githolon 0.116.4 → 0.117.0

package/dist/full-cli.mjs

@@ -3707,18 +3707,18 @@ function mint(typeTag) {
 function recordIdentity(typeTag) {
   const queued = authoringContext?.preMintedRecords;
   if (queued === void 0 || queued.length === 0) return mint(typeTag);
-  const record = queued.shift();
-  if (record.type !== typeTag) {
+  const record2 = queued.shift();
+  if (record2.type !== typeTag) {
     throw new Error(
-      `Nomos reserved an owned '${record.type}' identity, but the law tried to create '${typeTag}'. The generated client and installed law disagree; recompile them together.`
+      `Nomos reserved an owned '${record2.type}' identity, but the law tried to create '${typeTag}'. The generated client and installed law disagree; recompile them together.`
     );
   }
-  if (!record.id.startsWith(`${typeTag}_`)) {
+  if (!record2.id.startsWith(`${typeTag}_`)) {
     throw new Error(
-      `Nomos reserved owned '${typeTag}' identity '${record.id}', but that id belongs to another type. The generated client and installed law disagree; recompile them together.`
+      `Nomos reserved owned '${typeTag}' identity '${record2.id}', but that id belongs to another type. The generated client and installed law disagree; recompile them together.`
     );
   }
-  return record.id;
+  return record2.id;
 }
 function create(agg) {
   const id = recordIdentity(__qualifyAggregateType(agg.id));
@@ -5656,10 +5656,10 @@ function readInheritedOperators() {
 function writeFoundingPrincipal(p) {
   const grantedBy = "genesis";
   const grantedAt = String(p.grantedAt);
-  const record = instance(FoundingPrincipal, FOUNDING_PRINCIPAL_ID);
+  const record2 = instance(FoundingPrincipal, FOUNDING_PRINCIPAL_ID);
   return [
-    set(record, "principal", p.principal),
-    set(record, "keyHash", p.keyHash),
+    set(record2, "principal", p.principal),
+    set(record2, "keyHash", p.keyHash),
     ...writeTuple({
       object: signerObject(p.principal),
       relation: SIGNER_RELATION,
@@ -5736,8 +5736,8 @@ var init_founding_genesis = __esm({
       parentIntent: t.string().merge(Lww)
     }).public();
     seedBirthOrigin = directive(SEED_BIRTH_ORIGIN_DIRECTIVE).ensures(BirthOrigin).payload(z16.object({ parent: z16.string().min(1), parentIntent: z16.string().min(1) }).strict()).plan((p) => {
-      const record = instance(BirthOrigin, BIRTH_ORIGIN_ID);
-      return [set(record, "parent", p.parent), set(record, "parentIntent", p.parentIntent)];
+      const record2 = instance(BirthOrigin, BIRTH_ORIGIN_ID);
+      return [set(record2, "parent", p.parent), set(record2, "parentIntent", p.parentIntent)];
     });
     birthOriginVirginOnly = workspaceInvariant("BirthOriginVirginOnly").on(SEED_BIRTH_ORIGIN_DIRECTIVE).reads(readSet(
       readRef("warrant", "GenesisWarrant").pre().at(GENESIS_WARRANT_ID),
@@ -6361,26 +6361,26 @@ var init_birth_meter2 = __esm({
       ];
     }).requires("admin");
     reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequiresRetired").on("reclaimChild").reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" }))).assert(
-      ({ record }, ctx) => record?.status === "retired" && sameLifecyclePrincipal(record.principal, ctx?.principal) ? { accept: true } : { reject: "reclaim-child-requires-retired" }
+      ({ record: record2 }, ctx) => record2?.status === "retired" && sameLifecyclePrincipal(record2.principal, ctx?.principal) ? { accept: true } : { reject: "reclaim-child-requires-retired" }
     );
     reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChildAsAdminRequiresRetired").on("reclaimChildAsAdmin").reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" }))).assert(
-      ({ record }) => record?.status === "retired" ? { accept: true } : { reject: "reclaim-child-requires-retired" }
+      ({ record: record2 }) => record2?.status === "retired" ? { accept: true } : { reject: "reclaim-child-requires-retired" }
     );
     retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaimed").on("retireChild").reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" }))).assert(
-      ({ record }) => record?.status === "reclaimed" ? { reject: "reclaimed-child-is-terminal" } : { accept: true }
+      ({ record: record2 }) => record2?.status === "reclaimed" ? { reject: "reclaimed-child-is-terminal" } : { accept: true }
     );
     retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsAdminNotReclaimed").on("retireChildAsAdmin").reads(readSet(readRef("record", NomosChildLifecycle).pre().fromPayload("child", { prefix: "nomos-child-lifecycle:" }))).assert(
-      ({ record }) => record?.status === "reclaimed" ? { reject: "reclaimed-child-is-terminal" } : { accept: true }
+      ({ record: record2 }) => record2?.status === "reclaimed" ? { reject: "reclaimed-child-is-terminal" } : { accept: true }
     );
     retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresBirth").on("retireChild").reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" }))).assert(({ birth: birth2 }, ctx) => {
-      const record = birth2;
+      const record2 = birth2;
       const intent2 = ctx?.intent;
-      return record?.child === intent2?.child && record?.principal === intent2?.principal && sameLifecyclePrincipal(record?.principal, ctx?.principal) ? { accept: true } : { reject: "retire-child-requires-exact-birth-record" };
+      return record2?.child === intent2?.child && record2?.principal === intent2?.principal && sameLifecyclePrincipal(record2?.principal, ctx?.principal) ? { accept: true } : { reject: "retire-child-requires-exact-birth-record" };
     });
     retireChildAsAdminRequiresBirth = workspaceInvariant("RetireChildAsAdminRequiresBirth").on("retireChildAsAdmin").reads(readSet(readRef("birth", NomosBirthRecord).pre().fromPayload("child", { prefix: "nomos-birth-record:" }))).assert(({ birth: birth2 }, ctx) => {
-      const record = birth2;
+      const record2 = birth2;
       const intent2 = ctx?.intent;
-      return record?.child === intent2?.child && record?.principal === intent2?.principal ? { accept: true } : { reject: "retire-child-requires-exact-birth-record" };
+      return record2?.child === intent2?.child && record2?.principal === intent2?.principal ? { accept: true } : { reject: "retire-child-requires-exact-birth-record" };
     });
     setBirthPolicy = directive("setBirthPolicy").ensures(BirthPolicy).payload(
       z20.object({
@@ -11443,7 +11443,7 @@ var init_pack_import_steps = __esm({
         this.#millisPerByte = this.#millisPerByte === void 0 ? sample : (this.#millisPerByte + sample) / 2;
       }
     };
-    yieldToQueuedWork = () => new Promise((resolve11) => setTimeout(resolve11, 0));
+    yieldToQueuedWork = () => new Promise((resolve12) => setTimeout(resolve12, 0));
   }
 });
 
@@ -12156,6 +12156,18 @@ function gitCustodyDesk(kernel, fetchImpl = fetch, observe, phaseStarted, import
         }
         const publish = async (allowReconcile) => {
           const oldHead = remote.get(reference) ?? ZERO_OID;
+          const expectedRemote = sealedMain.get(key2) ?? resolveRef(workspace, receiptRef(ledger)) ?? ZERO_OID;
+          if (allowReconcile && expectedRemote !== ZERO_OID && oldHead !== expectedRemote) {
+            remote = new Map(Object.entries(await lsRefs(
+              ledger.remote,
+              ledger.headers ?? {},
+              { service: "git-receive-pack", prefix: "refs/", signal: ledger.signal },
+              fetchImpl
+            )));
+            observedRemoteRefs.set(key2, remote);
+            await publish(false);
+            return;
+          }
           const bookmarkUpdates = [SYNC_BASE_REF, PLACEMENT_SYNC_BASE_REF].filter((ref2) => named.has(ref2) && remote.get(ref2) !== named.get(ref2)).map((ref2) => ({ ref: ref2, oldOid: remote.get(ref2) ?? ZERO_OID, newOid: named.get(ref2) }));
           const outcomeUpdates = cursors.filter(([ref2]) => ref2.startsWith(EFFECT_OUTCOME_PREFIX) && remote.get(ref2) === void 0).map(([ref2, oid]) => ({ ref: ref2, oldOid: ZERO_OID, newOid: oid }));
           const deliveryUpdates = cursors.filter(([ref2]) => ref2.startsWith(DELIVERY_PREFIX) && remote.get(ref2) === void 0).map(([ref2, oid]) => ({ ref: ref2, oldOid: ZERO_OID, newOid: oid }));
@@ -12165,7 +12177,6 @@ function gitCustodyDesk(kernel, fetchImpl = fetch, observe, phaseStarted, import
           if (ledger.readOnly) {
             throw new Error(`read-only custody for '${workspace}' does not hold the requested frontier`);
           }
-          const expectedRemote = sealedMain.get(key2) ?? resolveRef(workspace, receiptRef(ledger)) ?? ZERO_OID;
           let ancestryPack;
           if (oldHead !== expectedRemote && oldHead !== head) {
             if (oldHead !== ZERO_OID) {
@@ -12504,7 +12515,7 @@ function filesystemCustodyFetch(dataDir, origin, options = {}, networkFetch = fe
 async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, contentType, body }, options = {}) {
   const stdin = body && body.length ? await requestBodyStdin(body) : void 0;
   try {
-    return await new Promise((resolve11, reject) => {
+    return await new Promise((resolve12, reject) => {
       const env = {
         ...process.env,
         GIT_PROJECT_ROOT: projectRoot,
@@ -12579,7 +12590,7 @@ async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2,
           }
           headers[k] = v;
         }
-        resolve11({ status: status2, headers, body: payload });
+        resolve12({ status: status2, headers, body: payload });
       });
     });
   } finally {
@@ -12871,15 +12882,15 @@ function fileCheckpointStaging(files) {
 function deskCheckpointStaging(store) {
   const chunksOf = (slot) => {
     const chunks = [];
-    for (const record of store.list(NAMESPACE(slot)).filter((candidate) => candidate.key.startsWith("chunk-"))) {
-      if (record.key !== chunkKey(chunks.length)) break;
-      chunks.push(record.value);
+    for (const record2 of store.list(NAMESPACE(slot)).filter((candidate) => candidate.key.startsWith("chunk-"))) {
+      if (record2.key !== chunkKey(chunks.length)) break;
+      chunks.push(record2.value);
     }
     return chunks;
   };
   return {
     held(slot) {
-      const checkpoint = described(store.list(NAMESPACE(slot)).find((record) => record.key === META)?.value);
+      const checkpoint = described(store.list(NAMESPACE(slot)).find((record2) => record2.key === META)?.value);
       if (!checkpoint) return void 0;
       const chunks = chunksOf(slot);
       return { checkpoint, bytes: chunks.reduce((total, chunk) => total + chunk.byteLength, 0), chunks: chunks.length };
@@ -12901,8 +12912,8 @@ function deskCheckpointStaging(store) {
       return { pack };
     },
     clear(slot) {
-      for (const record of store.list(NAMESPACE(slot))) {
-        store.compareExchange(NAMESPACE(slot), record.key, record.revision, void 0);
+      for (const record2 of store.list(NAMESPACE(slot))) {
+        store.compareExchange(NAMESPACE(slot), record2.key, record2.revision, void 0);
       }
     }
   };
@@ -20229,14 +20240,14 @@ var init_peer_desk_store = __esm({
   "../peer-office/src/runtime/peer_desk_store.ts"() {
     "use strict";
     recordId = (namespace2, key2) => `${namespace2.length}:${namespace2}${key2}`;
-    copy2 = (record) => ({
-      ...record,
-      value: record.value.slice()
+    copy2 = (record2) => ({
+      ...record2,
+      value: record2.value.slice()
     });
     MemoryPeerDeskStore = class {
       #records = /* @__PURE__ */ new Map();
       list(namespace2) {
-        return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+        return [...this.#records.values()].filter((record2) => record2.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
       }
       compareExchange(namespace2, key2, expectedRevision, value) {
         const id = recordId(namespace2, key2);
@@ -20284,22 +20295,22 @@ var init_custody_receipts = __esm({
       #receipts = /* @__PURE__ */ new Map();
       constructor(store = new MemoryPeerDeskStore()) {
         this.#store = store;
-        for (const record of store.list(namespace)) {
-          this.#records.set(record.key, record);
+        for (const record2 of store.list(namespace)) {
+          this.#records.set(record2.key, record2);
           try {
-            if (record.key.startsWith("receipt:")) {
-              const newline = record.value.indexOf(10);
+            if (record2.key.startsWith("receipt:")) {
+              const newline = record2.value.indexOf(10);
               if (newline < 0) continue;
-              const receipt = fromBinary14(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
-              const header2 = JSON.parse(decoder2.decode(record.value.subarray(0, newline)));
-              if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record.key, { ...header2, receipt });
+              const receipt = fromBinary14(CustodyIntentAdmissionSchema, record2.value.subarray(newline + 1));
+              const header2 = JSON.parse(decoder2.decode(record2.value.subarray(0, newline)));
+              if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record2.key, { ...header2, receipt });
               continue;
             }
-            if (!record.key.startsWith("head:")) continue;
-            const value = JSON.parse(decoder2.decode(record.value));
+            if (!record2.key.startsWith("head:")) continue;
+            const value = JSON.parse(decoder2.decode(record2.value));
             if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
             if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key2) => typeof key2 === "string")) continue;
-            this.#journals.set(record.key.slice(5), value);
+            this.#journals.set(record2.key.slice(5), value);
           } catch {
           }
         }
@@ -20336,8 +20347,8 @@ var init_custody_receipts = __esm({
           const bytes = new Uint8Array(header2.length + body.length);
           bytes.set(header2);
           bytes.set(body, header2.length);
-          const record2 = this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, bytes);
-          if (record2) this.#records.set(key2, record2);
+          const record3 = this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, bytes);
+          if (record3) this.#records.set(key2, record3);
           this.#receipts.set(key2, {
             generation: value.generation,
             head: after,
@@ -20352,13 +20363,13 @@ var init_custody_receipts = __esm({
           this.#records.delete(key2);
           this.#receipts.delete(key2);
         }
-        const record = this.#store.compareExchange(
+        const record2 = this.#store.compareExchange(
           namespace,
           journalKey,
           this.#records.get(journalKey)?.revision,
           encoder2.encode(JSON.stringify(value))
         );
-        if (record) this.#records.set(journalKey, record);
+        if (record2) this.#records.set(journalKey, record2);
         this.#journals.set(workspace, value);
       }
     };
@@ -20494,12 +20505,12 @@ var init_birth_refusal = __esm({
       #load() {
         if (this.#records === void 0) {
           this.#records = /* @__PURE__ */ new Map();
-          for (const record of this.#store.list(BIRTH_REFUSAL_NAMESPACE)) {
-            const value = JSON.parse(decoder3.decode(record.value));
-            if (value.version !== 1 || value.refusal?.child !== record.key) {
-              throw new Error(`corrupt birth refusal '${record.key}' at revision ${record.revision}`);
+          for (const record2 of this.#store.list(BIRTH_REFUSAL_NAMESPACE)) {
+            const value = JSON.parse(decoder3.decode(record2.value));
+            if (value.version !== 1 || value.refusal?.child !== record2.key) {
+              throw new Error(`corrupt birth refusal '${record2.key}' at revision ${record2.revision}`);
             }
-            this.#records.set(record.key, { refusal: Object.freeze({ ...value.refusal }), revision: record.revision });
+            this.#records.set(record2.key, { refusal: Object.freeze({ ...value.refusal }), revision: record2.revision });
           }
         }
         return this.#records;
@@ -24331,12 +24342,12 @@ var init_runtime_identity = __esm({
 });
 
 // ../peer-office/src/runtime/replica_follow_desk.ts
-function assertSpec(record, spec) {
+function assertSpec(record2, spec) {
   if (!spec.workspace || !spec.credentialCapability || typeof spec.cloudBound !== "boolean" || !Number.isFinite(spec.policy?.debounceMillis) || !Number.isFinite(spec.policy?.fallbackMillis) || spec.policy.debounceMillis < 0 || spec.policy.fallbackMillis <= 0) {
-    throw corrupt(record, "invalid specification");
+    throw corrupt(record2, "invalid specification");
   }
 }
-function assertState(record, state) {
+function assertState(record2, state) {
   switch (state.case) {
     case ReplicaFollowPhase.Desired:
       return;
@@ -24378,10 +24389,10 @@ function assertState(record, state) {
       break;
     default: {
       const exhaustive = state;
-      throw corrupt(record, `unknown state ${String(exhaustive)}`);
+      throw corrupt(record2, `unknown state ${String(exhaustive)}`);
     }
   }
-  throw corrupt(record, `invalid '${state.case}' state`);
+  throw corrupt(record2, `invalid '${state.case}' state`);
 }
 var REPLICA_FOLLOW_NAMESPACE, textEncoder, textDecoder, encode, decode, decodeWarming, decodeRefusal, decodeState, corrupt, samePolicy, sameSpec, ReplicaFollowDesk;
 var init_replica_follow_desk = __esm({
@@ -24392,19 +24403,19 @@ var init_replica_follow_desk = __esm({
     textEncoder = new TextEncoder();
     textDecoder = new TextDecoder();
     encode = (follow) => textEncoder.encode(JSON.stringify({ version: 1, spec: follow.spec, state: follow.state }));
-    decode = (record) => {
-      const value = JSON.parse(textDecoder.decode(record.value));
-      if (!value || typeof value !== "object") throw corrupt(record, "not an object");
+    decode = (record2) => {
+      const value = JSON.parse(textDecoder.decode(record2.value));
+      if (!value || typeof value !== "object") throw corrupt(record2, "not an object");
       const candidate = value;
       if (candidate.version !== 1 || !candidate.spec || !candidate.state) {
-        throw corrupt(record, "unsupported or incomplete record");
+        throw corrupt(record2, "unsupported or incomplete record");
       }
       const spec = candidate.spec;
-      const state = decodeState(record, candidate.state);
-      if (spec.workspace !== record.key) throw corrupt(record, "workspace key mismatch");
-      assertSpec(record, spec);
-      assertState(record, state);
-      return Object.freeze({ spec: Object.freeze(spec), state: Object.freeze(state), revision: record.revision });
+      const state = decodeState(record2, candidate.state);
+      if (spec.workspace !== record2.key) throw corrupt(record2, "workspace key mismatch");
+      assertSpec(record2, spec);
+      assertState(record2, state);
+      return Object.freeze({ spec: Object.freeze(spec), state: Object.freeze(state), revision: record2.revision });
     };
     decodeWarming = (value) => {
       const warming = value;
@@ -24424,8 +24435,8 @@ var init_replica_follow_desk = __esm({
         ...Number.isFinite(refusal2.rerunAtUnixMillis) ? { rerunAtUnixMillis: refusal2.rerunAtUnixMillis } : {}
       } } : {};
     };
-    decodeState = (record, value) => {
-      if (!value || typeof value !== "object") throw corrupt(record, "state is not an object");
+    decodeState = (record2, value) => {
+      if (!value || typeof value !== "object") throw corrupt(record2, "state is not an object");
       const state = value;
       switch (state.case) {
         case ReplicaFollowPhase.Desired:
@@ -24497,10 +24508,10 @@ var init_replica_follow_desk = __esm({
             dueAtUnixMillis: state.dueAtUnixMillis
           };
         default:
-          throw corrupt(record, `unknown state '${String(state.case)}'`);
+          throw corrupt(record2, `unknown state '${String(state.case)}'`);
       }
     };
-    corrupt = (record, why) => new Error(`corrupt replica follow '${record.key}' at revision ${record.revision}: ${why}`);
+    corrupt = (record2, why) => new Error(`corrupt replica follow '${record2.key}' at revision ${record2.revision}: ${why}`);
     samePolicy = (left, right) => left.debounceMillis === right.debounceMillis && left.fallbackMillis === right.fallbackMillis && left.signalMillis === right.signalMillis && left.signalId === right.signalId;
     sameSpec = (left, right) => left.workspace === right.workspace && left.replicaId === right.replicaId && left.credentialCapability === right.credentialCapability && left.cloudBound === right.cloudBound && left.cloud === right.cloud && left.custodyBreakPolicy === right.custodyBreakPolicy && samePolicy(left.policy, right.policy);
     ReplicaFollowDesk = class {
@@ -24512,8 +24523,8 @@ var init_replica_follow_desk = __esm({
       }
       load() {
         if (!this.#loaded) {
-          for (const record of this.#store.list(REPLICA_FOLLOW_NAMESPACE)) {
-            const follow = decode(record);
+          for (const record2 of this.#store.list(REPLICA_FOLLOW_NAMESPACE)) {
+            const follow = decode(record2);
             this.#inventory.set(follow.spec.workspace, follow);
           }
           this.#loaded = true;
@@ -24666,7 +24677,7 @@ function classifyRebirth(kernel, mount, requestId, disagreement) {
   });
 }
 function parkedLocalChanges(kernel, mount, requestId) {
-  return kernel.listRefs(mount, requestId, REFUSED_PREFIX).filter((record) => record.reference && kernel.readBlob(mount, requestId, record.oid, "verdict.usda")).map((record) => ({ reference: record.reference, oid: record.oid }));
+  return kernel.listRefs(mount, requestId, REFUSED_PREFIX).filter((record2) => record2.reference && kernel.readBlob(mount, requestId, record2.oid, "verdict.usda")).map((record2) => ({ reference: record2.reference, oid: record2.oid }));
 }
 function previewLocalCopyDrop(kernel, mount, requestId, follow, captureClock) {
   const localHead = kernel.head(mount, requestId);
@@ -24745,11 +24756,11 @@ var init_preserved_copies_desk = __esm({
         this.#store = store;
       }
       list(workspace) {
-        const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
-        if (!record) return [];
-        const values = JSON.parse(decoder4.decode(record.value));
+        const record2 = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
+        if (!record2) return [];
+        const values = JSON.parse(decoder4.decode(record2.value));
         if (!Array.isArray(values)) {
-          throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
+          throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record2.revision}`);
         }
         return values.map((value) => fromJsonString(PreservedLocalCopySchema, JSON.stringify(value)));
       }
@@ -24860,13 +24871,13 @@ var init_seated_peer_desk_store = __esm({
       list(namespace2) {
         if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
         const kept = [];
-        for (const record of this.#inner.list(namespace2)) {
-          const sealed = readSeal(record.value);
+        for (const record2 of this.#inner.list(namespace2)) {
+          const sealed = readSeal(record2.value);
           if (sealed?.seat === this.#seat.digest) {
-            kept.push({ ...record, value: sealed.value.slice() });
+            kept.push({ ...record2, value: sealed.value.slice() });
             continue;
           }
-          this.#quarantine(namespace2, record, sealed?.seat);
+          this.#quarantine(namespace2, record2, sealed?.seat);
         }
         return kept;
       }
@@ -24886,16 +24897,16 @@ var init_seated_peer_desk_store = __esm({
         return { ...stored, value: sealed.value.slice() };
       }
       /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-      #quarantine(namespace2, record, recordedSeat) {
-        const key2 = `${namespace2}\0${record.key}\0${record.revision}`;
+      #quarantine(namespace2, record2, recordedSeat) {
+        const key2 = `${namespace2}\0${record2.key}\0${record2.revision}`;
         try {
-          this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key2, void 0, record.value);
+          this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key2, void 0, record2.value);
         } catch {
         }
-        this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
+        this.#inner.compareExchange(namespace2, record2.key, record2.revision, void 0);
         this.#report(create47(QuarantinedBindingSchema, {
           namespace: namespace2,
-          key: record.key,
+          key: record2.key,
           reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
           recordedSeat: recordedSeat ?? "",
           officeSeat: this.#seat.digest
@@ -26551,7 +26562,7 @@ var init_live_correspondence_desk = __esm({
 // ../peer-office/src/runtime/replica_identity.ts
 function replicaIdentity(store, label, sources = {}) {
   const read2 = () => {
-    const stored = store.list(REPLICA_IDENTITY_NAMESPACE).find((record) => record.key === REPLICA_IDENTITY_KEY);
+    const stored = store.list(REPLICA_IDENTITY_NAMESPACE).find((record2) => record2.key === REPLICA_IDENTITY_KEY);
     if (!stored) return {};
     const text3 = new TextDecoder().decode(stored.value);
     return isReplicaId(text3) ? { id: text3, revision: stored.revision } : { revision: stored.revision };
@@ -27029,17 +27040,17 @@ var init_recovery_desk = __esm({
       }
       #entries(mount, requestId) {
         const entries = [];
-        for (const record of this.#kernel.listRefs(mount, requestId, REFUSED_PREFIX2)) {
+        for (const record2 of this.#kernel.listRefs(mount, requestId, REFUSED_PREFIX2)) {
           const verdictUsda = this.#kernel.readBlob(
             mount,
             requestId,
-            record.oid,
+            record2.oid,
             "verdict.usda"
           );
           if (!verdictUsda) continue;
           entries.push({
-            reference: record.reference,
-            commitOid: record.oid,
+            reference: record2.reference,
+            commitOid: record2.oid,
             verdict: this.#kernel.inspectRefusalVerdict(mount, requestId, verdictUsda)
           });
         }
@@ -29071,9 +29082,9 @@ var init_workspace_sync = __esm({
         return this.#route?.receptionUrl || `${this.#cloudBase()}/v2/workspaces/${encodeURIComponent(this.#mount.workspace)}`;
       }
       #authToken() {
-        const resolve11 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
-        if (!resolve11) throw new Error("workspace sync has no credential capability resolver");
-        return resolve11.call(this.#credentials, this.#binding.credentialCapability);
+        const resolve12 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
+        if (!resolve12) throw new Error("workspace sync has no credential capability resolver");
+        return resolve12.call(this.#credentials, this.#binding.credentialCapability);
       }
     };
   }
@@ -29509,7 +29520,7 @@ var init_history_acquisition_state = __esm({
 
 // ../peer-office/src/runtime/history_acquisition_desk.ts
 import { create as create62, toBinary as toBinary20 } from "@bufbuild/protobuf";
-function assertState2(record, state) {
+function assertState2(record2, state) {
   switch (state.case) {
     case HistoryAcquisitionPhase.Desired:
     case HistoryAcquisitionPhase.Settled:
@@ -29522,10 +29533,10 @@ function assertState2(record, state) {
       break;
     default: {
       const exhaustive = state;
-      throw corrupt2(record, `unknown state ${String(exhaustive)}`);
+      throw corrupt2(record2, `unknown state ${String(exhaustive)}`);
     }
   }
-  throw corrupt2(record, `invalid '${state.case}' state`);
+  throw corrupt2(record2, `invalid '${state.case}' state`);
 }
 var HISTORY_ACQUISITION_NAMESPACE, HISTORY_BACKGROUND_START_MILLIS, OMITTED_HISTORY_HOLD_MILLIS, SLICE_ANSWER_MILLIS, encoder6, decoder6, workId, effectId, encode2, upgraded, decode2, corrupt2, HistoryAcquisitionDesk;
 var init_history_acquisition_desk = __esm({
@@ -29555,25 +29566,25 @@ var init_history_acquisition_desk = __esm({
       }));
     };
     upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
-    decode2 = (record) => {
-      const value = JSON.parse(decoder6.decode(record.value));
-      if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
+    decode2 = (record2) => {
+      const value = JSON.parse(decoder6.decode(record2.value));
+      if (!value || typeof value !== "object") throw corrupt2(record2, "not an object");
       const candidate = value;
-      if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
-        throw corrupt2(record, "unsupported or incomplete record");
+      if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record2.key || !candidate.state) {
+        throw corrupt2(record2, "unsupported or incomplete record");
       }
       const credentialCapability = candidate.version === 2 ? candidate.credentialCapability : void 0;
-      if (candidate.version === 2 && !credentialCapability) throw corrupt2(record, "missing credential capability");
+      if (candidate.version === 2 && !credentialCapability) throw corrupt2(record2, "missing credential capability");
       const state = upgraded(candidate.state);
-      assertState2(record, state);
+      assertState2(record2, state);
       return Object.freeze({
         workspace: candidate.workspace,
         ...credentialCapability ? { credentialCapability } : {},
         state: Object.freeze(state),
-        revision: record.revision
+        revision: record2.revision
       });
     };
-    corrupt2 = (record, why) => new Error(`corrupt history acquisition '${record.key}' at revision ${record.revision}: ${why}`);
+    corrupt2 = (record2, why) => new Error(`corrupt history acquisition '${record2.key}' at revision ${record2.revision}: ${why}`);
     HistoryAcquisitionDesk = class {
       #store;
       #clock;
@@ -29780,8 +29791,8 @@ var init_history_acquisition_desk = __esm({
       }
       #load() {
         if (this.#loaded) return;
-        for (const record of this.#store.list(HISTORY_ACQUISITION_NAMESPACE)) {
-          const work = decode2(record);
+        for (const record2 of this.#store.list(HISTORY_ACQUISITION_NAMESPACE)) {
+          const work = decode2(record2);
           this.#inventory.set(work.workspace, work);
         }
         this.#loaded = true;
@@ -36041,19 +36052,19 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
   };
   const runner = {
     localReadResumable(workId2) {
-      let resolve11;
+      let resolve12;
       const resumable = new Promise((done) => {
-        resolve11 = done;
+        resolve12 = done;
       });
       let timer;
       const wait = peer2.localReadResumable(workId2, () => {
         if (timer !== void 0) clearTimeout(timer);
-        resolve11();
+        resolve12();
       });
       if (wait === void 0) return void 0;
       timer = setTimeout(() => {
         wait.cancel();
-        resolve11();
+        resolve12();
       }, wait.afterMillis);
       return resumable;
     },
@@ -36084,7 +36095,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const deadline = Date.now() + Math.max(0, withinMillis);
       while (outstanding() > 0 && Date.now() < deadline) {
         lanes.wake(0);
-        await new Promise((resolve11) => setTimeout(resolve11, 10));
+        await new Promise((resolve12) => setTimeout(resolve12, 10));
       }
       return outstanding();
     },
@@ -36147,7 +36158,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     if (response.outcome.case === "localReadPending") {
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
-      await (runner.localReadResumable?.(pending2.workId) ?? new Promise((resolve11) => setTimeout(resolve11, pending2.resumeAfterMillis)));
+      await (runner.localReadResumable?.(pending2.workId) ?? new Promise((resolve12) => setTimeout(resolve12, pending2.resumeAfterMillis)));
       responseFrame = await turn(() => runner.handleFrame(toBinary28(RuntimeRequestSchema, create78(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
@@ -36345,7 +36356,7 @@ async function executeHistoryAcquisitionEffect(effect, custody) {
   }
 }
 async function executeWakeEffect(effect) {
-  await new Promise((resolve11) => setTimeout(resolve11, effect.delayMillis));
+  await new Promise((resolve12) => setTimeout(resolve12, effect.delayMillis));
   return create78(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: { case: "woken", value: create78(PeerWokenSchema) } });
 }
 async function executeCredentialRefreshEffect(effect, provider) {
@@ -36380,9 +36391,9 @@ async function executeDeviceIdentityEffect(effect, store) {
       const bytes = await store.load(`nomos-device-recovery-v1|${effect.identity}`);
       if (bytes !== void 0) recovery = fromBinary25(DeviceRecoveryRecordSchema, bytes);
     } else if (effect.operation.case === "saveRecovery") {
-      const record = effect.operation.value.record;
-      if (!record) throw new Error("device recovery save contains no record");
-      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary28(DeviceRecoveryRecordSchema, record));
+      const record2 = effect.operation.value.record;
+      if (!record2) throw new Error("device recovery save contains no record");
+      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary28(DeviceRecoveryRecordSchema, record2));
     } else throw new Error("device identity effect has no operation");
     return create78(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: {
       case: "deviceIdentity",
@@ -37624,7 +37635,7 @@ async function prepareRemoteModelTransition(cloud, input) {
     }
     atHash = status2.outcome.value.head ?? "";
     if (atHash || Date.now() >= deadline) break;
-    await new Promise((resolve11) => setTimeout(resolve11, 1e3));
+    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
   }
   if (!atHash) {
     throw new Error("workspace has no current Git frontier to prove after pulling it");
@@ -37670,8 +37681,8 @@ async function prepareRemoteModelTransition(cloud, input) {
       target3
     );
     if (response.outcome.case !== "unavailable" || !response.outcome.value.retryable || Date.now() >= proofDeadline) break;
-    await new Promise((resolve11) => setTimeout(
-      resolve11,
+    await new Promise((resolve12) => setTimeout(
+      resolve12,
       Math.max(500, response.outcome.case === "unavailable" ? response.outcome.value.retryAfterMillis ?? 1e3 : 1e3)
     ));
   }
@@ -37823,7 +37834,7 @@ async function invokeUntilAvailable(cloud, command, target3, deadlineMillis = RE
       return response;
     }
     const wait = Math.min(5e3, Math.max(250, Number(response.outcome.value.retryAfterMillis ?? 1e3)));
-    await new Promise((resolve11) => setTimeout(resolve11, wait));
+    await new Promise((resolve12) => setTimeout(resolve12, wait));
   }
 }
 function unavailableDetail(response) {
@@ -38594,7 +38605,7 @@ async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
   while (Date.now() < deadline) {
     const head = await workspaceMainHead(cloud, workspace);
     if (head !== void 0) return head;
-    await new Promise((resolve11) => setTimeout(resolve11, 250));
+    await new Promise((resolve12) => setTimeout(resolve12, 250));
   }
   return void 0;
 }
@@ -38815,7 +38826,7 @@ async function ensureSovereignHome(opts = {}) {
     const deadline = Date.now() + 3e4;
     while (Date.now() < deadline) {
       if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
-      await new Promise((resolve11) => setTimeout(resolve11, 250));
+      await new Promise((resolve12) => setTimeout(resolve12, 250));
     }
     if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
       throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
@@ -38863,7 +38874,7 @@ async function ensureSovereignHome(opts = {}) {
         return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
       }).catch(() => false);
       if (visible) break;
-      await new Promise((resolve11) => setTimeout(resolve11, 250));
+      await new Promise((resolve12) => setTimeout(resolve12, 250));
     }
     if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
   }
@@ -40103,7 +40114,7 @@ async function waitForDurableMainAdvance(cloud, ws2, previousHead, opts = {}) {
   while (Date.now() < deadline) {
     const head = await durableMainHead(cloud, ws2, fetchImpl);
     if (head !== void 0 && head !== previousHead) return head;
-    await new Promise((resolve11) => setTimeout(resolve11, pollMs));
+    await new Promise((resolve12) => setTimeout(resolve12, pollMs));
   }
   return void 0;
 }
@@ -40497,11 +40508,11 @@ function declaredDirectives(projection, domainPath) {
 function lawDomainPath(projection, domain) {
   return [...projection.prims.values()].find((prim) => /^\/Nomos\/Domains\/d_[0-9a-f]{16}$/.test(prim.path) && (text(prim, "nomos:label") === domain || text(prim, "nomos:publicRoute") === domain))?.path;
 }
-function schemaFields(projection, record, remainingDepth) {
+function schemaFields(projection, record2, remainingDepth) {
   if (remainingDepth === 0) {
-    throw new Error(`${record.path} exceeds the operation schema recursion limit`);
+    throw new Error(`${record2.path} exceeds the operation schema recursion limit`);
   }
-  return (projection.childrenOf.get(`${record.path}/Fields`) ?? []).map((path4) => {
+  return (projection.childrenOf.get(`${record2.path}/Fields`) ?? []).map((path4) => {
     const field = projection.prims.get(path4);
     const label = text(field, "nomos:label");
     if (label === void 0) throw new Error(`${field.path} has no nomos:label`);
@@ -41087,7 +41098,7 @@ async function aggregateRow(cloud, workspace, id) {
     const { status: status2, body } = await getJson(cloud, `/v2/workspaces/${ws(workspace)}/aggregates/${encodeURIComponent(id)}`);
     if (body?.ok === true && status2 === 200) return (body.rows ?? [])[0]?.data;
     if ((status2 === 202 || status2 === 503) && Date.now() < deadline) {
-      await new Promise((resolve11) => setTimeout(resolve11, 1e3));
+      await new Promise((resolve12) => setTimeout(resolve12, 1e3));
       continue;
     }
     refuse(`${workspace} answered no rows for ${id} (HTTP ${status2}${typeof body?.error === "string" ? `: ${body.error}` : ""}); an unanswered read is not read as an absent record`);
@@ -41174,7 +41185,7 @@ async function foundedLineage(cloud, workspace, origin) {
   if (parent === "" || parentIntent === "") {
     refuse(`${workspace}'s birth origin (${BIRTH_ORIGIN_ID}) names no parent/parentIntent (parent=${parent || "\u2205"}, parentIntent=${parentIntent || "\u2205"})`);
   }
-  const [founding, warrant, record, lifecycle] = await Promise.all([
+  const [founding, warrant, record2, lifecycle] = await Promise.all([
     aggregateRow(cloud, workspace, FOUNDING_PRINCIPAL_ID),
     aggregateRow(cloud, workspace, GENESIS_WARRANT_ID),
     aggregateRow(cloud, parent, birthRecordId(workspace)),
@@ -41192,20 +41203,20 @@ async function foundedLineage(cloud, workspace, origin) {
   if (text2(warrant["principal"]) !== founder || text2(warrant["workspaceId"]) !== workspace) {
     refuse(`${workspace}'s genesis warrant names ${text2(warrant["principal"]) || "\u2205"} for ${text2(warrant["workspaceId"]) || "\u2205"}, but its founding record names ${founder} for ${workspace}; the records disagree`);
   }
-  if (record === void 0) {
+  if (record2 === void 0) {
     refuse(`${workspace}'s birth origin names ${parent} (birth intent ${parentIntent}), but ${parent}'s chain records no birth of it (${birthRecordId(workspace)}); origin and parent disagree, and this lane does not guess its lineage`);
   }
-  if (text2(record["child"]) !== workspace) {
-    refuse(`${parent}'s birth record ${birthRecordId(workspace)} names child ${text2(record["child"]) || "\u2205"}, not ${workspace}; origin and parent disagree`);
+  if (text2(record2["child"]) !== workspace) {
+    refuse(`${parent}'s birth record ${birthRecordId(workspace)} names child ${text2(record2["child"]) || "\u2205"}, not ${workspace}; origin and parent disagree`);
   }
-  const recordBornAt = text2(record["bornAt"]);
+  const recordBornAt = text2(record2["bornAt"]);
   const warrantBornAt = text2(warrant["bornAt"]);
   if (recordBornAt !== "" && warrantBornAt !== "" && recordBornAt !== warrantBornAt) {
     refuse(`${parent} records ${workspace} as born at ${recordBornAt}, but its genesis warrant says ${warrantBornAt}; origin and parent disagree`);
   }
   const status2 = text2(lifecycle?.["status"]) || "active";
   if (status2 === "reclaimed") refuse(`${parent} has reclaimed ${workspace} (${childLifecycleId(workspace)}); a reclaimed workspace has no custody to act in`);
-  return { lane: "founded", workspace, parent, founder, parentIntent, foundingKeyHash, lifecycle: status2, birthSubject: text2(record["principal"]) };
+  return { lane: "founded", workspace, parent, founder, parentIntent, foundingKeyHash, lifecycle: status2, birthSubject: text2(record2["principal"]) };
 }
 async function attestedLineage(cloud, workspace, birth2) {
   if (birth2 === void 0) {
@@ -41758,7 +41769,7 @@ async function waitFor(condition, deadlineMillis, report) {
       announced = elapsed;
       report(elapsed);
     }
-    await new Promise((resolve11) => setTimeout(resolve11, 1e3));
+    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
   }
   return false;
 }
@@ -42145,6 +42156,7 @@ var init_commands = __esm({
       "doctor",
       "cloud",
       "console",
+      "reception",
       "status",
       "model",
       "platform",
@@ -42195,6 +42207,28 @@ var init_help = __esm({
     "use strict";
     init_commands();
     HELP = {
+      reception: {
+        usage: "githolon reception <discover|read|offer|status|identity|prepare|enroll|recover|revoke> <workspace>\ngitholon reception batch <targets.json>",
+        what: "Use the target workspace's generated hosted Reception over HTTPS. No local law archive or kernel is required.\nA persistent operation journal resolves lost replies without automatically repeating business commands.",
+        flags: [
+          ["--cloud <HTTPS origin>", "provider endpoint (default https://nomos.cafe)"],
+          ["--as <principal>", "acting provider-scoped identity; its encrypted cloud device is enrolled and reused automatically"],
+          ["NOMOS_RECEPTION_TOKEN", "fresh provider assertion from the environment; never saved in the operation journal"],
+          ["--credential <id>", "select an explicitly managed scoped credential instead of automatic identity custody"],
+          ["discover --domain <domain>", "resolve an exact realised closure and its API readiness"],
+          ["read --closure <identity> --operation <name> [--args <file.json>]", "fresh kernel-authorized typed read"],
+          ["offer --domain <domain> --operation <name> --facts <file.json> --operation-id <id> --journal <file>", "persist intent to submit, then return the provider's admission outcome; reruns resolve the same operation"],
+          ["status --operation-id <id>", "recover an interrupted operation's retained receipt; pending remains unresolved"],
+          ["identity --file <targets.json>", "enroll one retained cloud device across explicit workspace/operation targets in one provider enrollment request; nonce providers return the required keyHash"],
+          ["batch <targets.json> --journal <file>", "enroll relevant targets together, fresh-read desired authority, skip existing state and resume retained operations; exit 1 while any target is unresolved"],
+          ["prepare --file <scope.json>", "persist a hosted device with operations and expiresAt; acquire a provider assertion with nonce equal to the returned keyHash"],
+          ["enroll | recover | revoke --credential <id>", "explicit signer onboarding, interrupted enrollment recovery or revocation with the device-bound provider assertion"]
+        ],
+        examples: [
+          "githolon reception discover example-catalogue --domain catalogue --as user:owner",
+          "githolon reception offer example-catalogue --domain catalogue --operation catalogue/grantCatalogueOwner --facts grant.json --operation-id grant-example-owner --journal grants.json --as user:owner"
+        ]
+      },
       console: {
         usage: "githolon console <login|logout|workspaces|universe|adoption|release-registry|releases|release-rollouts|rollouts>",
         what: "Use a downloaded console API credential. The browser and CLI use the same console API.\nCredentials are stored locally with owner-only permissions; tokens are never printed.",
@@ -43001,7 +43035,7 @@ function qualificationProgressLine(run4) {
   return `[qualify] ${p.judged}/${p.selected} targets judged (${p.percent}%): passed ${p.passed}, failed ${p.failed}, unknown ${p.unknown}${p.skipped ? `, skipped ${p.skipped}` : ""}${p.retrying ? `, retrying ${p.retrying}` : ""}${run4.detail ? ` (${run4.detail})` : ""}`;
 }
 async function waitForQualification(profile, first, wait, fetcher = fetch) {
-  const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+  const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
   const report = wait.report ?? ((line) => console.error(line));
   const deadline = Date.now() + wait.timeoutSeconds * 1e3;
   let delay = 1e3;
@@ -43382,7 +43416,7 @@ function rolloutVerdict(progress, options) {
     verdict: `${progress.state}, incomplete (${tally})${detail}${failures}${options.allowIncomplete ? "\n  (allowed by --allow-incomplete)" : ""}`
   };
 }
-async function waitForRollout(profile, showPath, options, fetcher = fetch, sleep2 = (ms) => new Promise((resolve11) => setTimeout(resolve11, ms)), report = (line) => console.error(line)) {
+async function waitForRollout(profile, showPath, options, fetcher = fetch, sleep2 = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms)), report = (line) => console.error(line)) {
   const deadline = Date.now() + options.timeoutSeconds * 1e3;
   let delay = 1e3;
   let last = "";
@@ -43404,9 +43438,9 @@ async function waitForRollout(profile, showPath, options, fetcher = fetch, sleep
   }
 }
 function writeStdout(text3) {
-  return new Promise((resolve11) => {
-    if (process.stdout.write(text3)) resolve11();
-    else process.stdout.once("drain", () => resolve11());
+  return new Promise((resolve12) => {
+    if (process.stdout.write(text3)) resolve12();
+    else process.stdout.once("drain", () => resolve12());
   });
 }
 async function consoleCommand(args) {
@@ -43524,6 +43558,360 @@ var init_console = __esm({
   }
 });
 
+// src/hosted_reception.ts
+var hosted_reception_exports = {};
+__export(hosted_reception_exports, {
+  HostedReceptionClient: () => HostedReceptionClient,
+  hostedReceptionBatch: () => hostedReceptionBatch,
+  hostedReceptionCommand: () => hostedReceptionCommand
+});
+import { createHash as createHash8 } from "node:crypto";
+import { chmodSync as chmodSync5, closeSync as closeSync2, existsSync as existsSync17, mkdirSync as mkdirSync13, openSync as openSync2, readFileSync as readFileSync16, renameSync as renameSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname6, resolve as resolve5 } from "node:path";
+function acquireJournalLock(path4) {
+  try {
+    const fd = openSync2(path4, "wx", 384);
+    writeFileSync14(fd, String(process.pid));
+    return fd;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const pid = Number(readFileSync16(path4, "utf8"));
+    if (!Number.isInteger(pid) || pid <= 0) throw new Error("journal lock has no process identity; inspect it before recovery");
+    try {
+      process.kill(pid, 0);
+    } catch (cause) {
+      if (cause.code !== "ESRCH") throw cause;
+      unlinkSync2(path4);
+      const fd = openSync2(path4, "wx", 384);
+      writeFileSync14(fd, String(process.pid));
+      return fd;
+    }
+    throw new Error("another CLI process owns this operation journal");
+  }
+}
+async function hostedReceptionBatch(client, targets, journalFile) {
+  if (new Set(targets.map((target3) => target3.operationId)).size !== targets.length) throw new Error("batch operation IDs must be unique");
+  const recovered = /* @__PURE__ */ new Map();
+  for (const target3 of targets) if (client.hasJournaledOperation(target3.operationId, journalFile)) {
+    recovered.set(target3.operationId, await client.offer(target3, journalFile));
+  }
+  const newTargets = targets.filter((target3) => !recovered.has(target3.operationId));
+  const enrollment = client.usesAutomaticIdentity && newTargets.length ? await client.enrollTargets(newTargets.flatMap((target3) => [
+    { workspace: target3.workspace, operation: target3.operation },
+    { workspace: target3.workspace, operation: target3.verify.operation }
+  ])) : { state: "active" };
+  if (enrollment.state !== "active" && !recovered.size && !Array.isArray(enrollment.identities)) return {
+    ...enrollment,
+    state: "pending",
+    ...enrollment.code ? {} : { code: "identity_enrollment_unresolved" },
+    enrollment
+  };
+  const active = /* @__PURE__ */ new Set();
+  if (Array.isArray(enrollment.identities)) for (const identity of enrollment.identities) {
+    if (!identity || typeof identity !== "object" || !Array.isArray(identity.targets)) continue;
+    for (const target3 of identity.targets) if (target3?.state === "active") active.add(`${target3.workspace}/${target3.operation}`);
+  }
+  const results = [];
+  for (const target3 of targets) {
+    let submissionReceipt = recovered.get(target3.operationId);
+    const verify = async () => {
+      const discovery = await client.discover(target3.workspace, target3.domain);
+      if (discovery.state !== "ready" || typeof discovery.closure !== "string") return false;
+      const read2 = await client.read(target3.workspace, discovery.closure, target3.verify.operation, target3.verify.args ?? []);
+      if (read2.state !== "read") return false;
+      let observed = read2.result;
+      for (const key2 of target3.verify.path) {
+        if (observed === null || typeof observed !== "object") return false;
+        observed = observed[key2];
+      }
+      if (Object.hasOwn(target3.verify, "contains")) return Array.isArray(observed) && observed.some((value) => canonical(value) === canonical(target3.verify.contains));
+      if (!Object.hasOwn(target3.verify, "equals")) throw new Error("batch verification needs explicit equals or contains");
+      return canonical(observed) === canonical(target3.verify.equals);
+    };
+    try {
+      if (!recovered.has(target3.operationId) && enrollment.state !== "active" && (!active.has(`${target3.workspace}/${target3.operation}`) || !active.has(`${target3.workspace}/${target3.verify.operation}`))) {
+        results.push({
+          workspace: target3.workspace,
+          operationId: target3.operationId,
+          state: "pending",
+          code: "identity_enrollment_unresolved",
+          enrollment
+        });
+        continue;
+      }
+      if (await verify()) {
+        results.push({ workspace: target3.workspace, operationId: target3.operationId, state: "verified", skipped: true });
+        continue;
+      }
+      const receipt = submissionReceipt ??= await client.offer(target3, journalFile);
+      if (receipt.state === "admitted" && await verify()) results.push({ ...receipt, workspace: target3.workspace, state: "verified", admission: receipt });
+      else results.push({ ...receipt, workspace: target3.workspace, ...receipt.state === "admitted" ? { state: "pending", code: "fresh_read_unverified", admission: receipt } : {} });
+    } catch (error) {
+      results.push({
+        workspace: target3.workspace,
+        operationId: target3.operationId,
+        state: "pending",
+        code: "target_unresolved",
+        ...submissionReceipt?.state === "admitted" ? { admission: submissionReceipt } : {},
+        detail: error instanceof Error ? error.message : "target request failed"
+      });
+    }
+  }
+  return { state: results.every((result) => result.state === "verified") ? "verified" : "pending", results };
+}
+async function hostedReceptionCommand(argv, fetcher = globalThis.fetch) {
+  const [command, workspace] = argv;
+  const opts = {};
+  for (let index = 2; index < argv.length; index += 2) {
+    const flag3 = argv[index];
+    const value = argv[index + 1];
+    if (!flag3.startsWith("--") || value === void 0 || value.startsWith("--")) throw new Error(`expected a value for ${flag3}`);
+    if (!["--cloud", "--as", "--credential", "--domain", "--operation", "--facts", "--args", "--journal", "--operation-id", "--closure", "--file"].includes(flag3)) throw new Error(`unknown flag ${flag3}`);
+    opts[flag3.slice(2)] = value;
+  }
+  const required2 = (key2) => {
+    const value = opts[key2];
+    if (!value) throw new Error(`--${key2} is required; see githolon reception --help`);
+    return value;
+  };
+  if (!workspace) throw new Error("workspace is required");
+  const client = new HostedReceptionClient({
+    endpoint: opts.cloud ?? "https://nomos.cafe",
+    principal: required2("as"),
+    credentialId: opts.credential ?? "",
+    token: process.env.NOMOS_RECEPTION_TOKEN ?? ""
+  }, fetcher);
+  const json = (key2) => opts[key2] ? record(JSON.parse(readFileSync16(required2(key2), "utf8"))) : {};
+  let result;
+  switch (command) {
+    case "discover":
+      result = await client.discover(workspace, required2("domain"));
+      break;
+    case "read": {
+      const args = opts.args ? JSON.parse(readFileSync16(required2("args"), "utf8")) : [];
+      if (!Array.isArray(args)) throw new Error("read args must be a JSON array of generated positional arguments");
+      result = await client.read(workspace, required2("closure"), required2("operation"), args);
+      break;
+    }
+    case "status":
+      result = await client.status(workspace, required2("operation-id"));
+      break;
+    case "offer":
+      result = await client.offer({
+        workspace,
+        domain: required2("domain"),
+        operation: required2("operation"),
+        facts: json("facts"),
+        operationId: required2("operation-id")
+      }, required2("journal"));
+      break;
+    case "identity": {
+      const targets = JSON.parse(readFileSync16(required2("file"), "utf8"));
+      if (!Array.isArray(targets)) throw new Error("identity targets must be a JSON array");
+      result = await client.enrollTargets(targets);
+      break;
+    }
+    case "prepare":
+      result = await client.request(workspace, "/credentials", { ...json("file"), action: "prepare" });
+      break;
+    case "enroll":
+      result = await client.request(workspace, "/credentials", { ...json("file"), action: "enroll", credentialId: required2("credential") });
+      break;
+    case "recover":
+      result = await client.request(workspace, "/credentials", { action: "recover", credentialId: required2("credential") });
+      break;
+    case "revoke":
+      result = await client.request(workspace, "/credentials", { action: "revoke", credentialId: required2("credential") });
+      break;
+    case "batch": {
+      const targets = JSON.parse(readFileSync16(workspace, "utf8"));
+      if (!Array.isArray(targets) || targets.length === 0 || targets.length > 64) throw new Error("batch file must contain 1-64 explicit targets");
+      for (const target3 of targets) {
+        record(target3);
+        record(target3.facts);
+        record(target3.verify);
+        if (!Array.isArray(target3.verify.path) || target3.verify.path.some((key2) => typeof key2 !== "string")) throw new Error("verification path must be an array of field names");
+      }
+      result = await hostedReceptionBatch(client, targets, required2("journal"));
+      break;
+    }
+    default:
+      throw new Error("expected discover, read, offer, status, identity, prepare, enroll, recover, revoke or batch; see githolon reception --help");
+  }
+  process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  return ["ready", "read", "admitted", "active", "prepared", "revoked", "verified"].includes(result.state) ? 0 : 1;
+}
+var record, canonical, isOperationReceipt, HostedReceptionClient;
+var init_hosted_reception = __esm({
+  "src/hosted_reception.ts"() {
+    "use strict";
+    record = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a JSON object");
+      return value;
+    };
+    canonical = (value) => {
+      if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+      if (value && typeof value === "object") return `{${Object.keys(value).sort().map((key2) => `${JSON.stringify(key2)}:${canonical(value[key2])}`).join(",")}}`;
+      return JSON.stringify(value);
+    };
+    isOperationReceipt = (receipt, operation, closure, caller) => ["pending", "admitted", "refused", "notAdmitted"].includes(receipt.state) && receipt.operationId === operation.operationId && receipt.workspace === operation.workspace && receipt.principal === caller.principal && typeof receipt.credentialId === "string" && !!receipt.credentialId && (!caller.credentialId || receipt.credentialId === caller.credentialId) && receipt.operation === operation.operation && receipt.closure === closure && receipt.requestDigest === createHash8("sha256").update(canonical({
+      workspace: operation.workspace,
+      principal: caller.principal,
+      credentialId: receipt.credentialId,
+      closure,
+      operation: operation.operation,
+      facts: operation.facts
+    })).digest("hex");
+    HostedReceptionClient = class {
+      #caller;
+      #fetch;
+      #enrolledTargets = /* @__PURE__ */ new Set();
+      constructor(caller, fetcher = globalThis.fetch) {
+        const endpoint = new URL(caller.endpoint);
+        if (endpoint.protocol !== "https:" || !/^https:\/\/[A-Za-z0-9.-]+(?::[0-9]+)?\/?$/.test(caller.endpoint)) {
+          throw new Error("hosted Reception endpoint must be an HTTPS origin");
+        }
+        if (!caller.principal.trim() || !caller.token.trim()) {
+          throw new Error("explicit principal and authentication token are required");
+        }
+        this.#caller = { ...caller, endpoint: endpoint.origin };
+        this.#fetch = fetcher;
+      }
+      async request(workspace, suffix, body) {
+        if (!workspace.trim()) throw new Error("workspace is required");
+        const response = await this.#fetch(`${this.#caller.endpoint}/v2/workspaces/${encodeURIComponent(workspace)}/reception${suffix}`, {
+          method: body === void 0 ? "GET" : "POST",
+          redirect: "error",
+          headers: {
+            authorization: `Bearer ${this.#caller.token}`,
+            "content-type": "application/json",
+            "x-nomos-principal": this.#caller.principal,
+            ...this.#caller.credentialId ? { "x-nomos-credential": this.#caller.credentialId } : {}
+          },
+          ...body ? { body: JSON.stringify({ ...body, principal: this.#caller.principal, ...this.#caller.credentialId ? { credentialId: this.#caller.credentialId } : {} }) } : {},
+          signal: AbortSignal.timeout(6e4)
+        });
+        const value = record(await response.json());
+        if (typeof value.state !== "string") {
+          if (!response.ok) return { ...value, state: "refused", httpStatus: response.status };
+          throw new Error("hosted Reception returned no typed state");
+        }
+        return { ...value, state: value.state, httpStatus: response.status };
+      }
+      async enrollTargets(targets) {
+        if (!targets.length || targets.length > 128) throw new Error("identity enrollment requires 1-128 explicit targets");
+        const result = await this.request(targets[0].workspace, "/identity", { targets });
+        if (result.state === "active") for (const target3 of targets) this.#enrolledTargets.add(`${target3.workspace}/${target3.operation}`);
+        return result;
+      }
+      get usesAutomaticIdentity() {
+        return !this.#caller.credentialId;
+      }
+      hasJournaledOperation(operationId, journalFile) {
+        return existsSync17(journalFile) && Object.hasOwn(record(JSON.parse(readFileSync16(journalFile, "utf8"))), operationId);
+      }
+      discover(workspace, domain) {
+        return this.request(workspace, `?domain=${encodeURIComponent(domain)}`);
+      }
+      status(workspace, operationId) {
+        return this.request(workspace, `/operations/${encodeURIComponent(operationId)}`);
+      }
+      read(workspace, closure, operation, args = []) {
+        return this.request(workspace, "/read", { closure, operation, args });
+      }
+      /** Persist before sending. A lost response or restarted process queries the same operation;
+       * it cannot turn uncertainty into another authoring attempt. The gateway owns admission status.
+       */
+      async offer(operation, journalFile) {
+        if (!/^[A-Za-z0-9_-]{1,128}$/.test(operation.operationId)) throw new Error("operation ID must be 1-128 letters, digits, underscores or hyphens");
+        const fingerprint = createHash8("sha256").update(canonical({
+          endpoint: this.#caller.endpoint,
+          principal: this.#caller.principal,
+          credentialId: this.#caller.credentialId,
+          workspace: operation.workspace,
+          domain: operation.domain,
+          operation: operation.operation,
+          facts: operation.facts,
+          operationId: operation.operationId
+        })).digest("hex");
+        mkdirSync13(dirname6(resolve5(journalFile)), { recursive: true, mode: 448 });
+        const lock = `${journalFile}.lock`;
+        const fd = acquireJournalLock(lock);
+        try {
+          const entries = existsSync17(journalFile) ? record(JSON.parse(readFileSync16(journalFile, "utf8"))) : {};
+          const saved = entries[operation.operationId];
+          const persist = (entry2) => {
+            entries[operation.operationId] = entry2;
+            const temporary = `${journalFile}.next`;
+            writeFileSync14(temporary, `${JSON.stringify(entries, null, 2)}
+`, { mode: 384 });
+            chmodSync5(temporary, 384);
+            renameSync5(temporary, journalFile);
+          };
+          if (saved) {
+            if (saved.fingerprint !== fingerprint) throw new Error("operation ID already binds different facts, principal, credential or endpoint");
+            if (["admitted", "refused", "notAdmitted"].includes(saved.receipt.state)) return saved.receipt;
+            try {
+              const receipt = await this.status(operation.workspace, operation.operationId);
+              const resolved = receipt.httpStatus === 200 && isOperationReceipt(receipt, operation, saved.closure, this.#caller) && (!saved.receipt.requestDigest || receipt.requestDigest === saved.receipt.requestDigest) ? receipt : {
+                state: "pending",
+                code: "operation_status_unknown",
+                operationId: operation.operationId,
+                statusCode: receipt.code,
+                httpStatus: receipt.httpStatus
+              };
+              persist({ ...saved, receipt: resolved });
+              return resolved;
+            } catch {
+              return { state: "pending", code: "operation_status_unavailable", operationId: operation.operationId };
+            }
+          }
+          const discovery = await this.discover(operation.workspace, operation.domain);
+          if (discovery.state !== "ready") return discovery;
+          const closure = discovery.closure;
+          if (typeof closure !== "string" || !/^[0-9a-f]{64}$/.test(closure)) throw new Error("discovery returned no exact closure identity");
+          if (this.usesAutomaticIdentity && !this.#enrolledTargets.has(`${operation.workspace}/${operation.operation}`)) {
+            const enrollment = await this.enrollTargets([{ workspace: operation.workspace, operation: operation.operation }]);
+            if (enrollment.state !== "active") return enrollment;
+          }
+          const entry = {
+            fingerprint,
+            operationId: operation.operationId,
+            workspace: operation.workspace,
+            closure,
+            receipt: { state: "pending", code: "submission_started", operationId: operation.operationId }
+          };
+          persist(entry);
+          try {
+            const receipt = await this.request(operation.workspace, "/offer", {
+              closure,
+              domain: operation.domain,
+              operation: operation.operation,
+              facts: operation.facts,
+              operationId: operation.operationId
+            });
+            const resolved = isOperationReceipt(receipt, operation, closure, this.#caller) ? receipt : {
+              state: "pending",
+              code: "operation_receipt_unavailable",
+              operationId: operation.operationId,
+              statusCode: receipt.code,
+              httpStatus: receipt.httpStatus
+            };
+            persist({ ...entry, receipt: resolved });
+            return resolved;
+          } catch {
+            return entry.receipt;
+          }
+        } finally {
+          closeSync2(fd);
+          unlinkSync2(lock);
+        }
+      }
+    };
+  }
+});
+
 // src/baseline.ts
 var baseline_exports = {};
 __export(baseline_exports, {
@@ -43531,9 +43919,9 @@ __export(baseline_exports, {
   baselineExport: () => baselineExport,
   renderBaselineExport: () => renderBaselineExport
 });
-import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync4, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname6, join as join21, resolve as resolve5 } from "node:path";
+import { dirname as dirname7, join as join21, resolve as resolve6 } from "node:path";
 import { tsImport as tsImport6 } from "tsx/esm/api";
 function flag2(args, name) {
   const at = args.indexOf(name);
@@ -43557,8 +43945,8 @@ async function downloadBlob(profile, digest, fetcher) {
     throw new Error(`Console ${response.status}: ${body.error ?? `artifact ${digest} unavailable`}`);
   }
   const bytes = new Uint8Array(await response.arrayBuffer());
-  const { createHash: createHash9 } = await import("node:crypto");
-  const actual = createHash9("sha256").update(bytes).digest("hex");
+  const { createHash: createHash10 } = await import("node:crypto");
+  const actual = createHash10("sha256").update(bytes).digest("hex");
   if (actual !== digest) throw new Error(`the console served ${actual} for ${digest}; refusing bytes that are not their digest`);
   return bytes;
 }
@@ -43571,8 +43959,8 @@ async function materialiseRelease(profile, release, fetcher, dsl) {
         throw new Error(`release ${release.identity} names an unsafe file path '${file.path}'`);
       }
       const target3 = join21(unitDir, file.path);
-      mkdirSync13(dirname6(target3), { recursive: true });
-      writeFileSync14(target3, await downloadBlob(profile, file.sha256, fetcher));
+      mkdirSync14(dirname7(target3), { recursive: true });
+      writeFileSync15(target3, await downloadBlob(profile, file.sha256, fetcher));
     }
   }
   return dir;
@@ -43597,7 +43985,7 @@ async function releaseOfInstalledUnits(profile, installed, fetcher) {
 }
 async function baselineExport(args, profileFor, fetcher = fetch) {
   const dsl = await baselineModule();
-  const out11 = resolve5(process.cwd(), flag2(args, "--out") ?? dsl.NOMOS_BASELINE_FILENAME);
+  const out11 = resolve6(process.cwd(), flag2(args, "--out") ?? dsl.NOMOS_BASELINE_FILENAME);
   const unitsArg = flag2(args, "--units");
   const releaseArg = flag2(args, "--release");
   const workspaceArg = flag2(args, "--workspace");
@@ -43609,7 +43997,7 @@ async function baselineExport(args, profileFor, fetcher = fetch) {
   try {
     if (unitsArg !== void 0) {
       exported = dsl.exportBaselineFromUnits({
-        unitsDir: resolve5(process.cwd(), unitsArg),
+        unitsDir: resolve6(process.cwd(), unitsArg),
         source: "units",
         ...flag2(args, "--series") === void 0 ? {} : { series: flag2(args, "--series") }
       });
@@ -43653,7 +44041,7 @@ async function baselineExport(args, profileFor, fetcher = fetch) {
   } finally {
     if (scratch !== void 0) rmSync6(scratch, { recursive: true, force: true });
   }
-  writeFileSync14(out11, exported.text, "utf8");
+  writeFileSync15(out11, exported.text, "utf8");
   const identities = Object.keys(exported.baseline.continuity.identity?.entities ?? {}).length;
   return {
     out: out11,
@@ -43723,15 +44111,15 @@ __export(mcp_exports, {
   toolEvolvePreview: () => toolEvolvePreview
 });
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname8, isAbsolute as isAbsolute2, resolve as resolve7 } from "node:path";
 function resolveConfig(config) {
   const arg = config ?? "nomos.project.ts";
-  const configPath = isAbsolute2(arg) ? arg : resolve6(process.cwd(), arg);
-  return { configPath, cfgDir: dirname7(configPath) };
+  const configPath = isAbsolute2(arg) ? arg : resolve7(process.cwd(), arg);
+  return { configPath, cfgDir: dirname8(configPath) };
 }
 function runCheckLauncher(configPath, extraArgs) {
-  const cfgDir = dirname7(configPath);
+  const cfgDir = dirname8(configPath);
   const launcher = resolveCheckLauncher(cfgDir) ?? resolveCheckLauncher(process.cwd());
   if (launcher === void 0) {
     return { findings: [], stdout: "", stderr: "", status: 1, error: NO_DSL_REMEDY };
@@ -43802,7 +44190,7 @@ function extractDispositions(humanReport) {
 }
 function toolCheck(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync17(configPath)) {
+  if (!existsSync18(configPath)) {
     return { text: `nomos_check: config not found: ${configPath}`, isError: true };
   }
   const extra = args.against !== void 0 ? ["--against", args.against] : [];
@@ -43819,11 +44207,11 @@ ${JSON.stringify(payload, null, 2)}`, isError: false };
 }
 function toolEvolvePreview(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync17(configPath)) {
+  if (!existsSync18(configPath)) {
     return { text: `nomos_evolve_preview: config not found: ${configPath}`, isError: true };
   }
-  const againstPath = isAbsolute2(args.against) ? args.against : resolve6(dirname7(configPath), args.against);
-  const priorArg = existsSync17(againstPath) ? againstPath : args.against;
+  const againstPath = isAbsolute2(args.against) ? args.against : resolve7(dirname8(configPath), args.against);
+  const priorArg = existsSync18(againstPath) ? againstPath : args.against;
   const jsonRun = runCheckJson(configPath, ["--against", priorArg]);
   if (jsonRun.error !== void 0) {
     return {
@@ -43985,21 +44373,21 @@ __export(conformance_exports, {
   runConformance: () => runConformance
 });
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { cpSync, existsSync as existsSync18, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync5, readFileSync as readFileSync16, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync15 } from "node:fs";
+import { cpSync, existsSync as existsSync19, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync5, readFileSync as readFileSync17, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync16 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname8, join as join23, resolve as resolve7 } from "node:path";
+import { dirname as dirname9, join as join23, resolve as resolve8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function installedPackage(name, from) {
   const require2 = createRequire3(join23(from, "package.json"));
   const entry = require2.resolve(name === "@githolon/testing" ? name : `${name}/package.json`);
-  for (let directory2 = dirname8(entry); ; directory2 = dirname8(directory2)) {
+  for (let directory2 = dirname9(entry); ; directory2 = dirname9(directory2)) {
     const manifest = join23(directory2, "package.json");
-    if (existsSync18(manifest)) {
-      const pkg = JSON.parse(readFileSync16(manifest, "utf8"));
+    if (existsSync19(manifest)) {
+      const pkg = JSON.parse(readFileSync17(manifest, "utf8"));
       if (pkg.name === name) return { name, version: pkg.version, directory: directory2 };
     }
-    if (dirname8(directory2) === directory2) throw new Error(`Cannot identify installed ${name}`);
+    if (dirname9(directory2) === directory2) throw new Error(`Cannot identify installed ${name}`);
   }
 }
 function runConformance(args, cwd = process.cwd()) {
@@ -44008,7 +44396,7 @@ function runConformance(args, cwd = process.cwd()) {
     const arg = args[index];
     if (arg === "--json") json = true;
     else if (arg === "--offline") offline = true;
-    else if (arg === "--runtime" && args[index + 1] && !args[index + 1].startsWith("--")) runtime = resolve7(cwd, args[++index]);
+    else if (arg === "--runtime" && args[index + 1] && !args[index + 1].startsWith("--")) runtime = resolve8(cwd, args[++index]);
     else {
       process.stderr.write(`error: unknown or incomplete conformance option: ${arg}. See githolon conformance --help.
 `);
@@ -44035,12 +44423,12 @@ function runConformance(args, cwd = process.cwd()) {
 `);
     }
     scratch = mkdtempSync5(join23(tmpdir4(), "nomos-conformance-"));
-    const here = dirname8(fileURLToPath2(import.meta.url));
-    const distribution = existsSync18(join23(here, "conformance-probe.mjs")) ? here : resolve7(here, "../dist");
+    const here = dirname9(fileURLToPath2(import.meta.url));
+    const distribution = existsSync19(join23(here, "conformance-probe.mjs")) ? here : resolve8(here, "../dist");
     cpSync(join23(distribution, "conformance-fixture"), scratch, { recursive: true });
-    writeFileSync15(join23(scratch, "package.json"), '{"name":"nomos-conformance-probe","private":true,"type":"module"}\n');
+    writeFileSync16(join23(scratch, "package.json"), '{"name":"nomos-conformance-probe","private":true,"type":"module"}\n');
     const modules = join23(scratch, "node_modules");
-    mkdirSync14(join23(modules, "@githolon"), { recursive: true });
+    mkdirSync15(join23(modules, "@githolon"), { recursive: true });
     for (const pkg of [dsl, peer2]) {
       symlinkSync(pkg.directory, join23(modules, pkg.name), process.platform === "win32" ? "junction" : "dir");
     }
@@ -44082,8 +44470,8 @@ function runConformance(args, cwd = process.cwd()) {
       timeout: 18e4,
       maxBuffer: 8 * 1024 * 1024
     });
-    if (existsSync18(resultFile)) {
-      const result = JSON.parse(readFileSync16(resultFile, "utf8"));
+    if (existsSync19(resultFile)) {
+      const result = JSON.parse(readFileSync17(resultFile, "utf8"));
       report.checks.push(...result.checks);
       if (result.runtime) report.runtime = result.runtime;
       if (result.failure) report.failure = result.failure;
@@ -44122,28 +44510,28 @@ __export(test_exports, {
   runDartTests: () => runDartTests
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname9, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { dirname as dirname10, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveTestCloudEntry(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const environment = options.environment ?? process.env;
   const explicit = environment.NOMOS_TEST_CLOUD_ENTRY;
   if (explicit !== void 0) {
-    const candidate = resolve8(cwd, explicit);
-    if (!existsSync19(candidate)) {
+    const candidate = resolve9(cwd, explicit);
+    if (!existsSync20(candidate)) {
       throw new Error(`NOMOS_TEST_CLOUD_ENTRY does not exist: ${candidate}`);
     }
     return candidate;
   }
-  const here = dirname9(fileURLToPath3(options.moduleUrl ?? import.meta.url));
+  const here = dirname10(fileURLToPath3(options.moduleUrl ?? import.meta.url));
   const candidates = [
-    resolve8(here, "dev-server.mjs"),
-    resolve8(here, "../dist/dev-server.mjs"),
-    resolve8(here, "../../platform-shells/node/local-development/server.ts"),
-    resolve8(cwd, "platform-shells/node/local-development/server.ts")
+    resolve9(here, "dev-server.mjs"),
+    resolve9(here, "../dist/dev-server.mjs"),
+    resolve9(here, "../../platform-shells/node/local-development/server.ts"),
+    resolve9(cwd, "platform-shells/node/local-development/server.ts")
   ];
-  const server = candidates.find((candidate) => existsSync19(candidate));
+  const server = candidates.find((candidate) => existsSync20(candidate));
   if (server === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
@@ -44404,8 +44792,8 @@ var init_workspace_epochs = __esm({
 // ../platform-shells/node/local-development/workspace_epochs.ts
 import { execFile } from "node:child_process";
 import { createPrivateKey as createPrivateKey3, createPublicKey as createPublicKey3, sign as ed25519Sign2 } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync17, renameSync as renameSync5, rmSync as rmSync8, writeFileSync as writeFileSync16 } from "node:fs";
-import { dirname as dirname10, join as join24 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync18, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
+import { dirname as dirname11, join as join24 } from "node:path";
 import { promisify } from "node:util";
 function localEpochRepoDir(dataDir, repo) {
   return join24(dataDir, "custody", `${repo}.git`);
@@ -44420,10 +44808,10 @@ async function git3(dir, ...args) {
 function localEpochCustodyHost(dataDir, workspace) {
   const pointerPath = localEpochPointerPath(dataDir, workspace);
   const dir = (repo) => localEpochRepoDir(dataDir, repo);
-  const storedPointer = () => existsSync20(pointerPath) ? readFileSync17(pointerPath, "utf8") : void 0;
+  const storedPointer = () => existsSync21(pointerPath) ? readFileSync18(pointerPath, "utf8") : void 0;
   return {
     readHead: async (repo) => {
-      if (!existsSync20(dir(repo))) return void 0;
+      if (!existsSync21(dir(repo))) return void 0;
       try {
         return parseGitObjectId2((await git3(dir(repo), "rev-parse", "--verify", "-q", "refs/heads/main^{commit}")).trim());
       } catch {
@@ -44431,8 +44819,8 @@ function localEpochCustodyHost(dataDir, workspace) {
       }
     },
     createRepo: async (repo) => {
-      if (existsSync20(dir(repo))) throw new Error(`${repo} already exists`);
-      mkdirSync15(dir(repo), { recursive: true });
+      if (existsSync21(dir(repo))) throw new Error(`${repo} already exists`);
+      mkdirSync16(dir(repo), { recursive: true });
       await run3("git", ["init", "--bare", "--quiet", dir(repo)]);
       await git3(dir(repo), "config", "http.uploadpack", "true");
       await git3(dir(repo), "config", "http.receivepack", "true");
@@ -44458,10 +44846,10 @@ function localEpochCustodyHost(dataDir, workspace) {
     },
     writePointer: async (expected, next) => {
       if (storedPointer() !== (expected === void 0 ? void 0 : encodeEpochPointer(expected))) return false;
-      mkdirSync15(dirname10(pointerPath), { recursive: true });
+      mkdirSync16(dirname11(pointerPath), { recursive: true });
       const staged = `${pointerPath}.${process.pid}.tmp`;
-      writeFileSync16(staged, encodeEpochPointer(next), { flag: "wx" });
-      renameSync5(staged, pointerPath);
+      writeFileSync17(staged, encodeEpochPointer(next), { flag: "wx" });
+      renameSync6(staged, pointerPath);
       return true;
     }
   };
@@ -44558,7 +44946,7 @@ __export(cloud_epoch_exports, {
   parseCloudEpochArgs: () => parseCloudEpochArgs,
   runCloudEpoch: () => runCloudEpoch
 });
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 function parseCloudEpochArgs(argv, env = process.env) {
   const [sub, workspace, ...rest] = argv;
   if (sub !== "plan" && sub !== "cut" && sub !== "verify") return { bad: `unknown epoch subcommand '${sub ?? ""}'` };
@@ -44648,7 +45036,7 @@ var init_cloud_epoch = __esm({
     defaultDeps = {
       host: localEpochCustodyHost,
       kernel: localEpochKernel,
-      readKey: (path4) => readFileSync18(path4, "utf8"),
+      readKey: (path4) => readFileSync19(path4, "utf8"),
       write: (text3) => void process.stdout.write(text3)
     };
   }
@@ -44891,7 +45279,7 @@ var init_model_children = __esm({
     init_law_directive_call();
     init_law_command_projection();
     init_law_encoder();
-    sleep = (ms) => new Promise((resolve11) => setTimeout(resolve11, ms));
+    sleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
   }
 });
 
@@ -45016,7 +45404,7 @@ async function modelAdopt(workspace, opts) {
         inventory = observed;
         break;
       }
-      await new Promise((resolve11) => setTimeout(resolve11, 250));
+      await new Promise((resolve12) => setTimeout(resolve12, 250));
     } while (Date.now() < deadline);
     if (inventory === void 0) throw new Error("the active-law projection did not converge within 30 seconds");
     const candidate = inventory.domains.find((installed) => installed.domainHash === identity);
@@ -45129,9 +45517,9 @@ var init_dlq = __esm({
 });
 
 // src/custodian.ts
-import { createHash as createHash8, createPrivateKey as createPrivateKey4, createPublicKey as createPublicKey4 } from "node:crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync19 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, join as join25, resolve as resolve9 } from "node:path";
+import { createHash as createHash9, createPrivateKey as createPrivateKey4, createPublicKey as createPublicKey4 } from "node:crypto";
+import { existsSync as existsSync22, readFileSync as readFileSync20 } from "node:fs";
+import { dirname as dirname12, isAbsolute as isAbsolute3, join as join25, resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL3 } from "node:url";
 import { create as create86 } from "@bufbuild/protobuf";
 import { AnySchema as AnySchema3 } from "@bufbuild/protobuf/wkt";
@@ -45141,7 +45529,7 @@ function custodianKeyHash(seed) {
   const publicKey = Buffer.from(
     createPublicKey4(createPrivateKey4({ key: pkcs8, format: "der", type: "pkcs8" })).export({ format: "der", type: "spki" }).subarray(-32)
   );
-  return createHash8("sha256").update(publicKey).digest("hex");
+  return createHash9("sha256").update(publicKey).digest("hex");
 }
 function custodianSeedFromText(text3, source) {
   const value = text3.trim();
@@ -45178,8 +45566,8 @@ async function resolveCustodianCredential(reference) {
     return fromSeed(custodianSeedFromText(device.secret, `~/.holon device key for ${rest}`), reference);
   }
   if (scheme === "file") {
-    if (rest === "" || !existsSync21(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
-    return fromSeed(custodianSeedFromText(readFileSync19(rest, "utf8"), rest), `file:${rest}`);
+    if (rest === "" || !existsSync22(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
+    return fromSeed(custodianSeedFromText(readFileSync20(rest, "utf8"), rest), `file:${rest}`);
   }
   if (scheme === "env") {
     const value = process.env[rest];
@@ -45205,8 +45593,8 @@ async function resolveCustodianCredential(reference) {
 }
 function readCustodianChain(file) {
   if (file === void 0) return [];
-  if (!existsSync21(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
-  const parsed = JSON.parse(readFileSync19(file, "utf8"));
+  if (!existsSync22(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
+  const parsed = JSON.parse(readFileSync20(file, "utf8"));
   const links = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.certChain) ? parsed.certChain : void 0;
   if (links === void 0) {
     throw new Error(
@@ -45257,9 +45645,9 @@ function scarFromVerdict(verdict) {
 function frameworkReceptionPath(here = moduleDirectory()) {
   const candidates = [
     join25(here, "framework", "nomos.reception.mjs"),
-    resolve9(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
+    resolve10(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
   ];
-  const found = candidates.find((candidate) => existsSync21(candidate));
+  const found = candidates.find((candidate) => existsSync22(candidate));
   if (found === void 0) {
     throw new Error(
       "the framework controller's compiled Reception is missing \u2014 reinstall `githolon`, or compile it with `node dsl/compile_package.mjs domain_nomos.nomos.project.ts` in cloud/cloudflare-shell/domains"
@@ -45268,8 +45656,8 @@ function frameworkReceptionPath(here = moduleDirectory()) {
   return found;
 }
 async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace, payload) {
-  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve9(process.cwd(), receptionPath);
-  if (!existsSync21(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
+  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve10(process.cwd(), receptionPath);
+  if (!existsSync22(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
   const module = await import(pathToFileURL3(absolute).href);
   const frameworkCalls = module["nomosFrameworkCalls"];
   if (typeof frameworkCalls === "object" && frameworkCalls !== null) {
@@ -45334,7 +45722,7 @@ async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace
   return captured;
 }
 function readPayload2(opts) {
-  const text3 = opts.payloadFile !== void 0 ? readFileSync19(opts.payloadFile, "utf8") : opts.payload;
+  const text3 = opts.payloadFile !== void 0 ? readFileSync20(opts.payloadFile, "utf8") : opts.payload;
   if (text3 === void 0) throw new Error("pass the directive's payload with --payload <json> or --payload-file <file>");
   const parsed = JSON.parse(text3);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
@@ -45403,7 +45791,7 @@ async function custodianCertify(workspace, opts) {
       custodianPrincipal: actor,
       certChain: chain
     });
-    const certId = createHash8("sha256").update(signed.certification).digest("hex");
+    const certId = createHash9("sha256").update(signed.certification).digest("hex");
     const call = await encodeDirectiveCall(
       opts.receptionPath ?? frameworkReceptionPath(),
       CERTIFY_ERA_DOMAIN,
@@ -45548,7 +45936,7 @@ var init_custodian = __esm({
       [/forged-principal|ForgedPrincipal|VERIFIED author/i, "ForgedPrincipal"],
       [/bad-signature|BadSignature/i, "BadSignature"]
     ];
-    moduleDirectory = () => dirname11(fileURLToPath4(import.meta.url));
+    moduleDirectory = () => dirname12(fileURLToPath4(import.meta.url));
     CapturedCall = class extends Error {
       constructor() {
         super("call captured");
@@ -45674,8 +46062,8 @@ Options
 });
 
 // src/cli.ts
-import { existsSync as existsSync22, readFileSync as readFileSync20 } from "node:fs";
-import { dirname as dirname12, join as join26, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync21 } from "node:fs";
+import { dirname as dirname13, join as join26, resolve as resolve11 } from "node:path";
 import { pathToFileURL as pathToFileURL4, fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/generate.ts
@@ -45921,28 +46309,28 @@ async function plan(cloud, parent, child, actor, action) {
       payload: { child, reclaimedBy: bare(actor), reclaimedAt: at }
     };
   }
-  const record = await registryRow(cloud, parent, child);
-  if (record === void 0) {
+  const record2 = await registryRow(cloud, parent, child);
+  if (record2 === void 0) {
     refuse(
       `${action} '${child}': no NomosBirthRecord or CloudWorkspace named '${child}' in ${parent} \u2014 nothing lawful to ${action}.
   An out-of-band custody repo has no parent lifecycle fact and needs a custodian investigation.`
     );
   }
-  const status2 = String(record.data["status"] ?? "");
-  const creatorOf = String(record.data["createdBy"] ?? record.data["principal"] ?? "");
+  const status2 = String(record2.data["status"] ?? "");
+  const creatorOf = String(record2.data["createdBy"] ?? record2.data["principal"] ?? "");
   if (action === "retire") {
     const own = sameIdentity2(creatorOf, actor);
     return {
       lane: "registry",
       directive: own ? "retireOwnWorkspace" : "retireWorkspace",
       gate: own ? "creator" : "admin",
-      payload: { workspaceId: record.id, retiredBy: bare(actor), retiredAt: at },
+      payload: { workspaceId: record2.id, retiredBy: bare(actor), retiredAt: at },
       ...status2 === "retired" ? { done: `${child} is already retired in ${parent}` } : {}
     };
   }
   if (status2 === "reclaimed") return { lane: "registry", directive: "reclaimWorkspace", gate: "admin", payload: {}, done: `${child} is already reclaimed in ${parent}` };
   if (status2 !== "retired") refuse(`${child} is ${status2 || "live"} in ${parent}; reclaim is two-phase \u2014 retire it first`);
-  return { lane: "registry", directive: "reclaimWorkspace", gate: "admin", payload: { workspaceId: record.id, reclaimedBy: bare(actor), reclaimedAt: at } };
+  return { lane: "registry", directive: "reclaimWorkspace", gate: "admin", payload: { workspaceId: record2.id, reclaimedBy: bare(actor), reclaimedAt: at } };
 }
 async function holders(cloud, workspace, relation) {
   try {
@@ -46573,6 +46961,9 @@ async function main(argv) {
   if (argv[0] === "console") {
     return (await Promise.resolve().then(() => (init_console(), console_exports))).consoleCommand(argv.slice(1));
   }
+  if (argv[0] === "reception") {
+    return (await Promise.resolve().then(() => (init_hosted_reception(), hosted_reception_exports))).hostedReceptionCommand(argv.slice(1));
+  }
   if (argv[0] === "compile") {
     return runCompileCommand(argv.slice(1));
   }
@@ -46625,12 +47016,12 @@ ${commandHelp("cloud") ?? USAGE2}`);
       return 1;
     }
     const { spawnSync: spawnSync7 } = await import("node:child_process");
-    const here = dirname12(fileURLToPath5(import.meta.url));
+    const here = dirname13(fileURLToPath5(import.meta.url));
     const candidates = [
-      resolve10(here, "dev-server.mjs")
+      resolve11(here, "dev-server.mjs")
       // published: dist/dev-server.mjs
     ];
-    const serverPath = candidates.find((p) => existsSync22(p));
+    const serverPath = candidates.find((p) => existsSync23(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;