New `kidlisp-sidecar/` Clojure service exposes a Datomic-native API for kidlisp pieces, ATProto rkeys, IPFS bundles, mint events, and the existing tezos/keep state. Schema marks `:kidlisp/hits` and `:kidlisp/last-accessed` `:db/noHistory` so the tx log stays meaningful. A read-only `/admin/*` surface (schema, stats, entity browse + history, tx log, sandboxed datalog console, backups) is silo-only. `silo/datomic/` holds the host-side ops: transactor systemd unit + properties template, Postgres init, nightly pg_dump cron with 14-day retention, and deploy/bootstrap fish scripts. Storage-access-key is aligned to the `datomic` PG user so peer connections work without a separate role. `silo/server.mjs` proxies `/api/datomic/*` to the sidecar with `requireAdmin`, and `silo/dashboard.html` adds a `datomic` tab with status, schema table, entity browser + history, tx log, and a read-only datalog console. Sidecar is bound to 127.0.0.1; only silo talks to it. `system/netlify/functions/store-kidlisp-datomic.mjs` is a parallel implementation of `store-kidlisp.mjs` that speaks the existing external API but routes all reads/writes through the sidecar (no Mongo writes for kidlisp). The original handler routes to it when `KIDLISP_DATOMIC=on`, so cutover is a single env-var flip and rollback is the inverse. `system/backend/backfill-kidlisp-to-datomic.mjs` is the one-shot Mongo replay (idempotent via hash dedup). MIGRATION.md punchlists the 30+ remaining touch points to migrate post-cutover. v1 brought up live on silo, backfilled 17,532 docs / 0 errors, counts match Mongo exactly. Feature flag stays off pending cutover. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>