midsummer-sol 0.2.2 → 0.3.1

package/sol.js

@@ -60,6 +60,11 @@ function verifyAtt(key, op, sig = op.att) {
 var init_attest = () => {};
 
 // src/errors.ts
+var exports_errors = {};
+__export(exports_errors, {
+  CorruptRepoError: () => CorruptRepoError,
+  CorruptObjectError: () => CorruptObjectError
+});
 var CorruptRepoError, CorruptObjectError;
 var init_errors = __esm(() => {
   CorruptRepoError = class CorruptRepoError extends Error {
@@ -1111,16 +1116,74 @@ var init_sign = __esm(() => {
 });
 
 // src/prov.ts
+function encodeTool(p) {
+  const surface = p.tool?.trim() || "";
+  if (!p.toolCall && !p.testRunId)
+    return surface || undefined;
+  const segs = [surface, TC_TAG];
+  const tc = p.toolCall;
+  segs.push(`name=${tc?.name ?? ""}`, `args=${tc?.argsHash ?? ""}`, `inv=${tc?.invocationId ?? ""}`, `test=${p.testRunId ?? ""}`);
+  return segs.join(TC_SEP);
+}
+function decodeTool(tool) {
+  if (!tool)
+    return {};
+  const parts = tool.split(TC_SEP);
+  if (parts.length < 2 || parts[1] !== TC_TAG)
+    return { tool: tool || undefined };
+  const surface = parts[0] || undefined;
+  const kv = new Map;
+  for (const seg of parts.slice(2)) {
+    const eq = seg.indexOf("=");
+    if (eq >= 0)
+      kv.set(seg.slice(0, eq), seg.slice(eq + 1));
+  }
+  const name = kv.get("name") || "";
+  const argsHash = kv.get("args") || "";
+  const invocationId = kv.get("inv") || "";
+  const testRunId = kv.get("test") || undefined;
+  const out = { tool: surface };
+  if (name || argsHash || invocationId)
+    out.toolCall = { name, argsHash, invocationId };
+  if (testRunId)
+    out.testRunId = testRunId;
+  return out;
+}
+function parseToolCall(raw) {
+  if (!raw)
+    return;
+  let v;
+  try {
+    v = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (!v || typeof v !== "object")
+    return;
+  const o = v;
+  const name = typeof o.name === "string" ? o.name : "";
+  const argsHash = typeof o.argsHash === "string" ? o.argsHash : "";
+  const invocationId = typeof o.invocationId === "string" ? o.invocationId : "";
+  if (!name || !argsHash || !invocationId)
+    return;
+  return { name, argsHash, invocationId };
+}
 function provenanceFromEnv(env = process.env) {
   const kind = env.SOL_KIND === "agent" ? "agent" : "human";
+  const tool = encodeTool({
+    tool: env.SOL_TOOL,
+    toolCall: parseToolCall(env.SOL_TOOL_CALL),
+    testRunId: env.SOL_TEST_RUN_ID || undefined
+  });
   const node = buildProvNode({
     agentId: env.SOL_AGENT_ID || (kind === "agent" ? env.SOL_ACTOR : undefined),
     sessionId: env.SOL_SESSION,
     model: env.SOL_MODEL,
     intent: env.SOL_INTENT,
-    tool: env.SOL_TOOL
+    tool
   });
-  return node ? { kind, node } : { kind };
+  const opRunId = env.SOL_OPERATION_ID || undefined;
+  return { kind, ...node ? { node } : {}, ...opRunId ? { opRunId } : {} };
 }
 function buildProvNode(fields) {
   const clean = { kind: "prov" };
@@ -1149,6 +1212,9 @@ function authorLabel(op, reader) {
   const bits = [];
   if (p?.sessionId)
     bits.push(`session ${p.sessionId}`);
+  const tp = p ? decodeTool(p.tool) : {};
+  if (tp.toolCall)
+    bits.push(`via ${tp.toolCall.name}`);
   const tail = p?.intent ? ` — intent: ${p.intent}` : "";
   return `${who}${bits.length ? ` (${bits.join(", ")})` : ""}${tail}`;
 }
@@ -1158,10 +1224,21 @@ function provJson(op, reader, key, trust) {
     return;
   const out = { kind: op.kind ?? "human" };
   if (p) {
-    for (const k of ["agentId", "sessionId", "model", "intent", "tool", "rationale", "parent"])
+    for (const k of ["agentId", "sessionId", "model", "intent", "rationale", "parent"])
       if (p[k])
         out[k] = p[k];
   }
+  if (p?.tool) {
+    const tp = decodeTool(p.tool);
+    if (tp.tool)
+      out.tool = tp.tool;
+    if (tp.toolCall)
+      out.toolCall = tp.toolCall;
+    if (tp.testRunId)
+      out.testRunId = tp.testRunId;
+  }
+  if (op.opRunId !== undefined)
+    out.opRunId = op.opRunId;
   if (op.sig !== undefined) {
     const t = trustAuthor(op, trust);
     out.signed = true;
@@ -1219,7 +1296,7 @@ function signTrailerValue(op, trust) {
       return `${t.fingerprint} verified`;
   }
 }
-function provTrailers(op, reader, key, trust) {
+function provTrailers(op, reader, key, trust, reviewCount) {
   const p = reader ? provOf(op, reader) : undefined;
   const lines = [];
   const signed = trustAuthor(op, trust);
@@ -1233,6 +1310,13 @@ function provTrailers(op, reader, key, trust) {
     lines.push(`Sol-Session: ${p.sessionId}`);
   if (p?.model)
     lines.push(`Sol-Model: ${p.model}`);
+  const tp = decodeTool(p?.tool);
+  if (tp.toolCall)
+    lines.push(`Sol-ToolCall: ${tp.toolCall.name} args=${tp.toolCall.argsHash} inv=${tp.toolCall.invocationId}`);
+  if (tp.testRunId)
+    lines.push(`Sol-TestRun: ${tp.testRunId}`);
+  if (op.opRunId)
+    lines.push(`Sol-Operation: ${op.opRunId}`);
   const intent = p?.intent || (isAgent ? op.message?.trim() || undefined : undefined);
   if (intent)
     lines.push(`Sol-Intent: ${intent}`);
@@ -1241,17 +1325,22 @@ function provTrailers(op, reader, key, trust) {
     lines.push(`Sol-Sign: ${sign}`);
   if (op.att !== undefined && !(key && !verifyAtt(key, op)))
     lines.push(`Sol-Attested: pushedBy=${op.pushedBy ?? "?"}`);
+  if (reviewCount && reviewCount > 0)
+    lines.push(`Sol-Attestations: ${reviewCount}`);
   return lines;
 }
 async function captureProv(sink, env = process.env) {
-  const { kind, node } = provenanceFromEnv(env);
+  const { kind, node, opRunId } = provenanceFromEnv(env);
   const out = {};
   if (kind === "agent")
     out.kind = "agent";
   if (node)
     out.prov = await sink.put(node);
+  if (opRunId)
+    out.opRunId = opRunId;
   return out;
 }
+var TC_SEP = "\x01", TC_TAG = "tc1";
 var init_prov = __esm(() => {
   init_attest();
   init_sign();
@@ -1283,10 +1372,25 @@ class AsyncRepo {
     await this.log.append(by === this.actor ? this.sign(entry) : entry);
   }
   provFor;
+  pendingToolCall;
+  setToolCall(tc) {
+    this.pendingToolCall = tc;
+  }
   async provenance(by) {
     if (by !== this.actor)
       return {};
-    return this.provFor ??= captureProv(this.store);
+    const base = await (this.provFor ??= captureProv(this.store));
+    const tc = this.pendingToolCall;
+    if (!tc)
+      return base;
+    this.pendingToolCall = undefined;
+    const { kind, node } = provenanceFromEnv();
+    const session = node ?? { kind: "prov" };
+    const surface = decodeTool(session.tool);
+    const tool = encodeTool({ tool: surface.tool, toolCall: tc, testRunId: surface.testRunId });
+    const merged = { ...session, kind: "prov", tool };
+    const prov = await this.store.put(merged);
+    return { ...kind === "agent" ? { kind: "agent" } : {}, prov, ...base.opRunId ? { opRunId: base.opRunId } : {} };
   }
   async currentRoot() {
     const head = await this.log.head();
@@ -1475,6 +1579,15 @@ var init_async_repo = __esm(() => {
 });
 
 // src/file-store.ts
+var exports_file_store = {};
+__export(exports_file_store, {
+  openLocal: () => openLocal,
+  initLocal: () => initLocal,
+  encodeObject: () => encodeObject,
+  decodeObject: () => decodeObject,
+  FileStore: () => FileStore,
+  FileOpLog: () => FileOpLog
+});
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { gunzipSync, gzipSync } from "node:zlib";
@@ -1564,6 +1677,17 @@ class FileOpLog {
     return pageOps(all, opts);
   }
 }
+function initLocal(dir, actor = "anon") {
+  const solDir = join(dir, ".sol");
+  mkdirSync(solDir, { recursive: true });
+  const store = new FileStore(solDir);
+  const log = new FileOpLog(solDir);
+  return { repo: new AsyncRepo(store, log, actor), store, log, solDir };
+}
+function openLocal(dir, actor = "anon") {
+  const solDir = join(dir, ".sol");
+  return new AsyncRepo(new FileStore(solDir), new FileOpLog(solDir), actor);
+}
 var init_file_store = __esm(() => {
   init_async_repo();
   init_chain();
@@ -2081,6 +2205,74 @@ var init_keyring_at_rest = __esm(() => {
 });
 
 // src/bin/lib.ts
+var exports_lib = {};
+__export(exports_lib, {
+  writeWorkingIndexAt: () => writeWorkingIndexAt,
+  writeWorkingIndex: () => writeWorkingIndex,
+  workingChanges: () => workingChanges,
+  workingChangeRows: () => workingChangeRows,
+  walkFiles: () => walkFiles,
+  walkEntries: () => walkEntries,
+  viewMetaPath: () => viewMetaPath,
+  unresolvedConflictPaths: () => unresolvedConflictPaths,
+  truncateOpLog: () => truncateOpLog,
+  solDir: () => solDir,
+  snapshotTree: () => snapshotTree,
+  snapshotFile: () => snapshotFile,
+  setSealedDecryptor: () => setSealedDecryptor,
+  setOpLogHead: () => setOpLogHead,
+  saveTrust: () => saveTrust,
+  saveRefs: () => saveRefs,
+  saveKeyRing: () => saveKeyRing,
+  revealedHeadForRender: () => revealedHeadForRender,
+  revealedHead: () => revealedHead,
+  resolveRefSoft: () => resolveRefSoft,
+  resolveRef: () => resolveRef,
+  repoRoot: () => repoRoot,
+  repoRel: () => repoRel,
+  refsPath: () => refsPath,
+  readViewMeta: () => readViewMeta,
+  procCwd: () => procCwd,
+  printWorkingDiff: () => printWorkingDiff,
+  printTreeDiff: () => printTreeDiff,
+  persistTree: () => persistTree,
+  parentSolDir: () => parentSolDir,
+  opsDir: () => opsDir,
+  open: () => open,
+  objectsDir: () => objectsDir,
+  materializeTree: () => materializeTree,
+  materializeInto: () => materializeInto,
+  materializeDiff: () => materializeDiff,
+  materialize: () => materialize,
+  lockDir: () => lockDir,
+  loadWorkingIndex: () => loadWorkingIndex,
+  loadTrust: () => loadTrust,
+  loadStore: () => loadStore,
+  loadSigner: () => loadSigner,
+  loadRefs: () => loadRefs,
+  loadKeyRing: () => loadKeyRing,
+  lexists: () => lexists,
+  isWorkingPath: () => isWorkingPath,
+  isIgnored: () => isIgnored,
+  ignorePatterns: () => ignorePatterns,
+  forceIncluded: () => forceIncluded,
+  fileChange: () => fileChange,
+  die: () => die,
+  cwd: () => cwd,
+  countChanges: () => countChanges,
+  conflictHunks: () => conflictHunks,
+  cfgDir: () => cfgDir,
+  blameFile: () => blameFile,
+  appendFileSync: () => appendFileSync2,
+  appendCommit: () => appendCommit,
+  appendCapture: () => appendCapture,
+  allLocalNodes: () => allLocalNodes,
+  addInclude: () => addInclude,
+  actor: () => actor,
+  acquireLock: () => acquireLock,
+  LazyStore: () => LazyStore,
+  DEFAULT_IGNORE: () => DEFAULT_IGNORE
+});
 import {
   appendFileSync as appendFileSync2,
   chmodSync as chmodSync3,
@@ -2090,6 +2282,7 @@ import {
   readdirSync as readdirSync2,
   readFileSync as readFileSync4,
   readlinkSync,
+  renameSync as renameSync2,
   symlinkSync,
   unlinkSync,
   writeFileSync as writeFileSync4
@@ -2120,6 +2313,9 @@ function parentSolDir(dir = solDir) {
   const m = readViewMeta(dir);
   return m ? resolve(dir, m.parent) : undefined;
 }
+function cfgDir(dir = solDir) {
+  return parentSolDir(dir) ?? dir;
+}
 function repoRel(p) {
   return relative(cwd, resolve(procCwd, p));
 }
@@ -3042,6 +3238,35 @@ function setOpLogHead(head) {
   const cur = existsSync4(hf) ? JSON.parse(readFileSync4(hf, "utf8")) : { seq: 0 };
   writeFileSync4(hf, JSON.stringify({ ...cur, head }));
 }
+function truncateOpLog(toSeq) {
+  const opsFile = join4(solDir, "ops.jsonl");
+  if (!existsSync4(opsFile))
+    return;
+  const kept = [];
+  let last;
+  for (const l of readFileSync4(opsFile, "utf8").split(`
+`)) {
+    if (!l)
+      continue;
+    let op;
+    try {
+      op = JSON.parse(l);
+    } catch {
+      break;
+    }
+    if (op.seq > toSeq)
+      break;
+    kept.push(l);
+    last = op;
+  }
+  const tmp = `${opsFile}.tmp`;
+  writeFileSync4(tmp, kept.length ? kept.join(`
+`) + `
+` : "");
+  renameSync2(tmp, opsFile);
+  const hf = join4(solDir, "HEAD");
+  writeFileSync4(hf, JSON.stringify(last ? { head: last.rootAfter, seq: last.seq, logTip: last.entryHash } : { seq: 0 }));
+}
 async function persistTree(src, dst, head) {
   const node = src.get(head);
   if (!node)
@@ -3113,7 +3338,7 @@ function saveKeyRing(ring) {
     chmodSync3(keysPath(), 384);
   } catch {}
 }
-var procCwd, repoRoot, cwd, solDir, actor, viewMetaPath = (dir = solDir) => join4(dir, "view.json"), viewParent, objectsDir = () => join4(viewParent ?? solDir, "objects"), lockDir = () => solDir, SYMLINK_MODE = 40960, EXEC_MODE = 493, DEFAULT_IGNORE, includePath = () => join4(solDir, "include"), LOCK_STALE_MS = 5000, LazyStore, sealedDecryptor, indent = (s) => s.split(`
+var procCwd, repoRoot, cwd, solDir, actor, viewMetaPath = (dir = solDir) => join4(dir, "view.json"), viewParent, objectsDir = () => join4(viewParent ?? solDir, "objects"), opsDir = () => solDir, lockDir = () => solDir, SYMLINK_MODE = 40960, EXEC_MODE = 493, DEFAULT_IGNORE, includePath = () => join4(solDir, "include"), LOCK_STALE_MS = 5000, LazyStore, sealedDecryptor, indent = (s) => s.split(`
 `).map((l) => "    " + l).join(`
 `), indexPath = () => join4(solDir, "index.json"), linesOf = (content) => content === "" ? [] : content.replace(/\n$/, "").split(`
 `), refsPath = () => join4(solDir, "refs.json"), saveRefs = (refs) => writeFileSync4(refsPath(), JSON.stringify(refs, null, 2)), _signer, trustPath = () => join4(solDir, "trust.json"), keysPath = () => join4(solDir, "keys.json");
@@ -3166,9 +3391,13 @@ __export(exports_remote, {
   writeBundle: () => writeBundle,
   saveRemote: () => saveRemote,
   remoteRefs: () => remoteRefs,
+  remotePushFinalize: () => remotePushFinalize,
+  remotePushChunked: () => remotePushChunked,
+  remotePushBatch: () => remotePushBatch,
   remotePush: () => remotePush,
   remotePromote: () => remotePromote,
   remoteHead: () => remoteHead,
+  remoteGate: () => remoteGate,
   remoteExport: () => remoteExport,
   remoteEnvPush: () => remoteEnvPush,
   remoteEnvPull: () => remoteEnvPull,
@@ -3179,6 +3408,7 @@ __export(exports_remote, {
   policyRemove: () => policyRemove,
   policyGet: () => policyGet,
   policyCheck: () => policyCheck,
+  ownerSet: () => ownerSet,
   mrOpen: () => mrOpen,
   mrList: () => mrList,
   mrGet: () => mrGet,
@@ -3192,6 +3422,7 @@ __export(exports_remote, {
 });
 import { appendFileSync as appendFileSync3, existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join5 } from "node:path";
+import { gzipSync as gzipSync2 } from "node:zlib";
 async function call(cfg, token, path, init) {
   const res = await fetch(endpoint(cfg, path), {
     ...init,
@@ -3201,6 +3432,44 @@ async function call(cfg, token, path, init) {
     throw new Error(`remote ${path} -> ${res.status}: ${(await res.text().catch(() => "")).slice(0, 200)}`);
   return res.json();
 }
+function splitNodes(nodes, batchSizeBytes) {
+  const batches = [];
+  let cur = [];
+  let curBytes = 0;
+  for (const node of nodes) {
+    const nb = sizeOf(node);
+    if (cur.length && curBytes + nb > batchSizeBytes) {
+      batches.push(cur);
+      cur = [];
+      curBytes = 0;
+    }
+    cur.push(node);
+    curBytes += nb;
+  }
+  if (cur.length)
+    batches.push(cur);
+  return batches.length ? batches : [[]];
+}
+async function remotePushChunked(cfg, token, body, batchSizeBytes = DEFAULT_BATCH_BYTES) {
+  const totalBytes = sizeOf(body.nodes) + sizeOf(body.ops);
+  if (totalBytes <= batchSizeBytes)
+    return remotePush(cfg, token, body);
+  const stamp = `${body.head ?? "h"}-${Date.now()}`;
+  const nodeBatches = splitNodes(body.nodes, batchSizeBytes);
+  const batchIds = [];
+  try {
+    for (let i = 0;i < nodeBatches.length; i++) {
+      const batchId = `${stamp}-${i}`;
+      batchIds.push(batchId);
+      await remotePushBatch(cfg, token, batchId, nodeBatches[i], i === 0 ? body.ops : [], i);
+    }
+  } catch (e) {
+    if (e instanceof Error && /-> 404/.test(e.message))
+      return remotePush(cfg, token, body);
+    throw e;
+  }
+  return remotePushFinalize(cfg, token, batchIds, body.branch, body.head, body.expectedHead);
+}
 function loadRemote(solDir2) {
   const p = join5(solDir2, "remote.json");
   return existsSync5(p) ? JSON.parse(readFileSync5(p, "utf8")) : undefined;
@@ -3221,9 +3490,10 @@ async function writeBundle(solDir2, bundle, from = 0) {
   writeFileSync5(join5(solDir2, "HEAD"), JSON.stringify({ head: bundle.head, seq: bundle.seq, logTip: bundle.tip }));
   return fresh.length;
 }
-var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
+var endpoint = (cfg, path) => `${cfg.url.replace(/\/+$/, "")}${path}${path.includes("?") ? "&" : "?"}repo=${encodeURIComponent(cfg.repo)}`, remoteHead = (cfg, token) => call(cfg, token, "/head"), remoteGate = (cfg, token, branch) => call(cfg, token, `/head?gateState=true${branch ? `&branch=${encodeURIComponent(branch)}` : ""}`), remoteExport = (cfg, token) => call(cfg, token, "/export"), remoteRefs = (cfg, token) => call(cfg, token, "/refs"), remotePush = (cfg, token, body) => call(cfg, token, "/push", { method: "POST", body: JSON.stringify(body) }), remotePromote = (cfg, token, branch) => call(cfg, token, "/promote", { method: "POST", body: JSON.stringify({ branch }) }), remotePushBatch = (cfg, token, batchId, nodes, ops, seq) => call(cfg, token, "/push/batch", { method: "POST", body: gzipSync2(JSON.stringify({ batchId, nodes, ops, seq })), headers: { "content-encoding": "gzip" } }), remotePushFinalize = (cfg, token, batchIds, branch, head, expectedHead) => call(cfg, token, "/push/finalize", { method: "POST", body: JSON.stringify({ batchIds, branch, head, expectedHead }) }), DEFAULT_BATCH_BYTES, sizeOf = (v) => JSON.stringify(v).length, mrOpen = (cfg, token, body) => call(cfg, token, "/mr", { method: "POST", body: JSON.stringify(body) }), mrList = (cfg, token) => call(cfg, token, "/mrs"), mrDiff = (cfg, token, id) => call(cfg, token, `/mr/diff?id=${id}`), mrGet = (cfg, token, id) => call(cfg, token, `/mr?id=${id}`), mrAction = (cfg, token, action, body) => call(cfg, token, `/mr/${action}`, { method: "POST", body: JSON.stringify(body) }), accessGet = (cfg, token) => call(cfg, token, "/access"), ownerSet = (cfg, token, ownerHandle) => call(cfg, token, "/owner", { method: "POST", body: JSON.stringify({ ownerHandle }) }), accessSet = (cfg, token, body) => call(cfg, token, "/access", { method: "POST", body: JSON.stringify(body) }), policyCheck = (cfg, token, paths) => call(cfg, token, "/policy/check", { method: "POST", body: JSON.stringify({ paths }) }), policyGet = (cfg, token) => call(cfg, token, "/policy"), policyUpsert = (cfg, token, rule) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "upsert", rule }) }), policyRemove = (cfg, token, pattern) => call(cfg, token, "/policy?write=1", { method: "POST", body: JSON.stringify({ op: "remove", pattern }) }), recipientsForPath = (cfg, token, path) => call(cfg, token, `/recipients?path=${encodeURIComponent(path)}`), recipientsForAudience = (cfg, token, audience, recovery) => call(cfg, token, `/recipients?audience=${encodeURIComponent(JSON.stringify(audience))}${recovery?.length ? `&recovery=${encodeURIComponent(recovery.join(","))}` : ""}`), remoteEnvPush = (cfg, token, bundle) => call(cfg, token, "/env/push", { method: "POST", body: JSON.stringify(bundle) }), remoteEnvAnchor = (cfg, token) => call(cfg, token, "/env/anchor"), remoteEnvPull = (cfg, token) => call(cfg, token, "/env/pull"), forkMeta = (cfg, token, parent) => call(cfg, token, "/fork-meta", { method: "POST", body: JSON.stringify({ parent }) }), forksList = (cfg, token) => call(cfg, token, "/forks"), saveRemote = (solDir2, cfg) => writeFileSync5(join5(solDir2, "remote.json"), JSON.stringify(cfg, null, 2));
 var init_remote = __esm(() => {
   init_file_store();
+  DEFAULT_BATCH_BYTES = 5 * 1024 * 1024;
 });
 
 // src/bin/test-gate.ts
@@ -5270,6 +5540,314 @@ var init_sealed_client = __esm(() => {
   init_crypto();
 });
 
+// src/bin/admin-repair.ts
+var exports_admin_repair = {};
+__export(exports_admin_repair, {
+  planRepair: () => planRepair,
+  makeResolves: () => makeResolves,
+  applyRepair: () => applyRepair
+});
+async function makeResolves(store2) {
+  const cache = new Map;
+  const walk = async (h, seen) => {
+    if (cache.get(h) === true)
+      return true;
+    if (seen.has(h))
+      return true;
+    seen.add(h);
+    const node = await store2.get(h);
+    if (!node)
+      return false;
+    if (node.kind === "tree") {
+      for (const e of Object.values(node.entries))
+        if (!await walk(e.hash, seen))
+          return false;
+    }
+    return true;
+  };
+  return async (root) => {
+    if (cache.has(root))
+      return cache.get(root);
+    const ok = await walk(root, new Set);
+    cache.set(root, ok);
+    return ok;
+  };
+}
+async function lastResolvableRoot(ops, upToIdx, resolves) {
+  for (let i = Math.min(upToIdx, ops.length - 1);i >= 0; i--) {
+    if (await resolves(ops[i].rootAfter))
+      return { op: ops[i], idx: i };
+  }
+  return;
+}
+function firstBrokenIdx(ops) {
+  let prev;
+  for (let i = 0;i < ops.length; i++) {
+    if (ops[i].seq !== i + 1)
+      return i;
+    try {
+      verifyChain(ops.slice(0, i + 1));
+    } catch {
+      return i;
+    }
+    prev = ops[i].entryHash;
+  }
+  return -1;
+}
+async function planRepair(ops, head, resolves) {
+  const broken = firstBrokenIdx(ops);
+  if (broken === -1) {
+    if (ops.length === 0)
+      return { kind: "noop", note: "", reason: "empty repo — nothing to repair" };
+    const headResolves = head !== undefined && await resolves(head);
+    if (headResolves)
+      return { kind: "noop", note: "", reason: "repo is healthy — chain valid, head resolves" };
+    const found2 = await lastResolvableRoot(ops, ops.length - 1, resolves);
+    if (!found2) {
+      return { kind: "unfixable", note: "", reason: head === undefined ? "head pointer lost and no historical root fully resolves — content is missing locally; rehydrate with `sol recover --from-remote <url> <repo>`" : `head ${head} dangles and no historical root fully resolves — a deep object is missing locally; rehydrate with \`sol recover --from-remote <url> <repo>\`` };
+    }
+    return {
+      kind: "repoint-head",
+      repointHead: found2.op.rootAfter,
+      note: `repair: re-pointed head to ${found2.op.rootAfter} (rootAfter of seq ${found2.op.seq})`,
+      reason: head === undefined ? "head pointer lost — recovered from the op-log" : `head ${head} dangles — recovered to the last fully-resolvable root`
+    };
+  }
+  const keepIdx = broken - 1;
+  if (keepIdx < 0) {
+    return { kind: "truncate-chain", truncateTo: 0, toEmptyTree: true, note: "repair: chain broken at genesis — truncated to an empty repo", reason: `op-log chain broken at seq ${ops[0]?.seq ?? 1} (the first op)` };
+  }
+  const prefix = ops.slice(0, keepIdx + 1);
+  const found = await lastResolvableRoot(prefix, keepIdx, resolves);
+  const truncateTo = prefix[keepIdx].seq;
+  if (!found) {
+    return { kind: "truncate-chain", truncateTo, toEmptyTree: true, note: `repair: truncated to seq ${truncateTo}; no resolvable root in the kept prefix — head -> empty tree`, reason: `op-log chain broken at seq ${ops[broken].seq}; kept prefix has no resolvable root` };
+  }
+  return {
+    kind: "truncate-chain",
+    truncateTo,
+    repointHead: found.op.rootAfter,
+    note: `repair: truncated to seq ${truncateTo} (chain broke at seq ${ops[broken].seq}); re-pointed head to ${found.op.rootAfter}`,
+    reason: `op-log chain broken at seq ${ops[broken].seq} — truncated to the last verified link (seq ${found.op.seq})`
+  };
+}
+async function applyRepair(exec, by = "sol-doctor", at = Date.now()) {
+  const ops = await exec.log.history();
+  const head = await exec.log.head();
+  const resolves = await makeResolves(exec.store);
+  const plan = await planRepair(ops, head, resolves);
+  if (plan.kind === "noop" || plan.kind === "unfixable")
+    return plan;
+  if (plan.kind === "truncate-chain" && plan.truncateTo !== undefined)
+    await exec.truncate(plan.truncateTo);
+  const newHead = plan.toEmptyTree ? await emptyRoot2(exec.store) : plan.repointHead;
+  if (newHead !== undefined)
+    await exec.setHead(newHead);
+  const repaired = newHead ?? head;
+  const seq = await exec.log.seq() + 1;
+  await exec.log.append({ seq, type: "checkpoint", path: "", rootAfter: repaired ?? await emptyRoot2(exec.store), at, by, message: plan.note });
+  return plan;
+}
+var init_admin_repair = __esm(() => {
+  init_chain();
+  init_async_tree();
+});
+
+// src/bin/admin.ts
+var exports_admin = {};
+__export(exports_admin, {
+  runDoctor: () => runDoctor,
+  renderDoctorIntegrity: () => renderDoctorIntegrity,
+  checkOpLog: () => checkOpLog,
+  checkObjects: () => checkObjects
+});
+function checkOpLog(ops) {
+  try {
+    for (let i = 0;i < ops.length; i++)
+      if (ops[i].seq !== i + 1)
+        throw new Error(`gap before seq ${i + 1}`);
+    const tip = verifyChain(ops);
+    return { count: ops.length, chainOk: true, tip };
+  } catch (e) {
+    return { count: ops.length, chainOk: false, chainError: String(e?.message ?? e) };
+  }
+}
+async function checkObjects(store2, head, ops) {
+  const missing = [];
+  const seen = new Set;
+  if (head === undefined)
+    return { reachable: 0, missing };
+  const seqOfRoot = new Map;
+  for (const op of ops)
+    if (!seqOfRoot.has(op.rootAfter))
+      seqOfRoot.set(op.rootAfter, op.seq);
+  const walk = async (h, refBy) => {
+    if (seen.has(h))
+      return;
+    seen.add(h);
+    const node = await store2.get(h);
+    if (!node) {
+      missing.push({ hash: h, refBy });
+      return;
+    }
+    if (node.kind === "tree")
+      for (const e of Object.values(node.entries))
+        await walk(e.hash, refBy);
+  };
+  await walk(head, seqOfRoot.get(head));
+  return { reachable: seen.size - missing.length, missing };
+}
+async function runDoctor(store2, log) {
+  const ops = await log.history();
+  const head = await log.head();
+  const seq = await log.seq();
+  const oplog = checkOpLog(ops);
+  const objects = await checkObjects(store2, head, ops);
+  const headLost = head === undefined && seq > 0;
+  const headDangling = head !== undefined && objects.missing.some((m) => m.hash === head);
+  const ok = oplog.chainOk && objects.missing.length === 0 && !headLost;
+  return { ok, oplog, objects, head, seq, headLost, headDangling };
+}
+function renderDoctorIntegrity(r) {
+  const lines = [];
+  const chain = r.oplog.chainOk ? `chain valid${r.oplog.tip ? `, tip: ${r.oplog.tip.slice(0, 16)}` : ""}` : `chain BROKEN — ${r.oplog.chainError}`;
+  lines.push(`  op-log: ${r.oplog.count} op(s), ${chain}`);
+  if (r.headLost) {
+    lines.push(`  head:   LOST (${r.seq} op(s) but no head pointer) — run \`sol fsck --repair\``);
+  } else if (r.headDangling) {
+    lines.push(`  head:   DANGLING (${r.head?.slice(0, 16)} missing from store) — run \`sol fsck --repair\``);
+  } else {
+    lines.push(`  objects: ${r.objects.reachable} reachable, ${r.objects.missing.length} missing${r.objects.missing.length ? " (run: sol fsck --repair)" : ""}`);
+  }
+  for (const m of r.objects.missing)
+    lines.push(`    missing ${m.hash}${m.refBy !== undefined ? ` (op seq ${m.refBy})` : ""}`);
+  return lines;
+}
+var init_admin = __esm(() => {
+  init_chain();
+});
+
+// src/bin/admin-reflog.ts
+var exports_admin_reflog = {};
+__export(exports_admin_reflog, {
+  renderReflog: () => renderReflog,
+  formatReflogLine: () => formatReflogLine,
+  filterReflog: () => filterReflog,
+  buildReflog: () => buildReflog
+});
+function buildReflog(ops) {
+  const rows = [];
+  let prevRoot;
+  for (const op of ops) {
+    rows.push({ seq: op.seq, by: op.by ?? "?", at: op.at, type: op.type, from: prevRoot, to: op.rootAfter, message: op.message, merge: op.parent2 });
+    prevRoot = op.rootAfter;
+  }
+  return rows;
+}
+function filterReflog(rows, f = {}) {
+  return rows.filter((r) => {
+    if (f.actor !== undefined && r.by !== f.actor)
+      return false;
+    if (f.since !== undefined && r.at < f.since)
+      return false;
+    if (f.type !== undefined && r.type !== f.type)
+      return false;
+    return true;
+  });
+}
+function formatReflogLine(r, branch) {
+  const when = new Date(r.at).toISOString().replace("T", " ").slice(0, 19);
+  const verb = r.merge ? "merge" : r.type;
+  const move = `${short(r.from)} -> ${short(r.to)}`;
+  const label = branch ? `${branch}: ` : "";
+  const body = r.message ? `${verb} ${label}${r.message}` : `${verb} ${label}`.trimEnd();
+  return `${r.seq} ${r.by} ${when} ${body} (${move})`;
+}
+function short(h) {
+  if (!h)
+    return "(empty)";
+  return h.length > 14 ? h.slice(0, 14) : h;
+}
+function renderReflog(ops, opts = {}) {
+  let rows = filterReflog(buildReflog(ops), opts);
+  if (opts.branchFilter) {
+    const b = opts.branchFilter;
+    rows = rows.filter((r) => r.type === "checkpoint" && (r.message?.includes(b) ?? false));
+  }
+  return rows.reverse().map((r) => formatReflogLine(r, opts.branch));
+}
+
+// src/bin/admin-recover.ts
+var exports_admin_recover = {};
+__export(exports_admin_recover, {
+  restoreFileFromHistory: () => restoreFileFromHistory,
+  listAllRoots: () => listAllRoots,
+  dumpLog: () => dumpLog,
+  RECOVER_HELP: () => RECOVER_HELP
+});
+async function listAllRoots(ops, has) {
+  const byRoot = new Map;
+  for (const op of ops) {
+    byRoot.set(op.rootAfter, { root: op.rootAfter, seq: op.seq, at: op.at, message: op.message });
+  }
+  const out = [...byRoot.values()].sort((a, b) => b.seq - a.seq);
+  if (has)
+    for (const e of out)
+      e.resolvable = await has(e.root);
+  return out;
+}
+async function restoreFileFromHistory(store2, ops, path, from) {
+  let window = ops;
+  if (typeof from === "number")
+    window = ops.filter((o) => o.seq <= from);
+  else if (typeof from === "string") {
+    const bare = from.startsWith("h_") ? from : "h_" + from;
+    const idx = ops.findIndex((o) => o.rootAfter === bare || o.rootAfter.startsWith(bare));
+    window = idx >= 0 ? ops.slice(0, idx + 1) : [];
+    if (idx < 0)
+      return { found: false, path, reason: `no op produced root ${from}` };
+  }
+  const tried = new Set;
+  for (let i = window.length - 1;i >= 0; i--) {
+    const root = window[i].rootAfter;
+    if (tried.has(root))
+      continue;
+    tried.add(root);
+    if (!await store2.has(root))
+      continue;
+    const leaf = await nodeAt(store2, root, path);
+    if (!leaf)
+      continue;
+    if (leaf.kind === "sealed")
+      return { found: true, path, sealed: true, box: leaf.box, fromSeq: window[i].seq, fromRoot: root };
+    const blob = await fileAt2(store2, root, path);
+    return { found: true, path, content: leaf.content, encoding: blob?.encoding, fromSeq: window[i].seq, fromRoot: root };
+  }
+  return { found: false, path, reason: from !== undefined ? `path ${path} not found at or before ${from}` : `path ${path} never existed in history` };
+}
+function dumpLog(ops, fromSeq, toSeq) {
+  const window = ops.filter((o) => (fromSeq === undefined || o.seq >= fromSeq) && (toSeq === undefined || o.seq <= toSeq));
+  return JSON.stringify(window, null, 2);
+}
+var RECOVER_HELP = `sol recover — guide through recovery scenarios
+
+  1. Rehydrate from the cloud (download ops + objects from the backend)
+       sol recover --from-remote <url> <repo>
+
+  2. List every root the repo ever landed on (find a lost head)
+       sol recover --list-all-roots
+
+  3. Restore a file from op history (even if the current tree dropped it)
+       sol recover --file <path> [--from <seq|hash>]
+
+  4. Dump raw op-log entries as JSON (manual inspection / salvage)
+       sol recover --dump-log [<from-seq> [<to-seq>]]
+
+  after a structural repair, run \`sol doctor\` to confirm the repo is healthy.`;
+var init_admin_recover = __esm(() => {
+  init_async_tree();
+});
+
 // src/bin/secret-scrub.ts
 var exports_secret_scrub = {};
 __export(exports_secret_scrub, {
@@ -5676,6 +6254,140 @@ var init_merge = __esm(() => {
   init_tree();
 });
 
+// src/bin/errors-friendly.ts
+var exports_errors_friendly = {};
+__export(exports_errors_friendly, {
+  friendlyError: () => friendlyError,
+  formatSealedError: () => formatSealedError,
+  formatMissingObjectError: () => formatMissingObjectError,
+  formatChainError: () => formatChainError,
+  formatAuthError: () => formatAuthError,
+  classifyAuthError: () => classifyAuthError
+});
+function classifyAuthError(status, message = "") {
+  if (status === 401 || / -> 401\b/.test(message) || /\b401\b/.test(message))
+    return "expired";
+  if (status === 403 || / -> 403\b/.test(message) || /\b403\b/.test(message))
+    return "forbidden";
+  if (/invalid token|malformed|not a jwt|jwt/i.test(message))
+    return "invalid";
+  return "unknown";
+}
+function formatAuthError(kind, repo) {
+  switch (kind) {
+    case "expired":
+      return "session expired — run `sol auth login` (or set SOL_TOKEN)";
+    case "forbidden":
+      return `you lack access${repo ? ` to ${repo}` : " to this repo"} — ask the owner to grant you access, or check you're logged in as the right account (\`sol auth status\`)`;
+    case "invalid":
+      return "invalid token format — SOL_TOKEN is not a valid session token; re-run `sol auth login` to mint a fresh one";
+    default:
+      return "authentication failed — run `sol auth login` (or set SOL_TOKEN), then try again";
+  }
+}
+function formatSealedError(path) {
+  return `sealed file ${path} — you lack a decryption key.
+  -> \`sol keys\` to see your keyring
+  -> ask the owner to re-seal this path to your account (\`sol seal ${path} <you>\`)`;
+}
+function formatChainError(err) {
+  const m = err.message;
+  const seq = /seq (\d+)/.exec(m)?.[1];
+  const where = seq ? `op-log chain broken at seq ${seq}` : "op-log chain broken";
+  return `${where}: ${m.replace(/^corrupt repo: /, "")}
+  -> \`sol doctor\` for a full diagnosis
+  -> \`sol fsck --repair\` to recover (truncates to the last verified link)`;
+}
+function formatMissingObjectError(hash, seq) {
+  const ref = seq !== undefined ? ` referenced by op seq ${seq}` : "";
+  return `object ${hash}${ref} not found in store.
+  -> \`sol doctor\` then \`sol fsck --repair\` to recover from backup
+  -> or \`sol recover --from-remote <url> <repo>\` to rehydrate from the cloud`;
+}
+function friendlyError(err, ctx) {
+  if (err instanceof CorruptObjectError)
+    return formatMissingObjectError(err.hash);
+  if (err instanceof CorruptRepoError) {
+    if (/dangling head|head is lost|missing from the store/.test(err.message)) {
+      return `${err.message.replace(/^corrupt repo: /, "")}
+  -> \`sol doctor\` then \`sol fsck --repair\` to re-point the head`;
+    }
+    return formatChainError(err);
+  }
+  const msg = err instanceof Error ? err.message : String(err);
+  const kind = classifyAuthError(undefined, msg);
+  if (kind !== "unknown")
+    return formatAuthError(kind, ctx?.repo);
+  return msg;
+}
+var init_errors_friendly = __esm(() => {
+  init_errors();
+});
+
+// src/bin/admin-remote-verify.ts
+var exports_admin_remote_verify = {};
+__export(exports_admin_remote_verify, {
+  renderRemoteVerify: () => renderRemoteVerify,
+  remoteVerify: () => remoteVerify,
+  classifyRemoteFailure: () => classifyRemoteFailure
+});
+function classifyRemoteFailure(status, message, repo) {
+  if (status === 401 || status === 403)
+    return { kind: "auth", message: formatAuthError(classifyAuthError(status, message), repo) };
+  if (status !== undefined)
+    return { kind: "backend", status, message: `backend error (${status}) — transient, try again: ${message}`.trim() };
+  return { kind: "network", message: `could not reach the remote — connectivity issue: ${message}` };
+}
+async function remoteVerify(fetchLike, url, repo, token) {
+  const endpoint2 = `${url.replace(/\/+$/, "")}/fsck?repo=${encodeURIComponent(repo)}`;
+  let res;
+  try {
+    res = await fetchLike(endpoint2, { headers: { authorization: `Bearer ${token}`, "content-type": "application/json" } });
+  } catch (e) {
+    return classifyRemoteFailure(undefined, String(e?.message ?? e), repo);
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    return classifyRemoteFailure(res.status, body.slice(0, 200), repo);
+  }
+  const fsck = await res.json();
+  return fsck.ok ? { kind: "ok", fsck } : { kind: "corrupt", fsck };
+}
+function renderRemoteVerify(r) {
+  switch (r.kind) {
+    case "ok":
+      return {
+        lines: [
+          "  checking remote repository...",
+          `  op-log: chain ${r.fsck.chainOk ? "valid" : "BROKEN"}${r.fsck.head ? `, tip: ${r.fsck.head.slice(0, 16)}` : ""}`,
+          `  objects: ${r.fsck.checked} reachable, ${r.fsck.missing.length} missing`,
+          "  status: OK"
+        ],
+        exitCode: 0
+      };
+    case "corrupt":
+      return {
+        lines: [
+          "  checking remote repository...",
+          `  op-log: chain ${r.fsck.chainOk ? "valid" : `BROKEN — ${r.fsck.chainError ?? "?"}`}`,
+          `  objects: ${r.fsck.checked} reachable, ${r.fsck.missing.length} missing`,
+          ...r.fsck.missing.map((h) => `    missing ${h}`),
+          "  status: PROBLEMS FOUND — the remote repository is corrupted"
+        ],
+        exitCode: 1
+      };
+    case "auth":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+    case "backend":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+    case "network":
+      return { lines: [`  ${r.message}`], exitCode: 1 };
+  }
+}
+var init_admin_remote_verify = __esm(() => {
+  init_errors_friendly();
+});
+
 // src/bin/local-peer.ts
 var exports_local_peer = {};
 __export(exports_local_peer, {
@@ -5926,12 +6638,333 @@ var init_converge = __esm(() => {
   EMPTY_TREE2 = { kind: "tree", entries: {} };
 });
 
+// src/bin/sync-watch-fs.ts
+var exports_sync_watch_fs = {};
+__export(exports_sync_watch_fs, {
+  buildFsSyncEnv: () => buildFsSyncEnv
+});
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "node:fs";
+function resolveRemote() {
+  const cfg = loadRemote(solDir);
+  if (!cfg)
+    return;
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL };
+}
+function readRefs() {
+  return existsSync13(refsPath()) ? JSON.parse(readFileSync13(refsPath(), "utf8")) : undefined;
+}
+async function buildFsSyncEnv(opts) {
+  if (!existsSync13(solDir))
+    throw new Error("not a sol repo — run `sol init` first");
+  const { repo, log } = open();
+  const cfg = resolveRemote() || (() => {
+    throw new Error("no remote — set one with `sol remote <url> <repo>`");
+  })();
+  const token = opts.token;
+  const replica = { store: new FileStore(solDir, objectsDir()), log };
+  const currentBranch = () => readRefs()?.current ?? "main";
+  const local = {
+    replica,
+    async capture() {
+      const snap = await snapshotTree(repo);
+      if (snap.changed)
+        writeWorkingIndex(await repo.list());
+      return snap.changed;
+    },
+    head: () => log.head(),
+    seq: () => log.seq(),
+    logTip: () => log.logTip(),
+    history: () => log.history(),
+    async nodes() {
+      return allLocalNodes();
+    },
+    branch: currentBranch,
+    forkBase() {
+      const refs = readRefs();
+      return refs?.branches[refs.current]?.remote;
+    },
+    async dirty() {
+      const wc = workingChanges(loadStore(), await log.head() ?? "");
+      return wc.added.length + wc.modified.length + wc.removed.length > 0;
+    },
+    async absorbCanonical(bundle, fromHead) {
+      const head = bundle.head ?? fromHead;
+      const canonBundle = {
+        head,
+        seq: bundle.ops.length ? bundle.ops[bundle.ops.length - 1].seq : 0,
+        tip: bundle.ops.length ? bundle.ops[bundle.ops.length - 1].entryHash : undefined,
+        ops: bundle.ops,
+        nodes: bundle.nodes,
+        refs: bundle.branches ? { branches: bundle.branches, production: readRefs()?.current ?? "main" } : undefined
+      };
+      await writeBundle(solDir, canonBundle, 0);
+      await local.adopt(fromHead, head, bundle.branches);
+    },
+    async adopt(from, to, branches) {
+      const refs = readRefs();
+      if (refs) {
+        if (branches) {
+          for (const [name, h] of Object.entries(branches)) {
+            refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
+          }
+        }
+        const cur = refs.current;
+        if (refs.branches[cur]) {
+          refs.branches[cur].head = to;
+          refs.branches[cur].remote = to;
+        }
+        saveRefs(refs);
+      }
+      setOpLogHead(to);
+      if (to && to !== from)
+        materializeDiff(loadStore(), from, to);
+    }
+  };
+  const remote = {
+    async head() {
+      const rh = await remoteHead(cfg, token);
+      return { head: rh.head, tip: rh.tip, seq: rh.seq };
+    },
+    async export() {
+      const b = await remoteExport(cfg, token);
+      return { head: b.head, tip: b.tip, seq: b.seq, ops: b.ops, nodes: b.nodes, branches: b.refs?.branches };
+    },
+    async push(body) {
+      const res = await remotePush(cfg, token, body);
+      return { head: res.head, applied: res.applied, merged: res.merged, conflicts: res.conflicts, branches: res.refs?.branches };
+    }
+  };
+  if (!loadRemote(solDir)?.url && cfg.repo)
+    saveRemote(solDir, cfg);
+  const logger = {
+    info: (line) => console.log(line),
+    warn: (line) => console.error("sol: " + line)
+  };
+  const runLocked = async (fn) => {
+    const release = acquireLock();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  };
+  return { local, remote, log: logger, actor, dryRun: !!opts.dryRun, runLocked };
+}
+var DEFAULT_REMOTE_URL;
+var init_sync_watch_fs = __esm(() => {
+  init_file_store();
+  init_lib();
+  init_remote();
+  DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+});
+
+// src/bin/sync-watch.ts
+var exports_sync_watch = {};
+__export(exports_sync_watch, {
+  runSyncWatch: () => runSyncWatch,
+  pushTick: () => pushTick,
+  pollTick: () => pollTick,
+  isFatalSyncError: () => isFatalSyncError,
+  formatTick: () => formatTick,
+  captureTick: () => captureTick
+});
+function isFatalSyncError(e) {
+  const m = (e instanceof Error ? e.message : String(e)).toLowerCase();
+  if (/-> 401|-> 403|unauthor|forbidden|session expired|invalid token/.test(m))
+    return true;
+  if (/corrupt|broken chain|chain mismatch|not a sol repo|tamper/.test(m))
+    return true;
+  return false;
+}
+async function captureTick(env) {
+  if (env.dryRun)
+    return { changed: 0 };
+  const changed = await env.local.capture();
+  return { changed };
+}
+async function pushTick(env) {
+  const { local, remote } = env;
+  const localHead = await local.head();
+  if (!localHead)
+    return { pushed: 0, merged: false, conflicts: [] };
+  const rh = await remote.head();
+  const ops = await local.history();
+  const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
+  const localTip = await local.logTip();
+  if (localSeq === rh.seq && localTip === rh.tip)
+    return { pushed: 0, merged: false, conflicts: [], head: localHead };
+  const branch = local.branch();
+  const forkBase = local.forkBase();
+  const baseOp = forkBase ? ops.find((o) => o.rootAfter === forkBase) : undefined;
+  const fromSeq = baseOp ? baseOp.seq : rh.seq;
+  const delta = ops.filter((o) => o.seq > fromSeq);
+  if (env.dryRun) {
+    env.log.info(`[dry-run] would push ${delta.length} op(s) (branch ${branch} @ ${short2(localHead)})`);
+    return { pushed: 0, merged: false, conflicts: [], head: localHead };
+  }
+  const res = await remote.push({ nodes: await local.nodes(), ops: delta, branch, head: localHead, expectedHead: forkBase });
+  const canon = await remote.export();
+  const convergedHead = res.head ?? canon.branches?.[branch] ?? localHead;
+  await local.absorbCanonical({ head: convergedHead, ops: canon.ops, nodes: canon.nodes, branches: canon.branches }, localHead);
+  return {
+    pushed: res.applied,
+    merged: !!res.merged,
+    conflicts: (res.conflicts ?? []).map((c) => c.path),
+    head: convergedHead
+  };
+}
+async function pollTick(env) {
+  const { local, remote } = env;
+  const rh = await remote.head();
+  const localTip = await local.logTip();
+  const localSeq = await local.seq();
+  if (rh.seq <= localSeq && rh.tip === localTip)
+    return { pulled: 0, merged: false, conflicts: [], deferred: false };
+  if (await local.dirty()) {
+    env.log.info("remote moved but the working tree is dirty — pull deferred to the next poll (your edits captured first)");
+    return { pulled: 0, merged: false, conflicts: [], deferred: true };
+  }
+  if (env.dryRun) {
+    env.log.info(`[dry-run] would pull remote @ ${short2(rh.head)} (seq ${rh.seq})`);
+    return { pulled: 0, merged: false, conflicts: [], deferred: false };
+  }
+  const bundle = await remote.export();
+  const prevHead = await local.head() ?? "";
+  const before = (await local.history()).length;
+  const res = await converge(local.replica, {
+    nodes: bundle.nodes,
+    ops: bundle.ops,
+    incomingHead: bundle.head,
+    actor: env.actor
+  });
+  const after = (await local.history()).length;
+  if (res.head !== prevHead)
+    await local.adopt(prevHead, res.head, bundle.branches);
+  return {
+    pulled: after - before,
+    merged: res.merged,
+    conflicts: res.conflicts.map((c) => c.path),
+    deferred: false,
+    head: res.head
+  };
+}
+function formatTick(parts) {
+  const segs = [];
+  if (parts.captured)
+    segs.push(`auto-captured ${parts.captured} change${parts.captured === 1 ? "" : "s"}`);
+  if (parts.push && parts.push.pushed) {
+    const note = parts.push.merged ? " (converged)" : "";
+    const conf = parts.push.conflicts.length ? ` [${parts.push.conflicts.length} conflict(s): ${parts.push.conflicts.join(", ")}]` : "";
+    segs.push(`pushed ${parts.push.pushed} op${parts.push.pushed === 1 ? "" : "s"} -> remote${note}${conf}`);
+  }
+  if (parts.poll && parts.poll.pulled) {
+    const note = parts.poll.merged ? " (merged)" : "";
+    const conf = parts.poll.conflicts.length ? ` [${parts.poll.conflicts.length} conflict(s): ${parts.poll.conflicts.join(", ")}]` : "";
+    segs.push(`pulled ${parts.poll.pulled} op${parts.poll.pulled === 1 ? "" : "s"} from remote${note}${conf}`);
+  }
+  if (!segs.length)
+    return;
+  const t = new Date().toLocaleTimeString();
+  return `[${t}] ${segs.join(" | ")}`;
+}
+async function runSyncWatch(opts) {
+  const { buildFsSyncEnv: buildFsSyncEnv2 } = await Promise.resolve().then(() => (init_sync_watch_fs(), exports_sync_watch_fs));
+  const env = await buildFsSyncEnv2(opts);
+  const { watch } = await import("node:fs");
+  const { sep: sep2 } = await import("node:path");
+  const { DEFAULT_IGNORE: DEFAULT_IGNORE2 } = await Promise.resolve().then(() => (init_lib(), exports_lib));
+  const pollInterval = opts.pollInterval ?? 5000;
+  const pushImmediate = opts.pushImmediate ?? true;
+  let exiting = false;
+  const fatal = (where, e) => {
+    if (exiting)
+      return;
+    exiting = true;
+    env.log.warn(`FATAL (${where}): ${e instanceof Error ? e.message : e} — exiting. fix it and re-run \`sol sync --watch\`.`);
+    process.exit(1);
+  };
+  let running = false;
+  let pending = false;
+  const captureAndPush = async () => {
+    if (running) {
+      pending = true;
+      return;
+    }
+    running = true;
+    try {
+      do {
+        pending = false;
+        try {
+          const cap = await env.runLocked(async () => {
+            const c = await captureTick(env);
+            let push;
+            if (c.changed && pushImmediate) {
+              try {
+                push = await pushTick(env);
+              } catch (e) {
+                if (isFatalSyncError(e))
+                  return fatal("push", e);
+                env.log.warn(`push failed (will retry next cycle): ${e instanceof Error ? e.message : e}`);
+              }
+            }
+            return { captured: c.changed, push };
+          });
+          const line = formatTick(cap);
+          if (line)
+            env.log.info(line);
+        } catch (e) {
+          if (isFatalSyncError(e))
+            return fatal("capture", e);
+          env.log.warn(`sync tick error (retrying): ${e?.message || e}`);
+        }
+      } while (pending);
+    } finally {
+      running = false;
+    }
+  };
+  const pollOnce = async () => {
+    try {
+      const res = await env.runLocked(() => pollTick(env));
+      const line = formatTick({ poll: res });
+      if (line)
+        env.log.info(line);
+    } catch (e) {
+      if (isFatalSyncError(e))
+        return fatal("poll", e);
+      env.log.warn(`poll failed (will retry in ${Math.round(pollInterval / 1000)}s): ${e?.message || e}`);
+    }
+  };
+  await captureAndPush();
+  env.log.info(`sol sync --watch on ${opts.repoDir}
+  every edit is auto-captured + pushed${pushImmediate ? "" : " (push disabled — capture only)"}; safe remote updates pull in every ${Math.round(pollInterval / 1000)}s.
+` + `  nothing is lost — all edits are durable locally first. Ctrl-C to stop.${opts.dryRun ? `
+  [DRY RUN — logging intent, mutating nothing]` : ""}`);
+  let timer;
+  watch(opts.repoDir, { recursive: true }, (_e, filename) => {
+    if (!filename)
+      return;
+    const top = String(filename).split(sep2)[0];
+    if (top === ".sol" || DEFAULT_IGNORE2.includes(top))
+      return;
+    clearTimeout(timer);
+    timer = setTimeout(() => void captureAndPush(), 400);
+  });
+  const poller = setInterval(() => void pollOnce(), pollInterval);
+  poller.unref?.();
+  await new Promise(() => {});
+}
+var short2 = (h) => (h ?? "").slice(0, 12);
+var init_sync_watch = __esm(() => {
+  init_converge();
+});
+
 // src/mr.ts
 var exports_mr = {};
 __export(exports_mr, {
   mrSummary: () => mrSummary,
   mergeGate: () => mergeGate,
-  latestVerdicts: () => latestVerdicts
+  latestVerdicts: () => latestVerdicts,
+  isAdvisoryGate: () => isAdvisoryGate
 });
 function latestVerdicts(mr) {
   const m = new Map;
@@ -5939,18 +6972,23 @@ function latestVerdicts(mr) {
     m.set(r.actor, r.verdict);
   return m;
 }
-function mergeGate(mr) {
+function mergeGate(mr, branchGate) {
   const reasons = [];
   if (mr.status !== "open")
     reasons.push(`MR is ${mr.status}`);
   for (const c of mr.checks)
     if (c.status === "fail")
       reasons.push(`check '${c.name}' failed`);
+  if (branchGate?.verdict === "fail")
+    reasons.push(`branch head gate failed${branchGate.summary ? `: ${branchGate.summary}` : ""}`);
   for (const [actor2, v] of latestVerdicts(mr))
     if (v === "request-changes")
       reasons.push(`${actor2} requested changes`);
   return reasons;
 }
+function isAdvisoryGate(reason) {
+  return reason.startsWith("check '") || reason.startsWith("branch head gate");
+}
 function mrSummary(mr) {
   const approvals = [...latestVerdicts(mr).values()].filter((v) => v === "approve").length;
   const checks = mr.checks.length ? `${mr.checks.filter((c) => c.status === "pass").length}/${mr.checks.length} checks pass` : "no checks";
@@ -5965,7 +7003,7 @@ __export(exports_runtime, {
   hydrate: () => hydrate2,
   capture: () => capture
 });
-import { chmodSync as chmodSync4, existsSync as existsSync13, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync as readdirSync6, readFileSync as readFileSync13, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync14, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync as readdirSync6, readFileSync as readFileSync14, readlinkSync as readlinkSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { platform } from "node:os";
 import { dirname as dirname3, join as join13, relative as relative2 } from "node:path";
 function isolateCommand(command, scratch) {
@@ -6029,7 +7067,7 @@ async function capture(repo, dir, keep = []) {
   const pats = ignorePatterns();
   const files = new Set(walkDir(dir, dir, pats));
   for (const k of keep)
-    if (existsSync13(join13(dir, k)))
+    if (existsSync14(join13(dir, k)))
       files.add(k);
   const written = [];
   for (const f of files) {
@@ -6044,7 +7082,7 @@ async function capture(repo, dir, keep = []) {
       }
       continue;
     }
-    const buf = readFileSync13(abs);
+    const buf = readFileSync14(abs);
     if (buf.includes(0)) {
       const cur = await repo.readBytes(f);
       if (cur === undefined || cur === SEALED || !Buffer.from(cur).equals(buf)) {
@@ -6061,7 +7099,7 @@ async function capture(repo, dir, keep = []) {
   }
   const deleted = [];
   for (const t of await repo.list()) {
-    if (!existsSync13(join13(dir, t))) {
+    if (!existsSync14(join13(dir, t))) {
       await repo.deleteFile(t);
       deleted.push(t);
     }
@@ -6175,7 +7213,7 @@ __export(exports_git_adapter, {
   exportHistoryToGit: () => exportHistoryToGit
 });
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync14, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync15, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join14 } from "node:path";
 import { deflateSync } from "node:zlib";
 async function importGitHead(gitPath, ws) {
@@ -6245,7 +7283,7 @@ async function applyGitFile(repo, path, mode, content) {
 }
 function setHead(fdir, head) {
   const hf = join14(fdir, "HEAD");
-  const cur = existsSync14(hf) ? JSON.parse(readFileSync14(hf, "utf8")) : { seq: 0 };
+  const cur = existsSync15(hf) ? JSON.parse(readFileSync15(hf, "utf8")) : { seq: 0 };
   writeFileSync13(hf, JSON.stringify({ ...cur, head }));
 }
 async function importGitRepo(gitPath, fdir) {
@@ -6312,14 +7350,14 @@ function exportToGit(store2, head, gitPath, message) {
 }
 function gitObjectsDir(gitPath) {
   for (const c of [join14(gitPath, ".git", "objects"), join14(gitPath, "objects")])
-    if (existsSync14(c))
+    if (existsSync15(c))
       return c;
   return;
 }
 function writeLooseObject(objectsDir2, o) {
   const dir = join14(objectsDir2, o.oid.slice(0, 2));
   const file = join14(dir, o.oid.slice(2));
-  if (existsSync14(file))
+  if (existsSync15(file))
     return;
   const header = Buffer.from(`${o.type} ${o.content.length}\x00`);
   const framed = Buffer.concat([header, Buffer.from(o.content)]);
@@ -6436,14 +7474,14 @@ __export(exports_views, {
   loadViewsRegistry: () => loadViewsRegistry,
   createView: () => createView
 });
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync15, rmSync, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync16, rmSync, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join15, relative as relative3, resolve as resolve3 } from "node:path";
 function loadViewsRegistry(parentSol) {
   const p = viewsRegistryPath(parentSol);
-  if (!existsSync15(p))
+  if (!existsSync16(p))
     return { views: [] };
   try {
-    return JSON.parse(readFileSync15(p, "utf8"));
+    return JSON.parse(readFileSync16(p, "utf8"));
   } catch {
     return { views: [] };
   }
@@ -6476,7 +7514,7 @@ async function viewStatuses(parentSol) {
   const out = [];
   for (const v of reg.views) {
     const viewSol = join15(v.dir, ".sol");
-    const exists = existsSync15(join15(viewSol, "view.json"));
+    const exists = existsSync16(join15(viewSol, "view.json"));
     let head;
     if (exists) {
       head = await new FileOpLog(viewSol).head();
@@ -6500,7 +7538,7 @@ function pruneViews(parentSol, opts = {}) {
   const reg = loadViewsRegistry(parentSol);
   const removed = [];
   reg.views = reg.views.filter((v) => {
-    const present = existsSync15(join15(v.dir, ".sol", "view.json"));
+    const present = existsSync16(join15(v.dir, ".sol", "view.json"));
     const target = opts.name ? v.name === opts.name : !present;
     if (!target)
       return true;
@@ -6517,7 +7555,7 @@ function pruneViews(parentSol, opts = {}) {
 }
 function sharedObjectCount(parentSol) {
   const dir = join15(parentSol, "objects");
-  if (!existsSync15(dir))
+  if (!existsSync16(dir))
     return 0;
   return readdirSync7(dir).filter((n) => !n.endsWith(".tmp")).length;
 }
@@ -6529,6 +7567,169 @@ var init_views = __esm(() => {
   init_lib();
 });
 
+// src/bin/agent-sessions.ts
+var exports_agent_sessions = {};
+__export(exports_agent_sessions, {
+  stopSession: () => stopSession,
+  sessions: () => sessions,
+  sessionPath: () => sessionPath,
+  sessionDir: () => sessionDir,
+  saveSessionsRegistry: () => saveSessionsRegistry,
+  pruneSession: () => pruneSession,
+  loadSessionsRegistry: () => loadSessionsRegistry,
+  fingerprintOfSeed: () => fingerprintOfSeed,
+  createSession: () => createSession
+});
+import { chmodSync as chmodSync5, existsSync as existsSync17, mkdirSync as mkdirSync10, readFileSync as readFileSync17, rmSync as rmSync2, writeFileSync as writeFileSync15 } from "node:fs";
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { basename, dirname as dirname4, join as join16, resolve as resolve4 } from "node:path";
+function sessionPath(parentSol) {
+  return join16(parentSol, "sessions.json");
+}
+function sessionDir(parentSol, sessionId) {
+  return join16(parentSol, "sessions", sessionId);
+}
+function loadSessionsRegistry(parentSol) {
+  const p = sessionPath(parentSol);
+  if (!existsSync17(p))
+    return { sessions: [] };
+  try {
+    return JSON.parse(readFileSync17(p, "utf8"));
+  } catch {
+    return { sessions: [] };
+  }
+}
+function saveSessionsRegistry(parentSol, reg) {
+  writeFileSync15(sessionPath(parentSol), JSON.stringify(reg, null, 2));
+}
+function newSessionId(name) {
+  const slug = name.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 24) || "agent";
+  return `${slug}-${Date.now().toString(36)}-${randomBytes5(3).toString("hex")}`;
+}
+function createSession(opts) {
+  const { parentSol, name, actor: actor2, check, metadata } = opts;
+  if (!existsSync17(parentSol))
+    throw new Error(`not a sol repo: ${parentSol}`);
+  const sessionId = opts.sessionId ?? newSessionId(name);
+  const sdir = sessionDir(parentSol, sessionId);
+  if (existsSync17(sdir)) {
+    if (opts.onExistingKey)
+      opts.onExistingKey(sessionId);
+    else
+      throw new Error(`session already exists: ${sessionId} (${sdir})`);
+  }
+  const repoRoot2 = dirname4(parentSol);
+  const viewDir = opts.dir ? resolve4(opts.dir) : join16(dirname4(repoRoot2), `${basename(repoRoot2)}-${name}`);
+  if (existsSync17(join16(viewDir, ".sol")))
+    throw new Error(`already a sol repo/view: ${viewDir}`);
+  const branch = `view/${name}`;
+  const startHead = headOf(parentSol);
+  createView({ parentSol, viewDir, name, branch, actor: actor2, startHead });
+  const kp = generateKeypair();
+  mkdirSync10(sdir, { recursive: true });
+  const signingKeyPath = join16(sdir, "signing.key");
+  writeFileSync15(signingKeyPath, kp.seed, { mode: 384 });
+  try {
+    chmodSync5(signingKeyPath, 384);
+  } catch {}
+  if (check) {
+    const cfg = loadSolConfig(parentSol);
+    cfg.check = check;
+    saveSolConfig(parentSol, cfg);
+  }
+  const record = {
+    sessionId,
+    name,
+    viewDir: resolve4(viewDir),
+    branch,
+    actor: actor2,
+    signingKeyPath: resolve4(signingKeyPath),
+    fingerprint: kp.fingerprint,
+    startHead,
+    createdAt: Date.now(),
+    ...metadata ? { metadata } : {}
+  };
+  const reg = loadSessionsRegistry(parentSol);
+  reg.sessions = reg.sessions.filter((s) => s.sessionId !== sessionId);
+  reg.sessions.push(record);
+  saveSessionsRegistry(parentSol, reg);
+  return record;
+}
+function headOf(parentSol) {
+  const headFile = join16(parentSol, "HEAD");
+  if (existsSync17(headFile)) {
+    try {
+      const h = JSON.parse(readFileSync17(headFile, "utf8"));
+      if (h.head)
+        return h.head;
+    } catch {}
+  }
+  return emptyRoot(new LazyStore(join16(parentSol, "objects")));
+}
+function matches(s, ref) {
+  return s.sessionId === ref || s.name === ref;
+}
+function stopSession(parentSol, ref) {
+  const reg = loadSessionsRegistry(parentSol);
+  const s = reg.sessions.find((x) => x.sessionId === ref) ?? reg.sessions.find((x) => matches(x, ref));
+  if (!s)
+    return false;
+  if (!s.stopAt) {
+    s.stopAt = Date.now();
+    saveSessionsRegistry(parentSol, reg);
+  }
+  return true;
+}
+async function sessions(parentSol) {
+  const reg = loadSessionsRegistry(parentSol);
+  const out = [];
+  for (const s of reg.sessions) {
+    const viewSol = join16(s.viewDir, ".sol");
+    const exists = existsSync17(join16(viewSol, "view.json"));
+    let head;
+    if (exists)
+      head = await new FileOpLog(viewSol).head();
+    const state = !exists ? "stale" : s.stopAt ? "stopped" : "running";
+    out.push({ ...s, head, exists, state });
+  }
+  return out;
+}
+function pruneSession(parentSol, ref, deleteDir = false) {
+  const reg = loadSessionsRegistry(parentSol);
+  const removed = [];
+  const drop = [];
+  reg.sessions = reg.sessions.filter((s) => {
+    const present = existsSync17(join16(s.viewDir, ".sol", "view.json"));
+    const target = ref ? matches(s, ref) : !present;
+    if (!target)
+      return true;
+    drop.push(s);
+    removed.push(s.sessionId);
+    return false;
+  });
+  for (const s of drop) {
+    try {
+      pruneViews(parentSol, { name: s.name, deleteDir });
+    } catch {}
+    try {
+      rmSync2(sessionDir(parentSol, s.sessionId), { recursive: true, force: true });
+    } catch {}
+  }
+  saveSessionsRegistry(parentSol, reg);
+  return removed;
+}
+function fingerprintOfSeed(seed) {
+  return fingerprintOf(publicOf(loadPrivateKey(seed)));
+}
+var init_agent_sessions = __esm(() => {
+  init_file_store();
+  init_sign();
+  init_tree();
+  init_lib();
+  init_test_gate();
+  init_views();
+});
+
 // ../vault-sdk/src/patterns.ts
 function suggestEnvName(baseName) {
   return ENV_NAME_MAP[baseName] ?? baseName;
@@ -6961,7 +8162,7 @@ __export(exports_secret2, {
   runEnv: () => runEnv,
   resolveReference: () => resolveReference
 });
-import { readFileSync as readFileSync16, readSync, writeSync } from "node:fs";
+import { readFileSync as readFileSync18, readSync, writeSync } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function flag(args, name) {
   const i = args.indexOf(name);
@@ -7333,7 +8534,7 @@ async function envValidate(ctx, args, json) {
 }
 function readSchemaText(solDir2) {
   try {
-    return readFileSync16(schemaLockPath(solDir2), "utf8");
+    return readFileSync18(schemaLockPath(solDir2), "utf8");
   } catch {
     return;
   }
@@ -8015,8 +9216,8 @@ var exports_sol_secret_mcp = {};
 __export(exports_sol_secret_mcp, {
   startSecretMcp: () => startSecretMcp
 });
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join17 } from "node:path";
 async function buildSecretServer(solDir2) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
@@ -8052,8 +9253,8 @@ async function buildSecretServer(solDir2) {
   return server;
 }
 async function startSecretMcp(opts = {}) {
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join16(process.cwd(), ".sol");
-  if (!existsSync16(solDir2)) {
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join17(process.cwd(), ".sol");
+  if (!existsSync18(solDir2)) {
     process.stderr.write(`sol-secret-mcp: no .sol at ${solDir2} — run \`sol init\` first (or set SOL_DIR)
 `);
     process.exit(1);
@@ -8097,6 +9298,9 @@ class SolWorkspace {
     this.actor = actor2;
     this.repo = new AsyncRepo(store2, log, actor2);
   }
+  setToolCall(tc) {
+    this.repo.setToolCall(tc);
+  }
   async write(path, content) {
     return this.repo.writeFile(safePath(path), content);
   }
@@ -8188,9 +9392,9 @@ __export(exports_dispatch, {
   dispatch: () => dispatch
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync8, readFileSync as readFileSync17, rmSync as rmSync2, unlinkSync as unlinkSync7, watch, writeFileSync as writeFileSync15 } from "node:fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync19, mkdirSync as mkdirSync11, mkdtempSync, readdirSync as readdirSync8, readFileSync as readFileSync19, rmSync as rmSync3, unlinkSync as unlinkSync7, watch, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir2, hostname, platform as platform2, tmpdir } from "node:os";
-import { basename, dirname as dirname4, join as join17, resolve as resolve4, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname5, join as join18, resolve as resolve5, sep as sep2 } from "node:path";
 function globCovers(pattern, path) {
   let re = "";
   for (let i = 0;i < pattern.length; i++) {
@@ -8210,6 +9414,14 @@ function globCovers(pattern, path) {
   }
   return new RegExp(`^${re}$`).test(path);
 }
+function writableTag(path) {
+  try {
+    accessSync(path, fsConstants.R_OK | fsConstants.W_OK);
+    return "RW";
+  } catch {
+    return "READ-ONLY";
+  }
+}
 function tokenClaims(token) {
   try {
     return JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString());
@@ -8218,11 +9430,11 @@ function tokenClaims(token) {
   }
 }
 async function loadStoredToken() {
-  if (!existsSync17(CRED_PATH))
+  if (!existsSync19(CRED_PATH))
     return;
   let creds;
   try {
-    creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
+    creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
   } catch {
     return;
   }
@@ -8237,7 +9449,7 @@ async function loadStoredToken() {
       if (res.ok) {
         const r = await res.json();
         if (r.accessToken) {
-          writeFileSync15(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
+          writeFileSync16(CRED_PATH, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
           return r.accessToken;
         }
       }
@@ -8258,7 +9470,7 @@ function authHost() {
   if (process.env.SOL_AUTH)
     return process.env.SOL_AUTH.replace(/\/+$/, "");
   try {
-    const w = JSON.parse(readFileSync17(CRED_PATH, "utf8")).webUrl;
+    const w = JSON.parse(readFileSync19(CRED_PATH, "utf8")).webUrl;
     if (w)
       return w.replace(/\/+$/, "");
   } catch {}
@@ -8282,11 +9494,11 @@ async function resolveMcpHttp(a, label) {
     die(`invalid --port: ${portRaw}`);
   return { token, port, host: flagVal("--host"), label: label ?? (a.includes("--secret") || a.includes("--secrets") ? "sol-secrets" : "sol") };
 }
-function resolveRemote(solDir2) {
+function resolveRemote2(solDir2) {
   const cfg = loadRemote(solDir2);
   if (!cfg)
     return;
-  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL };
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL2 };
 }
 async function pushEnvState(solDirPath, cfg, token) {
   const { readEnvStateBundle: readEnvStateBundle2 } = await Promise.resolve().then(() => (init_anchor(), exports_anchor));
@@ -8305,6 +9517,17 @@ ENV ANCHOR REJECTED by the remote: ${e?.message ?? String(e)}
     process.exitCode = 1;
   }
 }
+async function surfaceOwner(cfg, token) {
+  const slash = cfg.repo.indexOf("/");
+  if (slash < 0)
+    return;
+  const owner = cfg.repo.slice(0, slash);
+  try {
+    const res = await ownerSet(cfg, token, owner);
+    if (res.error)
+      console.error(`note: could not set repo owner to '${owner}': ${res.error}`);
+  } catch {}
+}
 async function pullEnvState(solDirPath, cfg, token) {
   try {
     const { bundle } = await remoteEnvPull(cfg, token);
@@ -8337,7 +9560,7 @@ function cliVersion() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync17(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync19(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }
@@ -8384,7 +9607,7 @@ examples:
   sol commit "add login route"
   sol commit -m "fix parser" src/parse.ts src/lex.ts`,
     push: `sol push                          push the current branch to the configured remote (converging — never FF-rejected)
-  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL}) + this repo name, then push
+  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL2}) + this repo name, then push
   sol push --create <repo>          same, explicit form (creates the repo on first push)
   sol push --public <repo>          create + push + make it public in ONE step (else new repos are private)
 
@@ -8407,6 +9630,21 @@ examples:
 notes:
   refuses to run over a dirty tree — commit or discard first. conflicts land in the working tree with markers.
   refuses to run while UNRESOLVED <<<<<<< markers remain — resolve them and \`sol commit\`, then pull again.`,
+    sync: `sol sync --watch                  HANDS-OFF bidirectional sync daemon — auto-capture + push every edit,
+                                    and converge safe remote updates in on a timer. no CLI invocations needed:
+                                    the working tree stays in sync while every local edit is durably captured.
+  --poll-interval <ms>              how often to poll the remote for updates (default 5000)
+  --no-push-immediately             capture locally but do NOT auto-push (push later with \`sol push\`)
+  --dry-run                         log what it WOULD do, mutate nothing
+
+how it works (three loops over the same core as watch/push/pull):
+  1. every file change is auto-captured into the op-log (nothing lost, even offline)
+  2. after each capture it pushes the delta; the server may converge a concurrent commit in
+  3. it polls the remote; a moved head pulls in via converge() — NEVER clobbering an in-flight edit
+notes:
+  needs a remote (\`sol remote <url> <repo>\` or \`sol push <repo>\` once) + auth (\`sol auth login\` / SOL_TOKEN).
+  a dirty tree DEFERS a pull to the next poll (your edits are captured first). Ctrl-C exits cleanly.
+  transient network errors are logged + retried; a fatal error (corrupt repo / auth) exits loud.`,
     hide: `sol hide <pattern> [--role write|admin] [--team <id>] [--users a,b] [--escrow] [--no-list] [--hide-names] [--hide-existence] [--strict]
                                     add/update a VisibilityPolicy RULE — the HEADLINE verb. binds a glob over tree
                                     paths to an AUDIENCE (who may DECRYPT). the rule is host-visible METADATA (no
@@ -8520,6 +9758,9 @@ examples:
   sol keys verify alice 1a2b-3c4d-...   # confirm alice's key out-of-band before sealing to her`,
     remote: `sol remote                        show the configured remote
   sol remote <url> <repo>           set the remote (url + repo name)
+  sol remote verify                 REMOTE-side health check (the backend's /fsck) — differentiates auth
+                                    (session expired / no access), backend (5xx, transient), connectivity,
+                                    and a 200-but-corrupt remote repo. needs SOL_TOKEN (or \`sol auth login\`).
 
 tip: \`sol push <repo>\` configures the hosted remote for you in one step.`,
     branch: `sol branch                        list branches (* = current)
@@ -8584,6 +9825,27 @@ what it's for (TEST-GATED CONVERGENCE):
   hydrate the current tree to a sandbox, run the command, capture produced files back into a commit.
   --isolate confines the run (no network, writes stay in the sandbox).`,
     promote: "sol promote [branch]   point the remote's production branch at <branch> (default: current branch)",
+    doctor: `sol doctor   — comprehensive LOCAL health check (exit 0 = OK, 1 = problems found)
+
+checks: op-log chain integrity + contiguity, object reachability from head, auth (SOL_TOKEN / stored
+  credentials + expiry), .sol file permissions, and the sealed keyring. read-only — it diagnoses but never
+  changes anything. to RECOVER from what it finds: \`sol fsck --repair\` (op-log/head) or \`sol recover\` (cloud/backup).`,
+    fsck: `sol fsck            verify the op-log chain + object reachability (exit 0 = OK, 1 = problems)
+  sol fsck --repair   recover a corrupt repo:
+                        - head pointer lost      -> re-point to the last resolvable historical root
+                        - head dangling          -> re-point to the newest root the store still has
+                        - op-log chain broken    -> truncate to the last verified link, re-point head
+
+  every repair appends an explicit CHECKPOINT recording what happened (visible in \`sol log\`/\`sol reflog\`),
+  so the recovery is itself in the tamper-evident history. idempotent: re-running on a healthy repo is a no-op.`,
+    recover: `sol recover                              the recovery guide (the menu below)
+  sol recover --from-remote <url> <repo>   rehydrate from the cloud
+  sol recover --list-all-roots             every root the repo ever landed on (find a lost head)
+  sol recover --file <path> [--from <seq|hash>]   restore a file from history (even if the tree dropped it)
+  sol recover --dump-log [<from> [<to>]]   dump raw op-log entries as JSON (manual salvage)`,
+    reflog: `sol reflog [<branch>] [--by <actor>] [--since <YYYY-MM-DD>]
+  the op-log as a ref-move history (git reflog): each line is a head move (from -> to) with seq, actor, time,
+  and message. a merge shows as "merge". a <branch> arg keeps only checkpoints whose message labels it.`,
     git: `sol git import <repo> [dir]       import a git repo's HEAD into a new Sol repo
   sol git export <repo> [-b branch]  replay the Sol commit DAG as git history (+ provenance trailers), then \`git push\``,
     mr: `sol mr open [--from <branch>] [--to <branch>] [--upstream <repo>] -t "title" [-m body]
@@ -8873,7 +10135,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     try {
       const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
       const { openContent: openContent2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-      const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+      const ring = existsSync19(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
       const self = loadSelfIdentity2();
       setSealedDecryptor((boxStr) => {
         const box = JSON.parse(boxStr);
@@ -8883,19 +10145,19 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     } catch {}
   }
   const servesMcp = cmd === "mcp" || cmd === "secret" && args[0] === "mcp";
-  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "env", "secret"]).has(cmd) && existsSync17(solDir) ? acquireLock() : undefined;
+  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "agent", "env", "secret"]).has(cmd) && existsSync19(solDir) ? acquireLock() : undefined;
   try {
     switch (cmd) {
       case "init": {
-        const here = join17(procCwd, ".sol");
-        if (existsSync17(here))
+        const here = join18(procCwd, ".sol");
+        if (existsSync19(here))
           die("already a sol repo: " + procCwd);
         if (repoRoot && repoRoot !== procCwd && !args.includes("--force")) {
           die(`already inside a Sol repo at ${repoRoot}
   -> just commit into it: \`sol commit ...\` works from here (sol walks up to find the repo)
   -> to nest a NEW repo here anyway: \`sol init --force\``);
         }
-        mkdirSync10(here, { recursive: true });
+        mkdirSync11(here, { recursive: true });
         new FileStore(here);
         console.log(`initialized empty sol repo in ${here}`);
         break;
@@ -8925,7 +10187,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const h = tok ? identityFromToken(tok)?.handle : undefined;
           return h || die("no account identity — run `sol auth login` (or set SOL_ACCOUNT for self-host)");
         };
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const sub = args[0];
         const wantJson = args.includes("--json");
         if (sub === "init") {
@@ -9011,7 +10273,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (sub === "import") {
           const passphrase = process.env.SOL_KEYSTORE_PASSPHRASE || die("set SOL_KEYSTORE_PASSPHRASE to decrypt the bundle");
           const file = args[1] || die("usage: sol keys import <bundle.json>   (set SOL_KEYSTORE_PASSPHRASE)");
-          const bundle = JSON.parse(readFileSync17(file, "utf8"));
+          const bundle = JSON.parse(readFileSync19(file, "utf8"));
           let recovered;
           try {
             recovered = importBundle2(bundle, passphrase);
@@ -9042,7 +10304,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "trust": {
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo — run `sol init` first");
         const map = loadTrust();
         if (args[0] === "--remove" || args[0] === "-r") {
@@ -9089,7 +10351,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "track":
       case "add": {
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo — run `sol init` first");
         const files = args.filter((a) => a !== "." && !a.startsWith("-"));
         if (!files.length) {
@@ -9100,7 +10362,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let n = 0;
         for (const f of files) {
           const rf = repoRel(f);
-          if (!existsSync17(join17(cwd, rf))) {
+          if (!existsSync19(join18(cwd, rf))) {
             console.error("skip (not on disk): " + f);
             continue;
           }
@@ -9129,14 +10391,14 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (!message)
           die('commit needs a message: sol commit "what you did"  (scoped: sol commit -m "msg" file1 file2)');
         const parentHead = await repo.head();
-        const mergeHeadPath = join17(solDir, "MERGE_HEAD");
-        const parent2 = existsSync17(mergeHeadPath) ? readFileSync17(mergeHeadPath, "utf8").trim() || undefined : undefined;
+        const mergeHeadPath = join18(solDir, "MERGE_HEAD");
+        const parent2 = existsSync19(mergeHeadPath) ? readFileSync19(mergeHeadPath, "utf8").trim() || undefined : undefined;
         let changed = 0;
         let commitRoot = parentHead;
         if (paths.length) {
           for (const p of paths) {
             const rp = repoRel(p);
-            if (existsSync17(join17(cwd, rp))) {
+            if (existsSync19(join18(cwd, rp))) {
               if (await snapshotFile(repo, rp))
                 changed++;
             } else if ((await repo.list()).includes(rp)) {
@@ -9191,7 +10453,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "status": {
         const { repo, log } = open();
-        const refs = existsSync17(refsPath()) ? await loadRefs(log) : undefined;
+        const refs = existsSync19(refsPath()) ? await loadRefs(log) : undefined;
         const head = await repo.head();
         const headOp = head ? [...await log.history()].reverse().find((o) => o.rootAfter === head) : undefined;
         const headBy = headOp?.by ?? "?";
@@ -9281,7 +10543,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const { listAll: listAll3 } = await Promise.resolve().then(() => (init_tree(), exports_tree));
         const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-        const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync19(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const decrypt = (boxStr) => {
           try {
@@ -9329,7 +10591,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             const { readFile: readTree, entryKindAt: kindAt } = await Promise.resolve().then(() => (init_tree(), exports_tree));
             const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
             const { openContent: openContent2, UNREADABLE: UNREADABLE2, KeyRing: KeyRing3 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-            const ring = existsSync17(solDir) ? loadKeyRing() : new KeyRing3;
+            const ring = existsSync19(solDir) ? loadKeyRing() : new KeyRing3;
             const self = loadSelfIdentity2();
             const decrypt = (boxStr) => {
               try {
@@ -9428,7 +10690,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         };
         const live = await log.head() ?? "";
         const refArg = args.find((a) => !a.startsWith("-"));
-        const lrefs = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : null;
+        const lrefs = existsSync19(refsPath()) ? JSON.parse(readFileSync19(refsPath(), "utf8")) : null;
         let tipRoot = live;
         if (refArg) {
           tipRoot = lrefs?.branches[refArg]?.head ?? refArg;
@@ -9481,7 +10743,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const path = args[0] || die("rm needs a path");
         let onDisk = false;
         try {
-          unlinkSync7(join17(cwd, path));
+          unlinkSync7(join18(cwd, path));
           onDisk = true;
         } catch {}
         if (onDisk) {
@@ -9679,15 +10941,167 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           };
           walk(head);
         }
-        const ok = chainOk && missing.length === 0;
+        const headLost = head === undefined && ops.length > 0;
+        const ok = chainOk && missing.length === 0 && !headLost;
+        if (args.includes("--repair")) {
+          if (ok) {
+            console.log("fsck --repair: nothing to repair — the repo is OK");
+            process.exitCode = 0;
+            break;
+          }
+          const { applyRepair: applyRepair2 } = await Promise.resolve().then(() => (init_admin_repair(), exports_admin_repair));
+          const { FileStore: FileStore2 } = await Promise.resolve().then(() => (init_file_store(), exports_file_store));
+          const fileStore = new FileStore2(solDir, objectsDir());
+          const plan = await applyRepair2({
+            store: fileStore,
+            log,
+            truncate: async (toSeq) => truncateOpLog(toSeq),
+            setHead: async (h) => setOpLogHead(h)
+          }, "sol-doctor");
+          console.log(`fsck --repair: ${plan.reason}`);
+          if (plan.kind === "noop")
+            console.log("  (already healthy — nothing changed)");
+          else if (plan.kind === "unfixable") {
+            console.log("  status: UNFIXABLE — local repair cannot recover this; run `sol recover --from-remote <url> <repo>` to rehydrate");
+            process.exitCode = 1;
+            break;
+          } else {
+            console.log(`  ${plan.note}`);
+            console.log("  status: repaired — run `sol status` (or `sol fsck`) to verify");
+          }
+          process.exitCode = 0;
+          break;
+        }
         console.log(`fsck: ${ok ? "OK" : "PROBLEMS FOUND"}`);
         console.log(`  op-log: ${ops.length} op(s), chain ${chainOk ? "valid + contiguous" : "BROKEN — " + chainErr}`);
-        console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
+        if (headLost)
+          console.log(`  head:   LOST (${ops.length} op(s) but no head pointer) — run \`sol fsck --repair\``);
+        else
+          console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
         for (const mh of missing)
           console.log("    missing " + mh);
+        if (!ok)
+          console.log("  -> `sol doctor` for a full diagnosis, `sol fsck --repair` to recover");
         process.exitCode = ok ? 0 : 1;
         break;
       }
+      case "doctor": {
+        const { runDoctor: runDoctor2, renderDoctorIntegrity: renderDoctorIntegrity2 } = await Promise.resolve().then(() => (init_admin(), exports_admin));
+        const { log } = open();
+        const store2 = loadStore();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("doctor is read-only"), has: async (h) => store2.has(h) };
+        const report = await runDoctor2(asyncStore, log);
+        console.log("sol doctor");
+        for (const l of renderDoctorIntegrity2(report))
+          console.log(l);
+        const envTok = process.env.SOL_TOKEN;
+        if (envTok) {
+          const id = identityFromToken(envTok);
+          console.log(`  auth: SOL_TOKEN set${id?.handle ? ` (@${id.handle})` : id?.email ? ` (${id.email})` : ""}`);
+        } else if (existsSync19(CRED_PATH)) {
+          try {
+            const creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
+            const c = creds.accessToken ? tokenClaims(creds.accessToken) : {};
+            const exp = typeof c.exp === "number" ? new Date(c.exp * 1000).toISOString().slice(0, 10) : "?";
+            const stale = typeof c.exp === "number" && c.exp * 1000 <= Date.now();
+            console.log(`  auth: logged in${c.handle ? ` as @${c.handle}` : ""}${stale ? " (EXPIRED — run `sol auth login`)" : ` (expires ${exp})`}`);
+          } catch {
+            console.log("  auth: stored credentials unreadable — run `sol auth login`");
+          }
+        } else {
+          console.log("  auth: not logged in — `sol auth login` (or set SOL_TOKEN) for remote commands");
+        }
+        const objDir = join18(solDir, "objects");
+        const opsFile = join18(solDir, "ops.jsonl");
+        console.log(`  files: .sol/objects/ ${writableTag(objDir)}, .sol/ops.jsonl ${existsSync19(opsFile) ? writableTag(opsFile) : "(none yet)"}`);
+        const keyringPath = join18(homedir2(), ".sol", "keyring.json");
+        console.log(`  sealed: ${existsSync19(keyringPath) ? "keyring found, ready" : "no keyring (only needed for sealed paths)"}`);
+        console.log(`status: ${report.ok ? "OK" : "PROBLEMS FOUND"}`);
+        if (!report.ok)
+          console.log("  -> `sol fsck --repair` to recover the op-log/head; `sol recover` for cloud/backup rehydrate");
+        process.exitCode = report.ok ? 0 : 1;
+        break;
+      }
+      case "reflog": {
+        const { renderReflog: renderReflog2 } = await Promise.resolve().then(() => exports_admin_reflog);
+        const { log } = open();
+        const ops = await log.history();
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        const branchFilter = args[0] && !args[0].startsWith("--") ? args[0] : undefined;
+        const by = flag2("--by");
+        const sinceStr = flag2("--since");
+        const since = sinceStr ? Date.parse(sinceStr) : undefined;
+        if (sinceStr && Number.isNaN(since))
+          die(`--since: not a date: ${sinceStr} (try YYYY-MM-DD)`);
+        const lines2 = renderReflog2(ops, { branchFilter, actor: by, since });
+        if (!lines2.length)
+          console.log("(no matching ops)");
+        for (const l of lines2)
+          console.log(l);
+        break;
+      }
+      case "recover": {
+        const { RECOVER_HELP: RECOVER_HELP2, listAllRoots: listAllRoots2, restoreFileFromHistory: restoreFileFromHistory2, dumpLog: dumpLog2 } = await Promise.resolve().then(() => (init_admin_recover(), exports_admin_recover));
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        if (!args.length || args[0] === "--help") {
+          console.log(RECOVER_HELP2);
+          break;
+        }
+        if (args.includes("--from-remote")) {
+          const url = args[args.indexOf("--from-remote") + 1];
+          const repoName = args[args.indexOf("--from-remote") + 2];
+          if (!url || !repoName)
+            die("usage: sol recover --from-remote <url> <repo>");
+          console.log(`to rehydrate from the cloud, clone the remote into a fresh dir:
+  sol clone ${url} ${repoName}
+then copy your uncommitted working files in. (a destructive in-place rehydrate is intentionally manual.)`);
+          break;
+        }
+        const { log } = open();
+        const store2 = loadStore();
+        const ops = await log.history();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("recover is read-only"), has: async (h) => store2.has(h) };
+        if (args.includes("--list-all-roots")) {
+          const roots = await listAllRoots2(ops, async (h) => store2.has(h));
+          for (const r of roots)
+            console.log(`  ${r.root.slice(0, 16)}  seq ${r.seq}  ${r.resolvable ? "resolvable" : "MISSING"}${r.message ? `  ${r.message}` : ""}`);
+          if (!roots.length)
+            console.log("  (no roots — empty repo)");
+          break;
+        }
+        if (args.includes("--file")) {
+          const path = flag2("--file") || die("usage: sol recover --file <path> [--from <seq|hash>]");
+          const fromStr = flag2("--from");
+          const from = fromStr ? /^\d+$/.test(fromStr) ? Number(fromStr) : fromStr : undefined;
+          const rec = await restoreFileFromHistory2(asyncStore, ops, path, from);
+          if (!rec.found)
+            die(rec.reason);
+          if ("sealed" in rec) {
+            console.log(`${path} is sealed at seq ${rec.fromSeq} — recovered the opaque box (open it with your key):`);
+            console.log(rec.box);
+          } else {
+            const out = rec.encoding === "base64" ? Buffer.from(rec.content, "base64") : rec.content;
+            writeFileSync16(join18(cwd, path), out);
+            console.log(`restored ${path} from seq ${rec.fromSeq} (root ${rec.fromRoot.slice(0, 16)}) -> wrote to disk; \`sol add ${path}\` to re-track`);
+          }
+          break;
+        }
+        if (args.includes("--dump-log")) {
+          const i = args.indexOf("--dump-log");
+          const fromSeq = args[i + 1] && /^\d+$/.test(args[i + 1]) ? Number(args[i + 1]) : undefined;
+          const toSeq = args[i + 2] && /^\d+$/.test(args[i + 2]) ? Number(args[i + 2]) : undefined;
+          console.log(dumpLog2(ops, fromSeq, toSeq));
+          break;
+        }
+        console.log(RECOVER_HELP2);
+        break;
+      }
       case "gc": {
         const { log } = open();
         const store2 = loadStore();
@@ -9709,16 +11123,16 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           if (op.prov)
             walk(op.prov);
         }
-        const objDir = join17(solDir, "objects");
+        const objDir = join18(solDir, "objects");
         let removed = 0;
         for (const name of readdirSync8(objDir)) {
           if (name.endsWith(".tmp") || !reachable.has(name)) {
-            unlinkSync7(join17(objDir, name));
+            unlinkSync7(join18(objDir, name));
             removed++;
           }
         }
         console.log(`gc: kept ${reachable.size} object(s), removed ${removed} unreachable`);
-        if (existsSync17(join17(solDir, "env", "seal"))) {
+        if (existsSync19(join18(solDir, "env", "seal"))) {
           const { gcStaleStanzas: gcStaleStanzas2 } = await Promise.resolve().then(() => (init_secret(), exports_secret));
           const st = gcStaleStanzas2(solDir);
           if (st.removed)
@@ -9733,8 +11147,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log(p);
           break;
         }
-        const f = join17(cwd, ".solignore");
-        const lead = existsSync17(f) && !readFileSync17(f, "utf8").endsWith(`
+        const f = join18(cwd, ".solignore");
+        const lead = existsSync19(f) && !readFileSync19(f, "utf8").endsWith(`
 `) ? `
 ` : "";
         appendFileSync2(f, lead + pat + `
@@ -9745,7 +11159,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       case "hide": {
         const { repo } = open();
         const wantJson = args.includes("--json");
-        const cfg = resolveRemote(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
+        const cfg = resolveRemote2(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
         const token = process.env.SOL_TOKEN || authExpired();
         const sub = args[0];
         const flag2 = (name) => {
@@ -9850,12 +11264,12 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           let removed = 0;
           {
             const res = await scrubHistory2(solDir, ops, targets);
-            writeFileSync15(join17(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
+            writeFileSync16(join18(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
 `) + (res.ops.length ? `
 ` : ""));
-            writeFileSync15(join17(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
-            if (existsSync17(refsPath())) {
-              const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+            writeFileSync16(join18(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
+            if (existsSync19(refsPath())) {
+              const refs = JSON.parse(readFileSync19(refsPath(), "utf8"));
               for (const b of Object.values(refs.branches)) {
                 if (b.head && res.rootMap.has(b.head))
                   b.head = res.rootMap.get(b.head);
@@ -9878,7 +11292,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           break;
         }
         if (reapply) {
-          const cfg = resolveRemote(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote2(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired();
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -9945,7 +11359,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { parseRecipient: parseRecipient3, resolveRecipient: resolveRecipient3, recordAudience: recordAudience3 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
           const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
           const explicit = positional.slice(1);
           const recipientPubKeys2 = {};
           const audienceAccounts2 = [];
@@ -9953,7 +11367,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const crossAccount2 = [];
           let policyApplied2 = false;
           if (!explicit.length) {
-            const cfg = resolveRemote(solDir);
+            const cfg = resolveRemote2(solDir);
             const token = process.env.SOL_TOKEN;
             if (cfg && token) {
               const resolved = await recipientsForPath(cfg, token, dir).catch(() => {
@@ -10013,15 +11427,15 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (content === SEALED && !args.includes("--hide-names"))
           die("already sealed: " + path);
         if (content === undefined) {
-          const abs = join17(cwd, path);
-          if (!existsSync17(abs))
+          const abs = join18(cwd, path);
+          if (!existsSync19(abs))
             die("no such file: " + path);
-          content = readFileSync17(abs, "utf8");
+          content = readFileSync19(abs, "utf8");
         }
         const ring = loadKeyRing();
         const { SealedClient: SealedClient2 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
         const { parseRecipient: parseRecipient2, resolveRecipient: resolveRecipient2, recordAudience: recordAudience2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const recipientPubKeys = {};
         const audienceAccounts = [];
         const localRecipients = new Set([actor]);
@@ -10034,7 +11448,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let hideNamesFromPolicy = false;
         let hideExistenceFromPolicy = false;
         if (!rawRecipients.length) {
-          const cfg = resolveRemote(solDir);
+          const cfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -10063,7 +11477,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           }
         }
         if (wantEscrow && !escrowSlots.length) {
-          const cfg = resolveRemote(solDir);
+          const cfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { recipientsForAudience: recipientsForAudience2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
@@ -10269,7 +11683,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { repo } = open();
         const wantJson = args.includes("--json");
         if (args.includes("--check")) {
-          const cfg = resolveRemote(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote2(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired();
           const { policyCheck: policyCheck2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
           const states = [];
@@ -10326,7 +11740,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
         const { parseStruct: parseStruct2 } = await Promise.resolve().then(() => (init_struct(), exports_struct));
         const audiences = loadAudiences2(solDir);
-        const ring = existsSync17(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync19(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const levelOf = (boxStr) => {
           try {
@@ -10521,7 +11935,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const result = merge2({ store: store2 }, other.base, ours, other.head);
         if (result.conflicts.length) {
           materializeTree(store2, result.head);
-          writeFileSync15(join17(solDir, "MERGE_HEAD"), other.head);
+          writeFileSync16(join18(solDir, "MERGE_HEAD"), other.head);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`merge ${name} -> ${result.conflicts.length} conflict(s), left in your working tree (uncommitted):`);
           for (const c of result.conflicts)
@@ -10622,8 +12036,19 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "remote": {
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo");
+        if (args[0] === "verify") {
+          const { remoteVerify: remoteVerify2, renderRemoteVerify: renderRemoteVerify2 } = await Promise.resolve().then(() => (init_admin_remote_verify(), exports_admin_remote_verify));
+          const cfg2 = resolveRemote2(solDir) || die("no remote — `sol remote <url> <repo>` (or `sol clone`) first");
+          const token = process.env.SOL_TOKEN || await loadStoredToken() || authExpired();
+          const result = await remoteVerify2((url, init) => fetch(url, init), cfg2.url, cfg2.repo, token);
+          const { lines: lines2, exitCode } = renderRemoteVerify2(result);
+          for (const l of lines2)
+            console.log(l);
+          process.exitCode = exitCode;
+          break;
+        }
         if (args[0]) {
           const repoName = args[1] || die("usage: sol remote <url> <repo>");
           saveRemote(solDir, { url: args[0], repo: repoName });
@@ -10668,15 +12093,15 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           }
           if (!tokens)
             die("timed out waiting for approval");
-          mkdirSync10(dirname4(CRED_PATH), { recursive: true });
-          writeFileSync15(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
+          mkdirSync11(dirname5(CRED_PATH), { recursive: true });
+          writeFileSync16(CRED_PATH, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
           const c = tokenClaims(tokens.accessToken);
           console.log(`
   Logged in as ${c.handle ? `@${c.handle}` : c.email || "user"}.`);
           if (!c.handle)
             console.log("  (no handle yet — set one in the web app to get your <handle>/<repo> namespace)");
         } else if (sub === "logout") {
-          if (existsSync17(CRED_PATH))
+          if (existsSync19(CRED_PATH))
             unlinkSync7(CRED_PATH);
           console.log("logged out");
         } else if (sub === "status" || !sub) {
@@ -10685,11 +12110,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log(`authenticated via SOL_TOKEN (env)${c2.handle ? ` as @${c2.handle}` : ""}`);
             break;
           }
-          if (!existsSync17(CRED_PATH)) {
+          if (!existsSync19(CRED_PATH)) {
             console.log("not logged in — run `sol auth login` (or set SOL_TOKEN)");
             break;
           }
-          const creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
           const c = tokenClaims(creds.accessToken || "");
           const stale = typeof c.exp === "number" && c.exp * 1000 < Date.now();
           console.log(`logged in as ${c.handle ? `@${c.handle}` : c.email || "user"} via ${creds.webUrl}${stale ? " (token stale — refreshes on next use)" : ""}`);
@@ -10739,9 +12164,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log("heads-up: changing your handle re-namespaces your repos under the new <handle>/<repo>.");
           console.log(`handle set to @${out.handle}`);
         } else if (sub === "pat") {
-          if (!existsSync17(CRED_PATH))
+          if (!existsSync19(CRED_PATH))
             die("run `sol auth login` first");
-          const creds = JSON.parse(readFileSync17(CRED_PATH, "utf8"));
+          const creds = JSON.parse(readFileSync19(CRED_PATH, "utf8"));
           const token = await loadStoredToken();
           if (!token || !creds.webUrl)
             die("run `sol auth login` first");
@@ -10799,11 +12224,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const { converge: converge2 } = await Promise.resolve().then(() => (init_converge(), exports_converge));
           const peer = openPeer2(localSrc);
           const peerHead = await peer.log.head();
-          const dest = resolve4(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
-          const ddir = join17(dest, ".sol");
-          if (existsSync17(ddir))
+          const dest = resolve5(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
+          const ddir = join18(dest, ".sol");
+          if (existsSync19(ddir))
             die("already a sol repo: " + dest);
-          mkdirSync10(ddir, { recursive: true });
+          mkdirSync11(ddir, { recursive: true });
           const peerOps = await peer.log.history();
           const res = await converge2({ store: new FileStore(ddir), log: new FileOpLog(ddir) }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor });
           const dstore = new Store;
@@ -10813,7 +12238,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const files = (res.head ? listAll(dstore, res.head) : []).filter((f) => !f.split("/").some(isReservedKey2));
           for (const f of files)
             materializeInto(dstore, res.head, dest, f);
-          writeFileSync15(join17(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
+          writeFileSync16(join18(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
           writeWorkingIndexAt(ddir, dest, files);
           console.log(`cloned local peer ${args[0]} -> ${dest} (${(await peer.log.history()).length} ops, ${files.length} files)`);
           break;
@@ -10821,13 +12246,13 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const [url, rest] = remoteUrlArg(args);
         const repoName = rest[0] || die("usage: sol clone [<url>] <owner>/<repo> [dir]");
         const token = process.env.SOL_TOKEN || die("set SOL_TOKEN to the backend bearer token");
-        const target = resolve4(cwd, rest[1] || repoName.split("/").pop() || repoName);
-        const fdir = join17(target, ".sol");
-        if (existsSync17(fdir))
+        const target = resolve5(cwd, rest[1] || repoName.split("/").pop() || repoName);
+        const fdir = join18(target, ".sol");
+        if (existsSync19(fdir))
           die("already a sol repo: " + target);
         const cfg = { url, repo: repoName };
         const bundle = await remoteExport(cfg, token);
-        mkdirSync10(fdir, { recursive: true });
+        mkdirSync11(fdir, { recursive: true });
         await writeBundle(fdir, bundle, 0);
         saveRemote(fdir, cfg);
         await pullEnvState(fdir, cfg, token);
@@ -10840,8 +12265,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           cloneBranches[name] = { head: h, base: h, remote: h };
         if (!cloneBranches[onBranch])
           cloneBranches[onBranch] = { head: checkoutHead, base: checkoutHead, remote: checkoutHead };
-        writeFileSync15(join17(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync15(join17(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
+        writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync16(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
         const store2 = new Store;
         for (const node of bundle.nodes)
           store2.put(node);
@@ -10862,11 +12287,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         if (!loadRemote(solDir)) {
           const repoName = args.find((a) => !a.startsWith("-"));
           if (repoName) {
-            saveRemote(solDir, { url: DEFAULT_REMOTE_URL, repo: repoName });
-            console.log(`remote set: ${DEFAULT_REMOTE_URL} (repo ${repoName})`);
+            saveRemote(solDir, { url: DEFAULT_REMOTE_URL2, repo: repoName });
+            console.log(`remote set: ${DEFAULT_REMOTE_URL2} (repo ${repoName})`);
           }
         }
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
         {
           const { pendingScrubPaths: pendingScrubPaths2, historyHasCleartext: historyHasCleartext2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
           const ops0 = await log.history();
@@ -10880,7 +12305,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const localRefs = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : undefined;
+        const localRefs = existsSync19(refsPath()) ? JSON.parse(readFileSync19(refsPath(), "utf8")) : undefined;
         const branch = localRefs?.current ?? "main";
         const branchHead = await log.head() ?? "";
         const remoteWasEmpty = rh.seq === 0 && !rh.tip;
@@ -10892,7 +12317,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const forkBase = localRefs?.branches[branch]?.remote;
         const baseOp = forkBase ? ops.find((o) => o.rootAfter === forkBase) : undefined;
         const fromSeq = baseOp ? baseOp.seq : rh.seq;
-        const res = await remotePush(cfg, token, {
+        const res = await remotePushChunked(cfg, token, {
           nodes: allLocalNodes(),
           ops: ops.filter((o) => o.seq > fromSeq),
           branch,
@@ -10903,8 +12328,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const prevHead = await log.head() ?? "";
         await writeBundle(solDir, canon, 0);
         const convergedHead = res.head ?? canon.refs?.branches?.[branch] ?? branchHead;
-        if (existsSync17(refsPath())) {
-          const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+        if (existsSync19(refsPath())) {
+          const refs = JSON.parse(readFileSync19(refsPath(), "utf8"));
           if (canon.refs) {
             for (const [name, h] of Object.entries(canon.refs.branches)) {
               refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
@@ -10928,6 +12353,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           console.log(`pushed ${res.applied} op(s) -> remote (branch ${branch} @ ${(convergedHead || "").slice(0, 12)})${mergedNote}${conflictNote}${prod ? `; production=${prod}` : ""}`);
         }
         await pushEnvState(solDir, cfg, token);
+        await surfaceOwner(cfg, token);
         if (wantPublic) {
           const a = await accessSet(cfg, token, { visibility: "public" });
           console.log(`${cfg.repo} is now ${a.visibility}`);
@@ -10968,8 +12394,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const ownMeta = readViewMeta(solDir);
           const base2 = peerMeta?.startHead ?? ownMeta?.startHead;
           const res = await converge2({ store: new FileStore(solDir, objectsDir()), log }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor, ...base2 ? { base: base2 } : {} });
-          if (existsSync17(refsPath())) {
-            const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+          if (existsSync19(refsPath())) {
+            const refs = JSON.parse(readFileSync19(refsPath(), "utf8"));
             if (refs.branches[refs.current])
               refs.branches[refs.current].head = res.head;
             saveRefs(refs);
@@ -10992,7 +12418,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           }
           break;
         }
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         await surfaceEnvDivergence(solDir, cfg, token);
         await pullEnvState(solDir, cfg, token);
@@ -11000,11 +12426,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const curBranch = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")).current : bundle.refs?.production || "main";
+        const curBranch = existsSync19(refsPath()) ? JSON.parse(readFileSync19(refsPath(), "utf8")).current : bundle.refs?.production || "main";
         const remoteCurHead = bundle.refs?.branches?.[curBranch] ?? bundle.head ?? "";
         if (bundle.seq === localSeq && bundle.tip === localTip) {
-          if (bundle.refs && existsSync17(refsPath())) {
-            const lr = JSON.parse(readFileSync17(refsPath(), "utf8"));
+          if (bundle.refs && existsSync19(refsPath())) {
+            const lr = JSON.parse(readFileSync19(refsPath(), "utf8"));
             const before = lr.branches[lr.current]?.head;
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
@@ -11028,9 +12454,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           break;
         }
         const syncRefHead = (h) => {
-          if (!existsSync17(refsPath()))
+          if (!existsSync19(refsPath()))
             return;
-          const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+          const refs = JSON.parse(readFileSync19(refsPath(), "utf8"));
           if (refs.branches[refs.current])
             refs.branches[refs.current].head = h;
           saveRefs(refs);
@@ -11048,8 +12474,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           syncRefHead(remoteCurHead);
           setOpLogHead(remoteCurHead);
           materializeTree(loadStore(), remoteCurHead);
-          if (bundle.refs && existsSync17(refsPath())) {
-            const lr = JSON.parse(readFileSync17(refsPath(), "utf8"));
+          if (bundle.refs && existsSync19(refsPath())) {
+            const lr = JSON.parse(readFileSync19(refsPath(), "utf8"));
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
             saveRefs(lr);
@@ -11097,9 +12523,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           for (const c of result.conflicts) {
             const blob = fileAt(store2, result.head, c.path);
             if (blob)
-              writeFileSync15(join17(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+              writeFileSync16(join18(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
           }
-          writeFileSync15(join17(solDir, "MERGE_HEAD"), remoteHead2);
+          writeFileSync16(join18(solDir, "MERGE_HEAD"), remoteHead2);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`pulled + merged WITH ${result.conflicts.length} conflict(s), left uncommitted in your working tree:`);
           for (const c of result.conflicts)
@@ -11113,12 +12539,36 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         }
         break;
       }
+      case "sync": {
+        if (!existsSync19(solDir))
+          die("not a sol repo — run `sol init` first");
+        if (!args.includes("--watch"))
+          die("usage: sol sync --watch [--poll-interval <ms>] [--no-push-immediately] [--dry-run]");
+        resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` first");
+        const token = process.env.SOL_TOKEN || await loadStoredToken() || authExpired();
+        const intFlag = (name, def) => {
+          const i = args.indexOf(name);
+          if (i < 0 || i + 1 >= args.length)
+            return def;
+          const n = Number(args[i + 1]);
+          return Number.isFinite(n) && n > 0 ? n : def;
+        };
+        const { runSyncWatch: runSyncWatch2 } = await Promise.resolve().then(() => (init_sync_watch(), exports_sync_watch));
+        await runSyncWatch2({
+          repoDir: cwd,
+          token,
+          pollInterval: intFlag("--poll-interval", 5000),
+          pushImmediate: !args.includes("--no-push-immediately"),
+          dryRun: args.includes("--dry-run")
+        });
+        break;
+      }
       case "promote": {
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo");
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
-        const cur = existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")).current : "main";
+        const cur = existsSync19(refsPath()) ? JSON.parse(readFileSync19(refsPath(), "utf8")).current : "main";
         const branch = args[0] || cur;
         const refs = await remotePromote(cfg, token, branch);
         console.log(`promoted '${branch}' -> production '${refs.production}' now at ${(refs.branches[refs.production] ?? "").slice(0, 12)}`);
@@ -11129,9 +12579,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const parent = frest[0] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const newRepo = frest[1] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const token = process.env.SOL_TOKEN || authExpired();
-        const target = resolve4(cwd, frest[2] || newRepo);
-        const fdir = join17(target, ".sol");
-        if (existsSync17(fdir))
+        const target = resolve5(cwd, frest[2] || newRepo);
+        const fdir = join18(target, ".sol");
+        if (existsSync19(fdir))
           die("already a sol repo: " + target);
         const parentCfg = { url, repo: parent };
         const newCfg = { url, repo: newRepo, forkParent: parent };
@@ -11147,7 +12597,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         }
         await forkMeta(newCfg, token, parent);
         const canon = await remoteExport(newCfg, token);
-        mkdirSync10(fdir, { recursive: true });
+        mkdirSync11(fdir, { recursive: true });
         await writeBundle(fdir, canon, 0);
         const srvRefs = canon.refs ?? { branches: { main: canon.head ?? "" }, production: "main" };
         const checkout = canon.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? canon.head };
@@ -11156,8 +12606,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const cloneBranches = {};
         for (const [name, h] of Object.entries(srvRefs.branches))
           cloneBranches[name] = { head: h, base: h, remote: h };
-        writeFileSync15(join17(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync15(join17(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
+        writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync16(join18(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
         saveRemote(fdir, newCfg);
         const store2 = new Store;
         for (const node of canon.nodes)
@@ -11175,7 +12625,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
       }
       case "access": {
         const token = process.env.SOL_TOKEN || authExpired();
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const sub = args[0];
         if (!sub || sub === "show") {
           const a = await accessGet(cfg, token);
@@ -11227,7 +12677,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "forks": {
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         const { forks } = await forksList(cfg, token);
         if (!forks.length)
@@ -11240,11 +12690,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "mr": {
-        const cfg = resolveRemote(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired();
         const { mrSummary: mrSummary2 } = await Promise.resolve().then(() => exports_mr);
         const sub = args[0];
-        const localRefs = () => existsSync17(refsPath()) ? JSON.parse(readFileSync17(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
+        const localRefs = () => existsSync19(refsPath()) ? JSON.parse(readFileSync19(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
         const flag2 = (name) => {
           const i = args.indexOf(name);
           return i >= 0 ? args[i + 1] : undefined;
@@ -11422,7 +12872,7 @@ ${mrSummary2(pr)}`);
           die("usage: sol run [--keep <path>] [--isolate] <command...>");
         const { capture: capture3, hydrate: hydrate3, isolateCommand: isolateCommand2 } = await Promise.resolve().then(() => (init_runtime(), exports_runtime));
         const head = await repo.head();
-        const dir = mkdtempSync(join17(tmpdir(), "sol-run-"));
+        const dir = mkdtempSync(join18(tmpdir(), "sol-run-"));
         try {
           const hn = hydrate3(loadStore(), head, dir);
           console.log(`hydrated ${hn} file(s) -> sandbox${isolate ? " (isolated: no network, writes confined to the sandbox)" : ""}`);
@@ -11442,8 +12892,8 @@ ${mrSummary2(pr)}`);
           const { written, deleted } = await capture3(repo, dir, keep);
           if (written.length || deleted.length) {
             await appendCommit(log, await repo.head(), `run: ${command.join(" ")}`, head);
-            if (existsSync17(refsPath())) {
-              const refs = JSON.parse(readFileSync17(refsPath(), "utf8"));
+            if (existsSync19(refsPath())) {
+              const refs = JSON.parse(readFileSync19(refsPath(), "utf8"));
               if (refs.branches[refs.current]) {
                 refs.branches[refs.current].head = await repo.head();
                 saveRefs(refs);
@@ -11455,7 +12905,7 @@ ${mrSummary2(pr)}`);
               materialize(synced, nh, f);
             for (const f of deleted) {
               try {
-                unlinkSync7(join17(cwd, f));
+                unlinkSync7(join18(cwd, f));
               } catch {}
             }
             console.log(`captured ${written.length} written, ${deleted.length} deleted file(s):`);
@@ -11467,7 +12917,7 @@ ${mrSummary2(pr)}`);
             console.log("no files captured (the run produced no tracked changes)");
           }
         } finally {
-          rmSync2(dir, { recursive: true, force: true });
+          rmSync3(dir, { recursive: true, force: true });
         }
         break;
       }
@@ -11475,12 +12925,12 @@ ${mrSummary2(pr)}`);
         const [{ exportHistoryToGit: exportHistoryToGit2, importGitRepo: importGitRepo2 }, { hydrate: hydrate3 }] = await Promise.all([Promise.resolve().then(() => (init_git_adapter(), exports_git_adapter)), Promise.resolve().then(() => (init_runtime(), exports_runtime))]);
         const sub = args[0];
         if (sub === "import") {
-          const gitPath = resolve4(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
-          const target = resolve4(cwd, args[2] || basename(gitPath));
-          const fdir = join17(target, ".sol");
-          if (existsSync17(fdir))
+          const gitPath = resolve5(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
+          const target = resolve5(cwd, args[2] || basename2(gitPath));
+          const fdir = join18(target, ".sol");
+          if (existsSync19(fdir))
             die("already a sol repo: " + target);
-          mkdirSync10(fdir, { recursive: true });
+          mkdirSync11(fdir, { recursive: true });
           const { commits, branches, head, current } = await importGitRepo2(gitPath, fdir);
           const refsBranches = {};
           for (const b of branches)
@@ -11488,20 +12938,20 @@ ${mrSummary2(pr)}`);
           if (!refsBranches[current])
             refsBranches[current] = { head, base: head };
           refsBranches[current].head = head;
-          writeFileSync15(join17(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
+          writeFileSync16(join18(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
           const store2 = new Store;
-          for (const name of readdirSync8(join17(fdir, "objects"))) {
+          for (const name of readdirSync8(join18(fdir, "objects"))) {
             if (name.endsWith(".tmp"))
               continue;
             try {
-              store2.put(decodeObject(readFileSync17(join17(fdir, "objects", name))));
+              store2.put(decodeObject(readFileSync19(join18(fdir, "objects", name))));
             } catch {}
           }
           const onDisk = hydrate3(store2, head, target);
-          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename(gitPath)} (${onDisk} files; on branch ${current})`);
+          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename2(gitPath)} (${onDisk} files; on branch ${current})`);
         } else if (sub === "export") {
           const { log } = open();
-          const gitPath = resolve4(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
+          const gitPath = resolve5(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
           const store2 = loadStore();
           const head = await log.head() ?? "";
           if (!head || !listAll(store2, head).length) {
@@ -11520,15 +12970,111 @@ ${mrSummary2(pr)}`);
         }
         break;
       }
+      case "agent": {
+        if (!existsSync19(solDir))
+          die("not a sol repo — run `sol init` first");
+        const parentSol = parentSolDir(solDir) ?? solDir;
+        const { createSession: createSession2, stopSession: stopSession2, sessions: sessions2, pruneSession: pruneSession2 } = await Promise.resolve().then(() => (init_agent_sessions(), exports_agent_sessions));
+        const sub = args[0];
+        const json = args.includes("--json");
+        const flagVal = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        switch (sub) {
+          case "start": {
+            const name = args.slice(1).find((a) => !a.startsWith("-")) || die('usage: sol agent start <name> [dir] [--actor <name>] [--check "<cmd>"]');
+            const positionals2 = args.slice(1).filter((a) => !a.startsWith("-"));
+            const sessionActor = flagVal("--actor") || actor;
+            const metaRaw = flagVal("--meta");
+            let metadata;
+            if (metaRaw) {
+              try {
+                metadata = JSON.parse(metaRaw);
+              } catch {
+                die("--meta must be valid JSON");
+              }
+            }
+            const rec = createSession2({
+              parentSol,
+              name,
+              actor: sessionActor,
+              dir: positionals2[1] ? resolve5(procCwd, positionals2[1]) : undefined,
+              check: flagVal("--check"),
+              metadata
+            });
+            if (json) {
+              console.log(JSON.stringify(rec));
+              break;
+            }
+            console.log(`started agent session '${rec.name}'  (id ${rec.sessionId})`);
+            console.log(`  view     ${rec.viewDir}  (branch ${rec.branch} @ ${(rec.startHead || "empty").slice(0, 12)})`);
+            console.log(`  actor    ${rec.actor}`);
+            console.log(`  identity ${rec.fingerprint}`);
+            console.log(`  -> wire the agent:  cd ${rec.viewDir} && export SOL_ACTOR=${rec.actor} SOL_SIGNING_KEY=$(cat ${rec.signingKeyPath})`);
+            console.log(`     then edit + \`sol commit -m "..." <files>\`; converge with \`sol pull ${rec.viewDir}\` from the parent.`);
+            console.log(`  stop/clean:  \`sol agent stop ${rec.sessionId}\`  |  \`sol agent cleanup ${rec.sessionId} --delete\``);
+            break;
+          }
+          case "stop": {
+            const id = args.slice(1).find((a) => !a.startsWith("-")) || die("usage: sol agent stop <sessionId>");
+            const ok = stopSession2(parentSol, id);
+            if (json)
+              console.log(JSON.stringify({ stopped: ok, sessionId: id }));
+            else
+              console.log(ok ? `stopped session ${id} (the view + key remain — \`sol agent cleanup\` to remove)` : `no such session: ${id}`);
+            if (!ok)
+              process.exitCode = 1;
+            break;
+          }
+          case "status":
+          case undefined: {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const all = await sessions2(parentSol);
+            const list = id ? all.filter((s) => s.sessionId === id || s.name === id) : all;
+            if (json) {
+              console.log(JSON.stringify({ repo: parentSol, sessions: list }));
+              break;
+            }
+            if (!list.length) {
+              console.log(id ? `no such session: ${id}` : "no agent sessions — start one with `sol agent start <name>`");
+              break;
+            }
+            console.log(`agent sessions of ${parentSol}:`);
+            for (const s of list) {
+              console.log(`  ${s.name.padEnd(16)} ${s.sessionId.padEnd(28)} ${(s.head || s.startHead || "empty").slice(0, 12)}  ${s.actor.padEnd(12)} ${s.fingerprint}  [${s.state}]`);
+              console.log(`      ${s.viewDir}`);
+            }
+            console.log("  stop: `sol agent stop <id>` | cleanup: `sol agent cleanup <id> [--delete]` (or bare `cleanup` to prune stale)");
+            break;
+          }
+          case "cleanup": {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const removed = pruneSession2(parentSol, id, args.includes("--delete"));
+            if (json)
+              console.log(JSON.stringify({ removed }));
+            else
+              console.log(removed.length ? `cleaned ${removed.length} session(s): ${removed.join(", ")}` : id ? `no such session: ${id}` : "no stale sessions to clean");
+            break;
+          }
+          default:
+            die(`unknown: sol agent ${sub}
+  sol agent start <name> [dir] [--actor N] [--check "<cmd>"]
+  sol agent status [<id>]
+  sol agent stop <id>
+  sol agent cleanup [<id>] [--delete]`);
+        }
+        break;
+      }
       case "view": {
         const { log } = open();
         if (readViewMeta(solDir))
           die("already inside a view — create views from the parent repo (its `.sol` owns the shared store + op-log).");
         const name = args.find((a) => !a.startsWith("-")) || die("usage: sol view <name> [dir]");
         const rest = args.filter((a) => !a.startsWith("-"));
-        const defaultDir = join17(dirname4(cwd), `${basename(cwd)}-${name}`);
-        const viewDir = rest[1] ? resolve4(procCwd, rest[1]) : defaultDir;
-        if (existsSync17(join17(viewDir, ".sol")))
+        const defaultDir = join18(dirname5(cwd), `${basename2(cwd)}-${name}`);
+        const viewDir = rest[1] ? resolve5(procCwd, rest[1]) : defaultDir;
+        if (existsSync19(join18(viewDir, ".sol")))
           die("already a sol repo/view: " + viewDir);
         const branch = `view/${name}`;
         const startHead = await log.head() ?? emptyRoot(loadStore());
@@ -11542,7 +13088,7 @@ ${mrSummary2(pr)}`);
         break;
       }
       case "views": {
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo");
         const parentSol = parentSolDir(solDir) ?? solDir;
         const { pruneViews: pruneViews2, viewStatuses: viewStatuses2, sharedObjectCount: sharedObjectCount2 } = await Promise.resolve().then(() => (init_views(), exports_views));
@@ -11638,12 +13184,12 @@ ${mrSummary2(pr)}`);
           await startSecretMcp2({ solDir, http });
           break;
         }
-        if (!existsSync17(solDir))
+        if (!existsSync19(solDir))
           die("not a sol repo — run `sol init` first");
         const { runEnv: runEnv2, runSecret: runSecret2, resolveReference: resolveReference2 } = await Promise.resolve().then(() => (init_secret2(), exports_secret2));
         const { loadSelfIdentity: loadSelfIdentity2, loadManageIdentity: loadManageIdentity2, fetchKey: fetchKey2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { loadIdentity: loadIdentity2 } = await Promise.resolve().then(() => (init_identity_store(), exports_identity_store));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
         const selfPub = (account) => {
           const id = loadIdentity2();
           return id && id.accountId === account ? id.x25519Pub : undefined;
@@ -11655,7 +13201,7 @@ ${mrSummary2(pr)}`);
         };
         const dirEdPub = async (account) => (await fetchKey2(dirUrl, account))?.edPub;
         const remoteAnchorVerify = async () => {
-          const rcfg = resolveRemote(solDir);
+          const rcfg = resolveRemote2(solDir);
           const token = process.env.SOL_TOKEN || await loadStoredToken();
           if (!rcfg || !token)
             return;
@@ -11705,6 +13251,11 @@ everyday (examples are copy-safe — use real filenames):
   sol rm old.txt                 delete a file (from the repo and disk)
   sol ignore "*.tmp"             add an ignore pattern (no arg lists the active patterns)
   sol fsck / sol gc            verify integrity / drop unreachable objects
+  sol doctor                     full health check (op-log + objects + auth + files + sealed keyring)
+  sol fsck --repair              recover a corrupt repo (re-point a lost head / truncate to the last verified link)
+  sol recover                    guide through recovery (rehydrate from cloud, list roots, restore a file from history)
+  sol reflog                     the op-log as a ref-move history (head moves, by actor/branch/date)
+  sol remote verify              REMOTE-side health check (the backend's /fsck) with auth/network differentiation
   sol check --set "bun test"     gate convergence on a test command: a merge that line-converges but FAILS
                                  the check is flagged as a SEMANTIC conflict (status state:"SEMANTIC"), not
                                  silently accepted. \`sol check\` runs it on demand. (sol check --help)
@@ -11741,6 +13292,16 @@ clone-free agent views (the worktree killer — N agents, one shared store on di
                                  \`sol pull <view>\` converges losslessly. (sol view --help)
   sol views                      list every view (name, dir, branch, head, author, active/stale) + --prune
 
+agent sessions (one atomic command provisions a working tree, a signing identity, an actor, and the test-gate):
+  sol agent start <name>         create a view + MINT a per-session Ed25519 signing key + wire the actor +
+                                 inherit/set the test-gate, all at once. prints SOL_SIGNING_KEY / SOL_ACTOR to
+                                 export so every op the agent authors is cryptographically attributable.
+                                 (--actor <name>, --check "<cmd>", [dir], --json)
+  sol agent status [<id>]        list sessions (name, id, head, actor, fingerprint, running/stopped/stale)
+  sol agent stop <id>            mark a session stopped (presence signal; view + key remain)
+  sol agent cleanup [<id>]       remove the session record + its key (--delete also removes the view dir;
+                                 bare \`cleanup\` prunes every stale session)
+
 branches & tags:
   sol branch                     list branches (sol branch feature creates one at HEAD)
   sol switch feature             switch to a branch (captures current work first, never loses it)
@@ -11757,6 +13318,7 @@ auth (sign in once; remote commands then use the cached token, no SOL_TOKEN need
 remotes (self-hostable backend; token in SOL_TOKEN or via sol auth login):
   sol clone [<url>] <owner>/<repo> [dir]   clone a remote repo (checks out PRODUCTION); default dir = <repo>
   sol push / sol pull          sync your commits with the remote (push registers your branch's head)
+  sol sync --watch             hands-off bidirectional sync daemon: auto-capture + push edits, converge safe pulls in
   sol push <repo>                one-step share: no remote set? use the hosted Sol + <repo>, then push
   sol push --public <repo>       create + push + make public in one step (new repos are private by default)
   sol promote [branch]         point the remote's production branch at <branch> (default: current)
@@ -11796,10 +13358,15 @@ async function runCli(argv) {
     const msg = e?.message || String(e);
     if (/ -> 401\b/.test(msg) || /\b401 unauthorized\b/i.test(msg))
       authExpired();
+    const { CorruptObjectError: CorruptObjectError2, CorruptRepoError: CorruptRepoError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
+    if (e instanceof CorruptObjectError2 || e instanceof CorruptRepoError2) {
+      const { friendlyError: friendlyError2 } = await Promise.resolve().then(() => (init_errors_friendly(), exports_errors_friendly));
+      die(friendlyError2(e));
+    }
     die(msg);
   }
 }
-var CRED_PATH, DEFAULT_REMOTE_URL, ATTEST_KEY, remoteUrlArg = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL, a], cfgDir = () => parentSolDir(solDir) ?? solDir;
+var CRED_PATH, DEFAULT_REMOTE_URL2, ATTEST_KEY, remoteUrlArg = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL2, a];
 var init_dispatch = __esm(() => {
   init_chain();
   init_diff();
@@ -11811,8 +13378,8 @@ var init_dispatch = __esm(() => {
   init_remote();
   init_lib();
   init_test_gate();
-  CRED_PATH = join17(homedir2(), ".sol", "credentials");
-  DEFAULT_REMOTE_URL = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+  CRED_PATH = join18(homedir2(), ".sol", "credentials");
+  DEFAULT_REMOTE_URL2 = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
   ATTEST_KEY = process.env.SOL_ATTEST_KEY || undefined;
 });
 
@@ -11992,10 +13559,16 @@ var init_mcp_vcs_tools = __esm(() => {
 // src/bin/sol-mcp.ts
 var exports_sol_mcp = {};
 __export(exports_sol_mcp, {
+  toolCallFor: () => toolCallFor,
   startWorkspaceMcp: () => startWorkspaceMcp
 });
-import { mkdirSync as mkdirSync11 } from "node:fs";
-import { dirname as dirname5, join as join18 } from "node:path";
+import { createHash as createHash7, randomUUID as randomUUID2 } from "node:crypto";
+import { mkdirSync as mkdirSync12 } from "node:fs";
+import { dirname as dirname6, join as join19 } from "node:path";
+function toolCallFor(name, args) {
+  const argsHash = "h_" + createHash7("sha256").update(JSON.stringify(args ?? {})).digest("hex").slice(0, 16);
+  return { name, argsHash, invocationId: randomUUID2() };
+}
 async function handle(ws, name, a) {
   switch (name) {
     case "sol_write":
@@ -12036,8 +13609,8 @@ async function handle(ws, name, a) {
 async function buildWorkspaceServer(solDir2) {
   const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
   const { CallToolRequestSchema, ListToolsRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
-  mkdirSync11(solDir2, { recursive: true });
-  const repoRoot2 = dirname5(solDir2);
+  mkdirSync12(solDir2, { recursive: true });
+  const repoRoot2 = dirname6(solDir2);
   if (process.cwd() !== repoRoot2) {
     try {
       process.chdir(repoRoot2);
@@ -12051,16 +13624,20 @@ async function buildWorkspaceServer(solDir2) {
       const r = await callVcsTool(req.params.name, req.params.arguments ?? {});
       return { content: [{ type: "text", text: r.text }], isError: r.isError };
     }
+    if (AUTHORING_MUTATORS.has(req.params.name)) {
+      ws.setToolCall(toolCallFor(req.params.name, req.params.arguments ?? {}));
+    }
     try {
       return await handle(ws, req.params.name, req.params.arguments ?? {});
     } catch (e) {
+      ws.setToolCall(undefined);
       return { content: [{ type: "text", text: "sol error: " + (e?.message ?? e) }], isError: true };
     }
   });
   return server;
 }
 async function startWorkspaceMcp(opts = {}) {
-  const solDir2 = opts.solDir || process.env.SOL_DIR || join18(process.cwd(), ".sol");
+  const solDir2 = opts.solDir || process.env.SOL_DIR || join19(process.cwd(), ".sol");
   if (opts.http) {
     const { serveMcpHttp: serveMcpHttp2 } = await Promise.resolve().then(() => (init_mcp_http(), exports_mcp_http));
     await serveMcpHttp2(() => buildWorkspaceServer(solDir2), opts.http);
@@ -12070,12 +13647,13 @@ async function startWorkspaceMcp(opts = {}) {
   const server = await buildWorkspaceServer(solDir2);
   await server.connect(new StdioServerTransport);
 }
-var authoringTools, VCS_TOOL_NAMES, tools, text = (s) => ({ content: [{ type: "text", text: s }] });
+var AUTHORING_MUTATORS, authoringTools, VCS_TOOL_NAMES, tools, text = (s) => ({ content: [{ type: "text", text: s }] });
 var init_sol_mcp = __esm(() => {
   init_file_store();
   init_workspace();
   init_mcp_http();
   init_mcp_vcs_tools();
+  AUTHORING_MUTATORS = new Set(["sol_write", "sol_edit", "sol_move", "sol_rm", "sol_commit", "sol_checkpoint"]);
   authoringTools = [
     { name: "sol_write", description: "Create or overwrite a text file in the sol workspace. Authoring goes here — not to a disk.", inputSchema: { type: "object", properties: { path: { type: "string" }, content: { type: "string" } }, required: ["path", "content"] } },
     { name: "sol_read", description: "Read a text file from the sol workspace.", inputSchema: { type: "object", properties: { path: { type: "string" } }, required: ["path"] } },
@@ -12098,9 +13676,9 @@ __export(exports_dispatch2, {
   dispatch: () => dispatch2
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync2, readdirSync as readdirSync9, readFileSync as readFileSync18, rmSync as rmSync3, unlinkSync as unlinkSync8, watch as watch2, writeFileSync as writeFileSync16 } from "node:fs";
+import { accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync20, mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync2, readdirSync as readdirSync9, readFileSync as readFileSync20, rmSync as rmSync4, unlinkSync as unlinkSync8, watch as watch2, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir as tmpdir2 } from "node:os";
-import { basename as basename2, dirname as dirname6, join as join19, resolve as resolve5, sep as sep3 } from "node:path";
+import { basename as basename3, dirname as dirname7, join as join20, resolve as resolve6, sep as sep3 } from "node:path";
 function globCovers2(pattern, path) {
   let re = "";
   for (let i = 0;i < pattern.length; i++) {
@@ -12120,6 +13698,14 @@ function globCovers2(pattern, path) {
   }
   return new RegExp(`^${re}$`).test(path);
 }
+function writableTag2(path) {
+  try {
+    accessSync2(path, fsConstants2.R_OK | fsConstants2.W_OK);
+    return "RW";
+  } catch {
+    return "READ-ONLY";
+  }
+}
 function tokenClaims2(token) {
   try {
     return JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString());
@@ -12128,11 +13714,11 @@ function tokenClaims2(token) {
   }
 }
 async function loadStoredToken2() {
-  if (!existsSync18(CRED_PATH2))
+  if (!existsSync20(CRED_PATH2))
     return;
   let creds;
   try {
-    creds = JSON.parse(readFileSync18(CRED_PATH2, "utf8"));
+    creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
   } catch {
     return;
   }
@@ -12147,7 +13733,7 @@ async function loadStoredToken2() {
       if (res.ok) {
         const r = await res.json();
         if (r.accessToken) {
-          writeFileSync16(CRED_PATH2, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
+          writeFileSync17(CRED_PATH2, JSON.stringify({ ...creds, accessToken: r.accessToken, refreshToken: r.refreshToken ?? creds.refreshToken }, null, 2), { mode: 384 });
           return r.accessToken;
         }
       }
@@ -12168,7 +13754,7 @@ function authHost2() {
   if (process.env.SOL_AUTH)
     return process.env.SOL_AUTH.replace(/\/+$/, "");
   try {
-    const w = JSON.parse(readFileSync18(CRED_PATH2, "utf8")).webUrl;
+    const w = JSON.parse(readFileSync20(CRED_PATH2, "utf8")).webUrl;
     if (w)
       return w.replace(/\/+$/, "");
   } catch {}
@@ -12192,11 +13778,11 @@ async function resolveMcpHttp2(a, label) {
     die(`invalid --port: ${portRaw}`);
   return { token, port, host: flagVal("--host"), label: label ?? (a.includes("--secret") || a.includes("--secrets") ? "sol-secrets" : "sol") };
 }
-function resolveRemote2(solDir2) {
+function resolveRemote3(solDir2) {
   const cfg = loadRemote(solDir2);
   if (!cfg)
     return;
-  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL2 };
+  return cfg.url ? cfg : { ...cfg, url: DEFAULT_REMOTE_URL3 };
 }
 async function pushEnvState2(solDirPath, cfg, token) {
   const { readEnvStateBundle: readEnvStateBundle2 } = await Promise.resolve().then(() => (init_anchor(), exports_anchor));
@@ -12215,6 +13801,17 @@ ENV ANCHOR REJECTED by the remote: ${e?.message ?? String(e)}
     process.exitCode = 1;
   }
 }
+async function surfaceOwner2(cfg, token) {
+  const slash = cfg.repo.indexOf("/");
+  if (slash < 0)
+    return;
+  const owner = cfg.repo.slice(0, slash);
+  try {
+    const res = await ownerSet(cfg, token, owner);
+    if (res.error)
+      console.error(`note: could not set repo owner to '${owner}': ${res.error}`);
+  } catch {}
+}
 async function pullEnvState2(solDirPath, cfg, token) {
   try {
     const { bundle } = await remoteEnvPull(cfg, token);
@@ -12247,7 +13844,7 @@ function cliVersion2() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync18(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync20(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }
@@ -12294,7 +13891,7 @@ examples:
   sol commit "add login route"
   sol commit -m "fix parser" src/parse.ts src/lex.ts`,
     push: `sol push                          push the current branch to the configured remote (converging — never FF-rejected)
-  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL2}) + this repo name, then push
+  sol push <repo>                   if no remote is set, use the hosted Sol (${DEFAULT_REMOTE_URL3}) + this repo name, then push
   sol push --create <repo>          same, explicit form (creates the repo on first push)
   sol push --public <repo>          create + push + make it public in ONE step (else new repos are private)
 
@@ -12317,6 +13914,21 @@ examples:
 notes:
   refuses to run over a dirty tree — commit or discard first. conflicts land in the working tree with markers.
   refuses to run while UNRESOLVED <<<<<<< markers remain — resolve them and \`sol commit\`, then pull again.`,
+    sync: `sol sync --watch                  HANDS-OFF bidirectional sync daemon — auto-capture + push every edit,
+                                    and converge safe remote updates in on a timer. no CLI invocations needed:
+                                    the working tree stays in sync while every local edit is durably captured.
+  --poll-interval <ms>              how often to poll the remote for updates (default 5000)
+  --no-push-immediately             capture locally but do NOT auto-push (push later with \`sol push\`)
+  --dry-run                         log what it WOULD do, mutate nothing
+
+how it works (three loops over the same core as watch/push/pull):
+  1. every file change is auto-captured into the op-log (nothing lost, even offline)
+  2. after each capture it pushes the delta; the server may converge a concurrent commit in
+  3. it polls the remote; a moved head pulls in via converge() — NEVER clobbering an in-flight edit
+notes:
+  needs a remote (\`sol remote <url> <repo>\` or \`sol push <repo>\` once) + auth (\`sol auth login\` / SOL_TOKEN).
+  a dirty tree DEFERS a pull to the next poll (your edits are captured first). Ctrl-C exits cleanly.
+  transient network errors are logged + retried; a fatal error (corrupt repo / auth) exits loud.`,
     hide: `sol hide <pattern> [--role write|admin] [--team <id>] [--users a,b] [--escrow] [--no-list] [--hide-names] [--hide-existence] [--strict]
                                     add/update a VisibilityPolicy RULE — the HEADLINE verb. binds a glob over tree
                                     paths to an AUDIENCE (who may DECRYPT). the rule is host-visible METADATA (no
@@ -12430,6 +14042,9 @@ examples:
   sol keys verify alice 1a2b-3c4d-...   # confirm alice's key out-of-band before sealing to her`,
     remote: `sol remote                        show the configured remote
   sol remote <url> <repo>           set the remote (url + repo name)
+  sol remote verify                 REMOTE-side health check (the backend's /fsck) — differentiates auth
+                                    (session expired / no access), backend (5xx, transient), connectivity,
+                                    and a 200-but-corrupt remote repo. needs SOL_TOKEN (or \`sol auth login\`).
 
 tip: \`sol push <repo>\` configures the hosted remote for you in one step.`,
     branch: `sol branch                        list branches (* = current)
@@ -12494,6 +14109,27 @@ what it's for (TEST-GATED CONVERGENCE):
   hydrate the current tree to a sandbox, run the command, capture produced files back into a commit.
   --isolate confines the run (no network, writes stay in the sandbox).`,
     promote: "sol promote [branch]   point the remote's production branch at <branch> (default: current branch)",
+    doctor: `sol doctor   — comprehensive LOCAL health check (exit 0 = OK, 1 = problems found)
+
+checks: op-log chain integrity + contiguity, object reachability from head, auth (SOL_TOKEN / stored
+  credentials + expiry), .sol file permissions, and the sealed keyring. read-only — it diagnoses but never
+  changes anything. to RECOVER from what it finds: \`sol fsck --repair\` (op-log/head) or \`sol recover\` (cloud/backup).`,
+    fsck: `sol fsck            verify the op-log chain + object reachability (exit 0 = OK, 1 = problems)
+  sol fsck --repair   recover a corrupt repo:
+                        - head pointer lost      -> re-point to the last resolvable historical root
+                        - head dangling          -> re-point to the newest root the store still has
+                        - op-log chain broken    -> truncate to the last verified link, re-point head
+
+  every repair appends an explicit CHECKPOINT recording what happened (visible in \`sol log\`/\`sol reflog\`),
+  so the recovery is itself in the tamper-evident history. idempotent: re-running on a healthy repo is a no-op.`,
+    recover: `sol recover                              the recovery guide (the menu below)
+  sol recover --from-remote <url> <repo>   rehydrate from the cloud
+  sol recover --list-all-roots             every root the repo ever landed on (find a lost head)
+  sol recover --file <path> [--from <seq|hash>]   restore a file from history (even if the tree dropped it)
+  sol recover --dump-log [<from> [<to>]]   dump raw op-log entries as JSON (manual salvage)`,
+    reflog: `sol reflog [<branch>] [--by <actor>] [--since <YYYY-MM-DD>]
+  the op-log as a ref-move history (git reflog): each line is a head move (from -> to) with seq, actor, time,
+  and message. a merge shows as "merge". a <branch> arg keeps only checkpoints whose message labels it.`,
     git: `sol git import <repo> [dir]       import a git repo's HEAD into a new Sol repo
   sol git export <repo> [-b branch]  replay the Sol commit DAG as git history (+ provenance trailers), then \`git push\``,
     mr: `sol mr open [--from <branch>] [--to <branch>] [--upstream <repo>] -t "title" [-m body]
@@ -12783,7 +14419,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     try {
       const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
       const { openContent: openContent2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-      const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+      const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
       const self = loadSelfIdentity2();
       setSealedDecryptor((boxStr) => {
         const box = JSON.parse(boxStr);
@@ -12793,19 +14429,19 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
     } catch {}
   }
   const servesMcp = cmd === "mcp" || cmd === "secret" && args[0] === "mcp";
-  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "env", "secret"]).has(cmd) && existsSync18(solDir) ? acquireLock() : undefined;
+  const release = !servesMcp && new Set(["add", "track", "commit", "checkpoint", "rm", "gc", "branch", "tag", "switch", "merge", "undo", "revert", "pull", "push", "restore", "checkout", "run", "seal", "view", "agent", "env", "secret"]).has(cmd) && existsSync20(solDir) ? acquireLock() : undefined;
   try {
     switch (cmd) {
       case "init": {
-        const here = join19(procCwd, ".sol");
-        if (existsSync18(here))
+        const here = join20(procCwd, ".sol");
+        if (existsSync20(here))
           die("already a sol repo: " + procCwd);
         if (repoRoot && repoRoot !== procCwd && !args.includes("--force")) {
           die(`already inside a Sol repo at ${repoRoot}
   -> just commit into it: \`sol commit ...\` works from here (sol walks up to find the repo)
   -> to nest a NEW repo here anyway: \`sol init --force\``);
         }
-        mkdirSync12(here, { recursive: true });
+        mkdirSync13(here, { recursive: true });
         new FileStore(here);
         console.log(`initialized empty sol repo in ${here}`);
         break;
@@ -12835,7 +14471,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const h = tok ? identityFromToken2(tok)?.handle : undefined;
           return h || die("no account identity — run `sol auth login` (or set SOL_ACCOUNT for self-host)");
         };
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL3).replace(/\/+$/, "");
         const sub = args[0];
         const wantJson = args.includes("--json");
         if (sub === "init") {
@@ -12921,7 +14557,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (sub === "import") {
           const passphrase = process.env.SOL_KEYSTORE_PASSPHRASE || die("set SOL_KEYSTORE_PASSPHRASE to decrypt the bundle");
           const file = args[1] || die("usage: sol keys import <bundle.json>   (set SOL_KEYSTORE_PASSPHRASE)");
-          const bundle = JSON.parse(readFileSync18(file, "utf8"));
+          const bundle = JSON.parse(readFileSync20(file, "utf8"));
           let recovered;
           try {
             recovered = importBundle2(bundle, passphrase);
@@ -12952,7 +14588,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         break;
       }
       case "trust": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const map = loadTrust();
         if (args[0] === "--remove" || args[0] === "-r") {
@@ -12999,7 +14635,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "track":
       case "add": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const files = args.filter((a) => a !== "." && !a.startsWith("-"));
         if (!files.length) {
@@ -13010,7 +14646,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let n = 0;
         for (const f of files) {
           const rf = repoRel(f);
-          if (!existsSync18(join19(cwd, rf))) {
+          if (!existsSync20(join20(cwd, rf))) {
             console.error("skip (not on disk): " + f);
             continue;
           }
@@ -13039,14 +14675,14 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (!message)
           die('commit needs a message: sol commit "what you did"  (scoped: sol commit -m "msg" file1 file2)');
         const parentHead = await repo.head();
-        const mergeHeadPath = join19(solDir, "MERGE_HEAD");
-        const parent2 = existsSync18(mergeHeadPath) ? readFileSync18(mergeHeadPath, "utf8").trim() || undefined : undefined;
+        const mergeHeadPath = join20(solDir, "MERGE_HEAD");
+        const parent2 = existsSync20(mergeHeadPath) ? readFileSync20(mergeHeadPath, "utf8").trim() || undefined : undefined;
         let changed = 0;
         let commitRoot = parentHead;
         if (paths.length) {
           for (const p of paths) {
             const rp = repoRel(p);
-            if (existsSync18(join19(cwd, rp))) {
+            if (existsSync20(join20(cwd, rp))) {
               if (await snapshotFile(repo, rp))
                 changed++;
             } else if ((await repo.list()).includes(rp)) {
@@ -13101,7 +14737,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       }
       case "status": {
         const { repo, log } = open();
-        const refs = existsSync18(refsPath()) ? await loadRefs(log) : undefined;
+        const refs = existsSync20(refsPath()) ? await loadRefs(log) : undefined;
         const head = await repo.head();
         const headOp = head ? [...await log.history()].reverse().find((o) => o.rootAfter === head) : undefined;
         const headBy = headOp?.by ?? "?";
@@ -13191,7 +14827,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const { listAll: listAll3 } = await Promise.resolve().then(() => (init_tree(), exports_tree));
         const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-        const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const decrypt = (boxStr) => {
           try {
@@ -13239,7 +14875,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             const { readFile: readTree, entryKindAt: kindAt } = await Promise.resolve().then(() => (init_tree(), exports_tree));
             const { loadSelfIdentity: loadSelfIdentity2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
             const { openContent: openContent2, UNREADABLE: UNREADABLE2, KeyRing: KeyRing3 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-            const ring = existsSync18(solDir) ? loadKeyRing() : new KeyRing3;
+            const ring = existsSync20(solDir) ? loadKeyRing() : new KeyRing3;
             const self = loadSelfIdentity2();
             const decrypt = (boxStr) => {
               try {
@@ -13338,7 +14974,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         };
         const live = await log.head() ?? "";
         const refArg = args.find((a) => !a.startsWith("-"));
-        const lrefs = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : null;
+        const lrefs = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : null;
         let tipRoot = live;
         if (refArg) {
           tipRoot = lrefs?.branches[refArg]?.head ?? refArg;
@@ -13391,7 +15027,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         const path = args[0] || die("rm needs a path");
         let onDisk = false;
         try {
-          unlinkSync8(join19(cwd, path));
+          unlinkSync8(join20(cwd, path));
           onDisk = true;
         } catch {}
         if (onDisk) {
@@ -13589,15 +15225,167 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           };
           walk(head);
         }
-        const ok = chainOk && missing.length === 0;
+        const headLost = head === undefined && ops.length > 0;
+        const ok = chainOk && missing.length === 0 && !headLost;
+        if (args.includes("--repair")) {
+          if (ok) {
+            console.log("fsck --repair: nothing to repair — the repo is OK");
+            process.exitCode = 0;
+            break;
+          }
+          const { applyRepair: applyRepair2 } = await Promise.resolve().then(() => (init_admin_repair(), exports_admin_repair));
+          const { FileStore: FileStore2 } = await Promise.resolve().then(() => (init_file_store(), exports_file_store));
+          const fileStore = new FileStore2(solDir, objectsDir());
+          const plan = await applyRepair2({
+            store: fileStore,
+            log,
+            truncate: async (toSeq) => truncateOpLog(toSeq),
+            setHead: async (h) => setOpLogHead(h)
+          }, "sol-doctor");
+          console.log(`fsck --repair: ${plan.reason}`);
+          if (plan.kind === "noop")
+            console.log("  (already healthy — nothing changed)");
+          else if (plan.kind === "unfixable") {
+            console.log("  status: UNFIXABLE — local repair cannot recover this; run `sol recover --from-remote <url> <repo>` to rehydrate");
+            process.exitCode = 1;
+            break;
+          } else {
+            console.log(`  ${plan.note}`);
+            console.log("  status: repaired — run `sol status` (or `sol fsck`) to verify");
+          }
+          process.exitCode = 0;
+          break;
+        }
         console.log(`fsck: ${ok ? "OK" : "PROBLEMS FOUND"}`);
         console.log(`  op-log: ${ops.length} op(s), chain ${chainOk ? "valid + contiguous" : "BROKEN — " + chainErr}`);
-        console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
+        if (headLost)
+          console.log(`  head:   LOST (${ops.length} op(s) but no head pointer) — run \`sol fsck --repair\``);
+        else
+          console.log(`  head:   ${head ? head.slice(0, 16) : "(empty)"}, ${missing.length} missing object(s)`);
         for (const mh of missing)
           console.log("    missing " + mh);
+        if (!ok)
+          console.log("  -> `sol doctor` for a full diagnosis, `sol fsck --repair` to recover");
         process.exitCode = ok ? 0 : 1;
         break;
       }
+      case "doctor": {
+        const { runDoctor: runDoctor2, renderDoctorIntegrity: renderDoctorIntegrity2 } = await Promise.resolve().then(() => (init_admin(), exports_admin));
+        const { log } = open();
+        const store2 = loadStore();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("doctor is read-only"), has: async (h) => store2.has(h) };
+        const report = await runDoctor2(asyncStore, log);
+        console.log("sol doctor");
+        for (const l of renderDoctorIntegrity2(report))
+          console.log(l);
+        const envTok = process.env.SOL_TOKEN;
+        if (envTok) {
+          const id = identityFromToken2(envTok);
+          console.log(`  auth: SOL_TOKEN set${id?.handle ? ` (@${id.handle})` : id?.email ? ` (${id.email})` : ""}`);
+        } else if (existsSync20(CRED_PATH2)) {
+          try {
+            const creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
+            const c = creds.accessToken ? tokenClaims2(creds.accessToken) : {};
+            const exp = typeof c.exp === "number" ? new Date(c.exp * 1000).toISOString().slice(0, 10) : "?";
+            const stale = typeof c.exp === "number" && c.exp * 1000 <= Date.now();
+            console.log(`  auth: logged in${c.handle ? ` as @${c.handle}` : ""}${stale ? " (EXPIRED — run `sol auth login`)" : ` (expires ${exp})`}`);
+          } catch {
+            console.log("  auth: stored credentials unreadable — run `sol auth login`");
+          }
+        } else {
+          console.log("  auth: not logged in — `sol auth login` (or set SOL_TOKEN) for remote commands");
+        }
+        const objDir = join20(solDir, "objects");
+        const opsFile = join20(solDir, "ops.jsonl");
+        console.log(`  files: .sol/objects/ ${writableTag2(objDir)}, .sol/ops.jsonl ${existsSync20(opsFile) ? writableTag2(opsFile) : "(none yet)"}`);
+        const keyringPath = join20(homedir3(), ".sol", "keyring.json");
+        console.log(`  sealed: ${existsSync20(keyringPath) ? "keyring found, ready" : "no keyring (only needed for sealed paths)"}`);
+        console.log(`status: ${report.ok ? "OK" : "PROBLEMS FOUND"}`);
+        if (!report.ok)
+          console.log("  -> `sol fsck --repair` to recover the op-log/head; `sol recover` for cloud/backup rehydrate");
+        process.exitCode = report.ok ? 0 : 1;
+        break;
+      }
+      case "reflog": {
+        const { renderReflog: renderReflog2 } = await Promise.resolve().then(() => exports_admin_reflog);
+        const { log } = open();
+        const ops = await log.history();
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        const branchFilter = args[0] && !args[0].startsWith("--") ? args[0] : undefined;
+        const by = flag2("--by");
+        const sinceStr = flag2("--since");
+        const since = sinceStr ? Date.parse(sinceStr) : undefined;
+        if (sinceStr && Number.isNaN(since))
+          die(`--since: not a date: ${sinceStr} (try YYYY-MM-DD)`);
+        const lines2 = renderReflog2(ops, { branchFilter, actor: by, since });
+        if (!lines2.length)
+          console.log("(no matching ops)");
+        for (const l of lines2)
+          console.log(l);
+        break;
+      }
+      case "recover": {
+        const { RECOVER_HELP: RECOVER_HELP2, listAllRoots: listAllRoots2, restoreFileFromHistory: restoreFileFromHistory2, dumpLog: dumpLog2 } = await Promise.resolve().then(() => (init_admin_recover(), exports_admin_recover));
+        const flag2 = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        if (!args.length || args[0] === "--help") {
+          console.log(RECOVER_HELP2);
+          break;
+        }
+        if (args.includes("--from-remote")) {
+          const url = args[args.indexOf("--from-remote") + 1];
+          const repoName = args[args.indexOf("--from-remote") + 2];
+          if (!url || !repoName)
+            die("usage: sol recover --from-remote <url> <repo>");
+          console.log(`to rehydrate from the cloud, clone the remote into a fresh dir:
+  sol clone ${url} ${repoName}
+then copy your uncommitted working files in. (a destructive in-place rehydrate is intentionally manual.)`);
+          break;
+        }
+        const { log } = open();
+        const store2 = loadStore();
+        const ops = await log.history();
+        const asyncStore = { get: async (h) => store2.get(h), put: async () => die("recover is read-only"), has: async (h) => store2.has(h) };
+        if (args.includes("--list-all-roots")) {
+          const roots = await listAllRoots2(ops, async (h) => store2.has(h));
+          for (const r of roots)
+            console.log(`  ${r.root.slice(0, 16)}  seq ${r.seq}  ${r.resolvable ? "resolvable" : "MISSING"}${r.message ? `  ${r.message}` : ""}`);
+          if (!roots.length)
+            console.log("  (no roots — empty repo)");
+          break;
+        }
+        if (args.includes("--file")) {
+          const path = flag2("--file") || die("usage: sol recover --file <path> [--from <seq|hash>]");
+          const fromStr = flag2("--from");
+          const from = fromStr ? /^\d+$/.test(fromStr) ? Number(fromStr) : fromStr : undefined;
+          const rec = await restoreFileFromHistory2(asyncStore, ops, path, from);
+          if (!rec.found)
+            die(rec.reason);
+          if ("sealed" in rec) {
+            console.log(`${path} is sealed at seq ${rec.fromSeq} — recovered the opaque box (open it with your key):`);
+            console.log(rec.box);
+          } else {
+            const out = rec.encoding === "base64" ? Buffer.from(rec.content, "base64") : rec.content;
+            writeFileSync17(join20(cwd, path), out);
+            console.log(`restored ${path} from seq ${rec.fromSeq} (root ${rec.fromRoot.slice(0, 16)}) -> wrote to disk; \`sol add ${path}\` to re-track`);
+          }
+          break;
+        }
+        if (args.includes("--dump-log")) {
+          const i = args.indexOf("--dump-log");
+          const fromSeq = args[i + 1] && /^\d+$/.test(args[i + 1]) ? Number(args[i + 1]) : undefined;
+          const toSeq = args[i + 2] && /^\d+$/.test(args[i + 2]) ? Number(args[i + 2]) : undefined;
+          console.log(dumpLog2(ops, fromSeq, toSeq));
+          break;
+        }
+        console.log(RECOVER_HELP2);
+        break;
+      }
       case "gc": {
         const { log } = open();
         const store2 = loadStore();
@@ -13619,16 +15407,16 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           if (op.prov)
             walk(op.prov);
         }
-        const objDir = join19(solDir, "objects");
+        const objDir = join20(solDir, "objects");
         let removed = 0;
         for (const name of readdirSync9(objDir)) {
           if (name.endsWith(".tmp") || !reachable.has(name)) {
-            unlinkSync8(join19(objDir, name));
+            unlinkSync8(join20(objDir, name));
             removed++;
           }
         }
         console.log(`gc: kept ${reachable.size} object(s), removed ${removed} unreachable`);
-        if (existsSync18(join19(solDir, "env", "seal"))) {
+        if (existsSync20(join20(solDir, "env", "seal"))) {
           const { gcStaleStanzas: gcStaleStanzas2 } = await Promise.resolve().then(() => (init_secret(), exports_secret));
           const st = gcStaleStanzas2(solDir);
           if (st.removed)
@@ -13643,8 +15431,8 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
             console.log(p);
           break;
         }
-        const f = join19(cwd, ".solignore");
-        const lead = existsSync18(f) && !readFileSync18(f, "utf8").endsWith(`
+        const f = join20(cwd, ".solignore");
+        const lead = existsSync20(f) && !readFileSync20(f, "utf8").endsWith(`
 `) ? `
 ` : "";
         appendFileSync2(f, lead + pat + `
@@ -13655,7 +15443,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
       case "hide": {
         const { repo } = open();
         const wantJson = args.includes("--json");
-        const cfg = resolveRemote2(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
+        const cfg = resolveRemote3(solDir) || die("no remote — `sol push <repo>` (or `sol remote <url> <repo>`) first; the policy lives on the repo");
         const token = process.env.SOL_TOKEN || authExpired2();
         const sub = args[0];
         const flag2 = (name) => {
@@ -13760,12 +15548,12 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           let removed = 0;
           {
             const res = await scrubHistory2(solDir, ops, targets);
-            writeFileSync16(join19(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
+            writeFileSync17(join20(solDir, "ops.jsonl"), res.ops.map((o) => JSON.stringify(o)).join(`
 `) + (res.ops.length ? `
 ` : ""));
-            writeFileSync16(join19(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
-            if (existsSync18(refsPath())) {
-              const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+            writeFileSync17(join20(solDir, "HEAD"), JSON.stringify({ head: res.newHead, seq: res.newSeq, logTip: res.newLogTip }));
+            if (existsSync20(refsPath())) {
+              const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
               for (const b of Object.values(refs.branches)) {
                 if (b.head && res.rootMap.has(b.head))
                   b.head = res.rootMap.get(b.head);
@@ -13788,7 +15576,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           break;
         }
         if (reapply) {
-          const cfg = resolveRemote2(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote3(solDir) || die("no remote — the policy lives on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired2();
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -13855,7 +15643,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const { SealedClient: SealedClient3 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
           const { parseRecipient: parseRecipient3, resolveRecipient: resolveRecipient3, recordAudience: recordAudience3 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
           const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
-          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
+          const dirUrl2 = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL3).replace(/\/+$/, "");
           const explicit = positional.slice(1);
           const recipientPubKeys2 = {};
           const audienceAccounts2 = [];
@@ -13863,7 +15651,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           const crossAccount2 = [];
           let policyApplied2 = false;
           if (!explicit.length) {
-            const cfg = resolveRemote2(solDir);
+            const cfg = resolveRemote3(solDir);
             const token = process.env.SOL_TOKEN;
             if (cfg && token) {
               const resolved = await recipientsForPath(cfg, token, dir).catch(() => {
@@ -13923,15 +15711,15 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         if (content === SEALED && !args.includes("--hide-names"))
           die("already sealed: " + path);
         if (content === undefined) {
-          const abs = join19(cwd, path);
-          if (!existsSync18(abs))
+          const abs = join20(cwd, path);
+          if (!existsSync20(abs))
             die("no such file: " + path);
-          content = readFileSync18(abs, "utf8");
+          content = readFileSync20(abs, "utf8");
         }
         const ring = loadKeyRing();
         const { SealedClient: SealedClient2 } = await Promise.resolve().then(() => (init_sealed_client(), exports_sealed_client));
         const { parseRecipient: parseRecipient2, resolveRecipient: resolveRecipient2, recordAudience: recordAudience2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL3).replace(/\/+$/, "");
         const recipientPubKeys = {};
         const audienceAccounts = [];
         const localRecipients = new Set([actor]);
@@ -13944,7 +15732,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
         let hideNamesFromPolicy = false;
         let hideExistenceFromPolicy = false;
         if (!rawRecipients.length) {
-          const cfg = resolveRemote2(solDir);
+          const cfg = resolveRemote3(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { pubFingerprint: pubFingerprint2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
@@ -13973,7 +15761,7 @@ refused for a non-recipient (host/agent-blind). a missing or malformed reference
           }
         }
         if (wantEscrow && !escrowSlots.length) {
-          const cfg = resolveRemote2(solDir);
+          const cfg = resolveRemote3(solDir);
           const token = process.env.SOL_TOKEN;
           if (cfg && token) {
             const { recipientsForAudience: recipientsForAudience2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
@@ -14179,7 +15967,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { repo } = open();
         const wantJson = args.includes("--json");
         if (args.includes("--check")) {
-          const cfg = resolveRemote2(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
+          const cfg = resolveRemote3(solDir) || die("no remote — drift is checked against the policy on the repo; `sol remote <url> <repo>` first");
           const token = process.env.SOL_TOKEN || authExpired2();
           const { policyCheck: policyCheck2 } = await Promise.resolve().then(() => (init_remote(), exports_remote));
           const states = [];
@@ -14236,7 +16024,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const { openContent: openContent2, UNREADABLE: UNREADABLE2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
         const { parseStruct: parseStruct2 } = await Promise.resolve().then(() => (init_struct(), exports_struct));
         const audiences = loadAudiences2(solDir);
-        const ring = existsSync18(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
+        const ring = existsSync20(solDir) ? loadKeyRing() : new (await Promise.resolve().then(() => (init_crypto(), exports_crypto))).KeyRing;
         const self = loadSelfIdentity2();
         const levelOf = (boxStr) => {
           try {
@@ -14431,7 +16219,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const result = merge2({ store: store2 }, other.base, ours, other.head);
         if (result.conflicts.length) {
           materializeTree(store2, result.head);
-          writeFileSync16(join19(solDir, "MERGE_HEAD"), other.head);
+          writeFileSync17(join20(solDir, "MERGE_HEAD"), other.head);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`merge ${name} -> ${result.conflicts.length} conflict(s), left in your working tree (uncommitted):`);
           for (const c of result.conflicts)
@@ -14449,7 +16237,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         materializeTree(store2, result.head);
         clearMergeConflicts(solDir);
         console.log(`merged ${name} into ${refs.current} cleanly -> ${result.head.slice(0, 12)}`);
-        reportSemanticGate2(gateMerge(solDir, cfgDir2(), cwd, result.head), args.includes("--json"));
+        reportSemanticGate2(gateMerge(solDir, cfgDir(), cwd, result.head), args.includes("--json"));
         break;
       }
       case "undo": {
@@ -14532,8 +16320,19 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "remote": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
+        if (args[0] === "verify") {
+          const { remoteVerify: remoteVerify2, renderRemoteVerify: renderRemoteVerify2 } = await Promise.resolve().then(() => (init_admin_remote_verify(), exports_admin_remote_verify));
+          const cfg2 = resolveRemote3(solDir) || die("no remote — `sol remote <url> <repo>` (or `sol clone`) first");
+          const token = process.env.SOL_TOKEN || await loadStoredToken2() || authExpired2();
+          const result = await remoteVerify2((url, init) => fetch(url, init), cfg2.url, cfg2.repo, token);
+          const { lines: lines2, exitCode } = renderRemoteVerify2(result);
+          for (const l of lines2)
+            console.log(l);
+          process.exitCode = exitCode;
+          break;
+        }
         if (args[0]) {
           const repoName = args[1] || die("usage: sol remote <url> <repo>");
           saveRemote(solDir, { url: args[0], repo: repoName });
@@ -14578,15 +16377,15 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           }
           if (!tokens)
             die("timed out waiting for approval");
-          mkdirSync12(dirname6(CRED_PATH2), { recursive: true });
-          writeFileSync16(CRED_PATH2, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
+          mkdirSync13(dirname7(CRED_PATH2), { recursive: true });
+          writeFileSync17(CRED_PATH2, JSON.stringify({ webUrl, ...tokens }, null, 2), { mode: 384 });
           const c = tokenClaims2(tokens.accessToken);
           console.log(`
   Logged in as ${c.handle ? `@${c.handle}` : c.email || "user"}.`);
           if (!c.handle)
             console.log("  (no handle yet — set one in the web app to get your <handle>/<repo> namespace)");
         } else if (sub === "logout") {
-          if (existsSync18(CRED_PATH2))
+          if (existsSync20(CRED_PATH2))
             unlinkSync8(CRED_PATH2);
           console.log("logged out");
         } else if (sub === "status" || !sub) {
@@ -14595,11 +16394,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log(`authenticated via SOL_TOKEN (env)${c2.handle ? ` as @${c2.handle}` : ""}`);
             break;
           }
-          if (!existsSync18(CRED_PATH2)) {
+          if (!existsSync20(CRED_PATH2)) {
             console.log("not logged in — run `sol auth login` (or set SOL_TOKEN)");
             break;
           }
-          const creds = JSON.parse(readFileSync18(CRED_PATH2, "utf8"));
+          const creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
           const c = tokenClaims2(creds.accessToken || "");
           const stale = typeof c.exp === "number" && c.exp * 1000 < Date.now();
           console.log(`logged in as ${c.handle ? `@${c.handle}` : c.email || "user"} via ${creds.webUrl}${stale ? " (token stale — refreshes on next use)" : ""}`);
@@ -14649,9 +16448,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             console.log("heads-up: changing your handle re-namespaces your repos under the new <handle>/<repo>.");
           console.log(`handle set to @${out.handle}`);
         } else if (sub === "pat") {
-          if (!existsSync18(CRED_PATH2))
+          if (!existsSync20(CRED_PATH2))
             die("run `sol auth login` first");
-          const creds = JSON.parse(readFileSync18(CRED_PATH2, "utf8"));
+          const creds = JSON.parse(readFileSync20(CRED_PATH2, "utf8"));
           const token = await loadStoredToken2();
           if (!token || !creds.webUrl)
             die("run `sol auth login` first");
@@ -14709,11 +16508,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const { converge: converge2 } = await Promise.resolve().then(() => (init_converge(), exports_converge));
           const peer = openPeer2(localSrc);
           const peerHead = await peer.log.head();
-          const dest = resolve5(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
-          const ddir = join19(dest, ".sol");
-          if (existsSync18(ddir))
+          const dest = resolve6(procCwd, args[1] || (args[0].replace(/\/+$/, "").split("/").pop() || "clone") + "-clone");
+          const ddir = join20(dest, ".sol");
+          if (existsSync20(ddir))
             die("already a sol repo: " + dest);
-          mkdirSync12(ddir, { recursive: true });
+          mkdirSync13(ddir, { recursive: true });
           const peerOps = await peer.log.history();
           const res = await converge2({ store: new FileStore(ddir), log: new FileOpLog(ddir) }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor });
           const dstore = new Store;
@@ -14723,7 +16522,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const files = (res.head ? listAll(dstore, res.head) : []).filter((f) => !f.split("/").some(isReservedKey2));
           for (const f of files)
             materializeInto(dstore, res.head, dest, f);
-          writeFileSync16(join19(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
+          writeFileSync17(join20(ddir, "refs.json"), JSON.stringify({ current: "main", branches: { main: { head: res.head, base: res.head, remote: res.head } }, tags: {} }, null, 2));
           writeWorkingIndexAt(ddir, dest, files);
           console.log(`cloned local peer ${args[0]} -> ${dest} (${(await peer.log.history()).length} ops, ${files.length} files)`);
           break;
@@ -14731,13 +16530,13 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const [url, rest] = remoteUrlArg2(args);
         const repoName = rest[0] || die("usage: sol clone [<url>] <owner>/<repo> [dir]");
         const token = process.env.SOL_TOKEN || die("set SOL_TOKEN to the backend bearer token");
-        const target = resolve5(cwd, rest[1] || repoName.split("/").pop() || repoName);
-        const fdir = join19(target, ".sol");
-        if (existsSync18(fdir))
+        const target = resolve6(cwd, rest[1] || repoName.split("/").pop() || repoName);
+        const fdir = join20(target, ".sol");
+        if (existsSync20(fdir))
           die("already a sol repo: " + target);
         const cfg = { url, repo: repoName };
         const bundle = await remoteExport(cfg, token);
-        mkdirSync12(fdir, { recursive: true });
+        mkdirSync13(fdir, { recursive: true });
         await writeBundle(fdir, bundle, 0);
         saveRemote(fdir, cfg);
         await pullEnvState2(fdir, cfg, token);
@@ -14750,8 +16549,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           cloneBranches[name] = { head: h, base: h, remote: h };
         if (!cloneBranches[onBranch])
           cloneBranches[onBranch] = { head: checkoutHead, base: checkoutHead, remote: checkoutHead };
-        writeFileSync16(join19(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync16(join19(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
+        writeFileSync17(join20(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync17(join20(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: bundle.seq, logTip: bundle.tip }));
         const store2 = new Store;
         for (const node of bundle.nodes)
           store2.put(node);
@@ -14772,11 +16571,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         if (!loadRemote(solDir)) {
           const repoName = args.find((a) => !a.startsWith("-"));
           if (repoName) {
-            saveRemote(solDir, { url: DEFAULT_REMOTE_URL2, repo: repoName });
-            console.log(`remote set: ${DEFAULT_REMOTE_URL2} (repo ${repoName})`);
+            saveRemote(solDir, { url: DEFAULT_REMOTE_URL3, repo: repoName });
+            console.log(`remote set: ${DEFAULT_REMOTE_URL3} (repo ${repoName})`);
           }
         }
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` to use the hosted Sol");
         {
           const { pendingScrubPaths: pendingScrubPaths2, historyHasCleartext: historyHasCleartext2 } = await Promise.resolve().then(() => (init_secret_scrub(), exports_secret_scrub));
           const ops0 = await log.history();
@@ -14790,7 +16589,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const localRefs = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : undefined;
+        const localRefs = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : undefined;
         const branch = localRefs?.current ?? "main";
         const branchHead = await log.head() ?? "";
         const remoteWasEmpty = rh.seq === 0 && !rh.tip;
@@ -14802,7 +16601,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const forkBase = localRefs?.branches[branch]?.remote;
         const baseOp = forkBase ? ops.find((o) => o.rootAfter === forkBase) : undefined;
         const fromSeq = baseOp ? baseOp.seq : rh.seq;
-        const res = await remotePush(cfg, token, {
+        const res = await remotePushChunked(cfg, token, {
           nodes: allLocalNodes(),
           ops: ops.filter((o) => o.seq > fromSeq),
           branch,
@@ -14813,8 +16612,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const prevHead = await log.head() ?? "";
         await writeBundle(solDir, canon, 0);
         const convergedHead = res.head ?? canon.refs?.branches?.[branch] ?? branchHead;
-        if (existsSync18(refsPath())) {
-          const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+        if (existsSync20(refsPath())) {
+          const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
           if (canon.refs) {
             for (const [name, h] of Object.entries(canon.refs.branches)) {
               refs.branches[name] = { head: refs.branches[name]?.head ?? h, base: refs.branches[name]?.base ?? h, remote: h };
@@ -14838,12 +16637,13 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           console.log(`pushed ${res.applied} op(s) -> remote (branch ${branch} @ ${(convergedHead || "").slice(0, 12)})${mergedNote}${conflictNote}${prod ? `; production=${prod}` : ""}`);
         }
         await pushEnvState2(solDir, cfg, token);
+        await surfaceOwner2(cfg, token);
         if (wantPublic) {
           const a = await accessSet(cfg, token, { visibility: "public" });
           console.log(`${cfg.repo} is now ${a.visibility}`);
         }
         if (res.merged && !(res.conflicts && res.conflicts.length) && convergedHead) {
-          reportSemanticGate2(gateMerge(solDir, cfgDir2(), cwd, convergedHead), args.includes("--json"));
+          reportSemanticGate2(gateMerge(solDir, cfgDir(), cwd, convergedHead), args.includes("--json"));
         }
         break;
       }
@@ -14878,8 +16678,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           const ownMeta = readViewMeta(solDir);
           const base2 = peerMeta?.startHead ?? ownMeta?.startHead;
           const res = await converge2({ store: new FileStore(solDir, objectsDir()), log }, { nodes: await peerNodes2(peer, peerHead, peerOps), ops: peerOps, incomingHead: peerHead, actor, ...base2 ? { base: base2 } : {} });
-          if (existsSync18(refsPath())) {
-            const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (existsSync20(refsPath())) {
+            const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
             if (refs.branches[refs.current])
               refs.branches[refs.current].head = res.head;
             saveRefs(refs);
@@ -14898,11 +16698,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
             clearMergeConflicts(solDir);
             console.log(`pulled from ${peerArg} -> ${res.applied} new op(s)${res.merged ? " (converged by merge)" : ""}, now at ${(res.head || "").slice(0, 12)}`);
             if (res.merged)
-              reportSemanticGate2(gateMerge(solDir, cfgDir2(), cwd, res.head), args.includes("--json"));
+              reportSemanticGate2(gateMerge(solDir, cfgDir(), cwd, res.head), args.includes("--json"));
           }
           break;
         }
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired2();
         await surfaceEnvDivergence2(solDir, cfg, token);
         await pullEnvState2(solDir, cfg, token);
@@ -14910,11 +16710,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const ops = await log.history();
         const localSeq = ops.length ? ops[ops.length - 1].seq : 0;
         const localTip = await log.logTip();
-        const curBranch = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")).current : bundle.refs?.production || "main";
+        const curBranch = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")).current : bundle.refs?.production || "main";
         const remoteCurHead = bundle.refs?.branches?.[curBranch] ?? bundle.head ?? "";
         if (bundle.seq === localSeq && bundle.tip === localTip) {
-          if (bundle.refs && existsSync18(refsPath())) {
-            const lr = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (bundle.refs && existsSync20(refsPath())) {
+            const lr = JSON.parse(readFileSync20(refsPath(), "utf8"));
             const before = lr.branches[lr.current]?.head;
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
@@ -14938,9 +16738,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           break;
         }
         const syncRefHead = (h) => {
-          if (!existsSync18(refsPath()))
+          if (!existsSync20(refsPath()))
             return;
-          const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
           if (refs.branches[refs.current])
             refs.branches[refs.current].head = h;
           saveRefs(refs);
@@ -14958,8 +16758,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           syncRefHead(remoteCurHead);
           setOpLogHead(remoteCurHead);
           materializeTree(loadStore(), remoteCurHead);
-          if (bundle.refs && existsSync18(refsPath())) {
-            const lr = JSON.parse(readFileSync18(refsPath(), "utf8"));
+          if (bundle.refs && existsSync20(refsPath())) {
+            const lr = JSON.parse(readFileSync20(refsPath(), "utf8"));
             for (const [name, h] of Object.entries(bundle.refs.branches))
               lr.branches[name] = { head: h, base: lr.branches[name]?.base ?? h, remote: h };
             saveRefs(lr);
@@ -15007,9 +16807,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
           for (const c of result.conflicts) {
             const blob = fileAt(store2, result.head, c.path);
             if (blob)
-              writeFileSync16(join19(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
+              writeFileSync17(join20(cwd, c.path), blob.encoding === "base64" ? Buffer.from(blob.content, "base64") : blob.content);
           }
-          writeFileSync16(join19(solDir, "MERGE_HEAD"), remoteHead2);
+          writeFileSync17(join20(solDir, "MERGE_HEAD"), remoteHead2);
           saveMergeConflicts(solDir, result.conflicts);
           console.log(`pulled + merged WITH ${result.conflicts.length} conflict(s), left uncommitted in your working tree:`);
           for (const c of result.conflicts)
@@ -15019,16 +16819,40 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         } else {
           clearMergeConflicts(solDir);
           console.log(`pulled + merged remote into local -> ${mergedHead.slice(0, 12)} (now run \`sol push\`)`);
-          reportSemanticGate2(gateMerge(solDir, cfgDir2(), cwd, mergedHead), args.includes("--json"));
+          reportSemanticGate2(gateMerge(solDir, cfgDir(), cwd, mergedHead), args.includes("--json"));
         }
         break;
       }
+      case "sync": {
+        if (!existsSync20(solDir))
+          die("not a sol repo — run `sol init` first");
+        if (!args.includes("--watch"))
+          die("usage: sol sync --watch [--poll-interval <ms>] [--no-push-immediately] [--dry-run]");
+        resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`, or `sol push <repo>` first");
+        const token = process.env.SOL_TOKEN || await loadStoredToken2() || authExpired2();
+        const intFlag = (name, def) => {
+          const i = args.indexOf(name);
+          if (i < 0 || i + 1 >= args.length)
+            return def;
+          const n = Number(args[i + 1]);
+          return Number.isFinite(n) && n > 0 ? n : def;
+        };
+        const { runSyncWatch: runSyncWatch2 } = await Promise.resolve().then(() => (init_sync_watch(), exports_sync_watch));
+        await runSyncWatch2({
+          repoDir: cwd,
+          token,
+          pollInterval: intFlag("--poll-interval", 5000),
+          pushImmediate: !args.includes("--no-push-immediately"),
+          dryRun: args.includes("--dry-run")
+        });
+        break;
+      }
       case "promote": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired2();
-        const cur = existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")).current : "main";
+        const cur = existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")).current : "main";
         const branch = args[0] || cur;
         const refs = await remotePromote(cfg, token, branch);
         console.log(`promoted '${branch}' -> production '${refs.production}' now at ${(refs.branches[refs.production] ?? "").slice(0, 12)}`);
@@ -15039,9 +16863,9 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const parent = frest[0] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const newRepo = frest[1] || die("usage: sol fork [<url>] <parent-repo> <new-repo> [dir]");
         const token = process.env.SOL_TOKEN || authExpired2();
-        const target = resolve5(cwd, frest[2] || newRepo);
-        const fdir = join19(target, ".sol");
-        if (existsSync18(fdir))
+        const target = resolve6(cwd, frest[2] || newRepo);
+        const fdir = join20(target, ".sol");
+        if (existsSync20(fdir))
           die("already a sol repo: " + target);
         const parentCfg = { url, repo: parent };
         const newCfg = { url, repo: newRepo, forkParent: parent };
@@ -15057,7 +16881,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         }
         await forkMeta(newCfg, token, parent);
         const canon = await remoteExport(newCfg, token);
-        mkdirSync12(fdir, { recursive: true });
+        mkdirSync13(fdir, { recursive: true });
         await writeBundle(fdir, canon, 0);
         const srvRefs = canon.refs ?? { branches: { main: canon.head ?? "" }, production: "main" };
         const checkout = canon.checkout ?? { branch: srvRefs.production || "main", head: srvRefs.branches[srvRefs.production] ?? canon.head };
@@ -15066,8 +16890,8 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         const cloneBranches = {};
         for (const [name, h] of Object.entries(srvRefs.branches))
           cloneBranches[name] = { head: h, base: h, remote: h };
-        writeFileSync16(join19(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
-        writeFileSync16(join19(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
+        writeFileSync17(join20(fdir, "refs.json"), JSON.stringify({ current: onBranch, branches: cloneBranches, tags: {} }, null, 2));
+        writeFileSync17(join20(fdir, "HEAD"), JSON.stringify({ head: checkoutHead, seq: canon.seq, logTip: canon.tip }));
         saveRemote(fdir, newCfg);
         const store2 = new Store;
         for (const node of canon.nodes)
@@ -15085,7 +16909,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
       }
       case "access": {
         const token = process.env.SOL_TOKEN || authExpired2();
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const sub = args[0];
         if (!sub || sub === "show") {
           const a = await accessGet(cfg, token);
@@ -15137,7 +16961,7 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "forks": {
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired2();
         const { forks } = await forksList(cfg, token);
         if (!forks.length)
@@ -15150,11 +16974,11 @@ WARNING: "${path}" was committed as PLAINTEXT before this seal — the pre-seal
         break;
       }
       case "mr": {
-        const cfg = resolveRemote2(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
+        const cfg = resolveRemote3(solDir) || die("no remote — set one with `sol remote <url> <repo>`");
         const token = process.env.SOL_TOKEN || authExpired2();
         const { mrSummary: mrSummary2 } = await Promise.resolve().then(() => exports_mr);
         const sub = args[0];
-        const localRefs = () => existsSync18(refsPath()) ? JSON.parse(readFileSync18(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
+        const localRefs = () => existsSync20(refsPath()) ? JSON.parse(readFileSync20(refsPath(), "utf8")) : { current: "main", branches: {}, tags: {} };
         const flag2 = (name) => {
           const i = args.indexOf(name);
           return i >= 0 ? args[i + 1] : undefined;
@@ -15332,7 +17156,7 @@ ${mrSummary2(pr)}`);
           die("usage: sol run [--keep <path>] [--isolate] <command...>");
         const { capture: capture3, hydrate: hydrate3, isolateCommand: isolateCommand2 } = await Promise.resolve().then(() => (init_runtime(), exports_runtime));
         const head = await repo.head();
-        const dir = mkdtempSync2(join19(tmpdir2(), "sol-run-"));
+        const dir = mkdtempSync2(join20(tmpdir2(), "sol-run-"));
         try {
           const hn = hydrate3(loadStore(), head, dir);
           console.log(`hydrated ${hn} file(s) -> sandbox${isolate ? " (isolated: no network, writes confined to the sandbox)" : ""}`);
@@ -15352,8 +17176,8 @@ ${mrSummary2(pr)}`);
           const { written, deleted } = await capture3(repo, dir, keep);
           if (written.length || deleted.length) {
             await appendCommit(log, await repo.head(), `run: ${command.join(" ")}`, head);
-            if (existsSync18(refsPath())) {
-              const refs = JSON.parse(readFileSync18(refsPath(), "utf8"));
+            if (existsSync20(refsPath())) {
+              const refs = JSON.parse(readFileSync20(refsPath(), "utf8"));
               if (refs.branches[refs.current]) {
                 refs.branches[refs.current].head = await repo.head();
                 saveRefs(refs);
@@ -15365,7 +17189,7 @@ ${mrSummary2(pr)}`);
               materialize(synced, nh, f);
             for (const f of deleted) {
               try {
-                unlinkSync8(join19(cwd, f));
+                unlinkSync8(join20(cwd, f));
               } catch {}
             }
             console.log(`captured ${written.length} written, ${deleted.length} deleted file(s):`);
@@ -15377,7 +17201,7 @@ ${mrSummary2(pr)}`);
             console.log("no files captured (the run produced no tracked changes)");
           }
         } finally {
-          rmSync3(dir, { recursive: true, force: true });
+          rmSync4(dir, { recursive: true, force: true });
         }
         break;
       }
@@ -15385,12 +17209,12 @@ ${mrSummary2(pr)}`);
         const [{ exportHistoryToGit: exportHistoryToGit2, importGitRepo: importGitRepo2 }, { hydrate: hydrate3 }] = await Promise.all([Promise.resolve().then(() => (init_git_adapter(), exports_git_adapter)), Promise.resolve().then(() => (init_runtime(), exports_runtime))]);
         const sub = args[0];
         if (sub === "import") {
-          const gitPath = resolve5(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
-          const target = resolve5(cwd, args[2] || basename2(gitPath));
-          const fdir = join19(target, ".sol");
-          if (existsSync18(fdir))
+          const gitPath = resolve6(cwd, args[1] || die("usage: sol git import <git-repo> [dir]"));
+          const target = resolve6(cwd, args[2] || basename3(gitPath));
+          const fdir = join20(target, ".sol");
+          if (existsSync20(fdir))
             die("already a sol repo: " + target);
-          mkdirSync12(fdir, { recursive: true });
+          mkdirSync13(fdir, { recursive: true });
           const { commits, branches, head, current } = await importGitRepo2(gitPath, fdir);
           const refsBranches = {};
           for (const b of branches)
@@ -15398,20 +17222,20 @@ ${mrSummary2(pr)}`);
           if (!refsBranches[current])
             refsBranches[current] = { head, base: head };
           refsBranches[current].head = head;
-          writeFileSync16(join19(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
+          writeFileSync17(join20(fdir, "refs.json"), JSON.stringify({ current, branches: refsBranches, tags: {} }, null, 2));
           const store2 = new Store;
-          for (const name of readdirSync9(join19(fdir, "objects"))) {
+          for (const name of readdirSync9(join20(fdir, "objects"))) {
             if (name.endsWith(".tmp"))
               continue;
             try {
-              store2.put(decodeObject(readFileSync18(join19(fdir, "objects", name))));
+              store2.put(decodeObject(readFileSync20(join20(fdir, "objects", name))));
             } catch {}
           }
           const onDisk = hydrate3(store2, head, target);
-          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename2(gitPath)} (${onDisk} files; on branch ${current})`);
+          console.log(`imported ${commits} commit(s), ${branches.length} branch(es) from git -> ${args[2] || basename3(gitPath)} (${onDisk} files; on branch ${current})`);
         } else if (sub === "export") {
           const { log } = open();
-          const gitPath = resolve5(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
+          const gitPath = resolve6(cwd, args[1] || die("usage: sol git export <git-repo> [-b branch]"));
           const store2 = loadStore();
           const head = await log.head() ?? "";
           if (!head || !listAll(store2, head).length) {
@@ -15430,15 +17254,111 @@ ${mrSummary2(pr)}`);
         }
         break;
       }
+      case "agent": {
+        if (!existsSync20(solDir))
+          die("not a sol repo — run `sol init` first");
+        const parentSol = parentSolDir(solDir) ?? solDir;
+        const { createSession: createSession2, stopSession: stopSession2, sessions: sessions2, pruneSession: pruneSession2 } = await Promise.resolve().then(() => (init_agent_sessions(), exports_agent_sessions));
+        const sub = args[0];
+        const json = args.includes("--json");
+        const flagVal = (name) => {
+          const i = args.indexOf(name);
+          return i >= 0 ? args[i + 1] : undefined;
+        };
+        switch (sub) {
+          case "start": {
+            const name = args.slice(1).find((a) => !a.startsWith("-")) || die('usage: sol agent start <name> [dir] [--actor <name>] [--check "<cmd>"]');
+            const positionals2 = args.slice(1).filter((a) => !a.startsWith("-"));
+            const sessionActor = flagVal("--actor") || actor;
+            const metaRaw = flagVal("--meta");
+            let metadata;
+            if (metaRaw) {
+              try {
+                metadata = JSON.parse(metaRaw);
+              } catch {
+                die("--meta must be valid JSON");
+              }
+            }
+            const rec = createSession2({
+              parentSol,
+              name,
+              actor: sessionActor,
+              dir: positionals2[1] ? resolve6(procCwd, positionals2[1]) : undefined,
+              check: flagVal("--check"),
+              metadata
+            });
+            if (json) {
+              console.log(JSON.stringify(rec));
+              break;
+            }
+            console.log(`started agent session '${rec.name}'  (id ${rec.sessionId})`);
+            console.log(`  view     ${rec.viewDir}  (branch ${rec.branch} @ ${(rec.startHead || "empty").slice(0, 12)})`);
+            console.log(`  actor    ${rec.actor}`);
+            console.log(`  identity ${rec.fingerprint}`);
+            console.log(`  -> wire the agent:  cd ${rec.viewDir} && export SOL_ACTOR=${rec.actor} SOL_SIGNING_KEY=$(cat ${rec.signingKeyPath})`);
+            console.log(`     then edit + \`sol commit -m "..." <files>\`; converge with \`sol pull ${rec.viewDir}\` from the parent.`);
+            console.log(`  stop/clean:  \`sol agent stop ${rec.sessionId}\`  |  \`sol agent cleanup ${rec.sessionId} --delete\``);
+            break;
+          }
+          case "stop": {
+            const id = args.slice(1).find((a) => !a.startsWith("-")) || die("usage: sol agent stop <sessionId>");
+            const ok = stopSession2(parentSol, id);
+            if (json)
+              console.log(JSON.stringify({ stopped: ok, sessionId: id }));
+            else
+              console.log(ok ? `stopped session ${id} (the view + key remain — \`sol agent cleanup\` to remove)` : `no such session: ${id}`);
+            if (!ok)
+              process.exitCode = 1;
+            break;
+          }
+          case "status":
+          case undefined: {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const all = await sessions2(parentSol);
+            const list = id ? all.filter((s) => s.sessionId === id || s.name === id) : all;
+            if (json) {
+              console.log(JSON.stringify({ repo: parentSol, sessions: list }));
+              break;
+            }
+            if (!list.length) {
+              console.log(id ? `no such session: ${id}` : "no agent sessions — start one with `sol agent start <name>`");
+              break;
+            }
+            console.log(`agent sessions of ${parentSol}:`);
+            for (const s of list) {
+              console.log(`  ${s.name.padEnd(16)} ${s.sessionId.padEnd(28)} ${(s.head || s.startHead || "empty").slice(0, 12)}  ${s.actor.padEnd(12)} ${s.fingerprint}  [${s.state}]`);
+              console.log(`      ${s.viewDir}`);
+            }
+            console.log("  stop: `sol agent stop <id>` | cleanup: `sol agent cleanup <id> [--delete]` (or bare `cleanup` to prune stale)");
+            break;
+          }
+          case "cleanup": {
+            const id = args.slice(1).find((a) => !a.startsWith("-"));
+            const removed = pruneSession2(parentSol, id, args.includes("--delete"));
+            if (json)
+              console.log(JSON.stringify({ removed }));
+            else
+              console.log(removed.length ? `cleaned ${removed.length} session(s): ${removed.join(", ")}` : id ? `no such session: ${id}` : "no stale sessions to clean");
+            break;
+          }
+          default:
+            die(`unknown: sol agent ${sub}
+  sol agent start <name> [dir] [--actor N] [--check "<cmd>"]
+  sol agent status [<id>]
+  sol agent stop <id>
+  sol agent cleanup [<id>] [--delete]`);
+        }
+        break;
+      }
       case "view": {
         const { log } = open();
         if (readViewMeta(solDir))
           die("already inside a view — create views from the parent repo (its `.sol` owns the shared store + op-log).");
         const name = args.find((a) => !a.startsWith("-")) || die("usage: sol view <name> [dir]");
         const rest = args.filter((a) => !a.startsWith("-"));
-        const defaultDir = join19(dirname6(cwd), `${basename2(cwd)}-${name}`);
-        const viewDir = rest[1] ? resolve5(procCwd, rest[1]) : defaultDir;
-        if (existsSync18(join19(viewDir, ".sol")))
+        const defaultDir = join20(dirname7(cwd), `${basename3(cwd)}-${name}`);
+        const viewDir = rest[1] ? resolve6(procCwd, rest[1]) : defaultDir;
+        if (existsSync20(join20(viewDir, ".sol")))
           die("already a sol repo/view: " + viewDir);
         const branch = `view/${name}`;
         const startHead = await log.head() ?? emptyRoot(loadStore());
@@ -15452,7 +17372,7 @@ ${mrSummary2(pr)}`);
         break;
       }
       case "views": {
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo");
         const parentSol = parentSolDir(solDir) ?? solDir;
         const { pruneViews: pruneViews2, viewStatuses: viewStatuses2, sharedObjectCount: sharedObjectCount2 } = await Promise.resolve().then(() => (init_views(), exports_views));
@@ -15482,7 +17402,7 @@ ${mrSummary2(pr)}`);
       }
       case "check": {
         open();
-        const cd = cfgDir2();
+        const cd = cfgDir();
         const setIdx = args.indexOf("--set");
         if (setIdx >= 0) {
           const cmd2 = args[setIdx + 1] || die('usage: sol check --set "<command>"   (e.g. sol check --set "bun test")');
@@ -15548,12 +17468,12 @@ ${mrSummary2(pr)}`);
           await startSecretMcp2({ solDir, http });
           break;
         }
-        if (!existsSync18(solDir))
+        if (!existsSync20(solDir))
           die("not a sol repo — run `sol init` first");
         const { runEnv: runEnv2, runSecret: runSecret2, resolveReference: resolveReference2 } = await Promise.resolve().then(() => (init_secret2(), exports_secret2));
         const { loadSelfIdentity: loadSelfIdentity2, loadManageIdentity: loadManageIdentity2, fetchKey: fetchKey2 } = await Promise.resolve().then(() => (init_seal_audience(), exports_seal_audience));
         const { loadIdentity: loadIdentity2 } = await Promise.resolve().then(() => (init_identity_store(), exports_identity_store));
-        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL2).replace(/\/+$/, "");
+        const dirUrl = (process.env.SOL_REMOTE || DEFAULT_REMOTE_URL3).replace(/\/+$/, "");
         const selfPub = (account) => {
           const id = loadIdentity2();
           return id && id.accountId === account ? id.x25519Pub : undefined;
@@ -15565,7 +17485,7 @@ ${mrSummary2(pr)}`);
         };
         const dirEdPub = async (account) => (await fetchKey2(dirUrl, account))?.edPub;
         const remoteAnchorVerify = async () => {
-          const rcfg = resolveRemote2(solDir);
+          const rcfg = resolveRemote3(solDir);
           const token = process.env.SOL_TOKEN || await loadStoredToken2();
           if (!rcfg || !token)
             return;
@@ -15615,6 +17535,11 @@ everyday (examples are copy-safe — use real filenames):
   sol rm old.txt                 delete a file (from the repo and disk)
   sol ignore "*.tmp"             add an ignore pattern (no arg lists the active patterns)
   sol fsck / sol gc            verify integrity / drop unreachable objects
+  sol doctor                     full health check (op-log + objects + auth + files + sealed keyring)
+  sol fsck --repair              recover a corrupt repo (re-point a lost head / truncate to the last verified link)
+  sol recover                    guide through recovery (rehydrate from cloud, list roots, restore a file from history)
+  sol reflog                     the op-log as a ref-move history (head moves, by actor/branch/date)
+  sol remote verify              REMOTE-side health check (the backend's /fsck) with auth/network differentiation
   sol check --set "bun test"     gate convergence on a test command: a merge that line-converges but FAILS
                                  the check is flagged as a SEMANTIC conflict (status state:"SEMANTIC"), not
                                  silently accepted. \`sol check\` runs it on demand. (sol check --help)
@@ -15651,6 +17576,16 @@ clone-free agent views (the worktree killer — N agents, one shared store on di
                                  \`sol pull <view>\` converges losslessly. (sol view --help)
   sol views                      list every view (name, dir, branch, head, author, active/stale) + --prune
 
+agent sessions (one atomic command provisions a working tree, a signing identity, an actor, and the test-gate):
+  sol agent start <name>         create a view + MINT a per-session Ed25519 signing key + wire the actor +
+                                 inherit/set the test-gate, all at once. prints SOL_SIGNING_KEY / SOL_ACTOR to
+                                 export so every op the agent authors is cryptographically attributable.
+                                 (--actor <name>, --check "<cmd>", [dir], --json)
+  sol agent status [<id>]        list sessions (name, id, head, actor, fingerprint, running/stopped/stale)
+  sol agent stop <id>            mark a session stopped (presence signal; view + key remain)
+  sol agent cleanup [<id>]       remove the session record + its key (--delete also removes the view dir;
+                                 bare \`cleanup\` prunes every stale session)
+
 branches & tags:
   sol branch                     list branches (sol branch feature creates one at HEAD)
   sol switch feature             switch to a branch (captures current work first, never loses it)
@@ -15667,6 +17602,7 @@ auth (sign in once; remote commands then use the cached token, no SOL_TOKEN need
 remotes (self-hostable backend; token in SOL_TOKEN or via sol auth login):
   sol clone [<url>] <owner>/<repo> [dir]   clone a remote repo (checks out PRODUCTION); default dir = <repo>
   sol push / sol pull          sync your commits with the remote (push registers your branch's head)
+  sol sync --watch             hands-off bidirectional sync daemon: auto-capture + push edits, converge safe pulls in
   sol push <repo>                one-step share: no remote set? use the hosted Sol + <repo>, then push
   sol push --public <repo>       create + push + make public in one step (new repos are private by default)
   sol promote [branch]         point the remote's production branch at <branch> (default: current)
@@ -15706,10 +17642,15 @@ async function runCli2(argv) {
     const msg = e?.message || String(e);
     if (/ -> 401\b/.test(msg) || /\b401 unauthorized\b/i.test(msg))
       authExpired2();
+    const { CorruptObjectError: CorruptObjectError2, CorruptRepoError: CorruptRepoError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
+    if (e instanceof CorruptObjectError2 || e instanceof CorruptRepoError2) {
+      const { friendlyError: friendlyError2 } = await Promise.resolve().then(() => (init_errors_friendly(), exports_errors_friendly));
+      die(friendlyError2(e));
+    }
     die(msg);
   }
 }
-var CRED_PATH2, DEFAULT_REMOTE_URL2, ATTEST_KEY2, remoteUrlArg2 = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL2, a], cfgDir2 = () => parentSolDir(solDir) ?? solDir;
+var CRED_PATH2, DEFAULT_REMOTE_URL3, ATTEST_KEY2, remoteUrlArg2 = (a) => /^https?:\/\//.test(a[0] ?? "") ? [a[0].replace(/\/+$/, ""), a.slice(1)] : [DEFAULT_REMOTE_URL3, a];
 var init_dispatch2 = __esm(() => {
   init_chain();
   init_diff();
@@ -15721,18 +17662,18 @@ var init_dispatch2 = __esm(() => {
   init_remote();
   init_lib();
   init_test_gate();
-  CRED_PATH2 = join19(homedir3(), ".sol", "credentials");
-  DEFAULT_REMOTE_URL2 = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
+  CRED_PATH2 = join20(homedir3(), ".sol", "credentials");
+  DEFAULT_REMOTE_URL3 = (process.env.SOL_REMOTE || "https://sol.midsummer.new").replace(/\/+$/, "");
   ATTEST_KEY2 = process.env.SOL_ATTEST_KEY || undefined;
 });
 
 // src/bin/sol.ts
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 function cliVersion3() {
   if (typeof __SOL_COMPILED_VERSION__ === "string" && __SOL_COMPILED_VERSION__)
     return __SOL_COMPILED_VERSION__;
   try {
-    return JSON.parse(readFileSync19(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
+    return JSON.parse(readFileSync21(new URL("./package.json", import.meta.url), "utf8")).version || "dev";
   } catch {
     return "dev";
   }