midsummer-sol 0.2.2 → 0.3.1

package/sol-mcp.js

@@ -60,6 +60,11 @@ function verifyAtt(key, op, sig = op.att) {
 var init_attest = () => {};
 
 // src/errors.ts
+var exports_errors = {};
+__export(exports_errors, {
+  CorruptRepoError: () => CorruptRepoError,
+  CorruptObjectError: () => CorruptObjectError
+});
 var CorruptRepoError, CorruptObjectError;
 var init_errors = __esm(() => {
   CorruptRepoError = class CorruptRepoError extends Error {
@@ -822,16 +827,74 @@ var init_sign = __esm(() => {
 });
 
 // src/prov.ts
+function encodeTool(p) {
+  const surface = p.tool?.trim() || "";
+  if (!p.toolCall && !p.testRunId)
+    return surface || undefined;
+  const segs = [surface, TC_TAG];
+  const tc = p.toolCall;
+  segs.push(`name=${tc?.name ?? ""}`, `args=${tc?.argsHash ?? ""}`, `inv=${tc?.invocationId ?? ""}`, `test=${p.testRunId ?? ""}`);
+  return segs.join(TC_SEP);
+}
+function decodeTool(tool) {
+  if (!tool)
+    return {};
+  const parts = tool.split(TC_SEP);
+  if (parts.length < 2 || parts[1] !== TC_TAG)
+    return { tool: tool || undefined };
+  const surface = parts[0] || undefined;
+  const kv = new Map;
+  for (const seg of parts.slice(2)) {
+    const eq = seg.indexOf("=");
+    if (eq >= 0)
+      kv.set(seg.slice(0, eq), seg.slice(eq + 1));
+  }
+  const name = kv.get("name") || "";
+  const argsHash = kv.get("args") || "";
+  const invocationId = kv.get("inv") || "";
+  const testRunId = kv.get("test") || undefined;
+  const out = { tool: surface };
+  if (name || argsHash || invocationId)
+    out.toolCall = { name, argsHash, invocationId };
+  if (testRunId)
+    out.testRunId = testRunId;
+  return out;
+}
+function parseToolCall(raw) {
+  if (!raw)
+    return;
+  let v;
+  try {
+    v = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (!v || typeof v !== "object")
+    return;
+  const o = v;
+  const name = typeof o.name === "string" ? o.name : "";
+  const argsHash = typeof o.argsHash === "string" ? o.argsHash : "";
+  const invocationId = typeof o.invocationId === "string" ? o.invocationId : "";
+  if (!name || !argsHash || !invocationId)
+    return;
+  return { name, argsHash, invocationId };
+}
 function provenanceFromEnv(env = process.env) {
   const kind = env.SOL_KIND === "agent" ? "agent" : "human";
+  const tool = encodeTool({
+    tool: env.SOL_TOOL,
+    toolCall: parseToolCall(env.SOL_TOOL_CALL),
+    testRunId: env.SOL_TEST_RUN_ID || undefined
+  });
   const node = buildProvNode({
     agentId: env.SOL_AGENT_ID || (kind === "agent" ? env.SOL_ACTOR : undefined),
     sessionId: env.SOL_SESSION,
     model: env.SOL_MODEL,
     intent: env.SOL_INTENT,
-    tool: env.SOL_TOOL
+    tool
   });
-  return node ? { kind, node } : { kind };
+  const opRunId = env.SOL_OPERATION_ID || undefined;
+  return { kind, ...node ? { node } : {}, ...opRunId ? { opRunId } : {} };
 }
 function buildProvNode(fields) {
   const clean = { kind: "prov" };
@@ -860,6 +923,9 @@ function authorLabel(op, reader) {
   const bits = [];
   if (p?.sessionId)
     bits.push(`session ${p.sessionId}`);
+  const tp = p ? decodeTool(p.tool) : {};
+  if (tp.toolCall)
+    bits.push(`via ${tp.toolCall.name}`);
   const tail = p?.intent ? ` — intent: ${p.intent}` : "";
   return `${who}${bits.length ? ` (${bits.join(", ")})` : ""}${tail}`;
 }
@@ -869,10 +935,21 @@ function provJson(op, reader, key, trust) {
     return;
   const out = { kind: op.kind ?? "human" };
   if (p) {
-    for (const k of ["agentId", "sessionId", "model", "intent", "tool", "rationale", "parent"])
+    for (const k of ["agentId", "sessionId", "model", "intent", "rationale", "parent"])
       if (p[k])
         out[k] = p[k];
   }
+  if (p?.tool) {
+    const tp = decodeTool(p.tool);
+    if (tp.tool)
+      out.tool = tp.tool;
+    if (tp.toolCall)
+      out.toolCall = tp.toolCall;
+    if (tp.testRunId)
+      out.testRunId = tp.testRunId;
+  }
+  if (op.opRunId !== undefined)
+    out.opRunId = op.opRunId;
   if (op.sig !== undefined) {
     const t = trustAuthor(op, trust);
     out.signed = true;
@@ -930,7 +1007,7 @@ function signTrailerValue(op, trust) {
       return `${t.fingerprint} verified`;
   }
 }
-function provTrailers(op, reader, key, trust) {
+function provTrailers(op, reader, key, trust, reviewCount) {
   const p = reader ? provOf(op, reader) : undefined;
   const lines = [];
   const signed = trustAuthor(op, trust);
@@ -944,6 +1021,13 @@ function provTrailers(op, reader, key, trust) {
     lines.push(`Sol-Session: ${p.sessionId}`);
   if (p?.model)
     lines.push(`Sol-Model: ${p.model}`);
+  const tp = decodeTool(p?.tool);
+  if (tp.toolCall)
+    lines.push(`Sol-ToolCall: ${tp.toolCall.name} args=${tp.toolCall.argsHash} inv=${tp.toolCall.invocationId}`);
+  if (tp.testRunId)
+    lines.push(`Sol-TestRun: ${tp.testRunId}`);
+  if (op.opRunId)
+    lines.push(`Sol-Operation: ${op.opRunId}`);
   const intent = p?.intent || (isAgent ? op.message?.trim() || undefined : undefined);
   if (intent)
     lines.push(`Sol-Intent: ${intent}`);
@@ -952,17 +1036,22 @@ function provTrailers(op, reader, key, trust) {
     lines.push(`Sol-Sign: ${sign}`);
   if (op.att !== undefined && !(key && !verifyAtt(key, op)))
     lines.push(`Sol-Attested: pushedBy=${op.pushedBy ?? "?"}`);
+  if (reviewCount && reviewCount > 0)
+    lines.push(`Sol-Attestations: ${reviewCount}`);
   return lines;
 }
 async function captureProv(sink, env = process.env) {
-  const { kind, node } = provenanceFromEnv(env);
+  const { kind, node, opRunId } = provenanceFromEnv(env);
   const out = {};
   if (kind === "agent")
     out.kind = "agent";
   if (node)
     out.prov = await sink.put(node);
+  if (opRunId)
+    out.opRunId = opRunId;
   return out;
 }
+var TC_SEP = "\x01", TC_TAG = "tc1";
 var init_prov = __esm(() => {
   init_attest();
   init_sign();
@@ -994,10 +1083,25 @@ class AsyncRepo {
     await this.log.append(by === this.actor ? this.sign(entry) : entry);
   }
   provFor;
+  pendingToolCall;
+  setToolCall(tc) {
+    this.pendingToolCall = tc;
+  }
   async provenance(by) {
     if (by !== this.actor)
       return {};
-    return this.provFor ??= captureProv(this.store);
+    const base = await (this.provFor ??= captureProv(this.store));
+    const tc = this.pendingToolCall;
+    if (!tc)
+      return base;
+    this.pendingToolCall = undefined;
+    const { kind, node } = provenanceFromEnv();
+    const session = node ?? { kind: "prov" };
+    const surface = decodeTool(session.tool);
+    const tool = encodeTool({ tool: surface.tool, toolCall: tc, testRunId: surface.testRunId });
+    const merged = { ...session, kind: "prov", tool };
+    const prov = await this.store.put(merged);
+    return { ...kind === "agent" ? { kind: "agent" } : {}, prov, ...base.opRunId ? { opRunId: base.opRunId } : {} };
   }
   async currentRoot() {
     const head = await this.log.head();
@@ -1305,6 +1409,9 @@ class SolWorkspace {
     this.actor = actor;
     this.repo = new AsyncRepo(store, log, actor);
   }
+  setToolCall(tc) {
+    this.repo.setToolCall(tc);
+  }
   async write(path, content) {
     return this.repo.writeFile(safePath(path), content);
   }
@@ -2239,6 +2346,15 @@ var init_diff = __esm(() => {
 });
 
 // src/file-store.ts
+var exports_file_store = {};
+__export(exports_file_store, {
+  openLocal: () => openLocal,
+  initLocal: () => initLocal,
+  encodeObject: () => encodeObject2,
+  decodeObject: () => decodeObject2,
+  FileStore: () => FileStore2,
+  FileOpLog: () => FileOpLog2
+});
 import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
@@ -2328,6 +2444,17 @@ class FileOpLog2 {
     return pageOps(all, opts);
   }
 }
+function initLocal(dir, actor = "anon") {
+  const solDir = join2(dir, ".sol");
+  mkdirSync2(solDir, { recursive: true });
+  const store = new FileStore2(solDir);
+  const log = new FileOpLog2(solDir);
+  return { repo: new AsyncRepo(store, log, actor), store, log, solDir };
+}
+function openLocal(dir, actor = "anon") {
+  const solDir = join2(dir, ".sol");
+  return new AsyncRepo(new FileStore2(solDir), new FileOpLog2(solDir), actor);
+}
 var init_file_store2 = __esm(() => {
   init_async_repo();
   init_chain();
@@ -2845,6 +2972,74 @@ var init_keyring_at_rest = __esm(() => {
 });
 
 // src/bin/lib.ts
+var exports_lib = {};
+__export(exports_lib, {
+  writeWorkingIndexAt: () => writeWorkingIndexAt,
+  writeWorkingIndex: () => writeWorkingIndex,
+  workingChanges: () => workingChanges,
+  workingChangeRows: () => workingChangeRows,
+  walkFiles: () => walkFiles,
+  walkEntries: () => walkEntries,
+  viewMetaPath: () => viewMetaPath,
+  unresolvedConflictPaths: () => unresolvedConflictPaths,
+  truncateOpLog: () => truncateOpLog,
+  solDir: () => solDir,
+  snapshotTree: () => snapshotTree,
+  snapshotFile: () => snapshotFile,
+  setSealedDecryptor: () => setSealedDecryptor,
+  setOpLogHead: () => setOpLogHead,
+  saveTrust: () => saveTrust,
+  saveRefs: () => saveRefs,
+  saveKeyRing: () => saveKeyRing,
+  revealedHeadForRender: () => revealedHeadForRender,
+  revealedHead: () => revealedHead,
+  resolveRefSoft: () => resolveRefSoft,
+  resolveRef: () => resolveRef,
+  repoRoot: () => repoRoot,
+  repoRel: () => repoRel,
+  refsPath: () => refsPath,
+  readViewMeta: () => readViewMeta,
+  procCwd: () => procCwd,
+  printWorkingDiff: () => printWorkingDiff,
+  printTreeDiff: () => printTreeDiff,
+  persistTree: () => persistTree,
+  parentSolDir: () => parentSolDir,
+  opsDir: () => opsDir,
+  open: () => open,
+  objectsDir: () => objectsDir,
+  materializeTree: () => materializeTree,
+  materializeInto: () => materializeInto,
+  materializeDiff: () => materializeDiff,
+  materialize: () => materialize,
+  lockDir: () => lockDir,
+  loadWorkingIndex: () => loadWorkingIndex,
+  loadTrust: () => loadTrust,
+  loadStore: () => loadStore,
+  loadSigner: () => loadSigner,
+  loadRefs: () => loadRefs,
+  loadKeyRing: () => loadKeyRing,
+  lexists: () => lexists,
+  isWorkingPath: () => isWorkingPath,
+  isIgnored: () => isIgnored,
+  ignorePatterns: () => ignorePatterns,
+  forceIncluded: () => forceIncluded,
+  fileChange: () => fileChange,
+  die: () => die,
+  cwd: () => cwd,
+  countChanges: () => countChanges,
+  conflictHunks: () => conflictHunks,
+  cfgDir: () => cfgDir,
+  blameFile: () => blameFile,
+  appendFileSync: () => appendFileSync3,
+  appendCommit: () => appendCommit,
+  appendCapture: () => appendCapture,
+  allLocalNodes: () => allLocalNodes,
+  addInclude: () => addInclude,
+  actor: () => actor,
+  acquireLock: () => acquireLock,
+  LazyStore: () => LazyStore,
+  DEFAULT_IGNORE: () => DEFAULT_IGNORE
+});
 import {
   appendFileSync as appendFileSync3,
   chmodSync as chmodSync3,
@@ -2854,6 +3049,7 @@ import {
   readdirSync as readdirSync3,
   readFileSync as readFileSync5,
   readlinkSync,
+  renameSync as renameSync3,
   symlinkSync,
   unlinkSync,
   writeFileSync as writeFileSync5
@@ -2884,6 +3080,9 @@ function parentSolDir(dir = solDir) {
   const m = readViewMeta(dir);
   return m ? resolve(dir, m.parent) : undefined;
 }
+function cfgDir(dir = solDir) {
+  return parentSolDir(dir) ?? dir;
+}
 function repoRel(p) {
   return relative(cwd, resolve(procCwd, p));
 }
@@ -3806,6 +4005,35 @@ function setOpLogHead(head) {
   const cur = existsSync5(hf) ? JSON.parse(readFileSync5(hf, "utf8")) : { seq: 0 };
   writeFileSync5(hf, JSON.stringify({ ...cur, head }));
 }
+function truncateOpLog(toSeq) {
+  const opsFile = join5(solDir, "ops.jsonl");
+  if (!existsSync5(opsFile))
+    return;
+  const kept = [];
+  let last;
+  for (const l of readFileSync5(opsFile, "utf8").split(`
+`)) {
+    if (!l)
+      continue;
+    let op;
+    try {
+      op = JSON.parse(l);
+    } catch {
+      break;
+    }
+    if (op.seq > toSeq)
+      break;
+    kept.push(l);
+    last = op;
+  }
+  const tmp = `${opsFile}.tmp`;
+  writeFileSync5(tmp, kept.length ? kept.join(`
+`) + `
+` : "");
+  renameSync3(tmp, opsFile);
+  const hf = join5(solDir, "HEAD");
+  writeFileSync5(hf, JSON.stringify(last ? { head: last.rootAfter, seq: last.seq, logTip: last.entryHash } : { seq: 0 }));
+}
 async function persistTree(src, dst, head) {
   const node = src.get(head);
   if (!node)
@@ -3877,7 +4105,7 @@ function saveKeyRing(ring) {
     chmodSync3(keysPath(), 384);
   } catch {}
 }
-var procCwd, repoRoot, cwd, solDir, actor, viewMetaPath = (dir = solDir) => join5(dir, "view.json"), viewParent, objectsDir = () => join5(viewParent ?? solDir, "objects"), lockDir = () => solDir, SYMLINK_MODE = 40960, EXEC_MODE = 493, DEFAULT_IGNORE, includePath = () => join5(solDir, "include"), LOCK_STALE_MS = 5000, LazyStore, sealedDecryptor, indent = (s) => s.split(`
+var procCwd, repoRoot, cwd, solDir, actor, viewMetaPath = (dir = solDir) => join5(dir, "view.json"), viewParent, objectsDir = () => join5(viewParent ?? solDir, "objects"), opsDir = () => solDir, lockDir = () => solDir, SYMLINK_MODE = 40960, EXEC_MODE = 493, DEFAULT_IGNORE, includePath = () => join5(solDir, "include"), LOCK_STALE_MS = 5000, LazyStore, sealedDecryptor, indent = (s) => s.split(`
 `).map((l) => "    " + l).join(`
 `), indexPath = () => join5(solDir, "index.json"), linesOf = (content) => content === "" ? [] : content.replace(/\n$/, "").split(`
 `), refsPath = () => join5(solDir, "refs.json"), saveRefs = (refs) => writeFileSync5(refsPath(), JSON.stringify(refs, null, 2)), _signer, trustPath = () => join5(solDir, "trust.json"), keysPath = () => join5(solDir, "keys.json");
@@ -3930,9 +4158,13 @@ __export(exports_remote, {
   writeBundle: () => writeBundle,
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
+  remotePushFinalize: () => remotePushFinalize,
+  remotePushChunked: () => remotePushChunked,
+  remotePushBatch: () => remotePushBatch,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
   remoteHead: () => remoteHead,
+  remoteGate: () => remoteGate,
   remoteExport: () => remoteExport,
   remoteEnvPush: () => remoteEnvPush,
   remoteEnvPull: () => remoteEnvPull,
@@ -3943,6 +4175,7 @@ __export(exports_remote, {
   policyRemove: () => policyRemove,
   policyGet: () => policyGet,
   policyCheck: () => policyCheck,
+  ownerSet: () => ownerSet,
   mrOpen: () => mrOpen,
   mrList: () => mrList,
   mrGet: () => mrGet,
@@ -3956,6 +4189,7 @@ __export(exports_remote, {
 });
 import { appendFileSync as appendFileSync4, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join6 } from "node:path";
+import { gzipSync as gzipSync3 } from "node:zlib";
 async function call(cfg, token, path, init) {
   const res = await fetch(endpoint(cfg, path), {
     ...init,
@@ -3965,6 +4199,44 @@ async function call(cfg, token, path, init) {
     throw new Error(`remote ${path} -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
   return res.json();
 }
+function splitNodes(nodes, batchSizeBytes) {
+  const batches = [];
+  let cur = [];
+  let curBytes = 0;
+  for (const node of nodes) {
+    const nb = sizeOf(node);
+    if (cur.length && curBytes + nb > batchSizeBytes) {
+      batches.push(cur);
+      cur = [];
+      curBytes = 0;
+    }
+    cur.push(node);
+    curBytes += nb;
+  }
+  if (cur.length)
+    batches.push(cur);
+  return batches.length ? batches : [[]];
+}
+async function remotePushChunked(cfg, token, body, batchSizeBytes = DEFAULT_BATCH_BYTES) {
+  const totalBytes = sizeOf(body.nodes) + sizeOf(body.ops);
+  if (totalBytes <= batchSizeBytes)
+    return remotePush(cfg, token, body);
+  const stamp = `${body.head ?? "h"}-${Date.now()}`;
+  const nodeBatches = splitNodes(body.nodes, batchSizeBytes);
+  const batchIds = [];
+  try {
+    for (let i = 0;i < nodeBatches.length; i++) {
+      const batchId = `${stamp}-${i}`;
+      batchIds.push(batchId);
+      await remotePushBatch(cfg, token, batchId, nodeBatches[i], i === 0 ? body.ops : [], i);
+    }
+  } catch (e) {
+    if (e instanceof Error && /-> 404/.test(e.message))
+      return remotePush(cfg, token, body);
+    throw e;
+  }
+  return remotePushFinalize(cfg, token, batchIds, body.branch, body.head, body.expectedHead);
+}
 function loadRemote(solDir2) {
   const p = join6(solDir2, "remote.json");
   return existsSync6(p) ? JSON.parse(readFileSync6(p, "utf8")) : undefined;
@@ -3985,9 +4257,10 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync6(join6(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), remotePushBatch = (cfg, token, batchId, nodes, ops, seq) => call(cfg, token, "/push/batch", { method: "POST", body: gzipSync3(JSON.stringify({ batchId, nodes, ops, seq })), headers: { "content-encoding": "gzip" } }), remotePushFinalize = (cfg, token, batchIds, branch, head, expectedHead) => call(cfg, token, "/push/finalize", { method: "POST", body: JSON.stringify({ batchIds, branch, head, expectedHead }) }), DEFAULT_BATCH_BYTES, sizeOf = (v) => JSON.stringify(v).length, mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync6(join6(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store2();
+  DEFAULT_BATCH_BYTES = 5 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -6034,6 +6307,314 @@ var init_sealed_client = __esm(() => {
   init_crypto();
 });
 
+// src/bin/admin-repair.ts
+var exports_admin_repair = {};
+__export(exports_admin_repair, {
+  planRepair: () => planRepair,
+  makeResolves: () => makeResolves,
+  applyRepair: () => applyRepair
+});
+async function makeResolves(store2) {
+  const cache = new Map;
+  const walk = async (h, seen) => {
+    if (cache.get(h) === true)
+      return true;
+    if (seen.has(h))
+      return true;
+    seen.add(h);
+    const node = await store2.get(h);
+    if (!node)
+      return false;
+    if (node.kind === "tree") {
+      for (const e of Object.values(node.entries))
+        if (!await walk(e.hash, seen))
+          return false;
+    }
+    return true;
+  };
+  return async (root) => {
+    if (cache.has(root))
+      return cache.get(root);
+    const ok = await walk(root, new Set);
+    cache.set(root, ok);
+    return ok;
+  };
+}
+async function lastResolvableRoot(ops, upToIdx, resolves) {
+  for (let i = Math.min(upToIdx, ops.length - 1);i >= 0; i--) {
+    if (await resolves(ops[i].rootAfter))
+      return { op: ops[i], idx: i };
+  }
+  return;
+}
+function firstBrokenIdx(ops) {
+  let prev;
+  for (let i = 0;i < ops.length; i++) {
+    if (ops[i].seq !== i + 1)
+      return i;
+    try {
+      verifyChain(ops.slice(0, i + 1));
+    } catch {
+      return i;
+    }
+    prev = ops[i].entryHash;
+  }
+  return -1;
+}
+async function planRepair(ops, head, resolves) {
+  const broken = firstBrokenIdx(ops);
+  if (broken === -1) {
+    if (ops.length === 0)
+      return { kind: "noop", note: "", reason: "empty repo — nothing to repair" };
+    const headResolves = head !== undefined && await resolves(head);
+    if (headResolves)
+      return { kind: "noop", note: "", reason: "repo is healthy — chain valid, head resolves" };
+    const found2 = await lastResolvableRoot(ops, ops.length - 1, resolves);
+    if (!found2) {
+      return { kind: "unfixable", note: "", reason: head === undefined ? "head pointer lost and no historical root fully resolves — content is missing locally; rehydrate with `sol recover --from-remote <url> <repo>`" : `head ${head} dangles and no historical root fully resolves — a deep object is missing locally; rehydrate with \`sol recover --from-remote <url> <repo>\`` };
+    }
+    return {
+      kind: "repoint-head",
+      repointHead: found2.op.rootAfter,
+      note: `repair: re-pointed head to ${found2.op.rootAfter} (rootAfter of seq ${found2.op.seq})`,
+      reason: head === undefined ? "head pointer lost — recovered from the op-log" : `head ${head} dangles — recovered to the last fully-resolvable root`
+    };
+  }
+  const keepIdx = broken - 1;
+  if (keepIdx < 0) {
+    return { kind: "truncate-chain", truncateTo: 0, toEmptyTree: true, note: "repair: chain broken at genesis — truncated to an empty repo", reason: `op-log chain broken at seq ${ops[0]?.seq ?? 1} (the first op)` };
+  }
+  const prefix = ops.slice(0, keepIdx + 1);
+  const found = await lastResolvableRoot(prefix, keepIdx, resolves);
+  const truncateTo = prefix[keepIdx].seq;
+  if (!found) {
+    return { kind: "truncate-chain", truncateTo, toEmptyTree: true, note: `repair: truncated to seq ${truncateTo}; no resolvable root in the kept prefix — head -> empty tree`, reason: `op-log chain broken at seq ${ops[broken].seq}; kept prefix has no resolvable root` };
+  }
+  return {
+    kind: "truncate-chain",
+    truncateTo,
+    repointHead: found.op.rootAfter,
+    note: `repair: truncated to seq ${truncateTo} (chain broke at seq ${ops[broken].seq}); re-pointed head to ${found.op.rootAfter}`,
+    reason: `op-log chain broken at seq ${ops[broken].seq} — truncated to the last verified link (seq ${found.op.seq})`
+  };
+}
+async function applyRepair(exec, by = "sol-doctor", at = Date.now()) {
+  const ops = await exec.log.history();
+  const head = await exec.log.head();
+  const resolves = await makeResolves(exec.store);
+  const plan = await planRepair(ops, head, resolves);
+  if (plan.kind === "noop" || plan.kind === "unfixable")
+    return plan;
+  if (plan.kind === "truncate-chain" && plan.truncateTo !== undefined)
+    await exec.truncate(plan.truncateTo);
+  const newHead = plan.toEmptyTree ? await emptyRoot(exec.store) : plan.repointHead;
+  if (newHead !== undefined)
+    await exec.setHead(newHead);
+  const repaired = newHead ?? head;
+  const seq = await exec.log.seq() + 1;
+  await exec.log.append({ seq, type: "checkpoint", path: "", rootAfter: repaired ?? await emptyRoot(exec.store), at, by, message: plan.note });
+  return plan;
+}
+var init_admin_repair = __esm(() => {
+  init_chain();
+  init_async_tree();
+});
+
+// src/bin/admin.ts
+var exports_admin = {};
+__export(exports_admin, {
+  runDoctor: () => runDoctor,
+  renderDoctorIntegrity: () => renderDoctorIntegrity,
+  checkOpLog: () => checkOpLog,
+  checkObjects: () => checkObjects
+});
+function checkOpLog(ops) {
+  try {
+    for (let i = 0;i < ops.length; i++)
+      if (ops[i].seq !== i + 1)
+        throw new Error(`gap before seq ${i + 1}`);
+    const tip = verifyChain(ops);
+    return { count: ops.length, chainOk: true, tip };
+  } catch (e) {
+    return { count: ops.length, chainOk: false, chainError: String(e?.message ?? e) };
+  }
+}
+async function checkObjects(store2, head, ops) {
+  const missing = [];
+  const seen = new Set;
+  if (head === undefined)
+    return { reachable: 0, missing };
+  const seqOfRoot = new Map;
+  for (const op of ops)
+    if (!seqOfRoot.has(op.rootAfter))
+      seqOfRoot.set(op.rootAfter, op.seq);
+  const walk = async (h, refBy) => {
+    if (seen.has(h))
+      return;
+    seen.add(h);
+    const node = await store2.get(h);
+    if (!node) {
+      missing.push({ hash: h, refBy });
+      return;
+    }
+    if (node.kind === "tree")
+      for (const e of Object.values(node.entries))
+        await walk(e.hash, refBy);
+  };
+  await walk(head, seqOfRoot.get(head));
+  return { reachable: seen.size - missing.length, missing };
+}
+async function runDoctor(store2, log) {
+  const ops = await log.history();
+  const head = await log.head();
+  const seq = await log.seq();
+  const oplog = checkOpLog(ops);
+  const objects = await checkObjects(store2, head, ops);
+  const headLost = head === undefined && seq > 0;
+  const headDangling = head !== undefined && objects.missing.some((m) => m.hash === head);
+  const ok = oplog.chainOk && objects.missing.length === 0 && !headLost;
+  return { ok, oplog, objects, head, seq, headLost, headDangling };
+}
+function renderDoctorIntegrity(r) {
+  const lines = [];
+  const chain = r.oplog.chainOk ? `chain valid${r.oplog.tip ? `, tip: ${r.oplog.tip.slice(0, 16)}` : ""}` : `chain BROKEN — ${r.oplog.chainError}`;
+  lines.push(`  op-log: ${r.oplog.count} op(s), ${chain}`);
+  if (r.headLost) {
+    lines.push(`  head:   LOST (${r.seq} op(s) but no head pointer) — run \`sol fsck --repair\``);
+  } else if (r.headDangling) {
+    lines.push(`  head:   DANGLING (${r.head?.slice(0, 16)} missing from store) — run \`sol fsck --repair\``);
+  } else {
+    lines.push(`  objects: ${r.objects.reachable} reachable, ${r.objects.missing.length} missing${r.objects.missing.length ? " (run: sol fsck --repair)" : ""}`);
+  }
+  for (const m of r.objects.missing)
+    lines.push(`    missing ${m.hash}${m.refBy !== undefined ? ` (op seq ${m.refBy})` : ""}`);
+  return lines;
+}
+var init_admin = __esm(() => {
+  init_chain();
+});
+
+// src/bin/admin-reflog.ts
+var exports_admin_reflog = {};
+__export(exports_admin_reflog, {
+  renderReflog: () => renderReflog,
+  formatReflogLine: () => formatReflogLine,
+  filterReflog: () => filterReflog,
+  buildReflog: () => buildReflog
+});
+function buildReflog(ops) {
+  const rows = [];
+  let prevRoot;
+  for (const op of ops) {
+    rows.push({ seq: op.seq, by: op.by ?? "?", at: op.at, type: op.type, from: prevRoot, to: op.rootAfter, message: op.message, merge: op.parent2 });
+    prevRoot = op.rootAfter;
+  }
+  return rows;
+}
+function filterReflog(rows, f = {}) {
+  return rows.filter((r) => {
+    if (f.actor !== undefined && r.by !== f.actor)
+      return false;
+    if (f.since !== undefined && r.at < f.since)
+      return false;
+    if (f.type !== undefined && r.type !== f.type)
+      return false;
+    return true;
+  });
+}
+function formatReflogLine(r, branch) {
+  const when = new Date(r.at).toISOString().replace("T", " ").slice(0, 19);
+  const verb = r.merge ? "merge" : r.type;
+  const move = `${short(r.from)} -> ${short(r.to)}`;
+  const label = branch ? `${branch}: ` : "";
+  const body = r.message ? `${verb} ${label}${r.message}` : `${verb} ${label}`.trimEnd();
+  return `${r.seq} ${r.by} ${when} ${body} (${move})`;
+}
+function short(h) {
+  if (!h)
+    return "(empty)";
+  return h.length > 14 ? h.slice(0, 14) : h;
+}
+function renderReflog(ops, opts = {}) {
+  let rows = filterReflog(buildReflog(ops), opts);
+  if (opts.branchFilter) {
+    const b = opts.branchFilter;
+    rows = rows.filter((r) => r.type === "checkpoint" && (r.message?.includes(b) ?? false));
+  }
+  return rows.reverse().map((r) => formatReflogLine(r, opts.branch));
+}
+
+// src/bin/admin-recover.ts
+var exports_admin_recover = {};
+__export(exports_admin_recover, {
+  restoreFileFromHistory: () => restoreFileFromHistory,
+  listAllRoots: () => listAllRoots,
+  dumpLog: () => dumpLog,
+  RECOVER_HELP: () => RECOVER_HELP
+});
+async function listAllRoots(ops, has) {
+  const byRoot = new Map;
+  for (const op of ops) {
+    byRoot.set(op.rootAfter, { root: op.rootAfter, seq: op.seq, at: op.at, message: op.message });
+  }
+  const out = [...byRoot.values()].sort((a, b) => b.seq - a.seq);
+  if (has)
+    for (const e of out)
+      e.resolvable = await has(e.root);
+  return out;
+}
+async function restoreFileFromHistory(store2, ops, path, from) {
+  let window = ops;
+  if (typeof from === "number")
+    window = ops.filter((o) => o.seq <= from);
+  else if (typeof from === "string") {
+    const bare = from.startsWith("h_") ? from : "h_" + from;
+    const idx = ops.findIndex((o) => o.rootAfter === bare || o.rootAfter.startsWith(bare));
+    window = idx >= 0 ? ops.slice(0, idx + 1) : [];
+    if (idx < 0)
+      return { found: false, path, reason: `no op produced root ${from}` };
+  }
+  const tried = new Set;
+  for (let i = window.length - 1;i >= 0; i--) {
+    const root = window[i].rootAfter;
+    if (tried.has(root))
+      continue;
+    tried.add(root);
+    if (!await store2.has(root))
+      continue;
+    const leaf = await nodeAt(store2, root, path);
+    if (!leaf)
+      continue;
+    if (leaf.kind === "sealed")
+      return { found: true, path, sealed: true, box: leaf.box, fromSeq: window[i].seq, fromRoot: root };
+    const blob = await fileAt(store2, root, path);
+    return { found: true, path, content: leaf.content, encoding: blob?.encoding, fromSeq: window[i].seq, fromRoot: root };
+  }
+  return { found: false, path, reason: from !== undefined ? `path ${path} not found at or before ${from}` : `path ${path} never existed in history` };
+}
+function dumpLog(ops, fromSeq, toSeq) {
+  const window = ops.filter((o) => (fromSeq === undefined || o.seq >= fromSeq) && (toSeq === undefined || o.seq <= toSeq));
+  return JSON.stringify(window, null, 2);
+}
+var RECOVER_HELP = `sol recover — guide through recovery scenarios
+
+  1. Rehydrate from the cloud (download ops + objects from the backend)
+       sol recover --from-remote <url> <repo>
+
+  2. List every root the repo ever landed on (find a lost head)
+       sol recover --list-all-roots
+
+  3. Restore a file from op history (even if the current tree dropped it)
+       sol recover --file <path> [--from <seq|hash>]
+
+  4. Dump raw op-log entries as JSON (manual inspection / salvage)
+       sol recover --dump-log [<from-seq> [<to-seq>]]
+
+  after a structural repair, run \`sol doctor\` to confirm the repo is healthy.`;
+var init_admin_recover = __esm(() => {
+  init_async_tree();
+});
+
 // src/bin/secret-scrub.ts
 var exports_secret_scrub = {};
 __export(exports_secret_scrub, {
@@ -6440,6 +7021,140 @@ var init_merge = __esm(() => {
   init_tree();
 });
 
+// src/bin/errors-friendly.ts
+var exports_errors_friendly = {};
+__export(exports_errors_friendly, {
+  friendlyError: () => friendlyError,
+  formatSealedError: () => formatSealedError,
+  formatMissingObjectError: () => formatMissingObjectError,
+  formatChainError: () => formatChainError,
+  formatAuthError: () => formatAuthError,
+  classifyAuthError: () => classifyAuthError
+});
+function classifyAuthError(status, message = "") {
+  if (status === 401 || / -> 401\b/.test(message) || /\b401\b/.test(message))
+    return "expired";
+  if (status === 403 || / -> 403\b/.test(message) || /\b403\b/.test(message))
+    return "forbidden";
+  if (/invalid token|malformed|not a jwt|jwt/i.test(message))
+    return "invalid";
+  return "unknown";
+}
+function formatAuthError(kind, repo) {
+  switch (kind) {
+    case "expired":
+      return "session expired — run `sol auth login` (or set SOL_TOKEN)";
+    case "forbidden":
+      return `you lack access${repo ? ` to ${repo}` : " to this repo"} — ask the owner to grant you access, or check you're logged in as the right account (\`sol auth status\`)`;
+    case "invalid":
+      return "invalid token format — SOL_TOKEN is not a valid session token; re-run `sol auth login` to mint a fresh one";
+    default:
+      return "authentication failed — run `sol auth login` (or set SOL_TOKEN), then try again";
+  }
+}
+function formatSealedError(path) {
+  return `sealed file ${path} — you lack a decryption key.
+  -> \`sol keys\` to see your keyring
+  -> ask the owner to re-seal this path to your account (\`sol seal ${path} <you>\`)`;
+}
+function formatChainError(err) {
+  const m = err.message;
+  const seq = /seq (\d+)/.exec(m)?.[1];
+  const where = seq ? `op-log chain broken at seq ${seq}` : "op-log chain broken";
+  return `${where}: ${m.replace(/^corrupt repo: /, "")}
+  -> \`sol doctor\` for a full diagnosis
+  -> \`sol fsck --repair\` to recover (truncates to the last verified link)`;
+}
+function formatMissingObjectError(hash, seq) {
+  const ref = seq !== undefined ? ` referenced by op seq ${seq}` : "";
+  return `object ${hash}${ref} not found in store.
+  -> \`sol doctor\` then \`sol fsck --repair\` to recover from backup
+  -> or \`sol recover --from-remote <url> <repo>\` to rehydrate from the cloud`;
+}
+function friendlyError(err, ctx) {
+  if (err instanceof CorruptObjectError)
+    return formatMissingObjectError(err.hash);
+  if (err instanceof CorruptRepoError) {
+    if (/dangling head|head is lost|missing from the store/.test(err.message)) {
+      return `${err.message.replace(/^corrupt repo: /, "")}
+  -> \`sol doctor\` then \`sol fsck --repair\` to re-point the head`;
+    }
+    return formatChainError(err);
+  }
+  const msg = err instanceof Error ? err.message : String(err);
+  const kind = classifyAuthError(undefined, msg);
+  if (kind !== "unknown")
+    return formatAuthError(kind, ctx?.repo);
+  return msg;
+}
+var init_errors_friendly = __esm(() => {
+  init_errors();
+});
+
+// src/bin/admin-remote-verify.ts
+var exports_admin_remote_verify = {};
+__export(exports_admin_remote_verify, {
+  renderRemoteVerify: () => renderRemoteVerify,
+  remoteVerify: () => remoteVerify,
+  classifyRemoteFailure: () => classifyRemoteFailure
+});
+function classifyRemoteFailure(status, message, repo) {
+  if (status === 401 || status === 403)
+    return { kind: "auth", message: formatAuthError(classifyAuthError(status, message), repo) };
+  if (status !== undefined)
+    return { kind: "backend", status, message: `backend error (${status}) — transient, try again: ${message}`.trim() };
+  return { kind: "network", message: `could not reach the remote — connectivity issue: ${message}` };
+}
+async function remoteVerify(fetchLike, url, repo, token) {
+  const endpoint2 = `${url.replace(/\/+$/, "")}/fsck?repo=${encodeURIComponent(repo)}`;
+  let res;
+  try {
+    res = await fetchLike(endpoint2, { headers: { authorization: `Bearer ${token}`, "content-type": "application/json" } });
+  } catch (e) {
+    return classifyRemoteFailure(undefined, String(e?.message ?? e), repo);
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    return classifyRemoteFailure(res.status, body.slice(0, 200), repo);
+  }
+  const fsck = await res.json();
+  return fsck.ok ? { kind: "ok", fsck } : { kind: "corrupt", fsck };
+}
+function renderRemoteVerify(r) {
+  switch (r.kind) {
+    case "ok":
+      return {
+        lines: [
+          "  checking remote repository...",
+          `  op-log: chain ${r.fsck.chainOk ? "valid" : "BROKEN"}${r.fsck.head ? `, tip: ${r.fsck.head.slice(0, 16)}` : ""}`,
+          `  objects: ${r.fsck.checked} reachable, ${r.fsck.missing.length} missing`,
+          "  status: OK"
+        ],
+        exitCode: 0
+      };
+    case "corrupt":
+      return {
+        lines: [
+          "  checking remote repository...",
+          `  op-log: chain ${r.fsck.chainOk ? "valid" : `BROKEN — ${r.fsck.chainError ?? "?"}`}`,
+          `  objects: ${r.fsck.checked} reachable, ${r.fsck.missing.length} missing`,
+          ...r.fsck.missing.map((h) => `    missing ${h}`),
+          "  status: PROBLEMS FOUND — the remote repository is corrupted"
+        ],
+        exitCode: 1
+      };
+    case "auth":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+    case "backend":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+    case "network":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+  }
+}
+var init_admin_remote_verify = __esm(() => {
+  init_errors_friendly();
+});
+
 // src/bin/local-peer.ts
 var exports_local_peer = {};
 __export(exports_local_peer, {
@@ -6690,12 +7405,333 @@ var init_converge = __esm(() => {
   EMPTY_TREE2 = { kind: "tree", entries: {} };
 });
 
+// src/bin/sync-watch-fs.ts
+var exports_sync_watch_fs = {};
+__export(exports_sync_watch_fs, {
+  buildFsSyncEnv: () => buildFsSyncEnv
+});
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
+function resolveRemote() {
+  const cfg = loadRemote(solDir);
+  if (!cfg)
+    return;
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL };
+}
+function readRefs() {
+  return existsSync14(refsPath()) ? JSON.parse(readFileSync14(refsPath(), "utf8")) : undefined;
+}
+async function buildFsSyncEnv(opts) {
+  if (!existsSync14(solDir))
+    throw new Error("not a sol repo — run `sol init` first");
+  const { repo, log } = open();
+  const cfg = resolveRemote() || (() => {
+    throw new Error("no remote — set one with `sol remote <url> <repo>`");
+  })();
+  const token = opts.token;
+  const replica = { store: new FileStore2(solDir, objectsDir()), log };
+  const currentBranch = () => readRefs()?.current ?? "main";
+  const local = {
+    replica,
+    async capture() {
+      const snap = await snapshotTree(repo);
+      if (snap.changed)
+        writeWorkingIndex(await repo.list());
+      return snap.changed;
+    },
+    head: () => log.head(),
+    seq: () => log.seq(),
+    logTip: () => log.logTip(),
+    history: () => log.history(),
+    async nodes() {
+      return allLocalNodes();
+    },
+    branch: currentBranch,
+    forkBase() {
+      const refs = readRefs();
+      return refs?.branches[refs.current]?.remote;
+    },
+    async dirty() {
+      const wc = workingChanges(loadStore(), await log.head() ?? "");
+      return wc.added.length + wc.modified.length + wc.removed.length > 0;
+    },
+    async absorbCanonical(bundle, fromHead) {
+      const head = bundle.head ?? fromHead;
+      const canonBundle = {
+        head,
+        seq: bundle.ops.length ? bundle.ops[bundle.ops.length - 1].seq : 0,
+        tip: bundle.ops.length ? bundle.ops[bundle.ops.length - 1].entryHash : undefined,
+        ops: bundle.ops,
+        nodes: bundle.nodes,
+        refs: bundle.branches ? { branches: bundle.branches, production: readRefs()?.current ?? "main" } : undefined
+      };
+      await writeBundle(solDir, canonBundle, 0);
+      await local.adopt(fromHead, head, bundle.branches);
+    },
+    async adopt(from, to, branches) {
+      const refs = readRefs();
+      if (refs) {
+        if (branches) {
+          for (const [name, h] of Object.entries(branches)) {
+            refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
+          }
+        }
+        const cur = refs.current;
+        if (refs.branches[cur]) {
+          refs.branches[cur].head = to;
+          refs.branches[cur].remote = to;
+        }
+        saveRefs(refs);
+      }
+      setOpLogHead(to);
+      if (to && to !== from)
+        materializeDiff(loadStore(), from, to);
+    }
+  };
+  const remote = {
+    async head() {
+      const rh = await remoteHead(cfg, token);
+      return { head: rh.head, tip: rh.tip, seq: rh.seq };
+    },
+    async export() {
+      const b = await remoteExport(cfg, token);
+      return { head: b.head, tip: b.tip, seq: b.seq, ops: b.ops, nodes: b.nodes, branches: b.refs?.branches };
+    },
+    async push(body) {
+      const res = await remotePush(cfg, token, body);
+      return { head: res.head, applied: res.applied, merged: res.merged, conflicts: res.conflicts, branches: res.refs?.branches };
+    }
+  };
+  if (!loadRemote(solDir)?.url && cfg.repo)
+    saveRemote(solDir, cfg);
+  const logger = {
+    info: (line) => console.log(line),
+    warn: (line) => console.error("sol: " + line)
+  };
+  const runLocked = async (fn) => {
+    const release = acquireLock();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  };
+  return { local, remote, log: logger, actor, dryRun: !!opts.dryRun, runLocked };
+}
+var DEFAULT_REMOTE_URL;
+var init_sync_watch_fs = __esm(() => {
+  init_file_store2();
+  init_lib();
+  init_remote();
+  DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+});
+
+// src/bin/sync-watch.ts
+var exports_sync_watch = {};
+__export(exports_sync_watch, {
+  runSyncWatch: () => runSyncWatch,
+  pushTick: () => pushTick,
+  pollTick: () => pollTick,
+  isFatalSyncError: () => isFatalSyncError,
+  formatTick: () => formatTick,
+  captureTick: () => captureTick
+});
+function isFatalSyncError(e) {
+  const m = (e instanceof Error ? e.message : String(e)).toLowerCase();
+  if (/-> 401|-> 403|unauthor|forbidden|session expired|invalid token/.test(m))
+    return true;
+  if (/corrupt|broken chain|chain mismatch|not a sol repo|tamper/.test(m))
+    return true;
+  return false;
+}
+async function captureTick(env) {
+  if (env.dryRun)
+    return { changed: 0 };
+  const changed = await env.local.capture();
+  return { changed };
+}
+async function pushTick(env) {
+  const { local, remote } = env;
+  const localHead = await local.head();
+  if (!localHead)
+    return { pushed: 0, merged: false, conflicts: [] };
+  const rh = await remote.head();
+  const ops = await local.history();
+  const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
+  const localTip = await local.logTip();
+  if (localSeq === rh.seq && localTip === rh.tip)
+    return { pushed: 0, merged: false, conflicts: [], head: localHead };
+  const branch = local.branch();
+  const forkBase = local.forkBase();
+  const baseOp = forkBase ? ops.find((o) => o.rootAfter === forkBase) : undefined;
+  const fromSeq = baseOp ? baseOp.seq : rh.seq;
+  const delta = ops.filter((o) => o.seq > fromSeq);
+  if (env.dryRun) {
+    env.log.info(`[dry-run] would push ${delta.length} op(s) (branch ${branch} @ ${short2(localHead)})`);
+    return { pushed: 0, merged: false, conflicts: [], head: localHead };
+  }
+  const res = await remote.push({ nodes: await local.nodes(), ops: delta, branch, head: localHead, expectedHead: forkBase });
+  const canon = await remote.export();
+  const convergedHead = res.head ?? canon.branches?.[branch] ?? localHead;
+  await local.absorbCanonical({ head: convergedHead, ops: canon.ops, nodes: canon.nodes, branches: canon.branches }, localHead);
+  return {
+    pushed: res.applied,
+    merged: !!res.merged,
+    conflicts: (res.conflicts ?? []).map((c) => c.path),
+    head: convergedHead
+  };
+}
+async function pollTick(env) {
+  const { local, remote } = env;
+  const rh = await remote.head();
+  const localTip = await local.logTip();
+  const localSeq = await local.seq();
+  if (rh.seq <= localSeq && rh.tip === localTip)
+    return { pulled: 0, merged: false, conflicts: [], deferred: false };
+  if (await local.dirty()) {
+    env.log.info("remote moved but the working tree is dirty — pull deferred to the next poll (your edits captured first)");
+    return { pulled: 0, merged: false, conflicts: [], deferred: true };
+  }
+  if (env.dryRun) {
+    env.log.info(`[dry-run] would pull remote @ ${short2(rh.head)} (seq ${rh.seq})`);
+    return { pulled: 0, merged: false, conflicts: [], deferred: false };
+  }
+  const bundle = await remote.export();
+  const prevHead = await local.head() ?? "";
+  const before = (await local.history()).length;
+  const res = await converge(local.replica, {
+    nodes: bundle.nodes,
+    ops: bundle.ops,
+    incomingHead: bundle.head,
+    actor: env.actor
+  });
+  const after = (await local.history()).length;
+  if (res.head !== prevHead)
+    await local.adopt(prevHead, res.head, bundle.branches);
+  return {
+    pulled: after - before,
+    merged: res.merged,
+    conflicts: res.conflicts.map((c) => c.path),
+    deferred: false,
+    head: res.head
+  };
+}
+function formatTick(parts) {
+  const segs = [];
+  if (parts.captured)
+    segs.push(`auto-captured ${parts.captured} change${parts.captured === 1 ? "" : "s"}`);
+  if (parts.push && parts.push.pushed) {
+    const note = parts.push.merged ? " (converged)" : "";
+    const conf = parts.push.conflicts.length ? ` [${parts.push.conflicts.length} conflict(s): ${parts.push.conflicts.join(", ")}]` : "";
+    segs.push(`pushed ${parts.push.pushed} op${parts.push.pushed === 1 ? "" : "s"} -> remote${note}${conf}`);
+  }
+  if (parts.poll && parts.poll.pulled) {
+    const note = parts.poll.merged ? " (merged)" : "";
+    const conf = parts.poll.conflicts.length ? ` [${parts.poll.conflicts.length} conflict(s): ${parts.poll.conflicts.join(", ")}]` : "";
+    segs.push(`pulled ${parts.poll.pulled} op${parts.poll.pulled === 1 ? "" : "s"} from remote${note}${conf}`);
+  }
+  if (!segs.length)
+    return;
+  const t = new Date().toLocaleTimeString();
+  return `[${t}] ${segs.join(" | ")}`;
+}
+async function runSyncWatch(opts) {
+  const { buildFsSyncEnv: buildFsSyncEnv2 } = await Promise.resolve().then(() => (init_sync_watch_fs(), exports_sync_watch_fs));
+  const env = await buildFsSyncEnv2(opts);
+  const { watch } = await import("node:fs");
+  const { sep: sep2 } = await import("node:path");
+  const { DEFAULT_IGNORE: DEFAULT_IGNORE2 } = await Promise.resolve().then(() => (init_lib(), exports_lib));
+  const pollInterval = opts.pollInterval ?? 5000;
+  const pushImmediate = opts.pushImmediate ?? true;
+  let exiting = false;
+  const fatal = (where, e) => {
+    if (exiting)
+      return;
+    exiting = true;
+    env.log.warn(`FATAL (${where}): ${e instanceof Error ? e.message : e} — exiting. fix it and re-run \`sol sync --watch\`.`);
+    process.exit(1);
+  };
+  let running = false;
+  let pending = false;
+  const captureAndPush = async () => {
+    if (running) {
+      pending = true;
+      return;
+    }
+    running = true;
+    try {
+      do {
+        pending = false;
+        try {
+          const cap = await env.runLocked(async () => {
+            const c = await captureTick(env);
+            let push;
+            if (c.changed && pushImmediate) {
+              try {
+                push = await pushTick(env);
+              } catch (e) {
+                if (isFatalSyncError(e))
+                  return fatal("push", e);
+                env.log.warn(`push failed (will retry next cycle): ${e instanceof Error ? e.message : e}`);
+              }
+            }
+            return { captured: c.changed, push };
+          });
+          const line = formatTick(cap);
+          if (line)
+            env.log.info(line);
+        } catch (e) {
+          if (isFatalSyncError(e))
+            return fatal("capture", e);
+          env.log.warn(`sync tick error (retrying): ${e?.message || e}`);
+        }
+      } while (pending);
+    } finally {
+      running = false;
+    }
+  };
+  const pollOnce = async () => {
+    try {
+      const res = await env.runLocked(() => pollTick(env));
+      const line = formatTick({ poll: res });
+      if (line)
+        env.log.info(line);
+    } catch (e) {
+      if (isFatalSyncError(e))
+        return fatal("poll", e);
+      env.log.warn(`poll failed (will retry in ${Math.round(pollInterval / 1000)}s): ${e?.message || e}`);
+    }
+  };
+  await captureAndPush();
+  env.log.info(`sol sync --watch on ${opts.repoDir}
+  every edit is auto-captured + pushed${pushImmediate ? "" : " (push disabled — capture only)"}; safe remote updates pull in every ${Math.round(pollInterval / 1000)}s.
+` + `  nothing is lost — all edits are durable locally first. Ctrl-C to stop.${opts.dryRun ? `
+  [DRY RUN — logging intent, mutating nothing]` : ""}`);
+  let timer;
+  watch(opts.repoDir, { recursive: true }, (_e, filename) => {
+    if (!filename)
+      return;
+    const top = String(filename).split(sep2)[0];
+    if (top === ".sol" || DEFAULT_IGNORE2.includes(top))
+      return;
+    clearTimeout(timer);
+    timer = setTimeout(() => void captureAndPush(), 400);
+  });
+  const poller = setInterval(() => void pollOnce(), pollInterval);
+  poller.unref?.();
+  await new Promise(() => {});
+}
+var short2 = (h) => (h ?? "").slice(0, 12);
+var init_sync_watch = __esm(() => {
+  init_converge();
+});
+
 // src/mr.ts
 var exports_mr = {};
 __export(exports_mr, {
   mrSummary: () => mrSummary,
   mergeGate: () => mergeGate,
-  latestVerdicts: () => latestVerdicts
+  latestVerdicts: () => latestVerdicts,
+  isAdvisoryGate: () => isAdvisoryGate
 });
 function latestVerdicts(mr) {
   const m = new Map;
@@ -6703,18 +7739,23 @@ function latestVerdicts(mr) {
     m.set(r.actor, r.verdict);
   return m;
 }
-function mergeGate(mr) {
+function mergeGate(mr, branchGate) {
   const reasons = [];
   if (mr.status !== "open")
     reasons.push(`MR is ${mr.status}`);
   for (const c of mr.checks)
     if (c.status === "fail")
       reasons.push(`check '${c.name}' failed`);
+  if (branchGate?.verdict === "fail")
+    reasons.push(`branch head gate failed${branchGate.summary ? `: ${branchGate.summary}` : ""}`);
   for (const [actor2, v] of latestVerdicts(mr))
     if (v === "request-changes")
       reasons.push(`${actor2} requested changes`);
   return reasons;
 }
+function isAdvisoryGate(reason) {
+  return reason.startsWith("check '") || reason.startsWith("branch head gate");
+}
 function mrSummary(mr) {
   const approvals = [...latestVerdicts(mr).values()].filter((v) => v === "approve").length;
   const checks = mr.checks.length ? `${mr.checks.filter((c) => c.status === "pass").length}/${mr.checks.length} checks pass` : "no checks";
@@ -6729,7 +7770,7 @@ __export(exports_runtime, {
   hydrate: () => hydrate2,
   capture: () => capture
 });
-import { chmodSync as chmodSync4, existsSync as existsSync14, lstatSync as lstatSync2, mkdirSync as mkdirSync8, readdirSync as readdirSync7, readFileSync as readFileSync14, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync15, lstatSync as lstatSync2, mkdirSync as mkdirSync8, readdirSync as readdirSync7, readFileSync as readFileSync15, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { platform } from "node:os";
 import { dirname as dirname3, join as join14, relative as relative2 } from "node:path";
 function isolateCommand(command, scratch) {
@@ -6793,7 +7834,7 @@ async function capture(repo, dir, keep = []) {
   const pats = ignorePatterns();
   const files = new Set(walkDir(dir, dir, pats));
   for (const k of keep)
-    if (existsSync14(join14(dir, k)))
+    if (existsSync15(join14(dir, k)))
       files.add(k);
   const written = [];
   for (const f of files) {
@@ -6808,7 +7849,7 @@ async function capture(repo, dir, keep = []) {
       }
       continue;
     }
-    const buf = readFileSync14(abs);
+    const buf = readFileSync15(abs);
     if (buf.includes(0)) {
       const cur = await repo.readBytes(f);
       if (cur === undefined || cur === SEALED || !Buffer.from(cur).equals(buf)) {
@@ -6825,7 +7866,7 @@ async function capture(repo, dir, keep = []) {
   }
   const deleted = [];
   for (const t of await repo.list()) {
-    if (!existsSync14(join14(dir, t))) {
+    if (!existsSync15(join14(dir, t))) {
       await repo.deleteFile(t);
       deleted.push(t);
     }
@@ -6939,7 +7980,7 @@ __export(exports_git_adapter, {
   exportHistoryToGit: () => exportHistoryToGit
 });
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync15, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join15 } from "node:path";
 import { deflateSync } from "node:zlib";
 async function importGitHead(gitPath, ws) {
@@ -7009,7 +8050,7 @@ async function applyGitFile(repo, path, mode, content) {
 }
 function setHead(fdir, head) {
   const hf = join15(fdir, "HEAD");
-  const cur = existsSync15(hf) ? JSON.parse(readFileSync15(hf, "utf8")) : { seq: 0 };
+  const cur = existsSync16(hf) ? JSON.parse(readFileSync16(hf, "utf8")) : { seq: 0 };
   writeFileSync14(hf, JSON.stringify({ ...cur, head }));
 }
 async function importGitRepo(gitPath, fdir) {
@@ -7076,14 +8117,14 @@ function exportToGit(store2, head, gitPath, message) {
 }
 function gitObjectsDir(gitPath) {
   for (const c of [join15(gitPath, ".git", "objects"), join15(gitPath, "objects")])
-    if (existsSync15(c))
+    if (existsSync16(c))
       return c;
   return;
 }
 function writeLooseObject(objectsDir2, o) {
   const dir = join15(objectsDir2, o.oid.slice(0, 2));
   const file = join15(dir, o.oid.slice(2));
-  if (existsSync15(file))
+  if (existsSync16(file))
     return;
   const header = Buffer.from(`${o.type} ${o.content.length}\x00`);
   const framed = Buffer.concat([header, Buffer.from(o.content)]);
@@ -7200,14 +8241,14 @@ __export(exports_views, {
   loadViewsRegistry: () => loadViewsRegistry,
   createView: () => createView
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, readdirSync as readdirSync8, readFileSync as readFileSync16, rmSync, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync10, readdirSync as readdirSync8, readFileSync as readFileSync17, rmSync, writeFileSync as writeFileSync15 } from "node:fs";
 import { join as join16, relative as relative3, resolve as resolve3 } from "node:path";
 function loadViewsRegistry(parentSol) {
   const p = viewsRegistryPath(parentSol);
-  if (!existsSync16(p))
+  if (!existsSync17(p))
     return { views: [] };
   try {
-    return JSON.parse(readFileSync16(p, "utf8"));
+    return JSON.parse(readFileSync17(p, "utf8"));
   } catch {
     return { views: [] };
   }
@@ -7240,7 +8281,7 @@ async function viewStatuses(parentSol) {
   const out = [];
   for (const v of reg.views) {
     const viewSol = join16(v.dir, ".sol");
-    const exists = existsSync16(join16(viewSol, "view.json"));
+    const exists = existsSync17(join16(viewSol, "view.json"));
     let head;
     if (exists) {
       head = await new FileOpLog2(viewSol).head();
@@ -7264,7 +8305,7 @@ function pruneViews(parentSol, opts = {}) {
   const reg = loadViewsRegistry(parentSol);
   const removed = [];
   reg.views = reg.views.filter((v) => {
-    const present = existsSync16(join16(v.dir, ".sol", "view.json"));
+    const present = existsSync17(join16(v.dir, ".sol", "view.json"));
     const target = opts.name ? v.name === opts.name : !present;
     if (!target)
       return true;
@@ -7281,7 +8322,7 @@ function pruneViews(parentSol, opts = {}) {
 }
 function sharedObjectCount(parentSol) {
   const dir = join16(parentSol, "objects");
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     return 0;
   return readdirSync8(dir).filter((n) => !n.endsWith(".tmp")).length;
 }
@@ -7293,6 +8334,169 @@ var init_views = __esm(() => {
   init_lib();
 });
 
+// src/bin/agent-sessions.ts
+var exports_agent_sessions = {};
+__export(exports_agent_sessions, {
+  stopSession: () => stopSession,
+  sessions: () => sessions,
+  sessionPath: () => sessionPath,
+  sessionDir: () => sessionDir,
+  saveSessionsRegistry: () => saveSessionsRegistry,
+  pruneSession: () => pruneSession,
+  loadSessionsRegistry: () => loadSessionsRegistry,
+  fingerprintOfSeed: () => fingerprintOfSeed,
+  createSession: () => createSession
+});
+import { chmodSync as chmodSync5, existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync18, rmSync as rmSync2, writeFileSync as writeFileSync16 } from "node:fs";
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { basename, dirname as dirname4, join as join17, resolve as resolve4 } from "node:path";
+function sessionPath(parentSol) {
+  return join17(parentSol, "sessions.json");
+}
+function sessionDir(parentSol, sessionId) {
+  return join17(parentSol, "sessions", sessionId);
+}
+function loadSessionsRegistry(parentSol) {
+  const p = sessionPath(parentSol);
+  if (!existsSync18(p))
+    return { sessions: [] };
+  try {
+    return JSON.parse(readFileSync18(p, "utf8"));
+  } catch {
+    return { sessions: [] };
+  }
+}
+function saveSessionsRegistry(parentSol, reg) {
+  writeFileSync16(sessionPath(parentSol), JSON.stringify(reg, null, 2));
+}
+function newSessionId(name) {
+  const slug = name.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 24) || "agent";
+  return `${slug}-${Date.now().toString(36)}-${randomBytes5(3).toString("hex")}`;
+}
+function createSession(opts) {
+  const { parentSol, name, actor: actor2, check, metadata } = opts;
+  if (!existsSync18(parentSol))
+    throw new Error(`not a sol repo: ${parentSol}`);
+  const sessionId = opts.sessionId ?? newSessionId(name);
+  const sdir = sessionDir(parentSol, sessionId);
+  if (existsSync18(sdir)) {
+    if (opts.onExistingKey)
+      opts.onExistingKey(sessionId);
+    else
+      throw new Error(`session already exists: ${sessionId} (${sdir})`);
+  }
+  const repoRoot2 = dirname4(parentSol);
+  const viewDir = opts.dir ? resolve4(opts.dir) : join17(dirname4(repoRoot2), `${basename(repoRoot2)}-${name}`);
+  if (existsSync18(join17(viewDir, ".sol")))
+    throw new Error(`already a sol repo/view: ${viewDir}`);
+  const branch = `view/${name}`;
+  const startHead = headOf(parentSol);
+  createView({ parentSol, viewDir, name, branch, actor: actor2, startHead });
+  const kp = generateKeypair();
+  mkdirSync11(sdir, { recursive: true });
+  const signingKeyPath = join17(sdir, "signing.key");
+  writeFileSync16(signingKeyPath, kp.seed, { mode: 384 });
+  try {
+    chmodSync5(signingKeyPath, 384);
+  } catch {}
+  if (check) {
+    const cfg = loadSolConfig(parentSol);
+    cfg.check = check;
+    saveSolConfig(parentSol, cfg);
+  }
+  const record = {
+    sessionId,
+    name,
+    viewDir: resolve4(viewDir),
+    branch,
+    actor: actor2,
+    signingKeyPath: resolve4(signingKeyPath),
+    fingerprint: kp.fingerprint,
+    startHead,
+    createdAt: Date.now(),
+    ...metadata ? { metadata } : {}
+  };
+  const reg = loadSessionsRegistry(parentSol);
+  reg.sessions = reg.sessions.filter((s) => s.sessionId !== sessionId);
+  reg.sessions.push(record);
+  saveSessionsRegistry(parentSol, reg);
+  return record;
+}
+function headOf(parentSol) {
+  const headFile = join17(parentSol, "HEAD");
+  if (existsSync18(headFile)) {
+    try {
+      const h = JSON.parse(readFileSync18(headFile, "utf8"));
+      if (h.head)
+        return h.head;
+    } catch {}
+  }
+  return emptyRoot2(new LazyStore(join17(parentSol, "objects")));
+}
+function matches(s, ref) {
+  return s.sessionId === ref || s.name === ref;
+}
+function stopSession(parentSol, ref) {
+  const reg = loadSessionsRegistry(parentSol);
+  const s = reg.sessions.find((x) => x.sessionId === ref) ?? reg.sessions.find((x) => matches(x, ref));
+  if (!s)
+    return false;
+  if (!s.stopAt) {
+    s.stopAt = Date.now();
+    saveSessionsRegistry(parentSol, reg);
+  }
+  return true;
+}
+async function sessions(parentSol) {
+  const reg = loadSessionsRegistry(parentSol);
+  const out = [];
+  for (const s of reg.sessions) {
+    const viewSol = join17(s.viewDir, ".sol");
+    const exists = existsSync18(join17(viewSol, "view.json"));
+    let head;
+    if (exists)
+      head = await new FileOpLog2(viewSol).head();
+    const state = !exists ? "stale" : s.stopAt ? "stopped" : "running";
+    out.push({ ...s, head, exists, state });
+  }
+  return out;
+}
+function pruneSession(parentSol, ref, deleteDir = false) {
+  const reg = loadSessionsRegistry(parentSol);
+  const removed = [];
+  const drop = [];
+  reg.sessions = reg.sessions.filter((s) => {
+    const present = existsSync18(join17(s.viewDir, ".sol", "view.json"));
+    const target = ref ? matches(s, ref) : !present;
+    if (!target)
+      return true;
+    drop.push(s);
+    removed.push(s.sessionId);
+    return false;
+  });
+  for (const s of drop) {
+    try {
+      pruneViews(parentSol, { name: s.name, deleteDir });
+    } catch {}
+    try {
+      rmSync2(sessionDir(parentSol, s.sessionId), { recursive: true, force: true });
+    } catch {}
+  }
+  saveSessionsRegistry(parentSol, reg);
+  return removed;
+}
+function fingerprintOfSeed(seed) {
+  return fingerprintOf(publicOf(loadPrivateKey(seed)));
+}
+var init_agent_sessions = __esm(() => {
+  init_file_store2();
+  init_sign();
+  init_tree();
+  init_lib();
+  init_test_gate();
+  init_views();
+});
+
 // src/bin/secret.ts
 var exports_secret2 = {};
 __export(exports_secret2, {
@@ -7300,7 +8504,7 @@ __export(exports_secret2, {
   runEnv: () => runEnv,
   resolveReference: () => resolveReference
 });
-import { readFileSync as readFileSync17, readSync, writeSync } from "node:fs";
+import { readFileSync as readFileSync19, readSync, writeSync } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function flag(args, name) {
   const i = args.indexOf(name);
@@ -7672,7 +8876,7 @@ async function envValidate(ctx, args, json) {
 }
 function readSchemaText(solDir2) {
   try {
-    return readFileSync17(schemaLockPath(solDir2), "utf8");
+    return readFileSync19(schemaLockPath(solDir2), "utf8");
   } catch {
     return;
   }
@@ -8354,8 +9558,8 @@ var exports_sol_secret_mcp = {};
 __export(exports_sol_secret_mcp, {
   startSecretMcp: () => startSecretMcp
 });
-import { existsSync as existsSync17 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join18 } from "node:path";
 async function buildSecretServer(solDir2) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
@@ -8391,8 +9595,8 @@ async function buildSecretServer(solDir2) {
   return server;
 }
 async function startSecretMcp(opts = {}) {
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join17(process.cwd(), ".sol");
-  if (!existsSync17(solDir2)) {
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join18(process.cwd(), ".sol");
+  if (!existsSync19(solDir2)) {
     process.stderr.write(`sol-secret-mcp: no .sol at ${solDir2} — run \`sol init\` first (or set SOL_DIR)
 `);
     process.exit(1);
@@ -8420,9 +9624,9 @@ __export(exports_dispatch, {
   dispatch: () => dispatch
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, mkdtempSync, readdirSync as readdirSync9, readFileSync as readFileSync18, rmSync as rmSync2, unlinkSync as unlinkSync7, watch, writeFileSync as writeFileSync16 } from "node:fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync20, mkdirSync as mkdirSync12, mkdtempSync, readdirSync as readdirSync9, readFileSync as readFileSync20, rmSync as rmSync3, unlinkSync as unlinkSync7, watch, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir2, hostname, platform as platform2, tmpdir } from "node:os";
-import { basename, dirname as dirname4, join as join18, resolve as resolve4, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname5, join as join19, resolve as resolve5, sep as sep2 } from "node:path";
 function globCovers(pattern, path) {
   let re = "";
   for (let i = 0;i < pattern.length; i++) {
@@ -8442,6 +9646,14 @@ function globCovers(pattern, path) {
   }
   return new RegExp(`^${re}$`).test(path);
 }
+function writableTag(path) {
+  try {
+    accessSync(path, fsConstants.R_OK | fsConstants.W_OK);
+    return "RW";
+  } catch {
+    return "READ-ONLY";
+  }
+}
 function tokenClaims(token) {
   try {
     return JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString());
@@ -8450,11 +9662,11 @@ function tokenClaims(token) {
   }
 }
 async function loadStoredToken() {
-  if (!existsSync18(CRED_PATH))
+  if (!existsSync20(CRED_PATH))
     return;
   let creds;
   try {
-    creds = JSON.parse(readFileSync18(CRED_PATH, "utf8"));
+    creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
   } catch {
     return;
   }
@@ -8469,7 +9681,7 @@ async function loadStoredToken() {
       if (res.ok) {
         const r = await res.json();
         if (r.accessToken) {
-          writeFileSync16(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
+          writeFileSync17(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
           return r.accessToken;
         }
       }
@@ -8490,7 +9702,7 @@ function authHost() {
   if (process.env.SOL_AUTH)
     return process.env.SOL_AUTH.replace(/\/+$/, "");
   try {
-    const w = JSON.parse(readFileSync18(CRED_PATH, "utf8")).webUrl;
+    const w = JSON.parse(readFileSync20(CRED_PATH, "utf8")).webUrl;
     if (w)
       return w.replace(/\/+$/, "");
   } catch {}
@@ -8514,11 +9726,11 @@ async function resolveMcpHttp(a, label) {
     die(`invalid --port: ${portRaw}`);
   return { token, port, host: flagVal("--host"), label: label ?? (a.includes("--secret") || a.includes("--secrets") ? "sol-secrets" : "sol") };
 }
-function resolveRemote(solDir2) {
+function resolveRemote2(solDir2) {
   const cfg = loadRemote(solDir2);
   if (!cfg)
     return;
-  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL };
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL2 };
 }
 async function pushEnvState(solDirPath, cfg, token) {
   const { readEnvStateBundle: readEnvStateBundle2 } = await Promise.resolve().then(() => (init_anchor(), exports_anchor));
@@ -8537,6 +9749,17 @@ ENV ANCHOR REJECTED by the remote: ${e?.message ?? String(e)}
     process.exitCode = 1;
   }
 }
+async function surfaceOwner(cfg, token) {
+  const slash = cfg.repo.indexOf("/");
+  if (slash < 0)
+    return;
+  const owner = cfg.repo.slice(0, slash);
+  try {
+    const res = await ownerSet(cfg, token, owner);
+    if (res.error)
+      console.error(`note: could not set repo owner to '${owner}': ${res.error}`);
+  } catch {}
+}
 async function pullEnvState(solDirPath, cfg, token) {
   try {
     const { bundle } = await remoteEnvPull(cfg, token);
@@ -8569,7 +9792,7 @@ function cliVersion() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync18(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync20(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }
@@ -8616,7 +9839,7 @@ examples:
   sol commit "add login route"
   sol commit -m "fix parser" src/parse.ts src/lex.ts`,
     push: `sol push                          push the current branch to the configured remote (converging — never FF-rejected)
-  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL}) + this repo name, then push
+  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL2}) + this repo name, then push
   sol push --create <repo>          same, explicit form (creates the repo on first push)
   sol push --public <repo>          create + push + make it public in ONE step (else new repos are private)
 
@@ -8639,6 +9862,21 @@ examples:
 notes:
   refuses to run over a dirty tree — commit or discard first. conflicts land in the working tree with markers.
   refuses to run while UNRESOLVED <<<<<<< markers remain — resolve them and \`sol commit\`, then pull again.`,
+    sync: `sol sync --watch                  HANDS-OFF bidirectional sync daemon — auto-capture + push every edit,
+                                    and converge safe remote updates in on a timer. no CLI invocations needed:
+                                    the working tree stays in sync while every local edit is durably captured.
+  --poll-interval <ms>              how often to poll the remote for updates (default 5000)
+  --no-push-immediately             capture locally but do NOT auto-push (push later with \`sol push\`)
+  --dry-run                         log what it WOULD do, mutate nothing
+
+how it works (three loops over the same core as watch/push/pull):
+  1. every file change is auto-captured into the op-log (nothing lost, even offline)
+  2. after each capture it pushes the delta; the server may converge a concurrent commit in
+  3. it polls the remote; a moved head pulls in via converge() — NEVER clobbering an in-flight edit
+notes:
+  needs a remote (\`sol remote <url> <repo>\` or \`sol push <repo>\` once) + auth (\`sol auth login\` / SOL_TOKEN).
+  a dirty tree DEFERS a pull to the next poll (your edits are captured first). Ctrl-C exits cleanly.
+  transient network errors are logged + retried; a fatal error (corrupt repo / auth) exits loud.`,
     hide: `sol hide <pattern> [--role write|admin] [--team <id>] [--users a,b] [--escrow] [--no-list] [--hide-names] [--hide-existence] [--strict]
                                     add/update a VisibilityPolicy RULE — the HEADLINE verb. binds a glob over tree
                                     paths to an AUDIENCE (who may DECRYPT). the rule is host-visible METADATA (no
@@ -8752,6 +9990,9 @@ examples:
   sol keys verify alice 1a2b-3c4d-...   # confirm alice's key out-of-band before sealing to her`,
     remote: `sol remote                        show the configured remote
   sol remote <url> <repo>           set the remote (url + repo name)
+  sol remote verify                 REMOTE-side health check (the backend's /fsck) — differentiates auth
+                                    (session expired / no access), backend (5xx, transient), connectivity,
+                                    and a 200-but-corrupt remote repo. needs SOL_TOKEN (or \`sol auth login\`).
 
 tip: \`sol push <repo>\` configures the hosted remote for you in one step.`,
     branch: `sol branch                        list branches (* = current)
@@ -8816,6 +10057,27 @@ what it's for (TEST-GATED CONVERGENCE):
   hydrate the current tree to a sandbox, run the command, capture produced files back into a commit.
   --isolate confines the run (no network, writes stay in the sandbox).`,
     promote: "sol promote [branch]   point the remote's production branch at <branch> (default: current branch)",
+    doctor: `sol doctor   — comprehensive LOCAL health check (exit 0 = OK, 1 = problems found)
+
+checks: op-log chain integrity + contiguity, object reachability from head, auth (SOL_TOKEN / stored
+  credentials + expiry), .sol file permissions, and the sealed keyring. read-only — it diagnoses but never
+  changes anything. to RECOVER from what it finds: \`sol fsck --repair\` (op-log/head) or \`sol recover\` (cloud/backup).`,
+    fsck: `sol fsck            verify the op-log chain + object reachability (exit 0 = OK, 1 = problems)
+  sol fsck --repair   recover a corrupt repo:
+                        - head pointer lost      -> re-point to the last resolvable historical root
+                        - head dangling          -> re-point to the newest root the store still has
+                        - op-log chain broken    -> truncate to the last verified link, re-point head
+
+  every repair appends an explicit CHECKPOINT recording what happened (visible in \`sol log\`/\`sol reflog\`),
+  so the recovery is itself in the tamper-evident history. idempotent: re-running on a healthy repo is a no-op.`,
+    recover: `sol recover                              the recovery guide (the menu below)
+  sol recover --from-remote <url> <repo>   rehydrate from the cloud
+  sol recover --list-all-roots             every root the repo ever landed on (find a lost head)
+  sol recover --file <path> [--from <seq|hash>]   restore a file from history (even if the tree dropped it)
+  sol recover --dump-log [<from> [<to>]]   dump raw op-log entries as JSON (manual salvage)`,
+    reflog: `sol reflog [<branch>] [--by <actor>] [--since <YYYY-MM-DD>]
+  the op-log as a ref-move history (git reflog): each line is a head move (from -> to) with seq, actor, time,
+  and message. a merge shows as "merge". a <branch> arg keeps only checkpoints whose message labels it.`,
     git: `sol git import <repo> [dir]       import a git repo's HEAD into a new Sol repo
   sol git export <repo> [-b branch]  replay the Sol commit DAG as git history (+ provenance trailers), then \`git push\``,
     mr: `sol mr open [--from <branch>] [--to <branch>] [--upstream <repo>] -t "title" [-m body]
@@ -9105,7 +10367,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     try {
       const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
       const { openContent: openContent2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-      const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+      const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
       const self = loadSelfIdentity2();
       setSealedDecryptor((boxStr) => {
         const box = JSON.parse(boxStr);
@@ -9115,19 +10377,19 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     } catch {}
   }
   const servesMcp = cmd === "mcp" || cmd === "secret" && args[0] === "mcp";
-  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "env", "secret"]).has(cmd) && existsSync18(solDir) ? acquireLock() : undefined;
+  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "agent", "env", "secret"]).has(cmd) && existsSync20(solDir) ? acquireLock() : undefined;
   try {
     switch (cmd) {
       case "init": {
-        const here = join18(procCwd, ".sol");
-        if (existsSync18(here))
+        const here = join19(procCwd, ".sol");
+        if (existsSync20(here))
           die("already a sol repo: " + procCwd);
         if (repoRoot && repoRoot !== procCwd && !args.includes("--force")) {
           die(`already inside a Sol repo at ${repoRoot}
   -> just commit into it: \`sol commit ...\` works from here (sol walks up to find the repo)
   -> to nest a NEW repo here anyway: \`sol init --force\``);
         }
-        mkdirSync11(here, { recursive: true });
+        mkdirSync12(here, { recursive: true });
         new FileStore2(here);
         console.log(`initialized empty sol repo in ${here}`);
         break;
@@ -9157,7 +10419,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const h = tok ? identityFromToken(tok)?.handle : undefined;
           return h || die("no account identity — run `sol auth login` (or set SOL_ACCOUNT for self-host)");
         };
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const sub = args[0];
         const wantJson = args.includes("--json");
         if (sub === "init") {
@@ -9243,7 +10505,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (sub === "import") {
           const passphrase = process.env.SOL_KEYSTORE_PASSPHRASE || die("set SOL_KEYSTORE_PASSPHRASE to decrypt the bundle");
           const file = args[1] || die("usage: sol keys import <bundle.json>   (set SOL_KEYSTORE_PASSPHRASE)");
-          const bundle = JSON.parse(readFileSync18(file, "utf8"));
+          const bundle = JSON.parse(readFileSync20(file, "utf8"));
           let recovered;
           try {
             recovered = importBundle2(bundle, passphrase);
@@ -9274,7 +10536,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "trust": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const map = loadTrust();
         if (args[0] === "--remove" || args[0] === "-r") {
@@ -9321,7 +10583,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "track":
       case "add": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const files = args.filter((a) => a !== "." && !a.startsWith("-"));
         if (!files.length) {
@@ -9332,7 +10594,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let n = 0;
         for (const f of files) {
           const rf = repoRel(f);
-          if (!existsSync18(join18(cwd, rf))) {
+          if (!existsSync20(join19(cwd, rf))) {
             console.error("skip (not on disk): " + f);
             continue;
           }
@@ -9361,14 +10623,14 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (!message)
           die('commit needs a message: sol commit "what you did"  (scoped: sol commit -m "msg" file1 file2)');
         const parentHead = await repo.head();
-        const mergeHeadPath = join18(solDir, "MERGE_HEAD");
-        const parent2 = existsSync18(mergeHeadPath) ? readFileSync18(mergeHeadPath, "utf8").trim() || undefined : undefined;
+        const mergeHeadPath = join19(solDir, "MERGE_HEAD");
+        const parent2 = existsSync20(mergeHeadPath) ? readFileSync20(mergeHeadPath, "utf8").trim() || undefined : undefined;
         let changed = 0;
         let commitRoot = parentHead;
         if (paths.length) {
           for (const p of paths) {
             const rp = repoRel(p);
-            if (existsSync18(join18(cwd, rp))) {
+            if (existsSync20(join19(cwd, rp))) {
               if (await snapshotFile(repo, rp))
                 changed++;
             } else if ((await repo.list()).includes(rp)) {
@@ -9423,7 +10685,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "status": {
         const { repo, log } = open();
-        const refs = existsSync18(refsPath()) ? await loadRefs(log) : undefined;
+        const refs = existsSync20(refsPath()) ? await loadRefs(log) : undefined;
         const head = await repo.head();
         const headOp = head ? [...await log.history()].reverse().find((o) => o.rootAfter === head) : undefined;
         const headBy = headOp?.by ?? "?";
@@ -9513,7 +10775,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const { listAll: listAll3 } = await Promise.resolve().then(() => (init_tree(), exports_tree));
         const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-        const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const decrypt = (boxStr) => {
           try {
@@ -9561,7 +10823,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             const { readFile: readTree, entryKindAt: kindAt } = await Promise.resolve().then(() => (init_tree(), exports_tree));
             const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
             const { openContent: openContent2, UNREADABLE: UNREADABLE2, KeyRing: KeyRing3 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-            const ring = existsSync18(solDir) ? loadKeyRing() : new KeyRing3;
+            const ring = existsSync20(solDir) ? loadKeyRing() : new KeyRing3;
             const self = loadSelfIdentity2();
             const decrypt = (boxStr) => {
               try {
@@ -9660,7 +10922,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         };
         const live = await log.head() ?? "";
         const refArg = args.find((a) => !a.startsWith("-"));
-        const lrefs = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : null;
+        const lrefs = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : null;
         let tipRoot = live;
         if (refArg) {
           tipRoot = lrefs?.branches[refArg]?.head ?? refArg;
@@ -9713,7 +10975,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const path = args[0] || die("rm needs a path");
         let onDisk = false;
         try {
-          unlinkSync7(join18(cwd, path));
+          unlinkSync7(join19(cwd, path));
           onDisk = true;
         } catch {}
         if (onDisk) {
@@ -9911,15 +11173,167 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           };
           walk(head);
         }
-        const ok = chainOk && missing.length === 0;
+        const headLost = head === undefined && ops.length > 0;
+        const ok = chainOk && missing.length === 0 && !headLost;
+        if (args.includes("--repair")) {
+          if (ok) {
+            console.log("fsck --repair: nothing to repair — the repo is OK");
+            process.exitCode = 0;
+            break;
+          }
+          const { applyRepair: applyRepair2 } = await Promise.resolve().then(() => (init_admin_repair(), exports_admin_repair));
+          const { FileStore: FileStore3 } = await Promise.resolve().then(() => (init_file_store2(), exports_file_store));
+          const fileStore = new FileStore3(solDir, objectsDir());
+          const plan = await applyRepair2({
+            store: fileStore,
+            log,
+            truncate: async (toSeq) => truncateOpLog(toSeq),
+            setHead: async (h) => setOpLogHead(h)
+          }, "sol-doctor");
+          console.log(`fsck --repair: ${plan.reason}`);
+          if (plan.kind === "noop")
+            console.log("  (already healthy — nothing changed)");
+          else if (plan.kind === "unfixable") {
+            console.log("  status: UNFIXABLE — local repair cannot recover this; run `sol recover --from-remote <url> <repo>` to rehydrate");
+            process.exitCode = 1;
+            break;
+          } else {
+            console.log(`  ${plan.note}`);
+            console.log("  status: repaired — run `sol status` (or `sol fsck`) to verify");
+          }
+          process.exitCode = 0;
+          break;
+        }
         console.log(`fsck: ${ok ? "OK" : "PROBLEMS FOUND"}`);
         console.log(`  op-log: ${ops.length} op(s), chain ${chainOk ? "valid + contiguous" : "BROKEN — " + chainErr}`);
-        console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
+        if (headLost)
+          console.log(`  head:   LOST (${ops.length} op(s) but no head pointer) — run \`sol fsck --repair\``);
+        else
+          console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
         for (const mh of missing)
           console.log("    missing " + mh);
+        if (!ok)
+          console.log("  -> `sol doctor` for a full diagnosis, `sol fsck --repair` to recover");
         process.exitCode = ok ? 0 : 1;
         break;
       }
+      case "doctor": {
+        const { runDoctor: runDoctor2, renderDoctorIntegrity: renderDoctorIntegrity2 } = await Promise.resolve().then(() => (init_admin(), exports_admin));
+        const { log } = open();
+        const store2 = loadStore();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("doctor is read-only"), has: async (h) => store2.has(h) };
+        const report = await runDoctor2(asyncStore, log);
+        console.log("sol doctor");
+        for (const l of renderDoctorIntegrity2(report))
+          console.log(l);
+        const envTok = process.env.SOL_TOKEN;
+        if (envTok) {
+          const id = identityFromToken(envTok);
+          console.log(`  auth: SOL_TOKEN set${id?.handle ? ` (@${id.handle})` : id?.email ? ` (${id.email})` : ""}`);
+        } else if (existsSync20(CRED_PATH)) {
+          try {
+            const creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
+            const c = creds.accessToken ? tokenClaims(creds.accessToken) : {};
+            const exp = typeof c.exp === "number" ? new Date(c.exp * 1000).toISOString().slice(0, 10) : "?";
+            const stale = typeof c.exp === "number" && c.exp * 1000 <= Date.now();
+            console.log(`  auth: logged in${c.handle ? ` as @${c.handle}` : ""}${stale ? " (EXPIRED — run `sol auth login`)" : ` (expires ${exp})`}`);
+          } catch {
+            console.log("  auth: stored credentials unreadable — run `sol auth login`");
+          }
+        } else {
+          console.log("  auth: not logged in — `sol auth login` (or set SOL_TOKEN) for remote commands");
+        }
+        const objDir = join19(solDir, "objects");
+        const opsFile = join19(solDir, "ops.jsonl");
+        console.log(`  files: .sol/objects/ ${writableTag(objDir)}, .sol/ops.jsonl ${existsSync20(opsFile) ? writableTag(opsFile) : "(none yet)"}`);
+        const keyringPath = join19(homedir2(), ".sol", "keyring.json");
+        console.log(`  sealed: ${existsSync20(keyringPath) ? "keyring found, ready" : "no keyring (only needed for sealed paths)"}`);
+        console.log(`status: ${report.ok ? "OK" : "PROBLEMS FOUND"}`);
+        if (!report.ok)
+          console.log("  -> `sol fsck --repair` to recover the op-log/head; `sol recover` for cloud/backup rehydrate");
+        process.exitCode = report.ok ? 0 : 1;
+        break;
+      }
+      case "reflog": {
+        const { renderReflog: renderReflog2 } = await Promise.resolve().then(() => exports_admin_reflog);
+        const { log } = open();
+        const ops = await log.history();
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        const branchFilter = args[0] && !args[0].startsWith("--") ? args[0] : undefined;
+        const by = flag2("--by");
+        const sinceStr = flag2("--since");
+        const since = sinceStr ? Date.parse(sinceStr) : undefined;
+        if (sinceStr && Number.isNaN(since))
+          die(`--since: not a date: ${sinceStr} (try YYYY-MM-DD)`);
+        const lines2 = renderReflog2(ops, { branchFilter, actor: by, since });
+        if (!lines2.length)
+          console.log("(no matching ops)");
+        for (const l of lines2)
+          console.log(l);
+        break;
+      }
+      case "recover": {
+        const { RECOVER_HELP: RECOVER_HELP2, listAllRoots: listAllRoots2, restoreFileFromHistory: restoreFileFromHistory2, dumpLog: dumpLog2 } = await Promise.resolve().then(() => (init_admin_recover(), exports_admin_recover));
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        if (!args.length || args[0] === "--help") {
+          console.log(RECOVER_HELP2);
+          break;
+        }
+        if (args.includes("--from-remote")) {
+          const url = args[args.indexOf("--from-remote") + 1];
+          const repoName = args[args.indexOf("--from-remote") + 2];
+          if (!url || !repoName)
+            die("usage: sol recover --from-remote <url> <repo>");
+          console.log(`to rehydrate from the cloud, clone the remote into a fresh dir:
+  sol clone ${url} ${repoName}
+then copy your uncommitted working files in. (a destructive in-place rehydrate is intentionally manual.)`);
+          break;
+        }
+        const { log } = open();
+        const store2 = loadStore();
+        const ops = await log.history();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("recover is read-only"), has: async (h) => store2.has(h) };
+        if (args.includes("--list-all-roots")) {
+          const roots = await listAllRoots2(ops, async (h) => store2.has(h));
+          for (const r of roots)
+            console.log(`  ${r.root.slice(0, 16)}  seq ${r.seq}  ${r.resolvable ? "resolvable" : "MISSING"}${r.message ? `  ${r.message}` : ""}`);
+          if (!roots.length)
+            console.log("  (no roots — empty repo)");
+          break;
+        }
+        if (args.includes("--file")) {
+          const path = flag2("--file") || die("usage: sol recover --file <path> [--from <seq|hash>]");
+          const fromStr = flag2("--from");
+          const from = fromStr ? /^\d+$/.test(fromStr) ? Number(fromStr) : fromStr : undefined;
+          const rec = await restoreFileFromHistory2(asyncStore, ops, path, from);
+          if (!rec.found)
+            die(rec.reason);
+          if ("sealed" in rec) {
+            console.log(`${path} is sealed at seq ${rec.fromSeq} — recovered the opaque box (open it with your key):`);
+            console.log(rec.box);
+          } else {
+            const out = rec.encoding === "base64" ? Buffer.from(rec.content, "base64") : rec.content;
+            writeFileSync17(join19(cwd, path), out);
+            console.log(`restored ${path} from seq ${rec.fromSeq} (root ${rec.fromRoot.slice(0, 16)}) -> wrote to disk; \`sol add ${path}\` to re-track`);
+          }
+          break;
+        }
+        if (args.includes("--dump-log")) {
+          const i = args.indexOf("--dump-log");
+          const fromSeq = args[i + 1] && /^\d+$/.test(args[i + 1]) ? Number(args[i + 1]) : undefined;
+          const toSeq = args[i + 2] && /^\d+$/.test(args[i + 2]) ? Number(args[i + 2]) : undefined;
+          console.log(dumpLog2(ops, fromSeq, toSeq));
+          break;
+        }
+        console.log(RECOVER_HELP2);
+        break;
+      }
       case "gc": {
         const { log } = open();
         const store2 = loadStore();
@@ -9941,16 +11355,16 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           if (op.prov)
             walk(op.prov);
         }
-        const objDir = join18(solDir, "objects");
+        const objDir = join19(solDir, "objects");
         let removed = 0;
         for (const name of readdirSync9(objDir)) {
           if (name.endsWith(".tmp") || !reachable.has(name)) {
-            unlinkSync7(join18(objDir, name));
+            unlinkSync7(join19(objDir, name));
             removed++;
           }
         }
         console.log(`gc: kept ${reachable.size} object(s), removed ${removed} unreachable`);
-        if (existsSync18(join18(solDir, "env", "seal"))) {
+        if (existsSync20(join19(solDir, "env", "seal"))) {
           const { gcStaleStanzas: gcStaleStanzas2 } = await Promise.resolve().then(() => (init_secret(), exports_secret));
           const st = gcStaleStanzas2(solDir);
           if (st.removed)
@@ -9965,8 +11379,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log(p);
           break;
         }
-        const f = join18(cwd, ".solignore");
-        const lead = existsSync18(f) && !readFileSync18(f, "utf8").endsWith(`
+        const f = join19(cwd, ".solignore");
+        const lead = existsSync20(f) && !readFileSync20(f, "utf8").endsWith(`
 `) ? `
 ` : "";
         appendFileSync3(f, lead + pat + `
@@ -9977,7 +11391,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       case "hide": {
         const { repo } = open();
         const wantJson = args.includes("--json");
-        const cfg = resolveRemote(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
+        const cfg = resolveRemote2(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
         const token = process.env.SOL_TOKEN || authExpired();
         const sub = args[0];
         const flag2 = (name) => {
@@ -10082,12 +11496,12 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           let removed = 0;
           {
             const res = await scrubHistory2(solDir, ops, targets);
-            writeFileSync16(join18(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
+            writeFileSync17(join19(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
 `) + (res.ops.length ? `
 ` : ""));
-            writeFileSync16(join18(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
-            if (existsSync18(refsPath())) {
-              const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+            writeFileSync17(join19(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
+            if (existsSync20(refsPath())) {
+              const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
               for (const b of Object.values(refs.branches)) {
                 if (b.head && res.rootMap.has(b.head))
                   b.head = res.rootMap.get(b.head);
@@ -10110,7 +11524,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           break;
         }
         if (reapply) {
-          const cfg = resolveRemote(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote2(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired();
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -10177,7 +11591,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { parseRecipient: parseRecipient3, resolveRecipient: resolveRecipient3, recordAudience: recordAudience3 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
           const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
           const explicit = positional.slice(1);
           const recipientPubKeys2 = {};
           const audienceAccounts2 = [];
@@ -10185,7 +11599,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const crossAccount2 = [];
           let policyApplied2 = false;
           if (!explicit.length) {
-            const cfg = resolveRemote(solDir);
+            const cfg = resolveRemote2(solDir);
             const token = process.env.SOL_TOKEN;
             if (cfg && token) {
               const resolved = await recipientsForPath(cfg, token, dir).catch(() => {
@@ -10245,15 +11659,15 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (content === SEALED && !args.includes("--hide-names"))
           die("already sealed: " + path);
         if (content === undefined) {
-          const abs = join18(cwd, path);
-          if (!existsSync18(abs))
+          const abs = join19(cwd, path);
+          if (!existsSync20(abs))
             die("no such file: " + path);
-          content = readFileSync18(abs, "utf8");
+          content = readFileSync20(abs, "utf8");
         }
         const ring = loadKeyRing();
         const { SealedClient: SealedClient2 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
         const { parseRecipient: parseRecipient2, resolveRecipient: resolveRecipient2, recordAudience: recordAudience2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const recipientPubKeys = {};
         const audienceAccounts = [];
         const localRecipients = new Set([actor]);
@@ -10266,7 +11680,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let hideNamesFromPolicy = false;
         let hideExistenceFromPolicy = false;
         if (!rawRecipients.length) {
-          const cfg = resolveRemote(solDir);
+          const cfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -10295,7 +11709,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           }
         }
         if (wantEscrow && !escrowSlots.length) {
-          const cfg = resolveRemote(solDir);
+          const cfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { recipientsForAudience: recipientsForAudience2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
@@ -10501,7 +11915,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { repo } = open();
         const wantJson = args.includes("--json");
         if (args.includes("--check")) {
-          const cfg = resolveRemote(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote2(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired();
           const { policyCheck: policyCheck2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
           const states = [];
@@ -10558,7 +11972,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
         const { parseStruct: parseStruct2 } = await Promise.resolve().then(() => (init_struct(), exports_struct));
         const audiences = loadAudiences2(solDir);
-        const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const levelOf = (boxStr) => {
           try {
@@ -10753,7 +12167,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const result = merge2({ store: store2 }, other.base, ours, other.head);
         if (result.conflicts.length) {
           materializeTree(store2, result.head);
-          writeFileSync16(join18(solDir, "MERGE_HEAD"), other.head);
+          writeFileSync17(join19(solDir, "MERGE_HEAD"), other.head);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`merge ${name} -> ${result.conflicts.length} conflict(s), left in your working tree (uncommitted):`);
           for (const c of result.conflicts)
@@ -10854,8 +12268,19 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "remote": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
+        if (args[0] === "verify") {
+          const { remoteVerify: remoteVerify2, renderRemoteVerify: renderRemoteVerify2 } = await Promise.resolve().then(() => (init_admin_remote_verify(), exports_admin_remote_verify));
+          const cfg2 = resolveRemote2(solDir) || die("no remote — `sol remote <url> <repo>` (or `sol clone`) first");
+          const token = process.env.SOL_TOKEN || await loadStoredToken() || authExpired();
+          const result = await remoteVerify2((url, init) => fetch(url, init), cfg2.url, cfg2.repo, token);
+          const { lines: lines2, exitCode } = renderRemoteVerify2(result);
+          for (const l of lines2)
+            console.log(l);
+          process.exitCode = exitCode;
+          break;
+        }
         if (args[0]) {
           const repoName = args[1] || die("usage: sol remote <url> <repo>");
           saveRemote(solDir, { url: args[0], repo: repoName });
@@ -10900,15 +12325,15 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           }
           if (!tokens)
             die("timed out waiting for approval");
-          mkdirSync11(dirname4(CRED_PATH), { recursive: true });
-          writeFileSync16(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
+          mkdirSync12(dirname5(CRED_PATH), { recursive: true });
+          writeFileSync17(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
           const c = tokenClaims(tokens.accessToken);
           console.log(`
   Logged in as ${c.handle ? `@${c.handle}` : c.email || "user"}.`);
           if (!c.handle)
             console.log("  (no handle yet — set one in the web app to get your <handle>/<repo> namespace)");
         } else if (sub === "logout") {
-          if (existsSync18(CRED_PATH))
+          if (existsSync20(CRED_PATH))
             unlinkSync7(CRED_PATH);
           console.log("logged out");
         } else if (sub === "status" || !sub) {
@@ -10917,11 +12342,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log(`authenticated via SOL_TOKEN (env)${c2.handle ? ` as @${c2.handle}` : ""}`);
             break;
           }
-          if (!existsSync18(CRED_PATH)) {
+          if (!existsSync20(CRED_PATH)) {
             console.log("not logged in — run `sol auth login` (or set SOL_TOKEN)");
             break;
           }
-          const creds = JSON.parse(readFileSync18(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
           const c = tokenClaims(creds.accessToken || "");
           const stale = typeof c.exp === "number" && c.exp * 1000 < Date.now();
           console.log(`logged in as ${c.handle ? `@${c.handle}` : c.email || "user"} via ${creds.webUrl}${stale ? " (token stale — refreshes on next use)" : ""}`);
@@ -10971,9 +12396,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log("heads-up: changing your handle re-namespaces your repos under the new <handle>/<repo>.");
           console.log(`handle set to @${out.handle}`);
         } else if (sub === "pat") {
-          if (!existsSync18(CRED_PATH))
+          if (!existsSync20(CRED_PATH))
             die("run `sol auth login` first");
-          const creds = JSON.parse(readFileSync18(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync20(CRED_PATH, "utf8"));
           const token = await loadStoredToken();
           if (!token || !creds.webUrl)
             die("run `sol auth login` first");
@@ -11031,11 +12456,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const { converge: converge2 } = await Promise.resolve().then(() => (init_converge(), exports_converge));
           const peer = openPeer2(localSrc);
           const peerHead = await peer.log.head();
-          const dest = resolve4(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
-          const ddir = join18(dest, ".sol");
-          if (existsSync18(ddir))
+          const dest = resolve5(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
+          const ddir = join19(dest, ".sol");
+          if (existsSync20(ddir))
             die("already a sol repo: " + dest);
-          mkdirSync11(ddir, { recursive: true });
+          mkdirSync12(ddir, { recursive: true });
           const peerOps = await peer.log.history();
           const res = await converge2({ store: new FileStore2(ddir), log: new FileOpLog2(ddir) }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor });
           const dstore = new Store;
@@ -11045,7 +12470,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const files = (res.head ? listAll2(dstore, res.head) : []).filter((f) => !f.split("/").some(isReservedKey2));
           for (const f of files)
             materializeInto(dstore, res.head, dest, f);
-          writeFileSync16(join18(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
+          writeFileSync17(join19(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
           writeWorkingIndexAt(ddir, dest, files);
           console.log(`cloned local peer ${args[0]} -> ${dest} (${(await peer.log.history()).length} ops, ${files.length} files)`);
           break;
@@ -11053,13 +12478,13 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const [url, rest] = remoteUrlArg(args);
         const repoName = rest[0] || die("usage: sol clone [<url>] <owner>/<repo> [dir]");
         const token = process.env.SOL_TOKEN || die("set SOL_TOKEN to the backend bearer token");
-        const target = resolve4(cwd, rest[1] || repoName.split("/").pop() || repoName);
-        const fdir = join18(target, ".sol");
-        if (existsSync18(fdir))
+        const target = resolve5(cwd, rest[1] || repoName.split("/").pop() || repoName);
+        const fdir = join19(target, ".sol");
+        if (existsSync20(fdir))
           die("already a sol repo: " + target);
         const cfg = { url, repo: repoName };
         const bundle = await remoteExport(cfg, token);
-        mkdirSync11(fdir, { recursive: true });
+        mkdirSync12(fdir, { recursive: true });
         await writeBundle(fdir, bundle, 0);
         saveRemote(fdir, cfg);
         await pullEnvState(fdir, cfg, token);
@@ -11072,8 +12497,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           cloneBranches[name] = { head: h, base: h, remote: h };
         if (!cloneBranches[onBranch])
           cloneBranches[onBranch] = { head: checkoutHead, base: checkoutHead, remote: checkoutHead };
-        writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync16(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
+        writeFileSync17(join19(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync17(join19(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
         const store2 = new Store;
         for (const node of bundle.nodes)
           store2.put(node);
@@ -11094,11 +12519,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         if (!loadRemote(solDir)) {
           const repoName = args.find((a) => !a.startsWith("-"));
           if (repoName) {
-            saveRemote(solDir, { url: DEFAULT_REMOTE_URL, repo: repoName });
-            console.log(`remote set: ${DEFAULT_REMOTE_URL} (repo ${repoName})`);
+            saveRemote(solDir, { url: DEFAULT_REMOTE_URL2, repo: repoName });
+            console.log(`remote set: ${DEFAULT_REMOTE_URL2} (repo ${repoName})`);
           }
         }
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
         {
           const { pendingScrubPaths: pendingScrubPaths2, historyHasCleartext: historyHasCleartext2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
           const ops0 = await log.history();
@@ -11112,7 +12537,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const localRefs = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : undefined;
+        const localRefs = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : undefined;
         const branch = localRefs?.current ?? "main";
         const branchHead = await log.head() ?? "";
         const remoteWasEmpty = rh.seq === 0 && !rh.tip;
@@ -11124,7 +12549,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const forkBase = localRefs?.branches[branch]?.remote;
         const baseOp = forkBase ? ops.find((o) => o.rootAfter === forkBase) : undefined;
         const fromSeq = baseOp ? baseOp.seq : rh.seq;
-        const res = await remotePush(cfg, token, {
+        const res = await remotePushChunked(cfg, token, {
           nodes: allLocalNodes(),
           ops: ops.filter((o) => o.seq > fromSeq),
           branch,
@@ -11135,8 +12560,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const prevHead = await log.head() ?? "";
         await writeBundle(solDir, canon, 0);
         const convergedHead = res.head ?? canon.refs?.branches?.[branch] ?? branchHead;
-        if (existsSync18(refsPath())) {
-          const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+        if (existsSync20(refsPath())) {
+          const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
           if (canon.refs) {
             for (const [name, h] of Object.entries(canon.refs.branches)) {
               refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
@@ -11160,6 +12585,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           console.log(`pushed ${res.applied} op(s) -> remote (branch ${branch} @ ${(convergedHead || "").slice(0, 12)})${mergedNote}${conflictNote}${prod ? `; production=${prod}` : ""}`);
         }
         await pushEnvState(solDir, cfg, token);
+        await surfaceOwner(cfg, token);
         if (wantPublic) {
           const a = await accessSet(cfg, token, { visibility: "public" });
           console.log(`${cfg.repo} is now ${a.visibility}`);
@@ -11200,8 +12626,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const ownMeta = readViewMeta(solDir);
           const base2 = peerMeta?.startHead ?? ownMeta?.startHead;
           const res = await converge2({ store: new FileStore2(solDir, objectsDir()), log }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor, ...base2 ? { base: base2 } : {} });
-          if (existsSync18(refsPath())) {
-            const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (existsSync20(refsPath())) {
+            const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
             if (refs.branches[refs.current])
               refs.branches[refs.current].head = res.head;
             saveRefs(refs);
@@ -11224,7 +12650,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           }
           break;
         }
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         await surfaceEnvDivergence(solDir, cfg, token);
         await pullEnvState(solDir, cfg, token);
@@ -11232,11 +12658,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const curBranch = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")).current : bundle.refs?.production || "main";
+        const curBranch = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")).current : bundle.refs?.production || "main";
         const remoteCurHead = bundle.refs?.branches?.[curBranch] ?? bundle.head ?? "";
         if (bundle.seq === localSeq && bundle.tip === localTip) {
-          if (bundle.refs && existsSync18(refsPath())) {
-            const lr = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (bundle.refs && existsSync20(refsPath())) {
+            const lr = JSON.parse(readFileSync20(refsPath(), "utf8"));
             const before = lr.branches[lr.current]?.head;
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
@@ -11260,9 +12686,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           break;
         }
         const syncRefHead = (h) => {
-          if (!existsSync18(refsPath()))
+          if (!existsSync20(refsPath()))
             return;
-          const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
           if (refs.branches[refs.current])
             refs.branches[refs.current].head = h;
           saveRefs(refs);
@@ -11280,8 +12706,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           syncRefHead(remoteCurHead);
           setOpLogHead(remoteCurHead);
           materializeTree(loadStore(), remoteCurHead);
-          if (bundle.refs && existsSync18(refsPath())) {
-            const lr = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (bundle.refs && existsSync20(refsPath())) {
+            const lr = JSON.parse(readFileSync20(refsPath(), "utf8"));
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
             saveRefs(lr);
@@ -11329,9 +12755,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           for (const c of result.conflicts) {
             const blob = fileAt2(store2, result.head, c.path);
             if (blob)
-              writeFileSync16(join18(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+              writeFileSync17(join19(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
           }
-          writeFileSync16(join18(solDir, "MERGE_HEAD"), remoteHead2);
+          writeFileSync17(join19(solDir, "MERGE_HEAD"), remoteHead2);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`pulled + merged WITH ${result.conflicts.length} conflict(s), left uncommitted in your working tree:`);
           for (const c of result.conflicts)
@@ -11345,12 +12771,36 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         }
         break;
       }
+      case "sync": {
+        if (!existsSync20(solDir))
+          die("not a sol repo — run `sol init` first");
+        if (!args.includes("--watch"))
+          die("usage: sol sync --watch [--poll-interval <ms>] [--no-push-immediately] [--dry-run]");
+        resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` first");
+        const token = process.env.SOL_TOKEN || await loadStoredToken() || authExpired();
+        const intFlag = (name, def) => {
+          const i = args.indexOf(name);
+          if (i < 0 || i + 1 >= args.length)
+            return def;
+          const n = Number(args[i + 1]);
+          return Number.isFinite(n) && n > 0 ? n : def;
+        };
+        const { runSyncWatch: runSyncWatch2 } = await Promise.resolve().then(() => (init_sync_watch(), exports_sync_watch));
+        await runSyncWatch2({
+          repoDir: cwd,
+          token,
+          pollInterval: intFlag("--poll-interval", 5000),
+          pushImmediate: !args.includes("--no-push-immediately"),
+          dryRun: args.includes("--dry-run")
+        });
+        break;
+      }
       case "promote": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
-        const cur = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")).current : "main";
+        const cur = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")).current : "main";
         const branch = args[0] || cur;
         const refs = await remotePromote(cfg, token, branch);
         console.log(`promoted '${branch}' -> production '${refs.production}' now at ${(refs.branches[refs.production] ?? "").slice(0, 12)}`);
@@ -11361,9 +12811,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const parent = frest[0] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const newRepo = frest[1] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const token = process.env.SOL_TOKEN || authExpired();
-        const target = resolve4(cwd, frest[2] || newRepo);
-        const fdir = join18(target, ".sol");
-        if (existsSync18(fdir))
+        const target = resolve5(cwd, frest[2] || newRepo);
+        const fdir = join19(target, ".sol");
+        if (existsSync20(fdir))
           die("already a sol repo: " + target);
         const parentCfg = { url, repo: parent };
         const newCfg = { url, repo: newRepo, forkParent: parent };
@@ -11379,7 +12829,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         }
         await forkMeta(newCfg, token, parent);
         const canon = await remoteExport(newCfg, token);
-        mkdirSync11(fdir, { recursive: true });
+        mkdirSync12(fdir, { recursive: true });
         await writeBundle(fdir, canon, 0);
         const srvRefs = canon.refs ?? { branches: { main: canon.head ?? "" }, production: "main" };
         const checkout = canon.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? canon.head };
@@ -11388,8 +12838,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const cloneBranches = {};
         for (const [name, h] of Object.entries(srvRefs.branches))
           cloneBranches[name] = { head: h, base: h, remote: h };
-        writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync16(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
+        writeFileSync17(join19(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync17(join19(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
         saveRemote(fdir, newCfg);
         const store2 = new Store;
         for (const node of canon.nodes)
@@ -11407,7 +12857,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
       }
       case "access": {
         const token = process.env.SOL_TOKEN || authExpired();
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const sub = args[0];
         if (!sub || sub === "show") {
           const a = await accessGet(cfg, token);
@@ -11459,7 +12909,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "forks": {
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         const { forks } = await forksList(cfg, token);
         if (!forks.length)
@@ -11472,11 +12922,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "mr": {
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         const { mrSummary: mrSummary2 } = await Promise.resolve().then(() => exports_mr);
         const sub = args[0];
-        const localRefs = () => existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
+        const localRefs = () => existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
         const flag2 = (name) => {
           const i = args.indexOf(name);
           return i >= 0 ? args[i + 1] : undefined;
@@ -11654,7 +13104,7 @@ ${mrSummary2(pr)}`);
           die("usage: sol run [--keep <path>] [--isolate] <command...>");
         const { capture: capture3, hydrate: hydrate3, isolateCommand: isolateCommand2 } = await Promise.resolve().then(() => (init_runtime(), exports_runtime));
         const head = await repo.head();
-        const dir = mkdtempSync(join18(tmpdir(), "sol-run-"));
+        const dir = mkdtempSync(join19(tmpdir(), "sol-run-"));
         try {
           const hn = hydrate3(loadStore(), head, dir);
           console.log(`hydrated ${hn} file(s) -> sandbox${isolate ? " (isolated: no network, writes confined to the sandbox)" : ""}`);
@@ -11674,8 +13124,8 @@ ${mrSummary2(pr)}`);
           const { written, deleted } = await capture3(repo, dir, keep);
           if (written.length || deleted.length) {
             await appendCommit(log, await repo.head(), `run: ${command.join(" ")}`, head);
-            if (existsSync18(refsPath())) {
-              const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+            if (existsSync20(refsPath())) {
+              const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
               if (refs.branches[refs.current]) {
                 refs.branches[refs.current].head = await repo.head();
                 saveRefs(refs);
@@ -11687,7 +13137,7 @@ ${mrSummary2(pr)}`);
               materialize(synced, nh, f);
             for (const f of deleted) {
               try {
-                unlinkSync7(join18(cwd, f));
+                unlinkSync7(join19(cwd, f));
               } catch {}
             }
             console.log(`captured ${written.length} written, ${deleted.length} deleted file(s):`);
@@ -11699,7 +13149,7 @@ ${mrSummary2(pr)}`);
             console.log("no files captured (the run produced no tracked changes)");
           }
         } finally {
-          rmSync2(dir, { recursive: true, force: true });
+          rmSync3(dir, { recursive: true, force: true });
         }
         break;
       }
@@ -11707,12 +13157,12 @@ ${mrSummary2(pr)}`);
         const [{ exportHistoryToGit: exportHistoryToGit2, importGitRepo: importGitRepo2 }, { hydrate: hydrate3 }] = await Promise.all([Promise.resolve().then(() => (init_git_adapter(), exports_git_adapter)), Promise.resolve().then(() => (init_runtime(), exports_runtime))]);
         const sub = args[0];
         if (sub === "import") {
-          const gitPath = resolve4(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
-          const target = resolve4(cwd, args[2] || basename(gitPath));
-          const fdir = join18(target, ".sol");
-          if (existsSync18(fdir))
+          const gitPath = resolve5(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
+          const target = resolve5(cwd, args[2] || basename2(gitPath));
+          const fdir = join19(target, ".sol");
+          if (existsSync20(fdir))
             die("already a sol repo: " + target);
-          mkdirSync11(fdir, { recursive: true });
+          mkdirSync12(fdir, { recursive: true });
           const { commits, branches, head, current } = await importGitRepo2(gitPath, fdir);
           const refsBranches = {};
           for (const b of branches)
@@ -11720,20 +13170,20 @@ ${mrSummary2(pr)}`);
           if (!refsBranches[current])
             refsBranches[current] = { head, base: head };
           refsBranches[current].head = head;
-          writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
+          writeFileSync17(join19(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
           const store2 = new Store;
-          for (const name of readdirSync9(join18(fdir, "objects"))) {
+          for (const name of readdirSync9(join19(fdir, "objects"))) {
             if (name.endsWith(".tmp"))
               continue;
             try {
-              store2.put(decodeObject2(readFileSync18(join18(fdir, "objects", name))));
+              store2.put(decodeObject2(readFileSync20(join19(fdir, "objects", name))));
             } catch {}
           }
           const onDisk = hydrate3(store2, head, target);
-          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename(gitPath)} (${onDisk} files; on branch ${current})`);
+          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename2(gitPath)} (${onDisk} files; on branch ${current})`);
         } else if (sub === "export") {
           const { log } = open();
-          const gitPath = resolve4(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
+          const gitPath = resolve5(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
           const store2 = loadStore();
           const head = await log.head() ?? "";
           if (!head || !listAll2(store2, head).length) {
@@ -11752,15 +13202,111 @@ ${mrSummary2(pr)}`);
         }
         break;
       }
+      case "agent": {
+        if (!existsSync20(solDir))
+          die("not a sol repo — run `sol init` first");
+        const parentSol = parentSolDir(solDir) ?? solDir;
+        const { createSession: createSession2, stopSession: stopSession2, sessions: sessions2, pruneSession: pruneSession2 } = await Promise.resolve().then(() => (init_agent_sessions(), exports_agent_sessions));
+        const sub = args[0];
+        const json = args.includes("--json");
+        const flagVal = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        switch (sub) {
+          case "start": {
+            const name = args.slice(1).find((a) => !a.startsWith("-")) || die('usage: sol agent start <name> [dir] [--actor <name>] [--check "<cmd>"]');
+            const positionals2 = args.slice(1).filter((a) => !a.startsWith("-"));
+            const sessionActor = flagVal("--actor") || actor;
+            const metaRaw = flagVal("--meta");
+            let metadata;
+            if (metaRaw) {
+              try {
+                metadata = JSON.parse(metaRaw);
+              } catch {
+                die("--meta must be valid JSON");
+              }
+            }
+            const rec = createSession2({
+              parentSol,
+              name,
+              actor: sessionActor,
+              dir: positionals2[1] ? resolve5(procCwd, positionals2[1]) : undefined,
+              check: flagVal("--check"),
+              metadata
+            });
+            if (json) {
+              console.log(JSON.stringify(rec));
+              break;
+            }
+            console.log(`started agent session '${rec.name}'  (id ${rec.sessionId})`);
+            console.log(`  view     ${rec.viewDir}  (branch ${rec.branch} @ ${(rec.startHead || "empty").slice(0, 12)})`);
+            console.log(`  actor    ${rec.actor}`);
+            console.log(`  identity ${rec.fingerprint}`);
+            console.log(`  -> wire the agent:  cd ${rec.viewDir} && export SOL_ACTOR=${rec.actor} SOL_SIGNING_KEY=$(cat ${rec.signingKeyPath})`);
+            console.log(`     then edit + \`sol commit -m "..." <files>\`; converge with \`sol pull ${rec.viewDir}\` from the parent.`);
+            console.log(`  stop/clean:  \`sol agent stop ${rec.sessionId}\`  |  \`sol agent cleanup ${rec.sessionId} --delete\``);
+            break;
+          }
+          case "stop": {
+            const id = args.slice(1).find((a) => !a.startsWith("-")) || die("usage: sol agent stop <sessionId>");
+            const ok = stopSession2(parentSol, id);
+            if (json)
+              console.log(JSON.stringify({ stopped: ok, sessionId: id }));
+            else
+              console.log(ok ? `stopped session ${id} (the view + key remain — \`sol agent cleanup\` to remove)` : `no such session: ${id}`);
+            if (!ok)
+              process.exitCode = 1;
+            break;
+          }
+          case "status":
+          case undefined: {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const all = await sessions2(parentSol);
+            const list = id ? all.filter((s) => s.sessionId === id || s.name === id) : all;
+            if (json) {
+              console.log(JSON.stringify({ repo: parentSol, sessions: list }));
+              break;
+            }
+            if (!list.length) {
+              console.log(id ? `no such session: ${id}` : "no agent sessions — start one with `sol agent start <name>`");
+              break;
+            }
+            console.log(`agent sessions of ${parentSol}:`);
+            for (const s of list) {
+              console.log(`  ${s.name.padEnd(16)} ${s.sessionId.padEnd(28)} ${(s.head || s.startHead || "empty").slice(0, 12)}  ${s.actor.padEnd(12)} ${s.fingerprint}  [${s.state}]`);
+              console.log(`      ${s.viewDir}`);
+            }
+            console.log("  stop: `sol agent stop <id>` | cleanup: `sol agent cleanup <id> [--delete]` (or bare `cleanup` to prune stale)");
+            break;
+          }
+          case "cleanup": {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const removed = pruneSession2(parentSol, id, args.includes("--delete"));
+            if (json)
+              console.log(JSON.stringify({ removed }));
+            else
+              console.log(removed.length ? `cleaned ${removed.length} session(s): ${removed.join(", ")}` : id ? `no such session: ${id}` : "no stale sessions to clean");
+            break;
+          }
+          default:
+            die(`unknown: sol agent ${sub}
+  sol agent start <name> [dir] [--actor N] [--check "<cmd>"]
+  sol agent status [<id>]
+  sol agent stop <id>
+  sol agent cleanup [<id>] [--delete]`);
+        }
+        break;
+      }
       case "view": {
         const { log } = open();
         if (readViewMeta(solDir))
           die("already inside a view — create views from the parent repo (its `.sol` owns the shared store + op-log).");
         const name = args.find((a) => !a.startsWith("-")) || die("usage: sol view <name> [dir]");
         const rest = args.filter((a) => !a.startsWith("-"));
-        const defaultDir = join18(dirname4(cwd), `${basename(cwd)}-${name}`);
-        const viewDir = rest[1] ? resolve4(procCwd, rest[1]) : defaultDir;
-        if (existsSync18(join18(viewDir, ".sol")))
+        const defaultDir = join19(dirname5(cwd), `${basename2(cwd)}-${name}`);
+        const viewDir = rest[1] ? resolve5(procCwd, rest[1]) : defaultDir;
+        if (existsSync20(join19(viewDir, ".sol")))
           die("already a sol repo/view: " + viewDir);
         const branch = `view/${name}`;
         const startHead = await log.head() ?? emptyRoot2(loadStore());
@@ -11774,7 +13320,7 @@ ${mrSummary2(pr)}`);
         break;
       }
       case "views": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
         const parentSol = parentSolDir(solDir) ?? solDir;
         const { pruneViews: pruneViews2, viewStatuses: viewStatuses2, sharedObjectCount: sharedObjectCount2 } = await Promise.resolve().then(() => (init_views(), exports_views));
@@ -11870,12 +13416,12 @@ ${mrSummary2(pr)}`);
           await startSecretMcp2({ solDir, http });
           break;
         }
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const { runEnv: runEnv2, runSecret: runSecret2, resolveReference: resolveReference2 } = await Promise.resolve().then(() => (init_secret2(), exports_secret2));
         const { loadSelfIdentity: loadSelfIdentity2, loadManageIdentity: loadManageIdentity2, fetchKey: fetchKey2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { loadIdentity: loadIdentity2 } = await Promise.resolve().then(() => (init_identity_store(), exports_identity_store));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const selfPub = (account) => {
           const id = loadIdentity2();
           return id && id.accountId === account ? id.x25519Pub : undefined;
@@ -11887,7 +13433,7 @@ ${mrSummary2(pr)}`);
         };
         const dirEdPub = async (account) => (await fetchKey2(dirUrl, account))?.edPub;
         const remoteAnchorVerify = async () => {
-          const rcfg = resolveRemote(solDir);
+          const rcfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN || await loadStoredToken();
           if (!rcfg || !token)
             return;
@@ -11937,6 +13483,11 @@ everyday (examples are copy-safe — use real filenames):
   sol rm old.txt                 delete a file (from the repo and disk)
   sol ignore "*.tmp"             add an ignore pattern (no arg lists the active patterns)
   sol fsck / sol gc            verify integrity / drop unreachable objects
+  sol doctor                     full health check (op-log + objects + auth + files + sealed keyring)
+  sol fsck --repair              recover a corrupt repo (re-point a lost head / truncate to the last verified link)
+  sol recover                    guide through recovery (rehydrate from cloud, list roots, restore a file from history)
+  sol reflog                     the op-log as a ref-move history (head moves, by actor/branch/date)
+  sol remote verify              REMOTE-side health check (the backend's /fsck) with auth/network differentiation
   sol check --set "bun test"     gate convergence on a test command: a merge that line-converges but FAILS
                                  the check is flagged as a SEMANTIC conflict (status state:"SEMANTIC"), not
                                  silently accepted. \`sol check\` runs it on demand. (sol check --help)
@@ -11973,6 +13524,16 @@ clone-free agent views (the worktree killer — N agents, one shared store on di
                                  \`sol pull <view>\` converges losslessly. (sol view --help)
   sol views                      list every view (name, dir, branch, head, author, active/stale) + --prune
 
+agent sessions (one atomic command provisions a working tree, a signing identity, an actor, and the test-gate):
+  sol agent start <name>         create a view + MINT a per-session Ed25519 signing key + wire the actor +
+                                 inherit/set the test-gate, all at once. prints SOL_SIGNING_KEY / SOL_ACTOR to
+                                 export so every op the agent authors is cryptographically attributable.
+                                 (--actor <name>, --check "<cmd>", [dir], --json)
+  sol agent status [<id>]        list sessions (name, id, head, actor, fingerprint, running/stopped/stale)
+  sol agent stop <id>            mark a session stopped (presence signal; view + key remain)
+  sol agent cleanup [<id>]       remove the session record + its key (--delete also removes the view dir;
+                                 bare \`cleanup\` prunes every stale session)
+
 branches & tags:
   sol branch                     list branches (sol branch feature creates one at HEAD)
   sol switch feature             switch to a branch (captures current work first, never loses it)
@@ -11989,6 +13550,7 @@ auth (sign in once; remote commands then use the cached token, no SOL_TOKEN need
 remotes (self-hostable backend; token in SOL_TOKEN or via sol auth login):
   sol clone [<url>] <owner>/<repo> [dir]   clone a remote repo (checks out PRODUCTION); default dir = <repo>
   sol push / sol pull          sync your commits with the remote (push registers your branch's head)
+  sol sync --watch             hands-off bidirectional sync daemon: auto-capture + push edits, converge safe pulls in
   sol push <repo>                one-step share: no remote set? use the hosted Sol + <repo>, then push
   sol push --public <repo>       create + push + make public in one step (new repos are private by default)
   sol promote [branch]         point the remote's production branch at <branch> (default: current)
@@ -12028,10 +13590,15 @@ async function runCli(argv) {
     const msg = e?.message || String(e);
     if (/ -> 401\b/.test(msg) || /\b401 unauthorized\b/i.test(msg))
       authExpired();
+    const { CorruptObjectError: CorruptObjectError2, CorruptRepoError: CorruptRepoError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
+    if (e instanceof CorruptObjectError2 || e instanceof CorruptRepoError2) {
+      const { friendlyError: friendlyError2 } = await Promise.resolve().then(() => (init_errors_friendly(), exports_errors_friendly));
+      die(friendlyError2(e));
+    }
     die(msg);
   }
 }
-var CRED_PATH, DEFAULT_REMOTE_URL, ATTEST_KEY, remoteUrlArg = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL, a], cfgDir = () => parentSolDir(solDir) ?? solDir;
+var CRED_PATH, DEFAULT_REMOTE_URL2, ATTEST_KEY, remoteUrlArg = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL2, a];
 var init_dispatch = __esm(() => {
   init_chain();
   init_diff();
@@ -12043,8 +13610,8 @@ var init_dispatch = __esm(() => {
   init_remote();
   init_lib();
   init_test_gate();
-  CRED_PATH = join18(homedir2(), ".sol", "credentials");
-  DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+  CRED_PATH = join19(homedir2(), ".sol", "credentials");
+  DEFAULT_REMOTE_URL2 = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
   ATTEST_KEY = process.env.SOL_ATTEST_KEY || undefined;
 });
 
@@ -12224,10 +13791,16 @@ var init_mcp_vcs_tools = __esm(() => {
 // src/bin/sol-mcp.ts
 var exports_sol_mcp = {};
 __export(exports_sol_mcp, {
+  toolCallFor: () => toolCallFor,
   startWorkspaceMcp: () => startWorkspaceMcp
 });
-import { mkdirSync as mkdirSync12 } from "fs";
-import { dirname as dirname5, join as join19 } from "path";
+import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
+import { mkdirSync as mkdirSync13 } from "fs";
+import { dirname as dirname6, join as join20 } from "path";
+function toolCallFor(name, args) {
+  const argsHash = "h_" + createHash7("sha256").update(JSON.stringify(args ?? {})).digest("hex").slice(0, 16);
+  return { name, argsHash, invocationId: randomUUID3() };
+}
 async function handle(ws, name, a) {
   switch (name) {
     case "sol_write":
@@ -12268,8 +13841,8 @@ async function handle(ws, name, a) {
 async function buildWorkspaceServer(solDir2) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
-  mkdirSync12(solDir2, { recursive: true });
-  const repoRoot2 = dirname5(solDir2);
+  mkdirSync13(solDir2, { recursive: true });
+  const repoRoot2 = dirname6(solDir2);
   if (process.cwd() !== repoRoot2) {
     try {
       process.chdir(repoRoot2);
@@ -12283,16 +13856,20 @@ async function buildWorkspaceServer(solDir2) {
       const r = await callVcsTool(req.params.name, req.params.arguments ?? {});
       return { content: [{ type: "text", text: r.text }], isError: r.isError };
     }
+    if (AUTHORING_MUTATORS.has(req.params.name)) {
+      ws.setToolCall(toolCallFor(req.params.name, req.params.arguments ?? {}));
+    }
     try {
       return await handle(ws, req.params.name, req.params.arguments ?? {});
     } catch (e) {
+      ws.setToolCall(undefined);
       return { content: [{ type: "text", text: "sol error: " + (e?.message ?? e) }], isError: true };
     }
   });
   return server;
 }
 async function startWorkspaceMcp(opts = {}) {
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join19(process.cwd(), ".sol");
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join20(process.cwd(), ".sol");
   if (opts.http) {
     const { serveMcpHttp: serveMcpHttp3 } = await Promise.resolve().then(() => (init_mcp_http(), exports_mcp_http));
     await serveMcpHttp3(() => buildWorkspaceServer(solDir2), opts.http);
@@ -12302,12 +13879,13 @@ async function startWorkspaceMcp(opts = {}) {
   const server = await buildWorkspaceServer(solDir2);
   await server.connect(new StdioServerTransport);
 }
-var authoringTools, VCS_TOOL_NAMES, tools, text = (s) => ({ content: [{ type: "text", text: s }] });
+var AUTHORING_MUTATORS, authoringTools, VCS_TOOL_NAMES, tools, text = (s) => ({ content: [{ type: "text", text: s }] });
 var init_sol_mcp = __esm(() => {
   init_file_store();
   init_workspace();
   init_mcp_http();
   init_mcp_vcs_tools();
+  AUTHORING_MUTATORS = new Set(["sol_write", "sol_edit", "sol_move", "sol_rm", "sol_commit", "sol_checkpoint"]);
   authoringTools = [
     { name: "sol_write", description: "Create or overwrite a text file in the sol workspace. Authoring goes here \u2014 not to a disk.", inputSchema: { type: "object", properties: { path: { type: "string" }, content: { type: "string" } }, required: ["path", "content"] } },
     { name: "sol_read", description: "Read a text file from the sol workspace.", inputSchema: { type: "object", properties: { path: { type: "string" } }, required: ["path"] } },
@@ -12332,5 +13910,6 @@ var init_sol_mcp = __esm(() => {
 init_sol_mcp();
 
 export {
+  toolCallFor,
   startWorkspaceMcp
 };