githolon 0.105.3 → 0.105.5

package/dist/compile_mountability_entry.js

@@ -587,6 +587,7 @@ __export(engine_exports, {
   cryptoUnwrapKey: () => cryptoUnwrapKey,
   cryptoWrapKey: () => cryptoWrapKey,
   currentLaw: () => currentLaw,
+  custodyConfirmedMain: () => custodyConfirmedMain,
   declaredCapabilities: () => declaredCapabilities,
   deepVerifyShard: () => deepVerifyShard,
   delegationCertSign: () => delegationCertSign,
@@ -613,6 +614,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
   kgit: () => kgit,
@@ -1645,6 +1647,40 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     const s0 = Date.now();
     return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
   };
+  let footageRef = null;
+  {
+    const parked = [];
+    for (const offer of Array.isArray(offers) ? offers : []) {
+      let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+      try {
+        if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
+      } catch {
+      }
+      if (blob && blob.byteLength) parked.push(blob);
+    }
+    if (parked.length) {
+      footageRef = `refs/heads/parked/offered/${t0.toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
+      const footageDone = span("park offer footage", "cseal", 1, { offers: parked.length });
+      try {
+        kgit.writeMetaCommit(eng, gitdirOf(ws), {
+          parents: [],
+          files: parked.map((bytes, i) => ({ path: `${i}.change.usda`, bytes })),
+          message: `offered: ${parked.length} intent(s) parked pre-judgment (footage-first)`,
+          timeSecs: 0,
+          ref: footageRef
+        });
+        await custodyPush(eng, ws, ledger, { remoteRef: footageRef });
+      } catch (e) {
+        try {
+          kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+        } catch {
+        }
+        throw new Error(`offer footage not durable \u2014 custody unreachable, nothing was folded; retry the batch: ${String(e).slice(0, 300)}`, { cause: e });
+      } finally {
+        footageDone();
+      }
+    }
+  }
   for (const offer of Array.isArray(offers) ? offers : []) {
     const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
     const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
@@ -1720,10 +1756,13 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
+  let refusalsParked = true;
   if (deadLetters.length) {
     try {
-      await materializeRefused(eng, ws, ledger, deadLetters);
+      const m = await materializeRefused(eng, ws, ledger, deadLetters);
+      refusalsParked = m.unparkedSessions.size === 0;
     } catch (e) {
+      refusalsParked = false;
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
@@ -1732,6 +1771,17 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     await commitAndPush(eng, ws, ledger);
     sealDone();
   }
+  if (footageRef && refusalsParked) {
+    try {
+      kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+    } catch {
+    }
+    try {
+      await custodyPush(eng, ws, ledger, { remoteRef: footageRef, del: true });
+    } catch (e) {
+      log("footage-delete-push-failed", { ws, ref: footageRef, error: String(e).slice(0, 200) });
+    }
+  }
   const gitdir = gitdirOf(ws);
   const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
@@ -1745,7 +1795,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, sealed: true, sealedMain: custodyConfirmedMain(eng, ws), deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 function intentOfferResidencies(eng, offers) {
   const unique = /* @__PURE__ */ new Map();
@@ -1877,6 +1927,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
+      custodyMainOf(eng).set(ws, remoteMain);
       verificationVerdict = jsStruct(mounted.verdict);
     }
   } catch (e) {
@@ -2347,7 +2398,7 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null, ffOnly = false }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   let remote;
@@ -2363,22 +2414,46 @@ async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del =
   }
   const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
   if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
-  if (tgt === oldOid) return;
+  if (tgt === oldOid) {
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng).set(ws, tgt);
+    return;
+  }
   let pack = null;
   if (!pointer) {
     pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
+    if (!pack && ffOnly && oldOid !== ZERO_OID) {
+      throw new Error(`custody ${remoteRefFull} regression refused: remote ${oldOid.slice(0, 12)} is not an ancestor of local ${tgt.slice(0, 12)} \u2014 this engine's view is stale; re-mount from custody instead of forcing`);
+    }
     if (!pack) pack = packDelta(eng, ws, "", tgt);
   }
   const packBytes = pack?.byteLength ?? 0;
   try {
-    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    const r = await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng).set(ws, tgt);
+    return r;
   } catch (error) {
     throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
   }
 }
+function custodyMainOf(eng) {
+  eng._custodyMain ??= /* @__PURE__ */ new Map();
+  return eng._custodyMain;
+}
+function custodyConfirmedMain(eng, ws) {
+  return custodyMainOf(eng).get(ws) ?? null;
+}
+function isDirty(eng, ws) {
+  try {
+    const resident = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+    if (!resident) return false;
+    return resident !== custodyMainOf(eng).get(ws);
+  } catch {
+    return false;
+  }
+}
 async function commitAndPush(eng, ws, ledger) {
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     unmount(eng, ws);
     const cause = e instanceof Error ? e.cause : void 0;
@@ -2781,6 +2856,80 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       _sessionDone();
     }
   }
+  const offeredRefPrefix = "refs/heads/parked/offered/";
+  const footageConsumed = [];
+  const footageBorn = [], footageBirthOutcomes = [];
+  try {
+    const offeredRefs = Object.entries(await custodyLsRefs(ledger, offeredRefPrefix));
+    for (const [oref, ooid] of offeredRefs) {
+      if (!oref.startsWith(offeredRefPrefix) || !ooid) continue;
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      const _fDone = _span(`footage ${fcid.slice(0, 24)}`, "csession", 1, { client: fcid });
+      const admitted = [], rejected = [], skipped = [];
+      try {
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: kgit.resolveRef(eng, gitdir, BRANCH) });
+        } catch {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: null });
+        }
+        const main = await mainIntentIds(eng, ws);
+        for (let i = 0; ; i++) {
+          let blob = null;
+          try {
+            blob = kgit.readBlob(eng, gitdir, ooid, `${i}.change.usda`);
+          } catch {
+            blob = null;
+          }
+          if (!blob || !blob.byteLength) break;
+          try {
+            const inspected = kgit.inspectChange(eng, blob);
+            const intentId = inspected.intentId || null;
+            const oid = String(intentId || `${fcid}#${i}`).slice(0, 10);
+            if (!inspected.authored || !inspected.call) {
+              rejected.push({ oid, error: "parked offer is not an authored nominal call" });
+              continue;
+            }
+            const { domainPath: dom, directivePath: dirId } = inspected.call;
+            if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+              const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+              continue;
+            }
+            if (intentId && main.ids.has(intentId)) {
+              skipped.push({ oid, intent: intentId, alreadyOnMain: true });
+              continue;
+            }
+            const res = offerAdmit(eng, ws, blob, { defer: canDeferProjection });
+            if (res.ok) {
+              if (intentId) main.ids.add(intentId);
+              main.oids.add(res.head);
+              main.head = res.head;
+              admitted.push({ oid, intent: intentId, head: res.head });
+              totalAdmitted += 1;
+              _intents += 1;
+              if (Array.isArray(res.born) && res.born.length) footageBorn.push(...res.born);
+              if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) footageBirthOutcomes.push(...res.birthOutcomes);
+            } else {
+              const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+            }
+          } catch (e) {
+            rejected.push({ oid: `${fcid}#${i}`.slice(0, 10), error: String(e).slice(0, 200) });
+          }
+        }
+        footageConsumed.push(oref);
+        results.push({ session: fcid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+      } catch (e) {
+        results.push({ session: fcid, error: String(e).slice(0, 200) });
+      } finally {
+        _fDone({ admitted: admitted.length, rejected: rejected.length });
+      }
+    }
+  } catch (e) {
+    log("footage-scan-failed", { ws, error: String(e).slice(0, 200) });
+  }
   if (canDeferProjection && totalAdmitted) {
     const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
     try {
@@ -2804,7 +2953,8 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
   const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
   const deferDurability = defer && !hasCoordination;
   let _sealed = true;
-  if (totalAdmitted && !deferDurability) {
+  const sealNeeded = totalAdmitted > 0 || isDirty(eng, ws);
+  if (sealNeeded && !deferDurability) {
     const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
     const _s = Date.now();
     try {
@@ -2824,17 +2974,38 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       } catch {
       }
     }
+    for (const oref of footageConsumed) {
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      if (unparkedSessions.has(fcid)) continue;
+      try {
+        kgit.deleteRef(eng, gitdir, oref);
+      } catch {
+      }
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: oref, del: true });
+      } catch {
+      }
+    }
   }
   const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
-  log("admit", { ws, sessions: results.length, main: newMain });
+  log("admit", { ws, sessions: results.length, main: newMain, sealed: _sealed, sealedMain: custodyConfirmedMain(eng, ws) });
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
   const _total = Date.now() - _t0;
   const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
   return {
+    // SCOREBOARD TRUTH: `main` is the resident fold head (the ack the client converges to);
+    // `sealedMain` is the custody-confirmed head — THE ONLY head the host may advertise/cache
+    // (seated_barrier_and_seal_obligation.md Part 2). `sealed:false` ⇒ the seal obligation is
+    // outstanding and the caller must re-arm the admit alarm (retry) rather than move on.
     sessions: results,
     main: newMain,
+    sealed: _sealed,
+    sealedMain: custodyConfirmedMain(eng, ws),
     deadLetters,
     timings,
+    // Footage-replayed `.births()` offers: the born child custody + typed verdicts, for the caller
+    // to persist exactly as the live POST lane does (packed here — the caller holds no engine FS).
+    ...footageBorn.length ? { born: packBornChildren(eng, footageBorn), birthOutcomes: footageBirthOutcomes } : {},
     ...summary ? { summary } : {},
     ...placements.length ? { placements } : {},
     ...splits.length ? { splits } : {},
@@ -2848,7 +3019,7 @@ async function backupHead(eng, ws, ledger, head) {
   if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
   if (!head) return { ok: false, error: "no head" };
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head, ffOnly: true });
     return { ok: true, head };
   } catch (e) {
     return { ok: false, error: String(e?.message || e).slice(0, 200), head };
@@ -2861,7 +3032,7 @@ async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
   head = kgit.resolveRef(eng, gitdir, BRANCH);
   if (!head) return { ok: false, error: "no local main" };
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     return { ok: false, error: String(e).slice(0, 200), head };
   }

package/dist/dev-server.mjs

@@ -936,6 +936,40 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     const s0 = Date.now();
     return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
   };
+  let footageRef = null;
+  {
+    const parked = [];
+    for (const offer of Array.isArray(offers) ? offers : []) {
+      let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+      try {
+        if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
+      } catch {
+      }
+      if (blob && blob.byteLength) parked.push(blob);
+    }
+    if (parked.length) {
+      footageRef = `refs/heads/parked/offered/${t0.toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
+      const footageDone = span("park offer footage", "cseal", 1, { offers: parked.length });
+      try {
+        kgit.writeMetaCommit(eng, gitdirOf(ws), {
+          parents: [],
+          files: parked.map((bytes, i) => ({ path: `${i}.change.usda`, bytes })),
+          message: `offered: ${parked.length} intent(s) parked pre-judgment (footage-first)`,
+          timeSecs: 0,
+          ref: footageRef
+        });
+        await custodyPush(eng, ws, ledger, { remoteRef: footageRef });
+      } catch (e) {
+        try {
+          kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+        } catch {
+        }
+        throw new Error(`offer footage not durable \u2014 custody unreachable, nothing was folded; retry the batch: ${String(e).slice(0, 300)}`, { cause: e });
+      } finally {
+        footageDone();
+      }
+    }
+  }
   for (const offer of Array.isArray(offers) ? offers : []) {
     const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
     const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
@@ -1011,10 +1045,13 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
+  let refusalsParked = true;
   if (deadLetters.length) {
     try {
-      await materializeRefused(eng, ws, ledger, deadLetters);
+      const m = await materializeRefused(eng, ws, ledger, deadLetters);
+      refusalsParked = m.unparkedSessions.size === 0;
     } catch (e) {
+      refusalsParked = false;
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
@@ -1023,6 +1060,17 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     await commitAndPush(eng, ws, ledger);
     sealDone();
   }
+  if (footageRef && refusalsParked) {
+    try {
+      kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+    } catch {
+    }
+    try {
+      await custodyPush(eng, ws, ledger, { remoteRef: footageRef, del: true });
+    } catch (e) {
+      log("footage-delete-push-failed", { ws, ref: footageRef, error: String(e).slice(0, 200) });
+    }
+  }
   const gitdir = gitdirOf(ws);
   const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
@@ -1036,7 +1084,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, sealed: true, sealedMain: custodyConfirmedMain(eng, ws), deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 function intentOfferResidencies(eng, offers) {
   const unique = /* @__PURE__ */ new Map();
@@ -1093,6 +1141,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
+      custodyMainOf(eng).set(ws, remoteMain);
       verificationVerdict = jsStruct(mounted.verdict);
     }
   } catch (e) {
@@ -1245,7 +1294,7 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null, ffOnly = false }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   let remote;
@@ -1261,22 +1310,46 @@ async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del =
   }
   const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
   if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
-  if (tgt === oldOid) return;
+  if (tgt === oldOid) {
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng).set(ws, tgt);
+    return;
+  }
   let pack = null;
   if (!pointer) {
     pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
+    if (!pack && ffOnly && oldOid !== ZERO_OID) {
+      throw new Error(`custody ${remoteRefFull} regression refused: remote ${oldOid.slice(0, 12)} is not an ancestor of local ${tgt.slice(0, 12)} \u2014 this engine's view is stale; re-mount from custody instead of forcing`);
+    }
     if (!pack) pack = packDelta(eng, ws, "", tgt);
   }
   const packBytes = pack?.byteLength ?? 0;
   try {
-    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    const r = await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng).set(ws, tgt);
+    return r;
   } catch (error) {
     throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
   }
 }
+function custodyMainOf(eng) {
+  eng._custodyMain ??= /* @__PURE__ */ new Map();
+  return eng._custodyMain;
+}
+function custodyConfirmedMain(eng, ws) {
+  return custodyMainOf(eng).get(ws) ?? null;
+}
+function isDirty(eng, ws) {
+  try {
+    const resident = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+    if (!resident) return false;
+    return resident !== custodyMainOf(eng).get(ws);
+  } catch {
+    return false;
+  }
+}
 async function commitAndPush(eng, ws, ledger) {
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     unmount(eng, ws);
     const cause = e instanceof Error ? e.cause : void 0;
@@ -1602,6 +1675,80 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       _sessionDone();
     }
   }
+  const offeredRefPrefix = "refs/heads/parked/offered/";
+  const footageConsumed = [];
+  const footageBorn = [], footageBirthOutcomes = [];
+  try {
+    const offeredRefs = Object.entries(await custodyLsRefs(ledger, offeredRefPrefix));
+    for (const [oref, ooid] of offeredRefs) {
+      if (!oref.startsWith(offeredRefPrefix) || !ooid) continue;
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      const _fDone = _span(`footage ${fcid.slice(0, 24)}`, "csession", 1, { client: fcid });
+      const admitted = [], rejected = [], skipped = [];
+      try {
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: kgit.resolveRef(eng, gitdir, BRANCH) });
+        } catch {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: null });
+        }
+        const main = await mainIntentIds(eng, ws);
+        for (let i = 0; ; i++) {
+          let blob = null;
+          try {
+            blob = kgit.readBlob(eng, gitdir, ooid, `${i}.change.usda`);
+          } catch {
+            blob = null;
+          }
+          if (!blob || !blob.byteLength) break;
+          try {
+            const inspected = kgit.inspectChange(eng, blob);
+            const intentId = inspected.intentId || null;
+            const oid = String(intentId || `${fcid}#${i}`).slice(0, 10);
+            if (!inspected.authored || !inspected.call) {
+              rejected.push({ oid, error: "parked offer is not an authored nominal call" });
+              continue;
+            }
+            const { domainPath: dom, directivePath: dirId } = inspected.call;
+            if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+              const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+              continue;
+            }
+            if (intentId && main.ids.has(intentId)) {
+              skipped.push({ oid, intent: intentId, alreadyOnMain: true });
+              continue;
+            }
+            const res = offerAdmit(eng, ws, blob, { defer: canDeferProjection });
+            if (res.ok) {
+              if (intentId) main.ids.add(intentId);
+              main.oids.add(res.head);
+              main.head = res.head;
+              admitted.push({ oid, intent: intentId, head: res.head });
+              totalAdmitted += 1;
+              _intents += 1;
+              if (Array.isArray(res.born) && res.born.length) footageBorn.push(...res.born);
+              if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) footageBirthOutcomes.push(...res.birthOutcomes);
+            } else {
+              const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+            }
+          } catch (e) {
+            rejected.push({ oid: `${fcid}#${i}`.slice(0, 10), error: String(e).slice(0, 200) });
+          }
+        }
+        footageConsumed.push(oref);
+        results.push({ session: fcid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+      } catch (e) {
+        results.push({ session: fcid, error: String(e).slice(0, 200) });
+      } finally {
+        _fDone({ admitted: admitted.length, rejected: rejected.length });
+      }
+    }
+  } catch (e) {
+    log("footage-scan-failed", { ws, error: String(e).slice(0, 200) });
+  }
   if (canDeferProjection && totalAdmitted) {
     const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
     try {
@@ -1625,7 +1772,8 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
   const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
   const deferDurability = defer && !hasCoordination;
   let _sealed = true;
-  if (totalAdmitted && !deferDurability) {
+  const sealNeeded = totalAdmitted > 0 || isDirty(eng, ws);
+  if (sealNeeded && !deferDurability) {
     const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
     const _s = Date.now();
     try {
@@ -1645,17 +1793,38 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       } catch {
       }
     }
+    for (const oref of footageConsumed) {
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      if (unparkedSessions.has(fcid)) continue;
+      try {
+        kgit.deleteRef(eng, gitdir, oref);
+      } catch {
+      }
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: oref, del: true });
+      } catch {
+      }
+    }
   }
   const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
-  log("admit", { ws, sessions: results.length, main: newMain });
+  log("admit", { ws, sessions: results.length, main: newMain, sealed: _sealed, sealedMain: custodyConfirmedMain(eng, ws) });
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
   const _total = Date.now() - _t0;
   const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
   return {
+    // SCOREBOARD TRUTH: `main` is the resident fold head (the ack the client converges to);
+    // `sealedMain` is the custody-confirmed head — THE ONLY head the host may advertise/cache
+    // (seated_barrier_and_seal_obligation.md Part 2). `sealed:false` ⇒ the seal obligation is
+    // outstanding and the caller must re-arm the admit alarm (retry) rather than move on.
     sessions: results,
     main: newMain,
+    sealed: _sealed,
+    sealedMain: custodyConfirmedMain(eng, ws),
     deadLetters,
     timings,
+    // Footage-replayed `.births()` offers: the born child custody + typed verdicts, for the caller
+    // to persist exactly as the live POST lane does (packed here — the caller holds no engine FS).
+    ...footageBorn.length ? { born: packBornChildren(eng, footageBorn), birthOutcomes: footageBirthOutcomes } : {},
     ...summary ? { summary } : {},
     ...placements.length ? { placements } : {},
     ...splits.length ? { splits } : {},

package/dist/full-cli.mjs

@@ -4979,7 +4979,7 @@ function createGovernanceOffers(ctx) {
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
      */
-    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken } = {}) => {
+    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken, remote } = {}) => {
       if (!parent || typeof parent !== "string") throw new Error("parentSignerEnrollment requires `parent` (the workspace whose chain holds the signer tuple)");
       if (!principal || typeof principal !== "string") throw new Error("parentSignerEnrollment requires `principal` (the auth-provider uid)");
       const p = canonicalPrincipal(principal);
@@ -4989,7 +4989,7 @@ function createGovernanceOffers(ctx) {
       }
       const object = signerObjectOf(p);
       let rows;
-      if (parent === workspace) {
+      if (parent === workspace && !remote) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
@@ -5560,7 +5560,7 @@ async function checkCompat(holon, nomosCompat) {
   }
   return verdict;
 }
-async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
+async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, onLocalWorkRejected, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
@@ -5722,6 +5722,47 @@ ${String(commit).toLowerCase()}`;
     }
   };
   const onCustodyBreakOpt = typeof onCustodyBreak === "function" ? onCustodyBreak : null;
+  let localWorkRejectedHook = typeof onLocalWorkRejected === "function" ? onLocalWorkRejected : null;
+  const localWorkRejectedListeners = /* @__PURE__ */ new Set();
+  const refusalIsRetryable = (error) => {
+    try {
+      const d = authzDiagnosisFromRefusal(String(error ?? ""));
+      return d?.code === "nomos.authz.signer_enrollment_missing";
+    } catch {
+      return false;
+    }
+  };
+  const emitLocalWorkRejected = (source, refused, resetTo) => {
+    if (!refused.length) return;
+    const items = refused.map((r) => ({
+      intentId: typeof r.intentId === "string" ? r.intentId : null,
+      oid: typeof r.oid === "string" ? r.oid : null,
+      domain: typeof r.domain === "string" ? r.domain : null,
+      directiveId: typeof r.directiveId === "string" ? r.directiveId : null,
+      error: String(r.error ?? "the law refused this offer").slice(0, 600),
+      retryable: refusalIsRetryable(r.error)
+    }));
+    const event = {
+      workspace,
+      refused: items,
+      parked: true,
+      resetTo,
+      retryable: items.every((i) => i.retryable),
+      source
+    };
+    if (localWorkRejectedHook) {
+      try {
+        localWorkRejectedHook(event);
+      } catch {
+      }
+    }
+    for (const l of [...localWorkRejectedListeners]) {
+      try {
+        l(event);
+      } catch {
+      }
+    }
+  };
   function captureIncarnation(j) {
     const inc = j && typeof j.incarnation === "string" && OID40_RE.test(j.incarnation) ? j.incarnation : null;
     if (inc !== null) remoteIncarnation = inc;
@@ -6308,6 +6349,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
+    if (deadLettered.length) emitLocalWorkRejected("sync", deadLettered.map((d) => ({ intentId: d.id, error: d.error })), remoteHead);
     invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
@@ -8620,6 +8662,22 @@ ${String(commit).toLowerCase()}`;
       if (typeof cb === "function") custodyListeners.add(cb);
       return () => custodyListeners.delete(cb);
     },
+    /** THE LOCAL-WORK-REJECTED HOOK (settable; connect({onLocalWorkRejected}) is the default) — the
+     *  typed "the cloud refused work your device had accepted" lifecycle event. See
+     *  `LocalWorkRejectedEvent`: refused intents are already parked + survivors replayed when it
+     *  fires; the app's only job is honest UX (retryable ⇒ "queued, will retry"; terminal ⇒
+     *  "preserved for review — contact support"). */
+    get onLocalWorkRejected() {
+      return localWorkRejectedHook;
+    },
+    set onLocalWorkRejected(fn) {
+      localWorkRejectedHook = typeof fn === "function" ? fn : null;
+    },
+    /** Subscribe (multi-listener) to LocalWorkRejectedEvents. Returns an unsubscribe fn. */
+    onLocalWorkRejectedEvent: (cb) => {
+      if (typeof cb === "function") localWorkRejectedListeners.add(cb);
+      return () => localWorkRejectedListeners.delete(cb);
+    },
     /**
      * INTROSPECTION — where this holon sits on the custody spectrum:
      *  `{ incarnation, localGenesis, remoteIncarnation, syncPosture, pendingLocalIntents, salvagedIntents,
@@ -10089,6 +10147,10 @@ ${String(commit).toLowerCase()}`;
         });
         _convSpan.end();
         if (result && result.custodyBreak) return await resolveCustodyBreakFlow(result.custodyBreak, { operation: "sync" });
+        if (admissionRefusals && admissionRefusals.size) {
+          const refusedEntries = (admission?.sessions || []).flatMap((s) => (s.rejected || []).map((r) => ({ intentId: r.intent, oid: r.oid, error: r.error })));
+          emitLocalWorkRejected("admission", refusedEntries, result && typeof result.remoteMain === "string" ? result.remoteMain : null);
+        }
         try {
           result.stillAhead = await resolveBranchHead() !== syncedBase;
         } catch {
@@ -10872,7 +10934,14 @@ function routedHolon(coordinator, { cloud, workspace, clientId, authToken, fetch
     },
     set onCustodyBreak(fn) {
       coordinator.onCustodyBreak = fn;
-    }
+    },
+    get onLocalWorkRejected() {
+      return coordinator.onLocalWorkRejected;
+    },
+    set onLocalWorkRejected(fn) {
+      coordinator.onLocalWorkRejected = fn;
+    },
+    onLocalWorkRejectedEvent: (cb) => coordinator.onLocalWorkRejectedEvent(cb)
   };
 }
 async function inspectSnapshot(opts) {
@@ -11804,6 +11873,7 @@ __export(engine_exports, {
   cryptoUnwrapKey: () => cryptoUnwrapKey,
   cryptoWrapKey: () => cryptoWrapKey,
   currentLaw: () => currentLaw,
+  custodyConfirmedMain: () => custodyConfirmedMain,
   declaredCapabilities: () => declaredCapabilities,
   deepVerifyShard: () => deepVerifyShard,
   delegationCertSign: () => delegationCertSign,
@@ -11830,6 +11900,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
   kgit: () => kgit,
@@ -12862,6 +12933,40 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     const s0 = Date.now();
     return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
   };
+  let footageRef = null;
+  {
+    const parked = [];
+    for (const offer of Array.isArray(offers) ? offers : []) {
+      let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+      try {
+        if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
+      } catch {
+      }
+      if (blob && blob.byteLength) parked.push(blob);
+    }
+    if (parked.length) {
+      footageRef = `refs/heads/parked/offered/${t0.toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
+      const footageDone = span("park offer footage", "cseal", 1, { offers: parked.length });
+      try {
+        kgit.writeMetaCommit(eng, gitdirOf(ws), {
+          parents: [],
+          files: parked.map((bytes, i) => ({ path: `${i}.change.usda`, bytes })),
+          message: `offered: ${parked.length} intent(s) parked pre-judgment (footage-first)`,
+          timeSecs: 0,
+          ref: footageRef
+        });
+        await custodyPush(eng, ws, ledger, { remoteRef: footageRef });
+      } catch (e) {
+        try {
+          kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+        } catch {
+        }
+        throw new Error(`offer footage not durable \u2014 custody unreachable, nothing was folded; retry the batch: ${String(e).slice(0, 300)}`, { cause: e });
+      } finally {
+        footageDone();
+      }
+    }
+  }
   for (const offer of Array.isArray(offers) ? offers : []) {
     const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
     const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
@@ -12937,10 +13042,13 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
+  let refusalsParked = true;
   if (deadLetters.length) {
     try {
-      await materializeRefused(eng, ws, ledger, deadLetters);
+      const m = await materializeRefused(eng, ws, ledger, deadLetters);
+      refusalsParked = m.unparkedSessions.size === 0;
     } catch (e) {
+      refusalsParked = false;
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
@@ -12949,6 +13057,17 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     await commitAndPush(eng, ws, ledger);
     sealDone();
   }
+  if (footageRef && refusalsParked) {
+    try {
+      kgit.deleteRef(eng, gitdirOf(ws), footageRef);
+    } catch {
+    }
+    try {
+      await custodyPush(eng, ws, ledger, { remoteRef: footageRef, del: true });
+    } catch (e) {
+      log("footage-delete-push-failed", { ws, ref: footageRef, error: String(e).slice(0, 200) });
+    }
+  }
   const gitdir = gitdirOf(ws);
   const head = kgit.resolveRef(eng, gitdir, BRANCH2) ?? main2.head;
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
@@ -12962,7 +13081,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, sealed: true, sealedMain: custodyConfirmedMain(eng, ws), deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 function intentOfferResidencies(eng, offers) {
   const unique = /* @__PURE__ */ new Map();
@@ -13094,6 +13213,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
+      custodyMainOf(eng).set(ws, remoteMain);
       verificationVerdict = jsStruct2(mounted.verdict);
     }
   } catch (e) {
@@ -13564,7 +13684,7 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null, ffOnly = false }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   let remote;
@@ -13580,22 +13700,46 @@ async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del =
   }
   const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
   if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
-  if (tgt === oldOid) return;
+  if (tgt === oldOid) {
+    if (remoteRefFull === fullRef(BRANCH2)) custodyMainOf(eng).set(ws, tgt);
+    return;
+  }
   let pack = null;
   if (!pointer) {
     pack = oldOid !== ZERO_OID2 ? packDelta(eng, ws, oldOid, tgt) : null;
+    if (!pack && ffOnly && oldOid !== ZERO_OID2) {
+      throw new Error(`custody ${remoteRefFull} regression refused: remote ${oldOid.slice(0, 12)} is not an ancestor of local ${tgt.slice(0, 12)} \u2014 this engine's view is stale; re-mount from custody instead of forcing`);
+    }
     if (!pack) pack = packDelta(eng, ws, "", tgt);
   }
   const packBytes = pack?.byteLength ?? 0;
   try {
-    return await pushVia(ledger, () => pushPack2(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    const r = await pushVia(ledger, () => pushPack2(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    if (remoteRefFull === fullRef(BRANCH2)) custodyMainOf(eng).set(ws, tgt);
+    return r;
   } catch (error) {
     throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
   }
 }
+function custodyMainOf(eng) {
+  eng._custodyMain ??= /* @__PURE__ */ new Map();
+  return eng._custodyMain;
+}
+function custodyConfirmedMain(eng, ws) {
+  return custodyMainOf(eng).get(ws) ?? null;
+}
+function isDirty(eng, ws) {
+  try {
+    const resident = kgit.resolveRef(eng, gitdirOf(ws), BRANCH2);
+    if (!resident) return false;
+    return resident !== custodyMainOf(eng).get(ws);
+  } catch {
+    return false;
+  }
+}
 async function commitAndPush(eng, ws, ledger) {
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     unmount(eng, ws);
     const cause = e instanceof Error ? e.cause : void 0;
@@ -13998,6 +14142,80 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       _sessionDone();
     }
   }
+  const offeredRefPrefix = "refs/heads/parked/offered/";
+  const footageConsumed = [];
+  const footageBorn = [], footageBirthOutcomes = [];
+  try {
+    const offeredRefs = Object.entries(await custodyLsRefs(ledger, offeredRefPrefix));
+    for (const [oref, ooid] of offeredRefs) {
+      if (!oref.startsWith(offeredRefPrefix) || !ooid) continue;
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      const _fDone = _span(`footage ${fcid.slice(0, 24)}`, "csession", 1, { client: fcid });
+      const admitted = [], rejected = [], skipped = [];
+      try {
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: kgit.resolveRef(eng, gitdir, BRANCH2) });
+        } catch {
+          await custodyFetch(eng, ws, ledger, { remoteRef: oref, have: null });
+        }
+        const main2 = await mainIntentIds(eng, ws);
+        for (let i = 0; ; i++) {
+          let blob = null;
+          try {
+            blob = kgit.readBlob(eng, gitdir, ooid, `${i}.change.usda`);
+          } catch {
+            blob = null;
+          }
+          if (!blob || !blob.byteLength) break;
+          try {
+            const inspected = kgit.inspectChange(eng, blob);
+            const intentId = inspected.intentId || null;
+            const oid = String(intentId || `${fcid}#${i}`).slice(0, 10);
+            if (!inspected.authored || !inspected.call) {
+              rejected.push({ oid, error: "parked offer is not an authored nominal call" });
+              continue;
+            }
+            const { domainPath: dom, directivePath: dirId } = inspected.call;
+            if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+              const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+              continue;
+            }
+            if (intentId && main2.ids.has(intentId)) {
+              skipped.push({ oid, intent: intentId, alreadyOnMain: true });
+              continue;
+            }
+            const res = offerAdmit(eng, ws, blob, { defer: canDeferProjection });
+            if (res.ok) {
+              if (intentId) main2.ids.add(intentId);
+              main2.oids.add(res.head);
+              main2.head = res.head;
+              admitted.push({ oid, intent: intentId, head: res.head });
+              totalAdmitted += 1;
+              _intents += 1;
+              if (Array.isArray(res.born) && res.born.length) footageBorn.push(...res.born);
+              if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) footageBirthOutcomes.push(...res.birthOutcomes);
+            } else {
+              const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+            }
+          } catch (e) {
+            rejected.push({ oid: `${fcid}#${i}`.slice(0, 10), error: String(e).slice(0, 200) });
+          }
+        }
+        footageConsumed.push(oref);
+        results.push({ session: fcid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+      } catch (e) {
+        results.push({ session: fcid, error: String(e).slice(0, 200) });
+      } finally {
+        _fDone({ admitted: admitted.length, rejected: rejected.length });
+      }
+    }
+  } catch (e) {
+    log("footage-scan-failed", { ws, error: String(e).slice(0, 200) });
+  }
   if (canDeferProjection && totalAdmitted) {
     const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
     try {
@@ -14021,7 +14239,8 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
   const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
   const deferDurability = defer && !hasCoordination;
   let _sealed = true;
-  if (totalAdmitted && !deferDurability) {
+  const sealNeeded = totalAdmitted > 0 || isDirty(eng, ws);
+  if (sealNeeded && !deferDurability) {
     const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
     const _s = Date.now();
     try {
@@ -14041,17 +14260,38 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       } catch {
       }
     }
+    for (const oref of footageConsumed) {
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      if (unparkedSessions.has(fcid)) continue;
+      try {
+        kgit.deleteRef(eng, gitdir, oref);
+      } catch {
+      }
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: oref, del: true });
+      } catch {
+      }
+    }
   }
   const newMain = kgit.resolveRef(eng, gitdir, BRANCH2);
-  log("admit", { ws, sessions: results.length, main: newMain });
+  log("admit", { ws, sessions: results.length, main: newMain, sealed: _sealed, sealedMain: custodyConfirmedMain(eng, ws) });
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
   const _total = Date.now() - _t0;
   const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
   return {
+    // SCOREBOARD TRUTH: `main` is the resident fold head (the ack the client converges to);
+    // `sealedMain` is the custody-confirmed head — THE ONLY head the host may advertise/cache
+    // (seated_barrier_and_seal_obligation.md Part 2). `sealed:false` ⇒ the seal obligation is
+    // outstanding and the caller must re-arm the admit alarm (retry) rather than move on.
     sessions: results,
     main: newMain,
+    sealed: _sealed,
+    sealedMain: custodyConfirmedMain(eng, ws),
     deadLetters,
     timings,
+    // Footage-replayed `.births()` offers: the born child custody + typed verdicts, for the caller
+    // to persist exactly as the live POST lane does (packed here — the caller holds no engine FS).
+    ...footageBorn.length ? { born: packBornChildren(eng, footageBorn), birthOutcomes: footageBirthOutcomes } : {},
     ...summary ? { summary } : {},
     ...placements.length ? { placements } : {},
     ...splits.length ? { splits } : {},
@@ -14065,7 +14305,7 @@ async function backupHead(eng, ws, ledger, head) {
   if (!eng.mounted.has(ws)) return { ok: false, error: "not mounted" };
   if (!head) return { ok: false, error: "no head" };
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head, ffOnly: true });
     return { ok: true, head };
   } catch (e) {
     return { ok: false, error: String(e?.message || e).slice(0, 200), head };
@@ -14078,7 +14318,7 @@ async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
   head = kgit.resolveRef(eng, gitdir, BRANCH2);
   if (!head) return { ok: false, error: "no local main" };
   try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     return { ok: false, error: String(e).slice(0, 200), head };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.105.3",
+  "version": "0.105.5",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.105.3",
+    "@githolon/dsl": "^0.105.5",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"
   },