../cloud/web-client/src/shape_compat.ts"() {
@@ -5036,7 +5035,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${parent}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: p
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -5090,7 +5096,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${ws}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent: ws,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: subj
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${ws}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -5687,13 +5700,13 @@ async function actorForShareQuote(quote) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   crypto.getRandomValues(bytes);
-  const out13 = new Array(n), T = 2 ** 53;
+  const out14 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z6 = 0n;
     for (let b = 7; b >= 0; b--) z6 = z6 << 8n | BigInt(bytes[i * 8 + b]);
-    out13[i] = Number(z6 >> 11n) / T;
+    out14[i] = Number(z6 >> 11n) / T;
   }
-  return out13;
+  return out14;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -5708,14 +5721,14 @@ async function routeTagHexOfHomeKey(homeKey) {
   return (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
 }
 function installedLawOfRows(rows) {
-  const out13 = [];
+  const out14 = [];
   for (const r of rows || []) {
     const d = r && r.data;
     if (!d || d["status.phase"] !== "Active") continue;
     const h = d["spec.domainHash"];
-    if (typeof h === "string" && h && !out13.includes(h)) out13.push(h);
+    if (typeof h === "string" && h && !out14.includes(h)) out14.push(h);
   }
-  return out13;
+  return out14;
 }
 function lawStatusOf(installed, clientHash) {
   const known = Array.isArray(installed);
@@ -5740,14 +5753,14 @@ function birthOutcomeFailure(birthOutcomes) {
   const first = bad[0];
   const list = bad.map((o) => `${o.workspace || "?"} [${o.status}${o.code ? `: ${o.code}` : ""}]${o.reason ? ` \u2014 ${o.reason}` : ""}`).join("; ");
   const lawUnavailable = bad.some((o) => o.code === "BirthLawPackageUnavailable");
-  const err13 = new Error(
+  const err14 = new Error(
     `birth incomplete: ${bad.length} child workspace(s) did NOT come up \u2014 ${list}. The parent offer admitted, but the child was not fully born, so opening it would poll head:null until timeout. ` + (lawUnavailable ? `The child's law package is not resolvable from the parent's custody \u2014 deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing.` : `See the outcome's reason/code for the cause.`) + ` [birth-failed]`
   );
-  err13.code = first.code || "BirthFailed";
-  err13.status = first.status;
-  err13.failedBirths = bad;
-  err13.birthOutcomes = birthOutcomes;
-  return err13;
+  err14.code = first.code || "BirthFailed";
+  err14.status = first.status;
+  err14.failedBirths = bad;
+  err14.birthOutcomes = birthOutcomes;
+  return err14;
 }
 async function checkCompat(holon, nomosCompat) {
   if (!holon || !nomosCompat || typeof nomosCompat.lawHash !== "string") return null;
@@ -6334,15 +6347,15 @@ ${String(commit).toLowerCase()}`;
     typeof principal === "string" && principal ? principal : typeof tokenSubject === "string" ? tokenSubject : ""
   );
   const readAuthFields = (keys, p) => {
-    const out13 = { nowUnix: Math.floor(Date.now() / 1e3) };
+    const out14 = { nowUnix: Math.floor(Date.now() / 1e3) };
     const pr = typeof p === "string" && p ? p : connectionPrincipal;
-    if (pr) out13.principal = pr;
+    if (pr) out14.principal = pr;
     if (activeAuthToken) {
-      out13.authToken = activeAuthToken;
+      out14.authToken = activeAuthToken;
     }
-    if (deviceSecret) out13.authorSecret = deviceSecret;
-    if (Array.isArray(keys) && keys.length) out13.keys = keys;
-    return out13;
+    if (deviceSecret) out14.authorSecret = deviceSecret;
+    if (Array.isArray(keys) && keys.length) out14.keys = keys;
+    return out14;
   };
   let clientLawHash;
   let warnedDrift = false;
@@ -6719,9 +6732,9 @@ ${String(commit).toLowerCase()}`;
     } catch {
     }
     const missingObject = (text.match(/\b[0-9a-f]{40}\b/) || [null])[0];
-    const err13 = new Error(text);
-    err13.code = code;
-    err13.errorInfo = {
+    const err14 = new Error(text);
+    err14.code = code;
+    err14.errorInfo = {
       code,
       message: text,
       component: "nomos.custody",
@@ -6739,7 +6752,7 @@ ${String(commit).toLowerCase()}`;
         "nomos.custody.recommended_action": source === "localSnapshot" ? "quarantineLocalSnapshotAndReclone" : "refetchFullHistoryAndRetry"
       }
     };
-    return err13;
+    return err14;
   };
   if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor) {
     const _ckptSpan = span("receive", restoreFrom ? "boot: restore folded state (snapshot)" : "boot: restore checkpoint", "boot");
@@ -7311,7 +7324,7 @@ ${String(commit).toLowerCase()}`;
             domain,
             candidateHash,
             atHash,
-            ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+            ackBy: connectionPrincipal
           })
         }));
       });
@@ -7324,8 +7337,7 @@ ${String(commit).toLowerCase()}`;
     }
     const prepared = prepareManagedPromotion(report, candidateHash, domain, {
       ...currentHash && currentHash !== candidateHash ? { replaces: currentHash } : {},
-      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {},
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {}
     });
     if (!prepared.ok) return prepared;
     try {
@@ -8140,7 +8152,7 @@ ${String(commit).toLowerCase()}`;
     if (!deviceSecret || !connectionPrincipal) {
       throw new Error("owned device recovery needs a signed-in session with its persisted device credential");
     }
-    const out13 = JSON.parse(call("query", {
+    const out14 = JSON.parse(call("query", {
       queryBytes: qBytes({
         op: "cryptoOwnedDeviceRequest",
         authorSecret: deviceSecret,
@@ -8149,7 +8161,7 @@ ${String(commit).toLowerCase()}`;
         scope
       })
     }));
-    return String(out13.request || "");
+    return String(out14.request || "");
   };
   const ownedRecoveryPolicyRaw = (owner) => ownedTupleData(ownedRecoveryPolicyId(owner));
   const ownedRecoveryOrdersRaw = async (recoveryPrincipal) => (await ownedQueryRows("nomosOwnedRecoveryOrdersByRecoveryPrincipal", { recoveryPrincipal })).map((row) => ({ id: String(row.id || ""), ...ownedRowData(row) }));
@@ -9491,11 +9503,11 @@ ${String(commit).toLowerCase()}`;
             await sleep(pollMs);
           }
           if (!sawDelegation) {
-            const err13 = new Error(
+            const err14 = new Error(
               `receiving-group setup: parent '${parent}' still holds NO SignerDelegation for '${owner}' after ${pollTimeoutMs}ms. enrollFirstDevice seated the device SIGNER, but the home cert chain's links[1] (the platform-signed delegation) never surfaced \u2014 the birth would come up UNWARRANTED/headless (birth-cert-not-seeded). The enroll must record the keyless delegation (enrollFirstDevice.delegationCert) BEFORE birth. [ParentSignerDelegationMissing]`
             );
-            err13.code = "ParentSignerDelegationMissing";
-            throw err13;
+            err14.code = "ParentSignerDelegationMissing";
+            throw err14;
           }
         } finally {
           delegationSpan.end();
@@ -9728,10 +9740,10 @@ ${String(commit).toLowerCase()}`;
       const off = installedInterfaceInner();
       if (off === null && _lastInterfaceReadError) {
         const e = _lastInterfaceReadError;
-        const err13 = new Error(`projection read failed on workspace '${workspace}': ${e.message}`);
-        err13.code = "nomos.projection.read_failed";
-        err13.errorInfo = { code: "nomos.projection.read_failed", message: e.message, component: "nomos.projection", workspace, attributes: { "nomos.projection.workspace": workspace } };
-        throw err13;
+        const err14 = new Error(`projection read failed on workspace '${workspace}': ${e.message}`);
+        err14.code = "nomos.projection.read_failed";
+        err14.errorInfo = { code: "nomos.projection.read_failed", message: e.message, component: "nomos.projection", workspace, attributes: { "nomos.projection.workspace": workspace } };
+        throw err14;
       }
       return off;
     }),
@@ -11004,12 +11016,12 @@ function routedHolon(coordinator, { cloud, workspace, clientId, authToken, fetch
   }
   async function frontierMap() {
     const rows = await coordinator.query("aggregatesByType", { __type: "NomosSummaryFrontier" });
-    const out13 = {};
+    const out14 = {};
     for (const r of rows || []) {
       const d = r.data || {};
-      if (typeof d.shard === "string" && typeof d.frontier === "string") out13[d.shard] = d.frontier;
+      if (typeof d.shard === "string" && typeof d.frontier === "string") out14[d.shard] = d.frontier;
     }
-    return out13;
+    return out14;
   }
   async function scopedValue(kind, readId, groupKey, opts = {}) {
     if (kind === "min" || kind === "max") {
@@ -11709,15 +11721,15 @@ var init_git_fs2 = __esm({
 });
 
 // vendor/engine/tree.ts
-function flatten2(dir, prefix, out13) {
+function flatten2(dir, prefix, out14) {
   const children = [...(dir.contents ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
   for (const [name, inode] of children) {
     const path2 = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
-      out13.push({ path: path2, dir: true });
-      flatten2(inode, path2, out13);
+      out14.push({ path: path2, dir: true });
+      flatten2(inode, path2, out14);
     } else {
-      out13.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+      out14.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
     }
   }
 }
@@ -11740,13 +11752,13 @@ function serializeTree2(workTree) {
   }
   let total = 0;
   for (const c of chunks) total += c.length;
-  const out13 = new Uint8Array(total);
+  const out14 = new Uint8Array(total);
   let off = 0;
   for (const c of chunks) {
-    out13.set(c, off);
+    out14.set(c, off);
     off += c.length;
   }
-  return out13;
+  return out14;
 }
 var enc5, dec5;
 var init_tree2 = __esm({
@@ -11761,13 +11773,13 @@ var init_tree2 = __esm({
 function concatBytes2(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out13 = new Uint8Array(n);
+  const out14 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out13.set(c, o);
+    out14.set(c, o);
     o += c.length;
   }
-  return out13;
+  return out14;
 }
 function pkt2(payload) {
   const body = typeof payload === "string" ? enc6.encode(payload) : payload;
@@ -12011,7 +12023,7 @@ function prepareManagedPromotion2(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -12027,7 +12039,6 @@ function prepareManagedRestoration2(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion2(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -12285,13 +12296,13 @@ async function sha256hex2(t2) {
 function osEntropyBuffer2(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out13 = new Array(n), T = 2 ** 53;
+  const out14 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z6 = 0n;
     for (let b = 7; b >= 0; b--) z6 = z6 << 8n | BigInt(bytes[i * 8 + b]);
-    out13[i] = Number(z6 >> 11n) / T;
+    out14[i] = Number(z6 >> 11n) / T;
   }
-  return out13;
+  return out14;
 }
 function callProto(ex, operation, STDERR) {
   const requestId = `adapter-${++protoRequestSequence2}`;
@@ -12985,15 +12996,15 @@ function contribution(read, cur) {
   return { group, value: typeof raw === "number" ? raw : 0 };
 }
 function contributionDiff(read, before, after) {
-  const out13 = [];
+  const out14 = [];
   if (before && after && before.group === after.group) {
     const d = after.value - before.value;
-    if (d !== 0) out13.push({ readId: read.id, group: after.group, delta: d });
-    return out13;
+    if (d !== 0) out14.push({ readId: read.id, group: after.group, delta: d });
+    return out14;
   }
-  if (before) out13.push({ readId: read.id, group: before.group, delta: -before.value });
-  if (after) out13.push({ readId: read.id, group: after.group, delta: after.value });
-  return out13.filter((d) => d.delta !== 0);
+  if (before) out14.push({ readId: read.id, group: before.group, delta: -before.value });
+  if (after) out14.push({ readId: read.id, group: after.group, delta: after.value });
+  return out14.filter((d) => d.delta !== 0);
 }
 function countTenantRows(eng, ws) {
   let total = 0;
@@ -13006,16 +13017,16 @@ async function countTenantRowsByHome(eng, ws, homeKeys) {
   const keySet = new Set(homeKeys);
   const tagOf = /* @__PURE__ */ new Map();
   for (const hk of homeKeys) tagOf.set(await routeTagHexOfHomeKey2(hk), hk);
-  const out13 = /* @__PURE__ */ new Map();
-  for (const hk of homeKeys) out13.set(hk, 0);
+  const out14 = /* @__PURE__ */ new Map();
+  for (const hk of homeKeys) out14.set(hk, 0);
   for (const type of tenantTypes(eng)) {
     for (const r of query2(eng, ws, "aggregatesByType", JSON.stringify({ __type: type }))) {
       const id = String(r.id || "");
       const hk = keySet.has(id) ? id : tagOf.get(routeTagHexOfMintedId(id) ?? "");
-      if (hk !== void 0) out13.set(hk, (out13.get(hk) ?? 0) + 1);
+      if (hk !== void 0) out14.set(hk, (out14.get(hk) ?? 0) + 1);
     }
   }
-  return out13;
+  return out14;
 }
 async function collectHomedIntents(eng, ws, homeKeys) {
   const routes = directiveRoutes(eng);
@@ -13040,7 +13051,7 @@ async function collectHomedIntents(eng, ws, homeKeys) {
       strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
     }
   }
-  const out13 = [];
+  const out14 = [];
   for (const { oid, blob, doc } of docs) {
     const id = doc && typeof doc.id === "string" ? doc.id : null;
     if (!id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
@@ -13056,9 +13067,9 @@ async function collectHomedIntents(eng, ws, homeKeys) {
       const tag = routeTagHexOfMintedId(value);
       homeKey = tag !== void 0 ? tagOf.get(tag) ?? null : null;
     }
-    if (homeKey !== null) out13.push({ oid, id, homeKey, blob });
+    if (homeKey !== null) out14.push({ oid, id, homeKey, blob });
   }
-  return out13;
+  return out14;
 }
 async function migrateHomes(eng, ws, ledger, sourceWs, homeKeys, { onlyIds = null } = {}) {
   const wanted = onlyIds ? new Set(onlyIds) : null;
@@ -13167,7 +13178,7 @@ async function collectGlobalIntents(eng, ws) {
       strikeParity.set(target, (strikeParity.get(target) ?? 0) + 1);
     }
   }
-  const out13 = [];
+  const out14 = [];
   for (const { oid, blob, doc } of docs) {
     const id = doc && typeof doc.id === "string" ? doc.id : null;
     let touches = false;
@@ -13178,9 +13189,9 @@ async function collectGlobalIntents(eng, ws) {
       if (t2 !== void 0 && globals.has(t2)) touches = true;
     }
     if (!touches || !id || (strikeParity.get(id) ?? 0) % 2 === 1) continue;
-    out13.push({ oid, id, blob });
+    out14.push({ oid, id, blob });
   }
-  return out13;
+  return out14;
 }
 async function replicateIntents(eng, ws, ledger, intents, { push = true } = {}) {
   const main2 = await mainIntentIds(eng, ws);
@@ -13537,7 +13548,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
-      if (!seeded?.seeded) {
+      if (!seeded?.seeded && ledger.readOnly !== true) {
         void pushCheckpoint(eng, ws, ledger).catch(() => {
         });
       }
@@ -13609,8 +13620,8 @@ function stageLawClosure(eng, lawUsdz, label = "candidate-law") {
   }, "lawClosureInfo");
 }
 function currentLaw(eng, ws) {
-  const out13 = namedQueryProto(eng, ws, QueryOperation2.CURRENT_LAW);
-  return out13.keyMap || {};
+  const out14 = namedQueryProto(eng, ws, QueryOperation2.CURRENT_LAW);
+  return out14.keyMap || {};
 }
 function installedLaw(eng, ws) {
   return namedQueryProto(eng, ws, QueryOperation2.INSTALLED_LAW);
@@ -13622,8 +13633,8 @@ function kernelStamp(eng, ws) {
   return namedQueryProto(eng, ws, QueryOperation2.KERNEL_STAMP);
 }
 function declaredCapabilities(eng, ws) {
-  const out13 = namedQueryProto(eng, ws, QueryOperation2.DECLARED_CAPABILITIES);
-  return out13.capabilities || [];
+  const out14 = namedQueryProto(eng, ws, QueryOperation2.DECLARED_CAPABILITIES);
+  return out14.capabilities || [];
 }
 function outboundOffers(eng, ws, nowMillis = Date.now()) {
   const response = callProto(eng.ex, {
@@ -13664,8 +13675,8 @@ function evolveDryRun(eng, ws, lawUsdz, domainHash, dispositions2 = null) {
   return r.ok ? { admits: true } : { admits: false, detail: r.error };
 }
 function mintId(eng, typeTag) {
-  const out13 = namedQueryProto(eng, "root", QueryOperation2.MINT, { typeTag, nowMillis: Date.now() });
-  return out13.id;
+  const out14 = namedQueryProto(eng, "root", QueryOperation2.MINT, { typeTag, nowMillis: Date.now() });
+  return out14.id;
 }
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
@@ -13853,13 +13864,13 @@ async function streamAll(stream) {
   }
   let len = 0;
   for (const c of chunks) len += c.length;
-  const out13 = new Uint8Array(len);
+  const out14 = new Uint8Array(len);
   let at = 0;
   for (const c of chunks) {
-    out13.set(c, at);
+    out14.set(c, at);
     at += c.length;
   }
-  return out13;
+  return out14;
 }
 async function gzip(bytes) {
   const cs = new CompressionStream("gzip");
@@ -14698,12 +14709,12 @@ async function verifyChain(eng, ws, ledger) {
 function verifyChainLocal(eng, ws) {
   return namedQueryProto(eng, ws, QueryOperation2.VERIFY_CHAIN);
 }
-function historyPreflight(eng, ws, domain, candidateHash, atHash, dispositions2) {
+function historyPreflight(eng, ws, domain, candidateHash, atHash, actor = "") {
   return namedQueryProto(eng, ws, QueryOperation2.HISTORY_PREFLIGHT, {
     domain,
     candidateHash,
     atHash,
-    ...dispositions2 ? { dispositions: dispositions2 } : {}
+    ...actor.trim() ? { ackBy: actor.trim() } : {}
   });
 }
 function historyRestorePreflight(eng, ws, domain, currentHash, priorHash, atHash, actor) {
@@ -14730,7 +14741,7 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
   }
   let report;
   try {
-    report = historyPreflight(eng, ws, domain, candidateHash, atHash, opts.dispositions);
+    report = historyPreflight(eng, ws, domain, candidateHash, atHash, actingPrincipal);
   } catch (error) {
     return { ok: false, stage: "preflight", error: String(error?.message || error) };
   }
@@ -14739,7 +14750,6 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
   const {
     replaces: _replaces,
     retireReplaced: _retireReplaced,
-    dispositions: _dispositions,
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
@@ -15044,17 +15054,17 @@ async function writeRefusedRef(eng, ws, dl) {
 async function listRefusedRefs(eng, ws) {
   const gitdir = gitdirOf(ws);
   const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
-  const out13 = [];
+  const out14 = [];
   for (const { ref, oid } of refs) {
     try {
       const vb = kgit.readBlob(eng, gitdir, oid, "verdict.usda") ?? new Uint8Array();
       const ib = kgit.readBlob(eng, gitdir, oid, "change.usda") ?? new Uint8Array();
       const v = kgit.inspectRefusalVerdict(eng, vb);
-      out13.push({ ref, ...v, verdict: { reason: v.reason }, changeB64: b64Bytes(ib) });
+      out14.push({ ref, ...v, verdict: { reason: v.reason }, changeB64: b64Bytes(ib) });
     } catch {
     }
   }
-  return out13;
+  return out14;
 }
 async function refusedSummary(eng, ws) {
   const gitdir = gitdirOf(ws);
@@ -15193,9 +15203,9 @@ async function ledgerStats(eng, ws, ledger = null) {
   const mounted = eng.mounted.get(ws);
   if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
   const commits = kgit.intentsAbove(eng, gitdir, head).length;
-  const out13 = { head, commits };
-  if (mounted) mounted.ledgerStats = out13;
-  return out13;
+  const out14 = { head, commits };
+  if (mounted) mounted.ledgerStats = out14;
+  return out14;
 }
 async function countRemoteCommits(eng, ledger) {
   const head = (await custodyLsRefs(ledger, "refs/heads/main"))["refs/heads/main"] || null;
@@ -19563,7 +19573,7 @@ __export(mcp_exports, {
   toolEvolvePreview: () => toolEvolvePreview
 });
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
 function resolveConfig(config) {
   const arg = config ?? "nomos.project.ts";
@@ -19642,7 +19652,7 @@ function extractDispositions(humanReport) {
 }
 function toolCheck(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync11(configPath)) {
+  if (!existsSync12(configPath)) {
     return { text: `nomos_check: config not found: ${configPath}`, isError: true };
   }
   const extra = args.against !== void 0 ? ["--against", args.against] : [];
@@ -19659,11 +19669,11 @@ ${JSON.stringify(payload, null, 2)}`, isError: false };
 }
 function toolEvolvePreview(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync11(configPath)) {
+  if (!existsSync12(configPath)) {
     return { text: `nomos_evolve_preview: config not found: ${configPath}`, isError: true };
   }
   const againstPath = isAbsolute2(args.against) ? args.against : resolve4(dirname7(configPath), args.against);
-  const priorArg = existsSync11(againstPath) ? againstPath : args.against;
+  const priorArg = existsSync12(againstPath) ? againstPath : args.against;
   const jsonRun = runCheckJson(configPath, ["--against", priorArg]);
   if (jsonRun.error !== void 0) {
     return {
@@ -19826,7 +19836,7 @@ __export(test_exports, {
   runDartTests: () => runDartTests
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { dirname as dirname8, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function resolveTestCloudEntry(options = {}) {
@@ -19835,7 +19845,7 @@ function resolveTestCloudEntry(options = {}) {
   const explicit = environment.NOMOS_TEST_CLOUD_ENTRY;
   if (explicit !== void 0) {
     const candidate = resolve5(cwd, explicit);
-    if (!existsSync12(candidate)) {
+    if (!existsSync13(candidate)) {
       throw new Error(`NOMOS_TEST_CLOUD_ENTRY does not exist: ${candidate}`);
     }
     return candidate;
@@ -19847,7 +19857,7 @@ function resolveTestCloudEntry(options = {}) {
     resolve5(here, "../../cloud/dev-server/server.ts"),
     resolve5(cwd, "cloud/dev-server/server.ts")
   ];
-  const server = candidates.find((candidate) => existsSync12(candidate));
+  const server = candidates.find((candidate) => existsSync13(candidate));
   if (server === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
@@ -19894,8 +19904,8 @@ __export(harness_exports, {
   harnessInstall: () => harnessInstall,
   looksLikeStaleRuntime: () => looksLikeStaleRuntime
 });
-import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join15 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function looksLikeStaleRuntime(msg) {
   return /\bbbox param\b|missing.*param|non-numeric|unknown (op|query op)|unsupported op|unexpected (field|key)|no such op/i.test(
@@ -19905,14 +19915,14 @@ function looksLikeStaleRuntime(msg) {
 async function harnessInstall(opts) {
   const { law: lawPaths, workspace, out: outPath } = opts;
   if (lawPaths.length === 0) die("no --law .law.usdz path(s) given");
-  const runtimeDir = opts.runtime || process.env["NOMOS_CANDIDATE_RUNTIME"] || process.env["NOMOS_OFFLINE_RUNTIME"] || join14(configDir(), "runtime");
+  const runtimeDir = opts.runtime || process.env["NOMOS_CANDIDATE_RUNTIME"] || process.env["NOMOS_OFFLINE_RUNTIME"] || join15(configDir(), "runtime");
   const refreshed = await refreshRuntimeDir(cloudBase(), runtimeDir);
   if (refreshed) process.stderr.write(`harness-install: refreshed runtime cache from the cloud \u2192 ${runtimeDir}
 `);
-  const wasmFile = join14(runtimeDir, "holon-testmint.wasm");
-  const bootstrapFile = join14(runtimeDir, "bootstrap.law.usdz");
-  const nomosFile = join14(runtimeDir, "nomos.law.usdz");
-  if (!existsSync13(wasmFile) || !existsSync13(bootstrapFile) || !existsSync13(nomosFile)) {
+  const wasmFile = join15(runtimeDir, "holon-testmint.wasm");
+  const bootstrapFile = join15(runtimeDir, "bootstrap.law.usdz");
+  const nomosFile = join15(runtimeDir, "nomos.law.usdz");
+  if (!existsSync14(wasmFile) || !existsSync14(bootstrapFile) || !existsSync14(nomosFile)) {
     die(
       `test runtime cache missing at ${runtimeDir} (holon-testmint.wasm + bootstrap.law.usdz + nomos.law.usdz). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`
     );
@@ -20051,23 +20061,23 @@ async function doctor(opts = {}) {
   const cloud = cloudBase(opts.cloud);
   const localLaw = await readLocalLaw(process.cwd(), cloud, opts.file);
   const report = await probeKernelCapabilities(cloud);
-  const out13 = [];
-  out13.push(`githolon doctor \u2014 release coherence`);
-  out13.push(`  cloud       : ${cloud}`);
-  out13.push(`  local law   : ${localLaw ? `${localLaw.identity.slice(0, 16)}\u2026 (${localLaw.domains.join(", ") || "no domains"})` : "(not admitted \u2014 run `githolon compile` or inspect the error with `githolon deploy`)"}`);
-  out13.push(`  runner      : cloud expects bundle version ${report?.expectedBundleVersion ?? "(not advertised)"}`);
-  out13.push(stampLine("prod kernel", report?.prod));
-  out13.push(stampLine("test kernel", report?.testmint));
+  const out14 = [];
+  out14.push(`githolon doctor \u2014 release coherence`);
+  out14.push(`  cloud       : ${cloud}`);
+  out14.push(`  local law   : ${localLaw ? `${localLaw.identity.slice(0, 16)}\u2026 (${localLaw.domains.join(", ") || "no domains"})` : "(not admitted \u2014 run `githolon compile` or inspect the error with `githolon deploy`)"}`);
+  out14.push(`  runner      : cloud expects bundle version ${report?.expectedBundleVersion ?? "(not advertised)"}`);
+  out14.push(stampLine("prod kernel", report?.prod));
+  out14.push(stampLine("test kernel", report?.testmint));
   if (!localLaw) {
-    out13.push(``);
-    out13.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
-    process.stdout.write(out13.join("\n") + "\n");
+    out14.push(``);
+    out14.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
+    process.stdout.write(out14.join("\n") + "\n");
     return report ? 0 : 1;
   }
-  out13.push(``);
-  out13.push(`  \u2713 ARCHIVE COHERENT \u2014 the selected kernel admitted and composed ${localLaw.identity.slice(0, 16)}\u2026 directly from typed USDA.`);
-  out13.push(`    Full schema/projection compatibility is enforced again by the ordinary install offer.`);
-  process.stdout.write(out13.join("\n") + "\n");
+  out14.push(``);
+  out14.push(`  \u2713 ARCHIVE COHERENT \u2014 the selected kernel admitted and composed ${localLaw.identity.slice(0, 16)}\u2026 directly from typed USDA.`);
+  out14.push(`    Full schema/projection compatibility is enforced again by the ordinary install offer.`);
+  process.stdout.write(out14.join("\n") + "\n");
   return 0;
 }
 var init_doctor = __esm({
@@ -20496,11 +20506,11 @@ function bareTypeLabel(t2) {
   return i > 0 && i < t2.length - 1 ? t2.slice(i + 1) : t2;
 }
 function geoFieldsOfInstalls(installs) {
-  const out13 = /* @__PURE__ */ new Map();
+  const out14 = /* @__PURE__ */ new Map();
   const add2 = (type, field) => {
-    const set2 = out13.get(type) ?? /* @__PURE__ */ new Set();
+    const set2 = out14.get(type) ?? /* @__PURE__ */ new Set();
     set2.add(field);
-    out13.set(type, set2);
+    out14.set(type, set2);
   };
   for (const inst of installs) {
     for (const layer of inst.layers) {
@@ -20516,7 +20526,7 @@ function geoFieldsOfInstalls(installs) {
       }
     }
   }
-  return out13;
+  return out14;
 }
 function pointOfOpValue(setOp) {
   let v = setOp["Json"];
@@ -21141,8 +21151,8 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join15, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join16, resolve as resolve6 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 async function walkChain2(eng, ws) {
   const gitdir = gitdirOf(ws);
@@ -21157,8 +21167,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync14(join15(target, ".git")) ? join15(target, ".git") : target;
-    if (!existsSync14(join15(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync15(join16(target, ".git")) ? join16(target, ".git") : target;
+    if (!existsSync15(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -21217,44 +21227,44 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync14(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync15(target) || target.includes("/") || target.startsWith(".");
   const name = isDir ? (resolve6(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
-  out11(`scene \u2014 ${name} (${isDir ? resolve6(target) : `${cloud} :: ${target}`})`);
+  out12(`scene \u2014 ${name} (${isDir ? resolve6(target) : `${cloud} :: ${target}`})`);
   let first, second;
   try {
     first = await projectOnce(cloud, target, isDir, name);
     second = await projectOnce(cloud, target, isDir, name);
   } catch (e) {
-    err11(String(e.message ?? e));
+    err12(String(e.message ?? e));
     return 1;
   }
   if (first.usda !== second.usda) {
-    err11(`two replays of the SAME chain emitted DIFFERENT bytes \u2014 the projector is nondeterministic (refusing to write)`);
+    err12(`two replays of the SAME chain emitted DIFFERENT bytes \u2014 the projector is nondeterministic (refusing to write)`);
     return 1;
   }
   const violations = lintPortableProfile(first.usda);
   if (violations.length > 0) {
-    err11(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
+    err12(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
     return 1;
   }
-  const outDir = resolve6(opts.out ?? join15("scene", name));
+  const outDir = resolve6(opts.out ?? join16("scene", name));
   mkdirSync6(outDir, { recursive: true });
-  const usdaPath = join15(outDir, `${name}.usda`);
-  const usdzPath = join15(outDir, `${name}.usdz`);
+  const usdaPath = join16(outDir, `${name}.usda`);
+  const usdzPath = join16(outDir, `${name}.usdz`);
   const usdaBytes = new TextEncoder().encode(first.usda);
   writeFileSync9(usdaPath, usdaBytes);
   writeFileSync9(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
   const s = first.stats;
-  out11(`  verify_chain ${s.verdictLine}`);
-  out11(`  law canopy   ${s.nodes} node(s), ${s.edges} edge(s) \u2014 from the chain's own installed packages`);
-  out11(`  chain tier   ${s.frames} frame(s), timeCodes 0..${s.endT} (timeCode = chain index)`);
-  out11(`  determinism  two fresh replays \u2192 BYTE-IDENTICAL  sha256 ${sha256(first.usda).slice(0, 16)}\u2026`);
-  out11(`  profile      portable (Mesh-only, UsdPreviewSurface, translate/scale/visibility timeSamples)`);
-  out11(`  \u2192 ${usdaPath} (${usdaBytes.length} bytes)`);
-  out11(`  \u2192 ${usdzPath}`);
+  out12(`  verify_chain ${s.verdictLine}`);
+  out12(`  law canopy   ${s.nodes} node(s), ${s.edges} edge(s) \u2014 from the chain's own installed packages`);
+  out12(`  chain tier   ${s.frames} frame(s), timeCodes 0..${s.endT} (timeCode = chain index)`);
+  out12(`  determinism  two fresh replays \u2192 BYTE-IDENTICAL  sha256 ${sha256(first.usda).slice(0, 16)}\u2026`);
+  out12(`  profile      portable (Mesh-only, UsdPreviewSurface, translate/scale/visibility timeSamples)`);
+  out12(`  \u2192 ${usdaPath} (${usdaBytes.length} bytes)`);
+  out12(`  \u2192 ${usdzPath}`);
   return s.verdictLine.startsWith("GREEN") ? 0 : 2;
 }
-var out11, err11, sha256;
+var out12, err12, sha256;
 var init_scene = __esm({
   "src/scene.ts"() {
     "use strict";
@@ -21262,8 +21272,8 @@ var init_scene = __esm({
     init_cloud();
     init_local_holon();
     init_scene_projector();
-    out11 = (s) => void process.stdout.write(s + "\n");
-    err11 = (s) => void process.stderr.write("error: " + s + "\n");
+    out12 = (s) => void process.stdout.write(s + "\n");
+    err12 = (s) => void process.stderr.write("error: " + s + "\n");
     sha256 = (s) => createHash5("sha256").update(s).digest("hex");
   }
 });
@@ -21297,42 +21307,42 @@ async function dlqSweep(ws, opts = {}) {
     const res = await fetch(url);
     body = await res.json();
     if (body.ok !== true || body.root === void 0) {
-      err12(`dlq sweep refused: ${String(body.error ?? "no sweep in the response").slice(0, 300)}`);
+      err13(`dlq sweep refused: ${String(body.error ?? "no sweep in the response").slice(0, 300)}`);
       return 1;
     }
   } catch (e) {
-    err12(`dlq sweep failed against ${cloud}: ${e.message}`);
+    err13(`dlq sweep failed against ${cloud}: ${e.message}`);
     return 1;
   }
   if (opts.json === true) {
-    out12(JSON.stringify(body, null, 2));
+    out13(JSON.stringify(body, null, 2));
     return body.jammed ? 2 : 0;
   }
-  out12(`DLQ sweep of '${ws}' \u2014 ${body.nodes} node(s), ${body.jammed} jammed`);
-  for (const line of renderSweepNode(body.root)) out12(line);
+  out13(`DLQ sweep of '${ws}' \u2014 ${body.nodes} node(s), ${body.jammed} jammed`);
+  for (const line of renderSweepNode(body.root)) out13(line);
   if (body.jammed) {
-    out12("");
-    out12("unjam: fix/deploy the law on the jammed workspace, then POST /v2/workspaces/<node>/dead-letters/retry");
-    out12("       (or from the app: holon.retryDeadLetter(id); discard is the app's explicit choice)");
+    out13("");
+    out13("unjam: fix/deploy the law on the jammed workspace, then POST /v2/workspaces/<node>/dead-letters/retry");
+    out13("       (or from the app: holon.retryDeadLetter(id); discard is the app's explicit choice)");
   }
   return body.jammed ? 2 : 0;
 }
-var out12, err12;
+var out13, err13;
 var init_dlq = __esm({
   "src/dlq.ts"() {
     "use strict";
     init_cloud();
-    out12 = (s) => void process.stdout.write(s + "\n");
-    err12 = (s) => void process.stderr.write("error: " + s + "\n");
+    out13 = (s) => void process.stdout.write(s + "\n");
+    err13 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
 // src/cli.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync12 } from "node:fs";
 import { spawn as spawn2, spawnSync as spawnSync7 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname9, join as join16, resolve as resolve7 } from "node:path";
+import { dirname as dirname9, join as join17, resolve as resolve7 } from "node:path";
 import { pathToFileURL as pathToFileURL5, fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/generate.ts
@@ -23093,8 +23103,8 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
-  const ACTOR = journey.actor ?? "user:proof-conformance";
-  const BARE_ACTOR = ACTOR.replace(/^user:/, "");
+  const ACTOR2 = journey.actor ?? "user:proof-conformance";
+  const BARE_ACTOR = ACTOR2.replace(/^user:/, "");
   const stamp = (/* @__PURE__ */ new Date()).toISOString();
   const grantedRelation = rb.grantedRelation ?? rb.relation;
   const computed = grantedRelation !== rb.relation;
@@ -23105,12 +23115,12 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
     authorities.add(grantedRelation);
   };
   if (rb.bornContext !== void 0) {
-    return runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState, journey);
+    return runBornContextLeg(eng, ws, lawHash, rb, ACTOR2, stamp, reuseJourneyState, journey);
   }
   if (reuseJourneyState && journey.domain === rb.domain && journey.workspace !== void 0) {
     ws = journey.workspace;
   }
-  const actorOpts = journey.authorSecret === void 0 ? { actor: ACTOR } : { actor: ACTOR, authorSecret: journey.authorSecret };
+  const actorOpts = journey.authorSecret === void 0 ? { actor: ACTOR2 } : { actor: ACTOR2, authorSecret: journey.authorSecret };
   if (rb.via === "unrestricted") reuseJourneyState = true;
   if (reuseJourneyState) {
     let retainedPreconditionsReady = true;
@@ -23187,7 +23197,7 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
       ws,
       lawHash,
       rb.granterAuthority,
-      ACTOR,
+      ACTOR2,
       stamp,
       lines,
       journey.authorSecret
@@ -23205,7 +23215,7 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
     const wrappedSet = new Set(wrapped);
     for (const k of Object.keys(payload)) {
       if (wrappedSet.has(k)) payload[k] = BARE_ACTOR;
-      else if (set2.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)) payload[k] = ACTOR;
+      else if (set2.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)) payload[k] = ACTOR2;
     }
   };
   for (const seed of rb.prerequisiteSeeds ?? []) {
@@ -23222,7 +23232,7 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
       lines.push(`\u2013 relation-bootstrap leg SKIPPED (prerequisite-seed chain) \u2014 the prerequisite seed ${rb.domain}/${seed.directiveId} REFUSED with a synthesized payload (${seedRes.error ?? "refused"}); the granter ${rb.grantDirectiveId}'s prerequisite can't be established standalone \u2014 prove ${rb.gatedDirectiveId} via a birth genesis / by hand`);
       return done(true);
     }
-    lines.push(`\u2713 relation bootstrap (prerequisite) \u2014 ${rb.domain}/${seed.directiveId} established (as founder ${ACTOR}) before the grant`);
+    lines.push(`\u2713 relation bootstrap (prerequisite) \u2014 ${rb.domain}/${seed.directiveId} established (as founder ${ACTOR2}) before the grant`);
   }
   const grantPayload = { ...rb.grantPayload };
   bindJourneyPrincipals(grantPayload, journey);
@@ -23240,7 +23250,7 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
     }
     return done(false, `relation bootstrap grant ${rb.domain}/${rb.grantDirectiveId} refused: ${grantRes.error ?? "unknown"} \u2014 the grant that should seat "${grantedRelation}" on the proof actor was rejected (is ${rb.grantDirectiveId} itself gated? add .grants("${grantedRelation}") + an ungated bootstrap, or prove by hand)`);
   }
-  const seatDesc = speculative ? `replayed the declared seed ${rb.domain}/${rb.grantDirectiveId} (seats [${(rb.seedWritesRelations ?? [grantedRelation]).join(", ")}]) on ${ACTOR} \u2014 deferring to the real gate to authorize "${rb.relation}"` : `${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${ACTOR} (${rb.via})${computed ? ` \u21D2 satisfies "${rb.relation}" via the rewrite` : ``}`;
+  const seatDesc = speculative ? `replayed the declared seed ${rb.domain}/${rb.grantDirectiveId} (seats [${(rb.seedWritesRelations ?? [grantedRelation]).join(", ")}]) on ${ACTOR2} \u2014 deferring to the real gate to authorize "${rb.relation}"` : `${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${ACTOR2} (${rb.via})${computed ? ` \u21D2 satisfies "${rb.relation}" via the rewrite` : ``}`;
   lines.push(`\u2713 relation bootstrap (${speculative ? "seed" : "grant"}) \u2014 ${seatDesc}`);
   for (const setup of rb.preconditionSetups ?? []) {
     if (reusablePreconditionExists(eng, ws, rb.domain, setup)) {
@@ -23293,17 +23303,17 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb, reuseJourneyState = false
       const id = gatedPayload[field];
       if (typeof id !== "string") return [];
       const object = `${rb.domain}__${aggregate2}:${id}`;
-      const verdict = check(eng, ws, object, rb.relation, ACTOR);
+      const verdict = check(eng, ws, object, rb.relation, ACTOR2);
       return [`${object}#${rb.relation}=${verdict.allowed === true ? "allowed" : `denied(${verdict.error ?? "no reason"})`}`];
     });
-    return done(false, `relation bootstrap prove ${rb.domain}/${rb.gatedDirectiveId} refused: ${gatedRes.error ?? "unknown"} \u2014 the gated write did NOT succeed even after granting "${grantedRelation}" to the actor${computed ? ` (which should satisfy "${rb.relation}" via the rewrite)` : ``} (the gate is not honoring the seeded relation, OR the grant did not seat it on ${ACTOR})${authorityChecks.length > 0 ? `; checks: ${authorityChecks.join(", ")}` : ""}${tracedProofPayload(eng, ws, rb.domain, gatedPayload, rb.gatedReferenceFields)}`);
+    return done(false, `relation bootstrap prove ${rb.domain}/${rb.gatedDirectiveId} refused: ${gatedRes.error ?? "unknown"} \u2014 the gated write did NOT succeed even after granting "${grantedRelation}" to the actor${computed ? ` (which should satisfy "${rb.relation}" via the rewrite)` : ``} (the gate is not honoring the seeded relation, OR the grant did not seat it on ${ACTOR2})${authorityChecks.length > 0 ? `; checks: ${authorityChecks.join(", ")}` : ""}${tracedProofPayload(eng, ws, rb.domain, gatedPayload, rb.gatedReferenceFields)}`);
   }
   lines.push(speculative ? `\u2713 relation bootstrap (prove) \u2014 ${rb.domain}/${rb.gatedDirectiveId} authored under the replayed seed (gated write SUCCEEDS \u2014 the REAL kernel gate confirmed the replayed seed establishes authority for "${rb.relation}")` : `\u2713 relation bootstrap (prove) \u2014 ${rb.domain}/${rb.gatedDirectiveId} authored under the seeded holder of "${rb.relation}" (gated write SUCCEEDS once granted)`);
   retainAuthoredReferences(eng, ws, gatedRes, journey);
   retainAuthority();
   return done(true);
 }
-function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState, journey) {
+function runBornContextLeg(eng, ws, lawHash, rb, ACTOR2, stamp, reuseJourneyState, journey) {
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
@@ -23323,12 +23333,12 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState
   const retainedWs = reuseJourneyState && journey.domain === rb.domain ? journey.workspace : void 0;
   const retainedSecret = reuseJourneyState && journey.domain === rb.domain ? journey.authorSecret : void 0;
   if (retainedWs !== void 0 && retainedSecret !== void 0) {
-    const actorOpts2 = { actor: ACTOR, authorSecret: retainedSecret };
+    const actorOpts2 = { actor: ACTOR2, authorSecret: retainedSecret };
     for (const setup of rb.preconditionSetups ?? []) {
       if (reusablePreconditionExists(eng, retainedWs, rb.domain, setup)) continue;
       const setupPayload = { ...setup.payload };
       for (const key2 of Object.keys(setupPayload)) {
-        if (seatsProofActor(key2, setupPayload[key2])) setupPayload[key2] = ACTOR;
+        if (seatsProofActor(key2, setupPayload[key2])) setupPayload[key2] = ACTOR2;
       }
       bindJourneyPrincipals(setupPayload, journey);
       for (const field of setup.autoStamped) setupPayload[field] = stamp;
@@ -23355,7 +23365,7 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState
     }
     const payload = { ...rb.gatedPayload };
     for (const key2 of Object.keys(payload)) {
-      if (seatsProofActor(key2, payload[key2])) payload[key2] = ACTOR;
+      if (seatsProofActor(key2, payload[key2])) payload[key2] = ACTOR2;
     }
     bindJourneyPrincipals(payload, journey);
     for (const field of rb.gatedAutoStamped) payload[field] = stamp;
@@ -23388,7 +23398,7 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState
     lines.push(unrestricted ? `\u2713 generated business action \u2014 ${rb.domain}/${rb.gatedDirectiveId} reused ${retainedWs}, its typed records and enrolled device` : `\u2713 relation bootstrap (retained born-context) \u2014 ${rb.domain}/${rb.gatedDirectiveId} reused ${retainedWs}, its business records, authority and enrolled device`);
     return done(true);
   }
-  const founder = ACTOR && !SENTINEL_PRINCIPAL.test(ACTOR) ? ACTOR : "user:00000000-0000-4000-8000-000000000001";
+  const founder = ACTOR2 && !SENTINEL_PRINCIPAL.test(ACTOR2) ? ACTOR2 : "user:00000000-0000-4000-8000-000000000001";
   const dev2 = journey.authorPublic !== void 0 && journey.authorSecret !== void 0 ? { public: journey.authorPublic, secret: journey.authorSecret } : authorKeygen(eng);
   const devKeyHash = keyHashOf(dev2.public);
   const identityProvider = journey.identityProvider ??= createOfflineProofIdentityProvider();
@@ -23441,7 +23451,7 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState
   journey.actor = founder;
   journey.authorSecret = dev2.secret;
   journey.authorPublic = dev2.public;
-  lines.push(unrestricted ? `\u2713 generated business context \u2014 birthed ${bornWs} via ${rb.domain}/${bc.birthDirectiveId} and enrolled the signed-in owner's device` : `\u2713 relation bootstrap (born-context) \u2014 birthed ${bornWs} via ${rb.domain}/${bc.birthDirectiveId}; its genesis (${bc.seatsViaDirectiveId}) seated "${rb.relation}" for the owner ${ACTOR}`);
+  lines.push(unrestricted ? `\u2713 generated business context \u2014 birthed ${bornWs} via ${rb.domain}/${bc.birthDirectiveId} and enrolled the signed-in owner's device` : `\u2713 relation bootstrap (born-context) \u2014 birthed ${bornWs} via ${rb.domain}/${bc.birthDirectiveId}; its genesis (${bc.seatsViaDirectiveId}) seated "${rb.relation}" for the owner ${ACTOR2}`);
   for (const setup of rb.preconditionSetups ?? []) {
     if (reusablePreconditionExists(eng, bornWs, rb.domain, setup)) continue;
     const setupPayload = { ...setup.payload };
@@ -23495,7 +23505,7 @@ function runBornContextLeg(eng, ws, lawHash, rb, ACTOR, stamp, reuseJourneyState
   if (source.line !== void 0) lines.push(source.line);
   const gatedRes = author(eng, bornWs, rb.domain, rb.gatedDirectiveId, gatedPayload, lawHash, source.opts);
   if (gatedRes.ok === false) {
-    lines.push(unrestricted ? `\u2013 generated business journey SKIPPED \u2014 ${rb.domain}/${rb.gatedDirectiveId} was refused inside the born ${bornWs} (${gatedRes.error ?? "refused"})` : `\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 dispatching ${rb.domain}/${rb.gatedDirectiveId} .requires("${rb.relation}") inside the born ${bornWs} as ${ACTOR} was REFUSED on the real gate (${gatedRes.error ?? "refused"}); the born genesis did not establish the authority the gate needs`);
+    lines.push(unrestricted ? `\u2013 generated business journey SKIPPED \u2014 ${rb.domain}/${rb.gatedDirectiveId} was refused inside the born ${bornWs} (${gatedRes.error ?? "refused"})` : `\u2013 relation-bootstrap leg SKIPPED (layer-4 born-context) \u2014 dispatching ${rb.domain}/${rb.gatedDirectiveId} .requires("${rb.relation}") inside the born ${bornWs} as ${ACTOR2} was REFUSED on the real gate (${gatedRes.error ?? "refused"}); the born genesis did not establish the authority the gate needs`);
     return done(true);
   }
   retainAuthoredReferences(eng, bornWs, gatedRes, journey);
@@ -23893,9 +23903,23 @@ var HELP = {
     examples: ["githolon compile", "githolon compile nomos.application.ts --require-usdcat"]
   },
   proof: {
-    usage: "githolon proof [build/<name>.proof.mts] [--live]",
-    what: "Run the application-wide proof GENERATED from your business law. By default it opens a blank\nlocal application through the same generated API tenant code uses, executes its business journey,\nsynchronizes, reopens, and reads the saved records back. --live runs that same business proof against\nNomos Cloud; identity, provisioning, persistence, and cleanup remain inside Nomos. ALL GREEN or it names the jam.",
-    examples: ["githolon proof", "githolon proof build/co2.proof.mts", "githolon proof --live"]
+    usage: "githolon proof [build/<name>.proof.mts] [--live] | githolon proof --upgrade [<ws|dir>] [--file <law.usdz>]",
+    what: "Run the application-wide proof GENERATED from your business law. By default it opens a blank\nlocal application through the same generated API tenant code uses, executes its business journey,\nsynchronizes, reopens, and reads the saved records back. --upgrade copies existing custody, replays the\ncandidate over its exact history, promotes only in memory, and cold-restarts it; the source stays read-only.\n--live runs the fresh proof against Nomos Cloud. ALL GREEN or it names the jam.",
+    flags: [
+      ["--upgrade [<ws|dir>]", "copy existing custody, replay the candidate over its exact history, promote only in memory, then cold-restart it"],
+      ["--target <name>", "use a named workspace target from nomos.project.ts when --upgrade has no explicit source"],
+      ["--file <law.usdz>", "candidate archive for --upgrade (default: the single build/*.law.usdz)"],
+      ["--acceptance-reason <why>", "account for an intentional historical outcome change; never inferred or supplied by Nomos"],
+      ["--live", "run the generated fresh-application proof against an isolated Nomos Cloud workspace"],
+      ["--performance", "repeat the local fresh-application proof and enforce its runtime budgets"]
+    ],
+    examples: [
+      "githolon proof",
+      "githolon proof --upgrade",
+      "githolon proof --upgrade ./custody",
+      "githolon proof --upgrade --target prod",
+      "githolon proof --live"
+    ]
   },
   test: {
     usage: "githolon test [test-file-or-flutter-test-flags] [--diagnostics]",
@@ -24265,9 +24289,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out13 = {};
-    for (const [k, x] of Object.entries(v)) out13[k] = capJsonStrings(x, max);
-    return out13;
+    const out14 = {};
+    for (const [k, x] of Object.entries(v)) out14[k] = capJsonStrings(x, max);
+    return out14;
   }
   return v;
 }
@@ -24630,6 +24654,267 @@ async function status(wsArg, opts) {
   return verdict.inSync ? 0 : 2;
 }
 
+// src/proof_upgrade.ts
+init_engine();
+init_cloud();
+init_local_holon();
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join13 } from "node:path";
+var WORKSPACE = "upgrade-proof";
+var ACTOR = "githolon-upgrade-proof";
+var out11 = (message) => void process.stdout.write(message + "\n");
+var err11 = (message) => void process.stderr.write("error: " + message + "\n");
+function flagValue(args, name) {
+  const exact = args.indexOf(name);
+  if (exact >= 0) {
+    const value = args[exact + 1];
+    if (value === void 0 || value.startsWith("--")) {
+      throw new Error(`${name} needs a value`);
+    }
+    return { value, indexes: [exact, exact + 1] };
+  }
+  const prefix = `${name}=`;
+  const inline = args.findIndex((argument) => argument.startsWith(prefix));
+  if (inline >= 0) {
+    const value = args[inline].slice(prefix.length).trim();
+    if (value.length === 0) throw new Error(`${name} needs a value`);
+    return { value, indexes: [inline] };
+  }
+  return { indexes: [] };
+}
+function parseUpgradeProofArguments(args) {
+  const upgradeIndex = args.findIndex((argument) => argument === "--upgrade" || argument.startsWith("--upgrade="));
+  if (upgradeIndex < 0) {
+    return { requested: false, consumed: /* @__PURE__ */ new Set() };
+  }
+  const consumed = /* @__PURE__ */ new Set([upgradeIndex]);
+  let source;
+  const upgrade = args[upgradeIndex];
+  if (upgrade.startsWith("--upgrade=")) {
+    source = upgrade.slice("--upgrade=".length).trim() || void 0;
+  } else {
+    const following = args[upgradeIndex + 1];
+    if (following !== void 0 && !following.startsWith("--") && !following.endsWith(".proof.mts")) {
+      source = following;
+      consumed.add(upgradeIndex + 1);
+    }
+  }
+  const target = flagValue(args, "--target");
+  const acceptance = flagValue(args, "--acceptance-reason");
+  const candidateFile = flagValue(args, "--file");
+  for (const index of [...target.indexes, ...acceptance.indexes, ...candidateFile.indexes]) consumed.add(index);
+  return {
+    requested: true,
+    ...source === void 0 ? {} : { source },
+    ...target.value === void 0 ? {} : { target: target.value },
+    ...acceptance.value === void 0 ? {} : { acceptanceReason: acceptance.value },
+    ...candidateFile.value === void 0 ? {} : { candidateFile: candidateFile.value },
+    consumed
+  };
+}
+function isLocalLedger(target) {
+  return existsSync11(target) || target.includes("/") || target.startsWith(".");
+}
+async function mountReadOnlyCopy(eng, source, cloud) {
+  if (!isLocalLedger(source)) {
+    const resident = /* @__PURE__ */ new Set();
+    const mountWithDependencies = async (workspace, mountName, ancestry) => {
+      if (resident.has(workspace)) return;
+      const ledger = {
+        remote: `${cloud}/v2/workspaces/${workspace}/git`,
+        headers: {},
+        readOnly: true
+      };
+      let mounted = await mountWorkspace(eng, mountName, ledger);
+      if (mounted.restored !== true && (mounted.requiredResidencies?.length ?? 0) > 0) {
+        for (const dependency of mounted.requiredResidencies ?? []) {
+          if (ancestry.includes(dependency.workspace)) {
+            throw new Error(`cyclic custody readiness while opening ${[...ancestry, dependency.workspace].join(" -> ")}`);
+          }
+          await mountWithDependencies(
+            dependency.workspace,
+            dependency.workspace,
+            [...ancestry, dependency.workspace]
+          );
+        }
+        mounted = await mountWorkspace(eng, mountName, ledger);
+      }
+      if (mounted.restored !== true) {
+        throw new Error(
+          `workspace '${workspace}' has no readable refs/heads/main on ${cloud}` + (mounted.restoreError ? ` (${String(mounted.restoreError).split(" | ")[0]})` : "")
+        );
+      }
+      resident.add(workspace);
+    };
+    await mountWithDependencies(source, WORKSPACE, [source]);
+    const dependencyCount = Math.max(0, resident.size - 1);
+    return {
+      location: `cloud custody${dependencyCount > 0 ? ` + ${dependencyCount} referenced workspace(s)` : ""}`,
+      rawLocalCopy: false
+    };
+  }
+  const gitDir = existsSync11(join13(source, ".git")) ? join13(source, ".git") : source;
+  if (!existsSync11(join13(gitDir, "HEAD"))) {
+    throw new Error(`${source} is not a GitHolon ledger (no HEAD)`);
+  }
+  await mountFresh(eng, WORKSPACE);
+  const workspaceDir = eng.preopen.dir.contents.get("ws").contents.get(WORKSPACE);
+  workspaceDir.contents.set("nomos.git", readTreeFromDisk(gitDir));
+  const head = kgit.resolveRef(eng, gitdirOf(WORKSPACE), "refs/heads/main");
+  if (!head) throw new Error(`${source} has no refs/heads/main`);
+  return { location: "local custody copy", rawLocalCopy: true };
+}
+function tenantPredecessors(candidateDomains, current, frameworkHashes) {
+  return [...new Set(candidateDomains.map((domain) => current[domain]).filter((hash) => typeof hash === "string" && !frameworkHashes.has(hash)))];
+}
+function printDifferences(report) {
+  out11(`  replayed  ${report.replayedIntents} historical intent(s); ${report.candidateIntents} candidate action(s)`);
+  for (const difference of report.divergences.slice(0, 12)) {
+    const location = [difference.domain, difference.directiveId].filter(Boolean).join(".");
+    out11(`  changed   ${difference.kind}${location ? ` at ${location}` : ""}: ${difference.detail}`);
+  }
+  if (report.divergences.length > 12) out11(`  changed   + ${report.divergences.length - 12} more difference(s)`);
+}
+function localAuthorIdentity() {
+  const credentials = loadCreds();
+  const actor = activePrincipal() ?? ACTOR;
+  const device = getDeviceKey(actor);
+  const session = credentials.session?.uid === actor ? credentials.session : void 0;
+  return {
+    actor,
+    ...device?.secret ? { authorSecret: device.secret } : {},
+    ...session?.accessToken ? { authToken: session.accessToken } : {}
+  };
+}
+async function runUpgradeProof(sourceArg, lawUsdzPath, opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  let source;
+  try {
+    source = await resolveWorkspace(
+      sourceArg,
+      process.cwd(),
+      opts.target,
+      "githolon proof --upgrade <ws|dir>"
+    );
+  } catch (error) {
+    err11(error.message);
+    return 1;
+  }
+  try {
+    const identity = localAuthorIdentity();
+    const { eng: sourceEngine, runtime } = await holonEngine(cloud, identity.actor);
+    const mounted = await mountReadOnlyCopy(sourceEngine, source, cloud);
+    const sourceVerdict = verifyChainLocal(sourceEngine, WORKSPACE);
+    if (sourceVerdict.valid !== true) {
+      throw new Error(`source chain is invalid at ${String(sourceVerdict.check ?? "verify_chain")}: ${String(sourceVerdict.error ?? "unknown refusal")}`);
+    }
+    let eng = sourceEngine;
+    if (mounted.rawLocalCopy) {
+      const sourceHead = kgit.resolveRef(sourceEngine, gitdirOf(WORKSPACE), "refs/heads/main");
+      if (!sourceHead) throw new Error("verified source custody has no main head");
+      const sourcePack = packDelta(sourceEngine, WORKSPACE, "", sourceHead);
+      if (!(sourcePack instanceof Uint8Array) || sourcePack.byteLength === 0) {
+        throw new Error("kernel produced no pack from the verified source custody copy");
+      }
+      ({ eng } = await holonEngine(cloud, identity.actor, "production", runtime));
+      await ingestPackAsCustody(eng, WORKSPACE, sourcePack, sourceHead);
+    }
+    const candidate = inspectLawArchive(eng, lawUsdzPath);
+    if (candidate.domainKeys.length === 0) throw new Error("candidate law archive carries no business domains");
+    const before = currentLaw(eng, WORKSPACE);
+    const predecessors = tenantPredecessors(
+      candidate.domainKeys,
+      before,
+      /* @__PURE__ */ new Set([eng.hashes.bootstrap, eng.hashes.nomos])
+    );
+    const alreadyCurrent = candidate.domainKeys.every((domain) => before[domain] === candidate.identity);
+    if (alreadyCurrent) {
+      out11(`githolon proof --upgrade \u2014 ${source} (${mounted.location})`);
+      out11(`\u2713 candidate ${candidate.identity.slice(0, 16)}\u2026 is already current for ${candidate.domainKeys.join(", ")}`);
+    } else {
+      if (predecessors.length === 0) {
+        throw new Error(
+          `the source does not currently serve any of the candidate domains (${candidate.domainKeys.join(", ")}); this is a first installation, so use \`githolon proof\` rather than an upgrade proof`
+        );
+      }
+      if (predecessors.length !== 1) {
+        throw new Error(
+          `candidate domains currently come from ${predecessors.length} different packages; Nomos will not guess which independent models this one package replaces`
+        );
+      }
+      const predecessor = predecessors[0];
+      const staged = author(
+        eng,
+        WORKSPACE,
+        "nomos",
+        "stageDomain",
+        closureInstallPayload(candidate.identity, identity.actor, { supersedes: predecessor }),
+        eng.hashes.nomos,
+        { ...identity, lawUsdz: candidate.lawUsdz }
+      );
+      if (staged.ok === false) throw new Error(`candidate staging refused: ${staged.error ?? "unknown refusal"}`);
+      const stagedHead = kgit.resolveRef(eng, gitdirOf(WORKSPACE), "refs/heads/main");
+      if (!stagedHead) throw new Error("candidate staging produced no current head");
+      const report = historyPreflight(
+        eng,
+        WORKSPACE,
+        candidate.domainKeys[0],
+        candidate.identity,
+        stagedHead,
+        identity.actor
+      );
+      out11(`githolon proof --upgrade \u2014 ${source} (${mounted.location}, never modified)`);
+      out11(`  current   ${predecessor.slice(0, 16)}\u2026`);
+      out11(`  candidate ${candidate.identity.slice(0, 16)}\u2026  (${candidate.domainKeys.join(", ")})`);
+      printDifferences(report);
+      if (!report.sourceVerified || !report.complete || !report.evolve.ok) {
+        throw new Error(
+          !report.sourceVerified ? "the source history did not verify" : !report.complete ? "the candidate could not re-derive every historical premise" : `typed evolution refused: ${report.evolve.violations.map((violation) => violation.detail).join("; ")}`
+        );
+      }
+      if (!report.promotable && !opts.acceptanceReason?.trim()) {
+        throw new Error(
+          'the candidate deliberately changes historical business outcomes; review the differences above, then rerun with --acceptance-reason "why this change is correct"'
+        );
+      }
+      const promoted = promotePreflighted(eng, WORKSPACE, candidate.domainKeys[0], candidate.identity, {
+        ...identity,
+        replaces: predecessor,
+        retireReplaced: true,
+        ...opts.acceptanceReason?.trim() ? { acceptanceReason: opts.acceptanceReason.trim() } : {}
+      });
+      if (!promoted.ok) throw new Error(`disposable promotion refused at ${promoted.stage}: ${promoted.error}`);
+      const active = currentLaw(eng, WORKSPACE);
+      for (const domain of candidate.domainKeys) {
+        if (active[domain] !== candidate.identity) {
+          throw new Error(`promotion completed but ${domain} does not resolve to the candidate model`);
+        }
+      }
+      out11(`\u2713 exact-history promotion admitted in the disposable copy`);
+    }
+    const warmVerdict = verifyChainLocal(eng, WORKSPACE);
+    if (warmVerdict.valid !== true) throw new Error(`promoted chain failed verification: ${String(warmVerdict.error ?? "unknown refusal")}`);
+    const head = kgit.resolveRef(eng, gitdirOf(WORKSPACE), "refs/heads/main");
+    if (!head) throw new Error("verified upgraded custody has no main head");
+    const pack = packDelta(eng, WORKSPACE, "", head);
+    if (!(pack instanceof Uint8Array) || pack.byteLength === 0) throw new Error("kernel produced no upgraded custody pack");
+    const { eng: cold } = await holonEngine(cloud, identity.actor, "production", runtime);
+    await ingestPackAsCustody(cold, WORKSPACE, pack, head);
+    const coldVerdict = verifyChainLocal(cold, WORKSPACE);
+    if (coldVerdict.valid !== true) throw new Error(`cold restart refused upgraded custody: ${String(coldVerdict.error ?? "unknown refusal")}`);
+    const coldLaw = currentLaw(cold, WORKSPACE);
+    for (const domain of candidate.domainKeys) {
+      if (coldLaw[domain] !== candidate.identity) throw new Error(`cold restart did not serve ${domain} from the candidate model`);
+    }
+    out11(`\u2713 cold restart serves the candidate at ${head.slice(0, 12)}\u2026`);
+    out11(`\u2713 UPGRADE PROOF GREEN \u2014 source custody was read-only; deployment may proceed through the ordinary offer lane`);
+    return 0;
+  } catch (error) {
+    err11(`upgrade proof failed: ${error.message ?? error}`);
+    return 1;
+  }
+}
+
 // src/cli.ts
 var KINDS = ["domain", "aggregate", "intent"];
 var DEFAULT_OUT = "domains";
@@ -24776,14 +25061,14 @@ function isKind(s) {
 function resolvedTsxCli() {
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname9(createRequire3(pathToFileURL5(join16(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname9(createRequire3(pathToFileURL5(join17(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname9(createRequire3(pathToFileURL5(join16(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname9(createRequire3(pathToFileURL5(join17(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
         return dirname9(createRequire3(import.meta.url).resolve("@githolon/dsl/package.json"));
@@ -24794,13 +25079,13 @@ function resolvedTsxCli() {
   })();
   const tsxDir = resolvePkgDir("tsx", process.cwd()) ?? (dslDir !== void 0 ? resolvePkgDir("tsx", dslDir) : void 0);
   if (tsxDir === void 0) throw new Error("tsx not found \u2014 add @githolon/dsl to the project and npm install");
-  const tsxPkg = JSON.parse(readFileSync12(join16(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync12(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.tsx;
-  return join16(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  return join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
 }
 async function runGeneratedApplicationProofLocally(proofPath, onPerformance) {
   const lawUsdzPath = proofPath.replace(/\.proof\.mts$/, ".law.usdz");
-  if (lawUsdzPath === proofPath || !existsSync15(lawUsdzPath)) {
+  if (lawUsdzPath === proofPath || !existsSync16(lawUsdzPath)) {
     throw new Error(`generated application proof needs its canonical sibling law archive: ${lawUsdzPath}`);
   }
   const here = dirname9(fileURLToPath3(import.meta.url));
@@ -24812,14 +25097,14 @@ async function runGeneratedApplicationProofLocally(proofPath, onPerformance) {
     resolve7(here, "dev-server.mjs"),
     resolve7(here, "../dist/dev-server.mjs")
   ];
-  const serverPath = serverCandidates.find((candidate) => existsSync15(candidate));
+  const serverPath = serverCandidates.find((candidate) => existsSync16(candidate));
   if (serverPath === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
   const candidateRuntime = process.env.NOMOS_CANDIDATE_RUNTIME ?? process.env.NOMOS_OFFLINE_RUNTIME;
-  const candidateTestMint = candidateRuntime === void 0 ? void 0 : join16(candidateRuntime, "holon-testmint.wasm");
+  const candidateTestMint = candidateRuntime === void 0 ? void 0 : join17(candidateRuntime, "holon-testmint.wasm");
   const priorLocalWasm = process.env.NOMOS_LOCAL_WASM;
-  if (candidateTestMint !== void 0 && existsSync15(candidateTestMint)) process.env.NOMOS_LOCAL_WASM = candidateTestMint;
+  if (candidateTestMint !== void 0 && existsSync16(candidateTestMint)) process.env.NOMOS_LOCAL_WASM = candidateTestMint;
   const module = await import(pathToFileURL5(serverPath).href);
   if (typeof module.startGeneratedApplicationProofCloud !== "function") {
     throw new Error("the bundled local Nomos cloud predates generated application execution \u2014 rebuild githolon");
@@ -24899,6 +25184,12 @@ async function runProof(args) {
   };
   const live = args.includes("--live");
   const performance2 = args.includes("--performance");
+  let upgrade;
+  try {
+    upgrade = parseUpgradeProofArguments(args);
+  } catch (error) {
+    return refuse(error.message);
+  }
   const samplesFlag = args.findIndex((argument) => argument === "--samples");
   const samplesValueIdx = samplesFlag < 0 ? -1 : samplesFlag + 1;
   const performanceSamples = samplesFlag < 0 ? 5 : Number(args[samplesFlag + 1]);
@@ -24906,6 +25197,8 @@ async function runProof(args) {
     return refuse("--samples needs an integer from 1 to 20");
   }
   if (live && performance2) return refuse("--performance is a local release gate; use the production-configured app gate for live deployment evidence");
+  if (upgrade.requested && live) return refuse("--upgrade proves copied existing custody locally; it cannot be combined with --live");
+  if (upgrade.requested && performance2) return refuse("--performance measures the generated fresh journey; --upgrade instead proves the exact existing history");
   if (args.includes("--keep")) return refuse("--keep no longer applies: proof --live owns its isolated acceptance workspace and preserves its verified history");
   let domainValueIdx = -1;
   const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
@@ -24914,14 +25207,36 @@ async function runProof(args) {
     if (!a.includes("=")) domainValueIdx = di + 1;
     return refuse("--domain has been removed: the generated proof exercises the whole application through its one business API");
   }
-  const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx && i !== samplesValueIdx);
+  const explicit = args.find(
+    (a, i) => !a.startsWith("--") && i !== domainValueIdx && i !== samplesValueIdx && !upgrade.consumed.has(i)
+  );
+  if (upgrade.requested) {
+    let lawUsdzPath;
+    try {
+      if (explicit?.endsWith(".proof.mts")) {
+        const explicitProof = resolve7(process.cwd(), explicit);
+        lawUsdzPath = explicitProof.replace(/\.proof\.mts$/, ".law.usdz");
+        if (!existsSync16(lawUsdzPath)) throw new Error(`generated proof has no canonical sibling law archive: ${lawUsdzPath}`);
+      } else if (explicit !== void 0) {
+        return refuse(`unexpected positional '${explicit}' \u2014 pass custody to --upgrade and candidate law with --file <law.usdz>`);
+      } else {
+        lawUsdzPath = discoverLawUsdz(process.cwd(), upgrade.candidateFile);
+      }
+    } catch (error) {
+      return refuse(error.message);
+    }
+    return runUpgradeProof(upgrade.source, lawUsdzPath, {
+      ...upgrade.target === void 0 ? {} : { target: upgrade.target },
+      ...upgrade.acceptanceReason === void 0 ? {} : { acceptanceReason: upgrade.acceptanceReason }
+    });
+  }
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve7(process.cwd(), explicit);
-    if (!existsSync15(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    if (!existsSync16(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join16(process.cwd(), "build");
-    if (!existsSync15(buildDir)) {
+    const buildDir = join17(process.cwd(), "build");
+    if (!existsSync16(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync6(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -24931,7 +25246,7 @@ async function runProof(args) {
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join16(buildDir, proofs[0]);
+    proofPath = join17(buildDir, proofs[0]);
   }
   if (!live) {
     try {
@@ -25113,10 +25428,10 @@ async function main(argv) {
     };
     const lawArg = pull("--law");
     const workspace = pull("--workspace") ?? "test-ws";
-    const out13 = pull("--out");
+    const out14 = pull("--out");
     const runtime = pull("--runtime");
     const law = (lawArg ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-    if (law.length === 0 || out13 === void 0) {
+    if (law.length === 0 || out14 === void 0) {
       process.stderr.write(
         `error: usage: githolon harness-install --law <law.usdz[,law.usdz...]> --workspace <ws> --out <snapshotPath> [--runtime <dir>]
 `
@@ -25124,7 +25439,7 @@ async function main(argv) {
       return 1;
     }
     const { harnessInstall: harnessInstall2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
-    return harnessInstall2({ law, workspace, out: out13, ...runtime !== void 0 ? { runtime } : {} });
+    return harnessInstall2({ law, workspace, out: out14, ...runtime !== void 0 ? { runtime } : {} });
   }
   if (argv[0] === "dev") {
     const rest = argv.slice(1);
@@ -25190,7 +25505,7 @@ usage: githolon cloud dev [--port <n>] [--data <dir>] [--ephemeral]
       resolve7(here, "../../../cloud/dev-server/server.mjs"),
       resolve7(process.cwd(), "cloud/dev-server/server.mjs")
     ];
-    const serverPath = candidates.find((p) => existsSync15(p));
+    const serverPath = candidates.find((p) => existsSync16(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;
@@ -25647,8 +25962,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err13) {
-    process.stderr.write(`error: ${err13.message}
+  } catch (err14) {
+    process.stderr.write(`error: ${err14.message}
 
 ${USAGE}`);
     return 1;
@@ -25667,8 +25982,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path2}
 `);
     return 0;
-  } catch (err13) {
-    process.stderr.write(`error: ${err13.message}
+  } catch (err14) {
+    process.stderr.write(`error: ${err14.message}
 `);
     return 1;
   }