githolon 0.67.0 → 0.69.0

package/dist/cli.mjs

@@ -24,7 +24,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
     return rel === "" ? [] : rel.split("/");
   }
-  function resolve5(ps) {
+  function resolve6(ps) {
     let cur = root;
     for (const part of ps) {
       if (!isDir(cur)) return null;
@@ -34,11 +34,11 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     }
     return cur;
   }
-  const parent = (ps) => resolve5(ps.slice(0, -1));
+  const parent = (ps) => resolve6(ps.slice(0, -1));
   const leaf = (ps) => ps[ps.length - 1];
   const promises = {
     async readFile(p, opts) {
-      const n = resolve5(parts(p));
+      const n = resolve6(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (isDir(n)) throw fsErr("EISDIR", p);
       const data = n.data ?? new Uint8Array(0);
@@ -57,7 +57,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
     },
     async readdir(p) {
-      const n = resolve5(parts(p));
+      const n = resolve6(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (!isDir(n)) throw fsErr("ENOTDIR", p);
       return [...n.contents.keys()];
@@ -77,7 +77,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       return promises.lstat(p);
     },
     async lstat(p) {
-      const n = resolve5(parts(p));
+      const n = resolve6(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       const dir = isDir(n);
       return {
@@ -386,6 +386,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installPayload: () => installPayload,
   installedLaw: () => installedLaw,
+  kgit: () => kgit,
   lawParity: () => lawParity,
   ledgerStats: () => ledgerStats,
   listRefusedRefs: () => listRefusedRefs,
@@ -414,6 +415,7 @@ __export(engine_exports, {
   readCheckpointBlob: () => readCheckpointBlob,
   readPosture: () => readPosture,
   readShape: () => readShape,
+  rebirthCompact: () => rebirthCompact,
   refreshProjection: () => refreshProjection,
   replicateIntents: () => replicateIntents,
   repoArgOf: () => repoArgOf,
@@ -2169,6 +2171,123 @@ async function verifyChain(eng, ws, ledger) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
+async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0, parent = "" } = {}) {
+  const incWs = `${ws}__rebirth`;
+  try {
+    if (!eng.mounted.has(ws)) await mountWorkspace(eng, ws, ledger || { remote: "https://unborn.invalid/", headers: {} });
+    const srcGitdir = gitdirOf(ws);
+    const oldHead = kgit.resolveRef(eng, srcGitdir, BRANCH);
+    if (!/^[0-9a-f]{40}$/i.test(oldHead || "")) return { ok: false, error: `'${ws}' has no refs/heads/main to rebirth \u2014 nothing to compact` };
+    const sealed = kgit.intentsAbove(eng, srcGitdir, oldHead, "", 0);
+    if (!Array.isArray(sealed) || !sealed.length) return { ok: false, error: `'${ws}' main carries no intents to replay` };
+    unmount(eng, incWs);
+    await mountEphemeralWorkspace(eng, incWs, {});
+    const isGenesisBootstrapInstall = (c) => {
+      try {
+        const doc = JSON.parse(dec3.decode(bytesFromB64(c.intentB64)));
+        return doc?.payload?.domain === "bootstrap" && doc?.payload?.directiveId === "installDomain";
+      } catch {
+        return false;
+      }
+    };
+    const transformState = (sealedBytes) => sealedBytes;
+    const carried = [];
+    const parkedIntents = [];
+    const parkedBlobs = [];
+    let idx = -1, lastCarriedIdx = -1, firstParkedIdx = -1;
+    for (const c of sealed) {
+      idx++;
+      if (isGenesisBootstrapInstall(c)) continue;
+      let bytes;
+      try {
+        bytes = transformState(bytesFromB64(c.intentB64), { oid: c.oid, incWs });
+      } catch {
+        parkedIntents.push({ oid: c.oid, reason: "undecodable intent blob" });
+        parkedBlobs.push(bytesFromB64(c.intentB64));
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+        continue;
+      }
+      const r = applyIntentBytes(eng, incWs, bytes, { defer: false });
+      if (r && r.ok) {
+        carried.push(c.oid);
+        lastCarriedIdx = idx;
+      } else {
+        parkedIntents.push({ oid: c.oid, reason: String(r && r.error || "refused").slice(0, 200) });
+        parkedBlobs.push(bytes);
+        if (firstParkedIdx < 0) firstParkedIdx = idx;
+      }
+    }
+    const scarShape = parkedIntents.length === 0 ? "none" : firstParkedIdx > lastCarriedIdx ? "tail" : "mid-chain";
+    const incGitdir = gitdirOf(incWs);
+    const head = kgit.resolveRef(eng, incGitdir, BRANCH);
+    if (!/^[0-9a-f]{40}$/i.test(head || "")) {
+      unmount(eng, incWs);
+      return { ok: false, error: `the incarnation folded no intents (all ${sealed.length} refused \u2014 all parked-to-be, nothing to serve)`, parked: parkedIntents.length, parkedIntents };
+    }
+    const incChain = kgit.intentsAbove(eng, incGitdir, head, "", 0);
+    const genesisOid = incChain.length ? incChain[0].oid : head;
+    let parkedRef = "";
+    let parkedTip = "";
+    if (parkedBlobs.length) {
+      parkedRef = `refs/heads/unreplayed/${supersededAt || Date.now()}`;
+      let parentOid = head;
+      for (let i = 0; i < parkedBlobs.length; i++) {
+        parentOid = kgit.writeMetaCommit(eng, incGitdir, {
+          parents: [parentOid],
+          files: [{ path: "intent.json", bytes: parkedBlobs[i] }],
+          message: `unreplayed: ${parkedIntents[i].oid.slice(0, 12)} \u2014 ${parkedIntents[i].reason.slice(0, 120)}`,
+          timeSecs: 0,
+          ref: i === parkedBlobs.length - 1 ? parkedRef : ""
+        });
+      }
+      parkedTip = parentOid;
+    }
+    const verdict = verifyChainLocal(eng, incWs);
+    const verified = verdict && verdict.valid === true;
+    let packB64 = "";
+    let parkedPackB64 = "";
+    if (verified) {
+      const pack = packDelta(eng, incWs, "", head);
+      if (pack && pack.length) packB64 = b64Bytes(pack);
+      if (parkedTip) {
+        const ppack = packDelta(eng, incWs, head, parkedTip);
+        if (ppack && ppack.length) parkedPackB64 = b64Bytes(ppack);
+        if (!parkedPackB64) {
+          unmount(eng, incWs);
+          return { ok: false, error: "parked intents exist but produced no parked pack \u2014 refusing (parked work must never be lost)", parked: parkedIntents.length };
+        }
+      }
+    }
+    unmount(eng, incWs);
+    if (verified && !packB64) return { ok: false, error: "the incarnation self-verified but produced no pack", verified: true };
+    return {
+      ok: true,
+      packB64,
+      head,
+      genesisOid,
+      verified,
+      ...verified ? {} : { verifyError: verdict && verdict.error || "verify_chain returned invalid" },
+      carried: carried.length,
+      parked: parkedIntents.length,
+      parkedIntents,
+      scarShape,
+      ...parkedTip ? { parkedRef, parkedTip, parkedPackB64 } : {},
+      // rebornFrom = the SUPERSEDED chain's genesis oid (the old ancestry the reborn holon descends
+      // from). Surfaced for the worker's status contract; NOT re-authored IN-CHAIN here (stamping it
+      // onto birthCloud would re-sign the record → the operator key, the CLI lane).
+      rebornFrom: sealed[0].oid,
+      parent,
+      reason,
+      supersededAt
+    };
+  } catch (e) {
+    try {
+      unmount(eng, incWs);
+    } catch {
+    }
+    return { ok: false, error: String(e && e.message || e).slice(0, 300) };
+  }
+}
 async function archiveRefusedMain(eng, ws, ledger, label) {
   unmount(eng, ws);
   const m = await mountWorkspace(eng, ws, ledger);
@@ -2483,6 +2602,8 @@ var init_engine = __esm({
       writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
       // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
       deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
+      applyPack: (eng, ws, packBytes) => applyPackInto(eng, ws, packBytes),
       // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
       // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
       writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
@@ -2710,7 +2831,10 @@ var init_local_holon = __esm({
 // src/governance.ts
 var governance_exports = {};
 __export(governance_exports, {
+  buildCertificate: () => buildCertificate,
+  buildRebirthPlan: () => buildRebirthPlan,
   certifyEra: () => certifyEra,
+  executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
   grantOrRevoke: () => grantOrRevoke,
@@ -2718,12 +2842,19 @@ __export(governance_exports, {
   keyExport: () => keyExport,
   keyImport: () => keyImport,
   keyShow: () => keyShow,
+  rebirthApply: () => rebirthApply,
+  rebirthPlanCommand: () => rebirthPlanCommand,
+  rebirthWorkspace: () => rebirthWorkspace,
+  renderRebirthImpact: () => renderRebirthImpact,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
   signAndPostGovernance: () => signAndPostGovernance,
-  signAndPostOffer: () => signAndPostOffer
+  signAndPostOffer: () => signAndPostOffer,
+  validatePlanForApply: () => validatePlanForApply,
+  verifyWorkspaceVerdict: () => verifyWorkspaceVerdict
 });
 import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
 async function clientConnect() {
   const mod = await import("@githolon/client");
   return mod.connect;
@@ -3163,6 +3294,549 @@ certify-era ${ws}:`);
   out2(`  verify: githolon ledger verify ${ws}   (expect GREEN with certifiedRanges naming the oids)`);
   return 0;
 }
+async function parkedAreAllLawInstalls(engMod, eng, ws, oids) {
+  try {
+    const git4 = (await import("isomorphic-git")).default;
+    const { gitdirOf: gitdirOf2 } = engMod;
+    const fs = eng.fs;
+    const gitdir = gitdirOf2(ws);
+    const dec4 = new TextDecoder();
+    for (const oid of oids) {
+      const { blob } = await git4.readBlob({ fs, gitdir, oid, filepath: "intent.json" });
+      const doc = JSON.parse(dec4.decode(blob));
+      const domain = doc.payload?.domain;
+      const dir = doc.payload?.directiveId;
+      if (!((domain === "nomos" || domain === "bootstrap") && dir === "installDomain")) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function buildRebirthPlan(cloud, ws, reason) {
+  const engMod = await Promise.resolve().then(() => (init_engine(), engine_exports));
+  const { query: query2, verifyChainLocal: verifyChainLocal2 } = engMod;
+  const { mountWorkspace: mountWorkspace2 } = engMod;
+  const { holonEngine: holonEngine2 } = await Promise.resolve().then(() => (init_local_holon(), local_holon_exports));
+  let eng;
+  try {
+    ({ eng } = await holonEngine2(cloud, void 0, "gov-rebirth-plan"));
+    const m = await mountWorkspace2(eng, "root", { remote: `${cloud}/v2/workspaces/root/git`, headers: {} });
+    if (m.restored !== true) return { error: `root has no ledger on ${cloud} \u2014 cannot analyse a supersession` };
+  } catch (e) {
+    return { error: `could not mount root: ${e.message}` };
+  }
+  const rows = query2(eng, "root", "workspaceByName", JSON.stringify({ name: ws }));
+  const rec = rows[rows.length - 1];
+  const workspaceId = rec?.id;
+  if (typeof workspaceId !== "string" || workspaceId === "") {
+    return { error: `no CloudWorkspace record named '${ws}' in root's registry \u2014 cannot supersede an unregistered workspace`, status: 404 };
+  }
+  const isRoot = String(rec?.data?.["name"]) === "root" || ws === "root";
+  const parent = String(rec?.data?.["parent"] ?? "");
+  let children = [];
+  try {
+    const kids = query2(eng, "root", "workspacesByParent", JSON.stringify({ parent: workspaceId }));
+    children = kids.map((k) => String(k?.data?.["name"] ?? "")).filter((n) => n !== "").map((name) => ({ name, preserved: true }));
+  } catch {
+  }
+  let incarnation = null;
+  let priorSupersessions = 0;
+  let ledgerCommits = null;
+  try {
+    const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
+    incarnation = typeof s.incarnation === "string" && s.incarnation !== "" ? s.incarnation : null;
+    priorSupersessions = Array.isArray(s.supersededChains) ? s.supersededChains.length : 0;
+    ledgerCommits = Number.isFinite(s.ledgerState?.commits) ? s.ledgerState?.commits ?? null : null;
+  } catch {
+  }
+  const lawHashes = {};
+  try {
+    const d = await (await fetch(`${cloud}/v2/workspaces/${ws}/domains`)).json();
+    for (const dom of d.domains ?? []) {
+      if (typeof dom.domainHash === "string" && dom.phase === "Active") lawHashes[dom.domainHash] = dom.phase;
+    }
+  } catch {
+  }
+  let verdict = { replay: "unknown", firstRefusal: null };
+  try {
+    const m = await mountWorkspace2(eng, ws, { remote: `${cloud}/v2/workspaces/${ws}/git`, headers: {} });
+    if (m.restored === true) {
+      const v = verifyChainLocal2(eng, ws);
+      if (v["valid"] === true) verdict = { replay: "green", firstRefusal: null };
+      else verdict = { replay: "red", firstRefusal: `${String(v["check"] ?? "?")}${v["atIndex"] !== void 0 ? ` @intent ${v["atIndex"]}` : ""}: ${String(v["error"] ?? "").slice(0, 200)}` };
+    }
+  } catch {
+  }
+  let compaction = { carried: null, parked: null, scarShape: "unknown" };
+  let parkedAllLawInstalls = false;
+  try {
+    const { rebirthCompact: rebirthCompact2 } = engMod;
+    const est = await rebirthCompact2(eng, ws, { remote: `${cloud}/v2/workspaces/${ws}/git`, headers: {} }, { parent });
+    if (est?.ok === true) {
+      const shape = est.scarShape === "none" || est.scarShape === "tail" || est.scarShape === "mid-chain" ? est.scarShape : "unknown";
+      compaction = { carried: est.carried ?? null, parked: est.parked ?? null, scarShape: shape };
+      const parkedOids = (est.parkedIntents ?? []).map((p) => p?.oid).filter((o) => typeof o === "string");
+      if (parkedOids.length > 0 && parkedOids.length <= 2) {
+        parkedAllLawInstalls = await parkedAreAllLawInstalls(engMod, eng, ws, parkedOids);
+      }
+    }
+  } catch {
+  }
+  const mode = compaction.scarShape === "mid-chain" && !((compaction.parked ?? 99) <= 2 && parkedAllLawInstalls) ? "state-seed" : "replay-compact";
+  const frozenAt = priorSupersessions === 0 ? ws : `${ws}--i${priorSupersessions}`;
+  const newCustodyAddress = `${ws}--i${priorSupersessions + 1}`;
+  const plan = {
+    v: 1,
+    workspace: ws,
+    reason: reason ?? null,
+    pinned: { incarnation, lawHashes, parent },
+    will: {
+      newCustodyAddress,
+      frozenAt,
+      lineageFacts: { supersededBy: newCustodyAddress, rebornFrom: incarnation ?? "" }
+    },
+    children,
+    verdict,
+    mode,
+    compaction,
+    repairs: [],
+    clientImpact: CLIENT_IMPACT,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { plan, workspaceId, ledgerCommits, isRoot };
+}
+function renderRebirthImpact(plan, ledgerCommits) {
+  const L = [];
+  const dim = (s) => s;
+  L.push(`REBIRTH IMPACT \u2014 ${plan.workspace}`);
+  L.push("\u2550".repeat(48));
+  L.push("");
+  L.push("CURRENT STATE");
+  L.push(`  incarnation   : ${plan.pinned.incarnation ? plan.pinned.incarnation.slice(0, 16) + "\u2026" : "(none recorded \u2014 first incarnation)"}`);
+  L.push(`  verify_chain  : ${plan.verdict.replay.toUpperCase()}${plan.verdict.firstRefusal ? `  \u2014 first refusal: ${plan.verdict.firstRefusal}` : ""}`);
+  L.push(`  ledger size   : ${ledgerCommits !== null ? `${ledgerCommits} commit(s)` : "(unknown)"}`);
+  const laws = Object.keys(plan.pinned.lawHashes);
+  L.push(`  installed law : ${laws.length ? laws.map((h) => h.slice(0, 12) + "\u2026").join(", ") : "(none read)"}`);
+  L.push(`  parent        : ${plan.pinned.parent || "(root)"}`);
+  L.push("");
+  L.push("WHAT A REBIRTH WOULD DO");
+  L.push(`  new custody   : ${plan.will.newCustodyAddress}   (the incarnation is born here, self-verified GREEN from intent 0 before the name repoints)`);
+  L.push(`  old holon      \u2192 FROZEN UNTOUCHED at ${plan.will.frozenAt}   (retained, GC-later; never rewritten)`);
+  L.push(`  parent        : ${plan.pinned.parent || "(root)"}   (UNCHANGED \u2014 a rebirth may never reparent)`);
+  L.push(`  lineage facts : supersededBy=${plan.will.lineageFacts.supersededBy}  \xB7  rebornFrom=${plan.will.lineageFacts.rebornFrom ? plan.will.lineageFacts.rebornFrom.slice(0, 16) + "\u2026" : "(the current incarnation)"}  \xB7  reason=${plan.reason ?? "(supply --reason)"}`);
+  L.push("");
+  L.push(`COMPACTION (mode: ${plan.mode})`);
+  const c = plan.compaction;
+  const n = (x) => x === null ? "?" : String(x);
+  L.push(`  replay-compact estimate : ${n(c.carried)} intent(s) CARRY onto the new main \xB7 ${n(c.parked)} PARK  (scar shape: ${c.scarShape})`);
+  if ((c.parked ?? 0) > 0 || c.scarShape === "unknown") {
+    L.push("  parked intents are NEVER dropped \u2014 they land byte-identical, in order, on the session-shaped");
+    L.push("  refs/heads/unreplayed/<ts> branch in the NEW repo, and re-enter through the STANDARD admit lane");
+    L.push("  after the law is corrected (a law fix / dispositions deploy).");
+  }
+  if (c.scarShape === "mid-chain") {
+    const rc = plan.mode === "replay-compact";
+    L.push("  MID-CHAIN scar \u2014 two options, choose informed:");
+    L.push(`    \u2022 replay-compact : keeps ${n(c.carried)} admissible intent(s) (incl. post-scar ones); parks ${n(c.parked)} for later re-admission${rc ? " \u2014 RECOMMENDED" : ""}`);
+    L.push(`    \u2022 state-seed     : the operator-signed compact re-genesis (current law + state seed, _rebirth_chains.mjs lane)${rc ? "" : " \u2014 RECOMMENDED"}`);
+    if (rc) L.push(`    \u2192 the parked set is \u22642 LAW INSTALL(s) (no data behind them) \u2014 replay-compact keeps FULL PROVENANCE at no real cost; the parked installs re-enter via the standard admit lane after the law fix.`);
+  }
+  L.push("");
+  L.push(`CHILDREN (${plan.children.length})`);
+  if (plan.children.length === 0) L.push("  (none \u2014 no downward lineage to preserve)");
+  else {
+    for (const c2 of plan.children) L.push(`  \u2022 ${c2.name}   [preserved]`);
+    L.push("  \u2192 preserved by lineage continuity; their birth-cert chains stay valid (same founding key + self-id).");
+  }
+  L.push("");
+  L.push("CLIENT IMPACT");
+  L.push(`  ${plan.clientImpact}.`);
+  L.push("  Recommend tenants DRAIN/SYNC their clients before the rebirth window.");
+  return L.join("\n");
+}
+async function rebirthPlanCommand(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const built = await buildRebirthPlan(cloud, ws, opts.reason ?? null);
+  if ("error" in built) {
+    err2(built.error);
+    return 1;
+  }
+  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const dir = opts.out ?? join3("rebirths", `${date}-${ws}`);
+  try {
+    mkdirSync3(dir, { recursive: true });
+    writeFileSync3(join3(dir, "plan.json"), JSON.stringify(built.plan, null, 2) + "\n");
+    writeFileSync3(join3(dir, "impact.md"), "```\n" + renderRebirthImpact(built.plan, built.ledgerCommits) + "\n```\n");
+  } catch (e) {
+    err2(`could not write the plan into ${dir}: ${e.message}`);
+    return 1;
+  }
+  out2(renderRebirthImpact(built.plan, built.ledgerCommits));
+  out2("");
+  out2(`\u2713 plan written: ${join3(dir, "plan.json")} + ${join3(dir, "impact.md")}`);
+  out2("  fill in `reason` before a future `githolon rebirth apply --plan` (apply is not yet available).");
+  return 0;
+}
+async function rebirthWorkspace(ws, opts) {
+  const cloudForPlan = cloudBase(opts.cloud);
+  if (opts.dryRun === true) {
+    const built = await buildRebirthPlan(cloudForPlan, ws, opts.reason ?? null);
+    if ("error" in built) {
+      err2(built.error);
+      return 1;
+    }
+    if (opts.json === true) out2(JSON.stringify(built.plan, null, 2));
+    else {
+      out2(renderRebirthImpact(built.plan, built.ledgerCommits));
+      out2("");
+      out2("DRY RUN \u2014 nothing was changed.");
+    }
+    return 0;
+  }
+  const reason = opts.reason;
+  if (reason === void 0 || reason.trim() === "") {
+    err2("gov rebirth requires a --reason (the mandatory audit justification for superseding this chain)");
+    return 1;
+  }
+  if (ws === "root") {
+    err2("the law refuses to rebirth root \u2014 the seat of the authorizing law cannot supersede itself");
+    return 1;
+  }
+  if (opts.plan !== void 0 && Array.isArray(opts.plan.repairs) && opts.plan.repairs.length > 0) {
+    err2("repair verbs are not yet available \u2014 the plan may not carry repairs (the `repairs` array must be empty)");
+    return 1;
+  }
+  let seed = opts.seedSecret ?? process.env["NOMOS_ROOT_SEED"];
+  if (seed === void 0 && opts.gcpSecret !== void 0) {
+    try {
+      const { execFileSync } = await import("node:child_process");
+      seed = execFileSync("gcloud", ["secrets", "versions", "access", "latest", "--secret", opts.gcpSecret], { encoding: "utf8" }).trim();
+    } catch (e) {
+      err2(`could not read GCP secret ${opts.gcpSecret}: ${e.message}`);
+      return 1;
+    }
+  }
+  if (seed === void 0 || seed.trim() === "") {
+    err2("gov rebirth needs the custodian seed \u2014 --seed-secret <b64>, env NOMOS_ROOT_SEED, or --gcp-secret <name>");
+    return 1;
+  }
+  const cloud = cloudBase(opts.cloud);
+  const engMod = await Promise.resolve().then(() => (init_engine(), engine_exports));
+  const { author: author2, query: query2 } = engMod;
+  const { holonEngine: holonEngine2 } = await Promise.resolve().then(() => (init_local_holon(), local_holon_exports));
+  const { mountWorkspace: mountWorkspace2 } = engMod;
+  let eng;
+  try {
+    ({ eng } = await holonEngine2(cloud, void 0, "gov-rebirth"));
+    const m = await mountWorkspace2(eng, "root", { remote: `${cloud}/v2/workspaces/root/git`, headers: {} });
+    if (m.restored !== true) {
+      err2(`root has no ledger on ${cloud} \u2014 cannot author a supersession`);
+      return 1;
+    }
+  } catch (e) {
+    err2(`could not mount root: ${e.message}`);
+    return 1;
+  }
+  const rows = query2(eng, "root", "workspaceByName", JSON.stringify({ name: ws }));
+  const rec = rows[rows.length - 1];
+  const workspaceId = rec?.id;
+  if (typeof workspaceId !== "string" || workspaceId === "") {
+    err2(`no CloudWorkspace record named '${ws}' in root's registry \u2014 cannot supersede an unregistered workspace`);
+    return 1;
+  }
+  if (String(rec?.data?.["name"]) === "root") {
+    err2("refusing to rebirth root (the fixed point)");
+    return 1;
+  }
+  if (opts.quiet !== true) {
+    try {
+      const built = await buildRebirthPlan(cloud, ws, reason);
+      if (!("error" in built)) {
+        out2("");
+        out2(renderRebirthImpact(built.plan, built.ledgerCommits));
+      }
+    } catch {
+    }
+  }
+  if (opts.quiet !== true) {
+    out2(`
+gov rebirth ${ws}:`);
+    out2(`  workspaceId : ${workspaceId}`);
+    out2(`  reason      : ${reason}`);
+    out2(`  effect      : supersedes the current chain \u2014 a NEW incarnation is re-genesised into fresh custody; the old holon is FROZEN UNTOUCHED at its own custody address (retained, GC-later)`);
+  }
+  if (opts.yes !== true && opts.quiet !== true) {
+    const rl = (await import("node:readline")).createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await new Promise((res2) => rl.question("  proceed? [y/N] ", (a) => {
+      rl.close();
+      res2(a);
+    }));
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      out2("aborted (nothing signed).");
+      return 1;
+    }
+  }
+  const rebornAt = Date.now();
+  const controllerHash = opts.controllerHash ?? eng.hashes?.nomos;
+  if (typeof controllerHash !== "string") {
+    err2("could not resolve root's governance controller hash (pass --controller-hash)");
+    return 1;
+  }
+  const res = author2(eng, "root", "workspaces", "rebirthWorkspace", { workspaceId, reason, rebornAt }, controllerHash, { authorSecret: seed, actor: "user:root-custodian" });
+  if (res.ok === false) {
+    err2(`rebirthWorkspace refused locally: ${res.error}`);
+    return 1;
+  }
+  const intentBytes = readSealedIntentBytes(eng, "root", res.intentOut);
+  if (intentBytes === void 0) {
+    err2("could not read the sealed rebirthWorkspace bytes to relay");
+    return 1;
+  }
+  let r;
+  try {
+    r = await fetch(`${cloud}/v2/workspaces/root/rebirthWorkspace`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ intentBytes }) });
+  } catch (e) {
+    err2(`relay to root failed: ${e.message}`);
+    return 1;
+  }
+  const text = await r.text();
+  if (!r.ok) {
+    err2(`rebirthWorkspace refused by root (${r.status}): ${text.slice(0, 300)}`);
+    return 1;
+  }
+  out2(`\u2713 rebirthWorkspace admitted at root \u2014 the supersession fact is folded; the bailiff will build the new incarnation`);
+  out2("  waiting for the new incarnation to serve \u2026");
+  for (let i = 0; i < 30; i++) {
+    await new Promise((res2) => setTimeout(res2, 2e3));
+    try {
+      const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
+      if (typeof s.incarnation === "string" && s.incarnation !== "") {
+        out2(`\u2713 new incarnation serving: ${s.incarnation.slice(0, 16)}\u2026  (superseded chains retained: ${(s.supersededChains ?? []).length})`);
+        out2(`  verify: githolon ledger verify ${ws}   (expect GREEN from intent 0)`);
+        return 0;
+      }
+    } catch {
+    }
+  }
+  out2(`  (the supersession is recorded; the custody swap has not surfaced an incarnation yet \u2014 check: githolon status ${ws})`);
+  return 0;
+}
+function validatePlanForApply(plan, liveIncarnation) {
+  if (plan.v !== 1) return { error: `unsupported plan schema v${String(plan.v)} \u2014 this CLI applies v1 plans` };
+  if (typeof plan.workspace !== "string" || plan.workspace === "") return { error: "the plan names no workspace" };
+  if (plan.reason === null || typeof plan.reason === "string" && plan.reason.trim() === "") {
+    return { error: "the plan's `reason` is still null \u2014 fill it in (the mandatory audit justification) before apply" };
+  }
+  if (Array.isArray(plan.repairs) && plan.repairs.length > 0) {
+    return { error: "repair verbs are not yet executable \u2014 the plan may not carry `repairs` (the array must be empty); state-transform verbs land in a future release" };
+  }
+  if (plan.pinned.incarnation !== null) {
+    if (liveIncarnation === void 0) {
+      return { error: "could not read the live workspace incarnation to confirm no drift \u2014 refusing (apply is drift-pinned)" };
+    }
+    if (liveIncarnation !== plan.pinned.incarnation) {
+      return { error: `the live workspace has DRIFTED from the plan: pinned incarnation ${plan.pinned.incarnation.slice(0, 16)}\u2026 but live is ${liveIncarnation === null ? "(none)" : liveIncarnation.slice(0, 16) + "\u2026"} \u2014 re-run \`githolon rebirth plan\` and re-review` };
+    }
+  }
+  return { ok: true };
+}
+function buildCertificate(args) {
+  const { plan } = args;
+  return {
+    v: 1,
+    plan,
+    executed: {
+      at: args.at,
+      custodian: args.custodian,
+      oldIncarnation: args.oldIncarnation,
+      newIncarnation: args.newIncarnation,
+      newCustodyAddress: plan.will.newCustodyAddress,
+      carried: plan.compaction.carried,
+      parked: plan.compaction.parked,
+      verdictBefore: args.verdictBefore,
+      ...args.firstRefusal ? { firstRefusal: args.firstRefusal } : {},
+      verdictAfter: args.verdictAfter
+    },
+    supersessionFacts: {
+      supersededBy: plan.will.newCustodyAddress,
+      rebornFrom: args.oldIncarnation ?? plan.will.lineageFacts.rebornFrom,
+      reason: plan.reason ?? "",
+      custodian: args.custodian,
+      at: args.at
+    },
+    ...args.repair !== void 0 ? { repair: args.repair } : {}
+  };
+}
+async function verifyWorkspaceVerdict(cloud, ws) {
+  try {
+    const engMod = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { verifyChainLocal: verifyChainLocal2 } = engMod;
+    const { mountWorkspace: mountWorkspace2 } = engMod;
+    const { holonEngine: holonEngine2 } = await Promise.resolve().then(() => (init_local_holon(), local_holon_exports));
+    const { eng } = await holonEngine2(cloud, void 0, "rebirth-verify");
+    const m = await mountWorkspace2(eng, ws, { remote: `${cloud}/v2/workspaces/${ws}/git`, headers: {} });
+    if (m.restored !== true) return { replay: "unknown", firstRefusal: null };
+    const v = verifyChainLocal2(eng, ws);
+    if (v["valid"] === true) return { replay: "green", firstRefusal: null };
+    return { replay: "red", firstRefusal: `${String(v["check"] ?? "?")}${v["atIndex"] !== void 0 ? ` @intent ${v["atIndex"]}` : ""}: ${String(v["error"] ?? "").slice(0, 200)}` };
+  } catch {
+    return { replay: "unknown", firstRefusal: null };
+  }
+}
+async function liveIncarnationOf(cloud, ws) {
+  try {
+    const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
+    return typeof s.incarnation === "string" && s.incarnation !== "" ? s.incarnation : null;
+  } catch {
+    return void 0;
+  }
+}
+async function rebirthApply(planPath, opts) {
+  let plan;
+  try {
+    plan = JSON.parse(readFileSync2(planPath, "utf8"));
+  } catch (e) {
+    err2(`cannot read the plan ${planPath}: ${e.message}`);
+    return 1;
+  }
+  const cloud = cloudBase(opts.cloud);
+  const ws = plan.workspace;
+  const liveIncarnation = await liveIncarnationOf(cloud, ws);
+  const check2 = validatePlanForApply(plan, liveIncarnation);
+  if ("error" in check2) {
+    err2(check2.error);
+    return 1;
+  }
+  let ledgerCommits = null;
+  try {
+    const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
+    ledgerCommits = Number.isFinite(s.ledgerState?.commits) ? s.ledgerState?.commits ?? null : null;
+  } catch {
+  }
+  out2(renderRebirthImpact(plan, ledgerCommits));
+  out2("");
+  out2(`APPLY \u2014 driving the reviewed plan (pinned incarnation ${plan.pinned.incarnation ? plan.pinned.incarnation.slice(0, 16) + "\u2026" : "(none)"}, mode ${plan.mode}).`);
+  if (opts.yes !== true) {
+    const rl = (await import("node:readline")).createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await new Promise((res) => rl.question("  proceed with the rebirth? [y/N] ", (a) => {
+      rl.close();
+      res(a);
+    }));
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      out2("aborted (nothing signed).");
+      return 1;
+    }
+  }
+  const verdictBefore = plan.verdict.replay === "green" ? "green" : "red";
+  const custodian = opts.principal ?? activePrincipal() ?? "root-custodian";
+  const code = await rebirthWorkspace(ws, {
+    ...opts,
+    reason: plan.reason ?? void 0,
+    plan,
+    quiet: true,
+    yes: true
+  });
+  if (code !== 0) {
+    err2("the rebirth did not complete \u2014 no certificate written (re-check status and retry)");
+    return code;
+  }
+  const newIncarnation = await liveIncarnationOf(cloud, ws) ?? null;
+  const verdictAfter = await verifyWorkspaceVerdict(cloud, ws);
+  const cert = buildCertificate({
+    plan,
+    custodian,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    oldIncarnation: plan.pinned.incarnation,
+    newIncarnation,
+    verdictBefore,
+    ...plan.verdict.firstRefusal ? { firstRefusal: plan.verdict.firstRefusal } : {},
+    verdictAfter
+  });
+  const certPath = join3(dirname2(planPath), "certificate.json");
+  try {
+    writeFileSync3(certPath, JSON.stringify(cert, null, 2) + "\n");
+  } catch (e) {
+    err2(`the rebirth succeeded but the certificate could not be written to ${certPath}: ${e.message}`);
+    return 1;
+  }
+  out2(`\u2713 certificate written: ${certPath}`);
+  if (verdictAfter.replay !== "green") {
+    err2(`WARNING: the new incarnation did NOT verify green (${verdictAfter.replay}${verdictAfter.firstRefusal ? `: ${verdictAfter.firstRefusal}` : ""}) \u2014 investigate before trusting the rebirth`);
+    return 1;
+  }
+  out2(`  new incarnation verifies GREEN from intent 0 \u2014 the certificate is cross-checkable against root lineage.`);
+  return 0;
+}
+async function executeRepairRebirth(cloud, ws, repair, verdict, opts) {
+  const cloudBaseUrl = cloudBase(cloud);
+  const reason = `${repair.reason} [repair:${repair.id}]`;
+  const built = await buildRebirthPlan(cloudBaseUrl, ws, reason);
+  if ("error" in built) {
+    err2(built.error);
+    return 1;
+  }
+  const plan = built.plan;
+  out2("");
+  out2(renderRebirthImpact(plan, built.ledgerCommits));
+  out2("");
+  out2(`\u2726 REPAIR: '${repair.id}' (${repair.file})`);
+  out2(`  matches: ${repair.matcher.refusal} \xB7 stable id ${repair.matcher.stableId}`);
+  out2(`  reason : ${repair.reason}`);
+  out2(`  NOTE: repair verb recorded; state transform verbs land in a future release (v1 executes the`);
+  out2(`        rebirth with the repair recorded in the reason + certificate \u2014 no state is transformed yet).`);
+  if (opts.yes !== true) {
+    const rl = (await import("node:readline")).createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await new Promise((res) => rl.question("  execute this repair (a rebirth)? [y/N] ", (a) => {
+      rl.close();
+      res(a);
+    }));
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      out2("aborted (nothing signed).");
+      return 1;
+    }
+  }
+  const custodian = opts.principal ?? activePrincipal() ?? "root-custodian";
+  const verdictBefore = "red";
+  const firstRefusal = `${String(verdict["check"] ?? "?")}: ${String(verdict["error"] ?? "").slice(0, 200)}`;
+  const code = await rebirthWorkspace(ws, { ...opts, reason, plan, quiet: true, yes: true });
+  if (code !== 0) {
+    err2("the repair rebirth did not complete \u2014 no certificate written");
+    return code;
+  }
+  const newIncarnation = await liveIncarnationOf(cloudBaseUrl, ws) ?? null;
+  const verdictAfter = await verifyWorkspaceVerdict(cloudBaseUrl, ws);
+  const cert = buildCertificate({
+    plan,
+    custodian,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    oldIncarnation: plan.pinned.incarnation,
+    newIncarnation,
+    verdictBefore,
+    firstRefusal,
+    verdictAfter,
+    repair: {
+      id: repair.id,
+      file: repair.file,
+      matcher: { refusal: repair.matcher.refusal, stableId: repair.matcher.stableId },
+      note: "repair verb recorded; state transform verbs land in a future release (v1 rebirth only)"
+    }
+  });
+  const certPath = join3(dirname2(repair.file), "certificate.json");
+  try {
+    writeFileSync3(certPath, JSON.stringify(cert, null, 2) + "\n");
+  } catch (e) {
+    err2(`the repair rebirth succeeded but the certificate could not be written to ${certPath}: ${e.message}`);
+    return 1;
+  }
+  out2(`\u2713 certificate written: ${certPath}`);
+  if (verdictAfter.replay !== "green") {
+    err2(`WARNING: the new incarnation did NOT verify green (${verdictAfter.replay}) \u2014 investigate`);
+    return 1;
+  }
+  out2(`  re-run \`githolon replay ${ws}\` \u2014 the refusal is gone (green), so the repair no longer matches (idempotent).`);
+  return 0;
+}
 function readSealedIntentBytes(eng, ws, intentOut) {
   if (typeof intentOut !== "string") return void 0;
   const tree = eng.preopen.dir.contents?.get("ws");
@@ -3170,13 +3844,14 @@ function readSealedIntentBytes(eng, ws, intentOut) {
   if (f?.data === void 0) return void 0;
   return Buffer.from(f.data).toString("base64");
 }
-var out2, err2;
+var out2, err2, CLIENT_IMPACT;
 var init_governance = __esm({
   "src/governance.ts"() {
     "use strict";
     init_cloud();
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
+    CLIENT_IMPACT = "every connected client raises CustodyBreak(superseded); unsynced client work is invisible to the cloud \u2014 drain/sync clients first";
   }
 });
 
@@ -3522,9 +4197,9 @@ __export(cloud_exports, {
   wsRetire: () => wsRetire,
   wsStatus: () => wsStatus
 });
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { homedir } from "node:os";
 function cloudBase(flag) {
   return (flag ?? process.env["NOMOS_CLOUD"] ?? DEFAULT_CLOUD).replace(/\/+$/, "");
@@ -3536,17 +4211,17 @@ function authAnonKey() {
   return process.env["HOLON_AUTH_ANON_KEY"] ?? DEFAULT_AUTH_ANON_KEY;
 }
 function configDir() {
-  return process.env["HOLON_CONFIG_DIR"] ?? join3(homedir(), ".holon");
+  return process.env["HOLON_CONFIG_DIR"] ?? join4(homedir(), ".holon");
 }
 function credsPath() {
-  return join3(configDir(), "credentials.json");
+  return join4(configDir(), "credentials.json");
 }
 function loadCreds() {
   if (!existsSync3(credsPath())) return { version: 1, secrets: {} };
   return JSON.parse(readFileSync4(credsPath(), "utf8"));
 }
 function saveCreds(c) {
-  mkdirSync3(configDir(), { recursive: true });
+  mkdirSync4(configDir(), { recursive: true });
   writeFileSync4(credsPath(), JSON.stringify(c, null, 2) + "\n", "utf8");
   chmodSync(credsPath(), 384);
 }
@@ -3665,7 +4340,7 @@ function discoverDeployJson(cwd, explicit) {
     if (!existsSync3(explicit)) throw new Error(`deploy body not found: ${explicit}`);
     return explicit;
   }
-  const buildDir = join3(cwd, "build");
+  const buildDir = join4(cwd, "build");
   if (!existsSync3(buildDir)) {
     throw new Error("no build/ directory \u2014 run `githolon compile` first (or pass --file <path>)");
   }
@@ -3676,7 +4351,7 @@ function discoverDeployJson(cwd, explicit) {
   if (bodies.length > 1) {
     throw new Error(`multiple deploy bodies in build/ (${bodies.join(", ")}) \u2014 pass --file <path>`);
   }
-  return join3(buildDir, bodies[0]);
+  return join4(buildDir, bodies[0]);
 }
 async function login(opts) {
   if (opts.agent !== true && opts.token === void 0) {
@@ -4036,10 +4711,10 @@ __export(editor_exports, {
   initEditor: () => initEditor,
   writeEditorRecommendation: () => writeEditorRecommendation
 });
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 function hasEditorRecommendation(cwd) {
-  const p = join4(cwd, ".vscode", "extensions.json");
+  const p = join5(cwd, ".vscode", "extensions.json");
   if (!existsSync4(p)) return false;
   try {
     const json = JSON.parse(readFileSync5(p, "utf8"));
@@ -4049,8 +4724,8 @@ function hasEditorRecommendation(cwd) {
   }
 }
 function writeEditorRecommendation(cwd) {
-  const dir = join4(cwd, ".vscode");
-  const path = join4(dir, "extensions.json");
+  const dir = join5(cwd, ".vscode");
+  const path = join5(dir, "extensions.json");
   let json = {};
   let existed = false;
   if (existsSync4(path)) {
@@ -4074,7 +4749,7 @@ function writeEditorRecommendation(cwd) {
   }
   recs.push(NOMOS_LAW_EXTENSION_ID);
   json.recommendations = recs;
-  mkdirSync4(dirname2(path), { recursive: true });
+  mkdirSync5(dirname3(path), { recursive: true });
   writeFileSync5(path, JSON.stringify(json, null, 2) + "\n", "utf8");
   return { path, action: existed ? "updated" : "created" };
 }
@@ -4111,19 +4786,19 @@ var init_editor = __esm({
 // src/compile.ts
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname4, join as join6 } from "node:path";
 import { pathToFileURL } from "node:url";
 function resolveCompileLauncher(cwd) {
   const resolveDslPkg = (fromDir) => {
     try {
-      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join5(fromDir, "noop.js")));
+      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join6(fromDir, "noop.js")));
       return req.resolve("@githolon/dsl/package.json");
     } catch {
       return void 0;
     }
   };
   const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
-  return dslPkg === void 0 ? void 0 : join5(dirname3(dslPkg), "compile_package.mjs");
+  return dslPkg === void 0 ? void 0 : join6(dirname4(dslPkg), "compile_package.mjs");
 }
 function runCompile(args) {
   const launcher = resolveCompileLauncher(process.cwd());
@@ -4146,7 +4821,7 @@ ${INIT_EDITOR_HINT}
 }
 function resolveCheckLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join5(dirname3(launcher), "check_package.mjs");
+  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "check_package.mjs");
 }
 function runCheck(args) {
   const launcher = resolveCheckLauncher(process.cwd());
@@ -4160,7 +4835,7 @@ function runCheck(args) {
 }
 function resolveCompatLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join5(dirname3(launcher), "compat_package.mjs");
+  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "compat_package.mjs");
 }
 function runCompat(args) {
   const launcher = resolveCompatLauncher(process.cwd());
@@ -4174,7 +4849,7 @@ function runCompat(args) {
 }
 function resolveLspLauncher(cwd) {
   const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join5(dirname3(launcher), "lsp_server.mjs");
+  return launcher === void 0 ? void 0 : join6(dirname4(launcher), "lsp_server.mjs");
 }
 function runLsp(args) {
   const launcher = resolveLspLauncher(process.cwd());
@@ -4224,7 +4899,7 @@ __export(proof_offline_exports, {
   runRelationBootstrapLeg: () => runRelationBootstrapLeg
 });
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { basename, dirname as dirname4, join as join7 } from "node:path";
+import { basename, dirname as dirname5, join as join8 } from "node:path";
 function parseOfflineLegs(proofSource) {
   if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
     throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
@@ -4651,12 +5326,12 @@ function actorFromPayload(payload, field) {
 async function runOfflineProofStandalone(proofPath, cloud, domain) {
   const src = readFileSync6(proofPath, "utf8");
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
-  const deployFile = join7(dirname4(proofPath), `${packageName}.deploy.json`);
+  const deployFile = join8(dirname5(proofPath), `${packageName}.deploy.json`);
   if (!existsSync6(deployFile)) {
     throw new Error(`missing ${deployFile} \u2014 run \`githolon compile\` (the proof and the deploy body are built together)`);
   }
   let legs;
-  const legsFile = join7(dirname4(proofPath), `${packageName}.proof-legs.json`);
+  const legsFile = join8(dirname5(proofPath), `${packageName}.proof-legs.json`);
   if (existsSync6(legsFile)) {
     const index = JSON.parse(readFileSync6(legsFile, "utf8"));
     const keys = Object.keys(index.domains);
@@ -4703,6 +5378,147 @@ var init_proof_offline = __esm({
   }
 });
 
+// src/repairs.ts
+var repairs_exports = {};
+__export(repairs_exports, {
+  discoverRepairs: () => discoverRepairs,
+  knownRepairBlock: () => knownRepairBlock,
+  matchRepair: () => matchRepair,
+  parseRefusal: () => parseRefusal
+});
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createRequire as createRequire2 } from "node:module";
+import { existsSync as existsSync9, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname7, isAbsolute, join as join11, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL4 } from "node:url";
+function parseRefusal(verdict) {
+  const check2 = String(verdict["check"] ?? "");
+  const error = String(verdict["error"] ?? "");
+  const raw = `${check2}: ${error}`;
+  const kind = /evolve.?gate/i.test(raw) || /evolve/i.test(check2) ? "evolve-gate" : "other";
+  const sids = /* @__PURE__ */ new Set();
+  const structured = verdict["stableId"] ?? verdict["stableIds"];
+  if (typeof structured === "string" && SID_SHAPE.test(structured)) sids.add(structured.toLowerCase());
+  if (Array.isArray(structured)) {
+    for (const s of structured) if (typeof s === "string" && SID_SHAPE.test(s)) sids.add(s.toLowerCase());
+  }
+  for (const m of raw.matchAll(SID_RE)) sids.add(m[1].toLowerCase());
+  return { kind, stableIds: [...sids], raw };
+}
+function matchRepair(refusal, repairs) {
+  if (refusal.kind === "other") return void 0;
+  return repairs.find(
+    (r) => r.matcher.refusal === refusal.kind && refusal.stableIds.includes(r.matcher.stableId.toLowerCase())
+  );
+}
+function knownRepairBlock(repair) {
+  return [
+    "",
+    `\u2726 KNOWN REPAIR: '${repair.id}' (${repair.file}) declares a remedy for exactly this refusal.`,
+    `  reason: ${repair.reason}`,
+    "  Re-run with --repair to execute it."
+  ].join("\n");
+}
+function resolveTsxCli(cwd) {
+  const pkgDir = (name, fromDir) => {
+    try {
+      return dirname7(createRequire2(pathToFileURL4(join11(fromDir, "noop.js")).href).resolve(`${name}/package.json`));
+    } catch {
+      return void 0;
+    }
+  };
+  const dslDir = pkgDir("@githolon/dsl", cwd) ?? (() => {
+    try {
+      return dirname7(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
+    } catch {
+      return void 0;
+    }
+  })();
+  const tsxDir = pkgDir("tsx", cwd) ?? (dslDir !== void 0 ? pkgDir("tsx", dslDir) : void 0);
+  if (tsxDir === void 0) return void 0;
+  try {
+    const pkg = JSON.parse(
+      readFileSync10(join11(tsxDir, "package.json"), "utf8")
+    );
+    const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["tsx"];
+    return join11(tsxDir, rel ?? "dist/cli.mjs");
+  } catch {
+    return void 0;
+  }
+}
+function resolveDslEntry(cwd) {
+  const tryFrom = (fromUrl) => {
+    try {
+      return createRequire2(fromUrl).resolve("@githolon/dsl");
+    } catch {
+      return void 0;
+    }
+  };
+  return tryFrom(pathToFileURL4(join11(cwd, "noop.js")).href) ?? tryFrom(import.meta.url);
+}
+function discoverRepairs(cwd) {
+  const dir = join11(cwd, "repairs");
+  if (!existsSync9(dir)) return { repairs: [] };
+  let files;
+  try {
+    files = readdirSync4(dir).filter((f) => /\.(ts|mts|cts)$/.test(f) && !/\.d\.ts$/.test(f)).sort().map((f) => resolve2(dir, f));
+  } catch (e) {
+    return { error: `could not read the repairs/ folder: ${e.message}` };
+  }
+  if (files.length === 0) return { repairs: [] };
+  const tsxCli = resolveTsxCli(cwd);
+  const dslEntry = resolveDslEntry(cwd);
+  if (tsxCli === void 0 || dslEntry === void 0) {
+    return { error: "repairs/ is present but the toolchain to load it is missing \u2014 add @githolon/dsl (tsx + the DSL ride it) to the project and npm install" };
+  }
+  const scratch = mkdtempSync(join11(tmpdir(), "githolon-repairs-"));
+  const loader = join11(scratch, "discover.mts");
+  const loaderSrc = `
+import { repairsOf } from ${JSON.stringify(dslEntry)};
+const files = ${JSON.stringify(files)};
+const out = [];
+const seen = new Map();
+for (const file of files) {
+  const mod = await import(${JSON.stringify("file://")} + file);
+  for (const r of repairsOf(mod)) {
+    if (seen.has(r.id)) {
+      throw new Error("duplicate repair id '" + r.id + "' \u2014 declared in " + seen.get(r.id) + " and " + file);
+    }
+    seen.set(r.id, file);
+    out.push({ id: r.id, matcher: r.matcher, reason: r.reason, verb: r.verb, file });
+  }
+}
+process.stdout.write("\\u0001REPAIRS\\u0001" + JSON.stringify(out) + "\\u0001END\\u0001\\n");
+`;
+  try {
+    writeFileSync7(loader, loaderSrc, "utf8");
+    const r = spawnSync4(process.execPath, [tsxCli, loader], { cwd, encoding: "utf8" });
+    if (r.status !== 0) {
+      const msg = (r.stderr || r.stdout || "").trim().split("\n").filter(Boolean).slice(-4).join("\n");
+      return { error: `loading repairs/ failed:
+${msg || `tsx exited ${r.status ?? "?"}`}` };
+    }
+    const m = /
REPAIRS
([\s\S]*?)
END
/.exec(r.stdout);
+    if (m === null) return { error: "the repairs loader produced no manifest (unexpected \u2014 the DSL/tsx may be too old)" };
+    const parsed = JSON.parse(m[1]);
+    const repairs = parsed.map((p) => ({ ...p, file: isAbsolute(p.file) ? p.file : resolve2(cwd, p.file) }));
+    return { repairs };
+  } catch (e) {
+    return { error: `loading repairs/ failed: ${e.message}` };
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+var SID_RE, SID_SHAPE;
+var init_repairs = __esm({
+  "src/repairs.ts"() {
+    "use strict";
+    SID_RE = /stable id ([0-9a-f]{16})/gi;
+    SID_SHAPE = /^[0-9a-f]{16}$/i;
+  }
+});
+
 // src/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
@@ -4714,21 +5530,21 @@ __export(mcp_exports, {
   toolCheck: () => toolCheck,
   toolEvolvePreview: () => toolEvolvePreview
 });
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
-import { dirname as dirname6, isAbsolute, resolve as resolve2 } from "node:path";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname8, isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
 function resolveConfig(config) {
   const arg = config ?? "nomos.package.mjs";
-  const configPath = isAbsolute(arg) ? arg : resolve2(process.cwd(), arg);
-  return { configPath, cfgDir: dirname6(configPath) };
+  const configPath = isAbsolute2(arg) ? arg : resolve3(process.cwd(), arg);
+  return { configPath, cfgDir: dirname8(configPath) };
 }
 function runCheckLauncher(configPath, extraArgs) {
-  const cfgDir = dirname6(configPath);
+  const cfgDir = dirname8(configPath);
   const launcher = resolveCheckLauncher(cfgDir) ?? resolveCheckLauncher(process.cwd());
   if (launcher === void 0) {
     return { findings: [], stdout: "", stderr: "", status: 1, error: NO_DSL_REMEDY };
   }
-  const r = spawnSync4(process.execPath, [launcher, configPath, ...extraArgs], {
+  const r = spawnSync5(process.execPath, [launcher, configPath, ...extraArgs], {
     cwd: cfgDir,
     encoding: "utf8"
   });
@@ -4794,7 +5610,7 @@ function extractDispositions(humanReport) {
 }
 function toolCheck(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync10(configPath)) {
+  if (!existsSync11(configPath)) {
     return { text: `nomos_check: config not found: ${configPath}`, isError: true };
   }
   const extra = args.against !== void 0 ? ["--against", args.against] : [];
@@ -4811,11 +5627,11 @@ ${JSON.stringify(payload, null, 2)}`, isError: false };
 }
 function toolEvolvePreview(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync10(configPath)) {
+  if (!existsSync11(configPath)) {
     return { text: `nomos_evolve_preview: config not found: ${configPath}`, isError: true };
   }
-  const againstPath = isAbsolute(args.against) ? args.against : resolve2(dirname6(configPath), args.against);
-  const priorArg = existsSync10(againstPath) ? againstPath : args.against;
+  const againstPath = isAbsolute2(args.against) ? args.against : resolve3(dirname8(configPath), args.against);
+  const priorArg = existsSync11(againstPath) ? againstPath : args.against;
   const jsonRun = runCheckJson(configPath, ["--against", priorArg]);
   if (jsonRun.error !== void 0) {
     return {
@@ -4978,8 +5794,8 @@ __export(harness_exports, {
   harnessInstall: () => harnessInstall,
   looksLikeStaleRuntime: () => looksLikeStaleRuntime
 });
-import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join14 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function looksLikeStaleRuntime(msg) {
   return /\bbbox param\b|missing.*param|non-numeric|unknown (op|query op)|unsupported op|unexpected (field|key)|no such op/i.test(
@@ -4989,19 +5805,19 @@ function looksLikeStaleRuntime(msg) {
 async function harnessInstall(opts) {
   const { deploy: deployPaths, workspace, out: outPath } = opts;
   if (deployPaths.length === 0) die("no --deploy JSON path(s) given");
-  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join12(configDir(), "runtime");
+  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join14(configDir(), "runtime");
   const refreshed = await refreshRuntimeDir(cloudBase(), runtimeDir);
   if (refreshed) process.stderr.write(`harness-install: refreshed runtime cache from the cloud \u2192 ${runtimeDir}
 `);
-  const wasmFile = join12(runtimeDir, "holon.wasm");
-  const pkgsFile = join12(runtimeDir, "packages.json");
-  if (!existsSync11(wasmFile) || !existsSync11(pkgsFile)) {
+  const wasmFile = join14(runtimeDir, "holon.wasm");
+  const pkgsFile = join14(runtimeDir, "packages.json");
+  if (!existsSync12(wasmFile) || !existsSync12(pkgsFile)) {
     die(
       `runtime cache missing at ${runtimeDir} (holon.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`
     );
   }
-  const wasm = readFileSync12(wasmFile);
-  const pkgs = JSON.parse(readFileSync12(pkgsFile, "utf8"));
+  const wasm = readFileSync13(wasmFile);
+  const pkgs = JSON.parse(readFileSync13(pkgsFile, "utf8"));
   const guarded = async (fn) => {
     try {
       return await fn();
@@ -5023,8 +5839,8 @@ async function harnessInstall(opts) {
   await guarded(() => author(eng, workspace, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "nomos-test-harness"), ""));
   const lawHashes = [];
   for (const p of deployPaths) {
-    if (!existsSync11(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
-    const deploy3 = JSON.parse(readFileSync12(p, "utf8"));
+    if (!existsSync12(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
+    const deploy3 = JSON.parse(readFileSync13(p, "utf8"));
     const usda = deploy3.packageUsda;
     if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
     const lawHash = await sha256hex(usda);
@@ -5036,7 +5852,7 @@ async function harnessInstall(opts) {
   const wsNode = eng.preopen.dir.contents.get("ws").contents.get(workspace);
   if (!wsNode) die(`internal: workspace tree '${workspace}' not found after install`);
   const treeBytes = serializeTree(wsNode);
-  writeFileSync7(outPath, treeBytes);
+  writeFileSync8(outPath, treeBytes);
   process.stderr.write(`harness-install: snapshot written (${treeBytes.length} bytes) \u2192 ${outPath}
 `);
   process.stdout.write(JSON.stringify({ ok: true, snapshot: outPath, workspace, lawHashes }) + "\n");
@@ -6115,8 +6931,8 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join13, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join15, resolve as resolve4 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import git3 from "isomorphic-git";
 async function walkChain2(eng, ws) {
@@ -6137,8 +6953,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync12(join13(target, ".git")) ? join13(target, ".git") : target;
-    if (!existsSync12(join13(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync13(join15(target, ".git")) ? join15(target, ".git") : target;
+    if (!existsSync13(join15(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -6197,9 +7013,9 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync12(target) || target.includes("/") || target.startsWith(".");
-  const name = isDir ? (resolve3(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
-  out11(`scene \u2014 ${name} (${isDir ? resolve3(target) : `${cloud} :: ${target}`})`);
+  const isDir = existsSync13(target) || target.includes("/") || target.startsWith(".");
+  const name = isDir ? (resolve4(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
+  out11(`scene \u2014 ${name} (${isDir ? resolve4(target) : `${cloud} :: ${target}`})`);
   let first, second;
   try {
     first = await projectOnce(cloud, target, isDir, name);
@@ -6217,13 +7033,13 @@ async function scene(target, opts) {
     err11(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
     return 1;
   }
-  const outDir = resolve3(opts.out ?? join13("scene", name));
-  mkdirSync5(outDir, { recursive: true });
-  const usdaPath = join13(outDir, `${name}.usda`);
-  const usdzPath = join13(outDir, `${name}.usdz`);
+  const outDir = resolve4(opts.out ?? join15("scene", name));
+  mkdirSync6(outDir, { recursive: true });
+  const usdaPath = join15(outDir, `${name}.usda`);
+  const usdzPath = join15(outDir, `${name}.usdz`);
   const usdaBytes = new TextEncoder().encode(first.usda);
-  writeFileSync8(usdaPath, usdaBytes);
-  writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
+  writeFileSync9(usdaPath, usdaBytes);
+  writeFileSync9(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
   const s = first.stats;
   out11(`  verify_chain ${s.verdictLine}`);
   out11(`  law canopy   ${s.nodes} node(s), ${s.edges} edge(s) \u2014 from the chain's own installed packages`);
@@ -6249,11 +7065,11 @@ var init_scene = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname7, join as join14, resolve as resolve4 } from "node:path";
-import { pathToFileURL as pathToFileURL4 } from "node:url";
+import { existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { createRequire as createRequire3 } from "node:module";
+import { dirname as dirname9, join as join16, resolve as resolve5 } from "node:path";
+import { pathToFileURL as pathToFileURL5 } from "node:url";
 
 // src/generate.ts
 import { mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -6444,16 +7260,16 @@ init_compile();
 init_local_holon();
 import { existsSync as existsSync7, readFileSync as readFileSync7, watch } from "node:fs";
 import { createServer } from "node:http";
-import { dirname as dirname5, join as join8, resolve } from "node:path";
+import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 
 // src/project.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var CONFIG_FILE = "nomos.package.mjs";
 async function loadProject(cwd, opts = {}) {
-  const configPath = join6(cwd, CONFIG_FILE);
+  const configPath = join7(cwd, CONFIG_FILE);
   if (!existsSync5(configPath)) return void 0;
   const href = pathToFileURL2(configPath).href + (opts.bust === true ? `?v=${statSync2(configPath).mtimeMs}-${Date.now()}` : "");
   const mod = await import(href);
@@ -6619,7 +7435,7 @@ function startServer(s) {
   });
 }
 function readDeployBody2(cwd, packageName) {
-  const file = join8(cwd, "build", `${packageName}.deploy.json`);
+  const file = join9(cwd, "build", `${packageName}.deploy.json`);
   if (!existsSync7(file)) {
     throw new Error(`compile produced no ${file} \u2014 check the compile output above`);
   }
@@ -6639,7 +7455,7 @@ async function installLaw(s, deployBody, installedBy) {
   return { ok: true };
 }
 async function runProofCycle(s, cwd, deployBody, installedBy) {
-  const proofPath = join8(cwd, "build", `${s.packageName}.proof.mts`);
+  const proofPath = join9(cwd, "build", `${s.packageName}.proof.mts`);
   if (!existsSync7(proofPath)) return void 0;
   const scratch = `proof-${s.cycle}`;
   try {
@@ -6662,7 +7478,7 @@ async function dev(opts) {
     return void 0;
   });
   if (project === void 0) {
-    if (!existsSync7(join8(cwd, CONFIG_FILE))) {
+    if (!existsSync7(join9(cwd, CONFIG_FILE))) {
       err5(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
@@ -6729,12 +7545,12 @@ ${firstCompile.output}`);
   try {
     const cfgModule = await import(pathToFileURL3(project.configPath).href);
     for (const d of cfgModule.default?.domains ?? []) {
-      for (const m of d.modules ?? []) moduleDirs.add(dirname5(resolve(cwd, m)));
+      for (const m of d.modules ?? []) moduleDirs.add(dirname6(resolve(cwd, m)));
     }
   } catch {
-    moduleDirs.add(join8(cwd, "domains"));
+    moduleDirs.add(join9(cwd, "domains"));
   }
-  if (moduleDirs.size === 0) moduleDirs.add(join8(cwd, "domains"));
+  if (moduleDirs.size === 0) moduleDirs.add(join9(cwd, "domains"));
   let timer;
   let cycling = false;
   let queued = false;
@@ -7144,7 +7960,7 @@ init_cloud();
 init_local_holon();
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 var out7 = (s) => void process.stdout.write(s + "\n");
 var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
@@ -7177,9 +7993,9 @@ async function ledgerInit(dir, opts) {
   const verdict = verifyChainLocal(eng, WS2);
   if (!printVerdict(verdict)) return 1;
   const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS2).contents.get("nomos.git");
-  const gitDir = join9(dir, ".git");
+  const gitDir = join10(dir, ".git");
   writeTreeToDisk(gitTree, gitDir);
-  const cfgPath = join9(gitDir, "config");
+  const cfgPath = join10(gitDir, "config");
   writeFileSync6(cfgPath, readFileSync9(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
   spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
   out7(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
@@ -7189,8 +8005,8 @@ Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
-  const gitDir = existsSync8(join9(dir, ".git")) ? join9(dir, ".git") : dir;
-  if (!existsSync8(join9(gitDir, "HEAD"))) {
+  const gitDir = existsSync8(join10(dir, ".git")) ? join10(dir, ".git") : dir;
+  if (!existsSync8(join10(gitDir, "HEAD"))) {
     err7(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
@@ -7206,8 +8022,8 @@ init_engine();
 init_engine();
 init_cloud();
 init_local_holon();
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join12 } from "node:path";
 import git2 from "isomorphic-git";
 var out8 = (s) => void process.stdout.write(s + "\n");
 var err8 = (s) => void process.stderr.write("error: " + s + "\n");
@@ -7303,10 +8119,10 @@ async function replay(target, opts) {
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
-  const isDir = existsSync9(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync10(target) || target.includes("/") || target.startsWith(".");
   if (isDir) {
-    const gitDir = existsSync9(join10(target, ".git")) ? join10(target, ".git") : target;
-    if (!existsSync9(join10(gitDir, "HEAD"))) {
+    const gitDir = existsSync10(join12(target, ".git")) ? join12(target, ".git") : target;
+    if (!existsSync10(join12(gitDir, "HEAD"))) {
       err8(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
@@ -7331,6 +8147,26 @@ async function replay(target, opts) {
   if (verdict["valid"] !== true) {
     if (json) emit({ finale: true, verdict });
     else printVerdict(verdict);
+    if (json && opts.repair !== true) return 1;
+    const { discoverRepairs: discoverRepairs2, parseRefusal: parseRefusal2, matchRepair: matchRepair2, knownRepairBlock: knownRepairBlock2 } = await Promise.resolve().then(() => (init_repairs(), repairs_exports));
+    const discovered = discoverRepairs2(process.cwd());
+    if ("error" in discovered) {
+      if (!json) err8(discovered.error);
+    } else if (discovered.repairs.length > 0) {
+      const refusal = parseRefusal2(verdict);
+      const hit = matchRepair2(refusal, discovered.repairs);
+      if (hit !== void 0) {
+        if (opts.repair === true) {
+          if (isDir) {
+            err8("--repair executes a rebirth of a cloud WORKSPACE \u2014 replay a workspace name (not a local directory) to repair it");
+            return 1;
+          }
+          const { executeRepairRebirth: executeRepairRebirth2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+          return executeRepairRebirth2(cloud, target, hit, verdict, opts);
+        }
+        if (!json) out8(knownRepairBlock2(hit));
+      }
+    }
     return 1;
   }
   const interactive = !json && opts.step === void 0 && process.stdout.isTTY === true && process.stdin.isTTY === true;
@@ -7470,7 +8306,7 @@ async function decrypt(ws, opts) {
 init_engine();
 init_cloud();
 init_lifecycle();
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var out10 = (s) => void process.stdout.write(s + "\n");
 var err10 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws, hasCurrencyData) {
@@ -7525,7 +8361,7 @@ async function status(wsArg, opts) {
   }
   let localHash;
   try {
-    const body = JSON.parse(readFileSync11(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+    const body = JSON.parse(readFileSync12(discoverDeployJson(process.cwd(), opts.file), "utf8"));
     if (typeof body.packageUsda === "string") localHash = await sha256hex(body.packageUsda);
   } catch {
     localHash = void 0;
@@ -7542,6 +8378,18 @@ async function status(wsArg, opts) {
     return 1;
   }
   out10(`workspace  ${ws} on ${cloud}`);
+  try {
+    const s = await (await fetch(`${cloud}/v2/workspaces/${ws}`)).json();
+    if (typeof s.incarnation === "string" && s.incarnation !== "") out10(`incarnation ${s.incarnation.slice(0, 16)}\u2026  (current genesis oid)`);
+    const superseded = s.supersededChains ?? [];
+    if (superseded.length > 0) {
+      out10(`superseded  ${superseded.length} retired holon(s) (frozen whole at their own custody addresses):`);
+      for (const c of superseded) out10(`    ${c.custodyAddress ?? c.ref ?? "?"}  ${c.supersededAt ? new Date(c.supersededAt).toISOString() : ""}  ${c.reason ? "\u2014 " + String(c.reason).slice(0, 80) : ""}`);
+    } else if (s.lineage?.supersededAt) {
+      out10(`superseded  supersession recorded (${s.lineage.supersessionReason ? String(s.lineage.supersessionReason).slice(0, 80) : "reborn"}); custody swap pending`);
+    }
+  } catch {
+  }
   const allDomains = d.domains ?? [];
   const frameworkHashes = new Set(FRAMEWORK_DOMAIN_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !frameworkHashes.has(dm.domainHash));
@@ -7629,6 +8477,11 @@ Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-aut
   githolon gov <ws> <directive> [--payload <json>]        author ANY workspaces directive as a signed offer
             [--as <uid>] [--stamp] [--save <file>]        to <ws> (--save signs without relaying; relay later)
   githolon gov relay <ws> <offer-file>                    relay a saved offer (the only step that hits the cloud)
+  githolon gov rebirth <ws> --reason <text>               LAWFUL SUPERSESSION (recovery verb 3): supersede a
+            [--dry-run [--json]] [--yes]                   scarred chain; --dry-run = READ-ONLY impact report
+  githolon rebirth plan <ws> [--reason <text>] [--out D]  write a stable plan.json + impact.md (rebirths-as-code)
+  githolon rebirth apply --plan <plan.json> [--yes]       drift-pinned apply of a reviewed plan \u2192 certificate.json
+  githolon replay <ws> --repair                            execute the repair matching a red verify (\u2192 certificate)
   githolon grant <admin|creation> <principal> [--label L] grant authority at the parent (default root)
   githolon grant quota <principal> --max <N>              grant a per-principal workspace allowance
   githolon revoke <admin|creation> <principal>            revoke it (the revoked fact rides the chain)
@@ -7678,8 +8531,8 @@ Options:
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
-  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash"];
-  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--keep-beside", "--retire-replaced", "--explain-current-interface"];
+  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan"];
+  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--keep-beside", "--retire-replaced", "--explain-current-interface", "--dry-run", "--json"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     if (BOOL_FLAGS.includes(a)) {
@@ -7689,6 +8542,8 @@ function cloudArgs(rest) {
       else if (a === "--keep-beside") opts.keepBeside = true;
       else if (a === "--retire-replaced") opts.retireReplaced = true;
       else if (a === "--explain-current-interface") opts.explain = true;
+      else if (a === "--dry-run") opts.dryRun = true;
+      else if (a === "--json") opts.json = true;
       else opts.yes = true;
     } else if (VALUE_FLAGS.includes(a)) {
       const v = rest[++i];
@@ -7788,21 +8643,21 @@ async function runProof(args) {
   const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx);
   let proofPath;
   if (explicit !== void 0) {
-    proofPath = resolve4(process.cwd(), explicit);
-    if (!existsSync13(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    proofPath = resolve5(process.cwd(), explicit);
+    if (!existsSync14(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join14(process.cwd(), "build");
-    if (!existsSync13(buildDir)) {
+    const buildDir = join16(process.cwd(), "build");
+    if (!existsSync14(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
-    const proofs = readdirSync4(buildDir).filter((f) => f.endsWith(".proof.mts"));
+    const proofs = readdirSync5(buildDir).filter((f) => f.endsWith(".proof.mts"));
     if (proofs.length === 0) {
       return refuse("no build/*.proof.mts found \u2014 run `githolon compile` (every compile generates the proof from your law; the compile summary says why when it can't)");
     }
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join14(buildDir, proofs[0]);
+    proofPath = join16(buildDir, proofs[0]);
   }
   if (!live) {
     try {
@@ -7815,17 +8670,17 @@ async function runProof(args) {
   }
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname7(createRequire2(pathToFileURL4(join14(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname9(createRequire3(pathToFileURL5(join16(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname7(createRequire2(pathToFileURL4(join14(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname9(createRequire3(pathToFileURL5(join16(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
-        return dirname7(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
+        return dirname9(createRequire3(import.meta.url).resolve("@githolon/dsl/package.json"));
       } catch {
         return void 0;
       }
@@ -7835,9 +8690,9 @@ async function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync13(join14(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync14(join16(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
-  const tsxCli = join14(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  const tsxCli = join16(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
   const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
   const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
@@ -7866,7 +8721,7 @@ async function runProof(args) {
       );
     }
   }
-  const r = spawnSync5(process.execPath, [tsxCli, proofPath], {
+  const r = spawnSync6(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
@@ -8031,7 +8886,8 @@ ${commandHelp("dev")}`);
       }
     }
     const json = rest.includes("--json");
-    const cleaned = rest.filter((a, i) => a !== "--json" && a !== "--step" && !(sAt >= 0 && i === sAt + 1));
+    const wantRepair = rest.includes("--repair");
+    const cleaned = rest.filter((a, i) => a !== "--json" && a !== "--repair" && a !== "--step" && !(sAt >= 0 && i === sAt + 1));
     const { pos, opts, bad } = cloudArgs(cleaned);
     if (bad !== void 0) {
       process.stderr.write(`error: ${bad}
@@ -8046,7 +8902,7 @@ ${commandHelp("replay")}`);
 ${commandHelp("replay")}`);
       return 1;
     }
-    return replay(target, { ...opts, ...step !== void 0 ? { step } : {}, ...json ? { json: true } : {} });
+    return replay(target, { ...opts, ...step !== void 0 ? { step } : {}, ...json ? { json: true } : {}, ...wantRepair ? { repair: true } : {} });
   }
   if (argv[0] === "scene") {
     const { scene: scene2 } = await Promise.resolve().then(() => (init_scene(), scene_exports));
@@ -8171,6 +9027,53 @@ ${USAGE}`);
 ${USAGE}`);
     return 1;
   }
+  if (argv[0] === "rebirth") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    if (pos[0] === "plan") {
+      const ws = pos[1];
+      if (ws === void 0) {
+        process.stderr.write("error: expected: githolon rebirth plan <ws> [--reason <text>] [--out <dir>]\n");
+        return 1;
+      }
+      const { rebirthPlanCommand: rebirthPlanCommand2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+      const flag = (n) => {
+        const i = argv.indexOf(n);
+        return i >= 0 ? argv[i + 1] : void 0;
+      };
+      return rebirthPlanCommand2(ws, {
+        ...opts,
+        ...flag("--reason") !== void 0 ? { reason: flag("--reason") } : {},
+        ...flag("--out") !== void 0 ? { out: flag("--out") } : {}
+      });
+    }
+    if (pos[0] === "apply") {
+      const flag = (n) => {
+        const i = argv.indexOf(n);
+        return i >= 0 ? argv[i + 1] : void 0;
+      };
+      const planPath = flag("--plan") ?? pos[1];
+      if (planPath === void 0) {
+        process.stderr.write("error: expected: githolon rebirth apply --plan <plan.json> [--seed-secret <b64>|--gcp-secret <name>] [--yes]\n");
+        return 1;
+      }
+      const { rebirthApply: rebirthApply2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+      return rebirthApply2(planPath, {
+        ...opts,
+        ...flag("--seed-secret") !== void 0 ? { seedSecret: flag("--seed-secret") } : {},
+        ...flag("--gcp-secret") !== void 0 ? { gcpSecret: flag("--gcp-secret") } : {},
+        ...flag("--controller-hash") !== void 0 ? { controllerHash: flag("--controller-hash") } : {},
+        yes: argv.includes("--yes")
+      });
+    }
+    process.stderr.write("error: expected: githolon rebirth <plan <ws> | apply --plan <plan.json>>\n");
+    return 1;
+  }
   if (argv[0] === "gov") {
     const { governanceOffer: governanceOffer2, governanceRelay: governanceRelay2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
@@ -8218,6 +9121,30 @@ ${commandHelp("gov") ?? USAGE}`);
         yes: argv.includes("--yes")
       });
     }
+    if (pos[0] === "rebirth") {
+      const ws2 = pos[1];
+      if (ws2 === void 0) {
+        process.stderr.write(`error: expected: githolon gov rebirth <ws> --reason <text> [--seed-secret <b64>|--gcp-secret <name>] [--yes]
+
+${commandHelp("gov") ?? USAGE}`);
+        return 1;
+      }
+      const { rebirthWorkspace: rebirthWorkspace2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+      const flag = (n) => {
+        const i = argv.indexOf(n);
+        return i >= 0 ? argv[i + 1] : void 0;
+      };
+      return rebirthWorkspace2(ws2, {
+        ...opts,
+        ...flag("--reason") !== void 0 ? { reason: flag("--reason") } : {},
+        ...flag("--seed-secret") !== void 0 ? { seedSecret: flag("--seed-secret") } : {},
+        ...flag("--gcp-secret") !== void 0 ? { gcpSecret: flag("--gcp-secret") } : {},
+        ...flag("--controller-hash") !== void 0 ? { controllerHash: flag("--controller-hash") } : {},
+        dryRun: argv.includes("--dry-run"),
+        json: argv.includes("--json"),
+        yes: argv.includes("--yes")
+      });
+    }
     const [ws, directiveId] = pos;
     if (ws === void 0 || directiveId === void 0) {
       process.stderr.write(`error: expected: githolon gov <ws> <directiveId> [--payload <json>] [--as <uid>]