@githolon/dsl 0.100.6 → 0.101.0

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.96.0';
+const String kExpectedRunnerBundleVersion = '0.100.6';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -87,16 +87,52 @@ class TransferProgress {
   final int received;
   final int? total;
   final String kind; // 'delta' (incremental) | 'full' (initial clone)
-  const TransferProgress({required this.received, this.total, this.kind = 'delta'});
-  double? get fraction => (total == null || total == 0) ? null : (received / total!).clamp(0.0, 1.0);
+  const TransferProgress(
+      {required this.received, this.total, this.kind = 'delta'});
+  double? get fraction => (total == null || total == 0)
+      ? null
+      : (received / total!).clamp(0.0, 1.0);
   bool get done => total != null && received >= total!;
-  factory TransferProgress.fromMessage(Map<String, Object?> m) => TransferProgress(
+  factory TransferProgress.fromMessage(Map<String, Object?> m) =>
+      TransferProgress(
         received: (m['received'] as num?)?.toInt() ?? 0,
         total: (m['total'] as num?)?.toInt(),
         kind: m['kind']?.toString() ?? 'delta',
       );
 }
 
+/// One opaque point in this workspace's verified history. Applications use it as the handle passed to a
+/// generated client's `past.at(moment)`; [id] is framework identity, not a business field and need never be
+/// parsed. The remaining fields make a timeline useful without exposing commit or event-sourcing ceremony.
+class NomosMoment {
+  final String id;
+  final DateTime? occurredAt;
+  final String? actorSubject;
+  final String? domain;
+  final String? action;
+
+  const NomosMoment({
+    required this.id,
+    this.occurredAt,
+    this.actorSubject,
+    this.domain,
+    this.action,
+  });
+
+  factory NomosMoment.fromJson(Map<String, Object?> json) {
+    final at = json['at'];
+    return NomosMoment(
+      id: (json['oid'] ?? '').toString(),
+      occurredAt: at is num
+          ? DateTime.fromMillisecondsSinceEpoch(at.toInt(), isUtc: true)
+          : null,
+      actorSubject: json['actorSubject']?.toString(),
+      domain: json['domain']?.toString(),
+      action: json['directiveId']?.toString(),
+    );
+  }
+}
+
 enum SyncPhase { idle, syncing, transferring, behind, offline, error }
 
 /// The app-ready sync state — a truthful aggregation of the low-level signals (sync rounds, the doorbell,
@@ -123,9 +159,17 @@ class SyncStatus {
     this.lastError,
   });
   SyncStatus copyWith({
-    SyncPhase? phase, int? ahead, int? behind, int? saved, int? onMain, int? deadLetters,
-    TransferProgress? transfer, bool clearTransfer = false, DateTime? lastSyncedAt,
-    String? lastError, bool clearError = false,
+    SyncPhase? phase,
+    int? ahead,
+    int? behind,
+    int? saved,
+    int? onMain,
+    int? deadLetters,
+    TransferProgress? transfer,
+    bool clearTransfer = false,
+    DateTime? lastSyncedAt,
+    String? lastError,
+    bool clearError = false,
   }) =>
       SyncStatus(
         phase: phase ?? this.phase,
@@ -149,7 +193,8 @@ class NomosCreated {
   /// The workspace the offer ran on (NomosRef). Additive — defaults to '' on older runners that
   /// don't stamp it; then [ref] is workspace-blank (still a valid locator on the local plane).
   final String workspace;
-  const NomosCreated({required this.type, required this.id, this.workspace = ''});
+  const NomosCreated(
+      {required this.type, required this.id, this.workspace = ''});
 
   /// The canonical [NomosRef] view — the `{workspace,type,id}` triple, followable/serializable
   /// (`nomos://<workspace>/<type>/<id>`). One reference, everywhere.
@@ -186,13 +231,17 @@ class NomosBbox {
         maxY = (maxY ?? maxLat)!;
 
   /// Deprecated geographic accessors — spatial axes are generic. Prefer [minX]/[minY]/[maxX]/[maxY].
-  @Deprecated('Spatial axes are generic; use minX/minY. Kept for source compat.')
+  @Deprecated(
+      'Spatial axes are generic; use minX/minY. Kept for source compat.')
   double get minLng => minX;
-  @Deprecated('Spatial axes are generic; use minX/minY. Kept for source compat.')
+  @Deprecated(
+      'Spatial axes are generic; use minX/minY. Kept for source compat.')
   double get minLat => minY;
-  @Deprecated('Spatial axes are generic; use maxX/maxY. Kept for source compat.')
+  @Deprecated(
+      'Spatial axes are generic; use maxX/maxY. Kept for source compat.')
   double get maxLng => maxX;
-  @Deprecated('Spatial axes are generic; use maxX/maxY. Kept for source compat.')
+  @Deprecated(
+      'Spatial axes are generic; use maxX/maxY. Kept for source compat.')
   double get maxLat => maxY;
 
   Map<String, Object?> toJson() => {
@@ -256,15 +305,18 @@ class NomosCompat {
 
   static NomosCompat? fromJson(Map<String, Object?>? m) {
     if (m == null) return null;
-    final rawMembers = (m['members'] as Map?)?.cast<String, Object?>() ?? const {};
+    final rawMembers =
+        (m['members'] as Map?)?.cast<String, Object?>() ?? const {};
     final members = <String, NomosCompatMember>{};
     rawMembers.forEach((k, v) {
-      if (v is Map) members[k] = NomosCompatMember.fromJson(v.cast<String, Object?>());
+      if (v is Map)
+        members[k] = NomosCompatMember.fromJson(v.cast<String, Object?>());
     });
     final install = (m['install'] as Map?)?.cast<String, Object?>() ?? const {};
     return NomosCompat(
       generatedFor: (m['generatedFor'] as String?) ?? '',
-      workspaceRuns: ((m['workspaceRuns'] as List?) ?? const []).map((e) => '$e').toList(),
+      workspaceRuns:
+          ((m['workspaceRuns'] as List?) ?? const []).map((e) => '$e').toList(),
       matches: m['matches'] == true,
       offerKnown: m['offerKnown'] == true,
       structurallyCompatible: m['structurallyCompatible'] as bool?,
@@ -285,9 +337,96 @@ class NomosScopeKey {
   final String scope;
   final int epoch;
   final String key;
+
+  /// Framework-private signing-key subject used to pin `.owned()` custody to one approved device.
+  final String? ownedKeySubject;
+
+  /// Framework-private encrypted handoff, present only while seating the first device.
+  final String? ownedCustody;
+
+  /// Framework-private deterministic child address, present only for an unborn owned business aggregate.
+  final String? workspace;
   const NomosScopeKey(
-      {required this.scope, required this.epoch, required this.key});
-  Map<String, Object?> toJson() => {'scope': scope, 'epoch': epoch, 'key': key};
+      {required this.scope,
+      required this.epoch,
+      required this.key,
+      this.ownedKeySubject,
+      this.ownedCustody,
+      this.workspace});
+  Map<String, Object?> toJson() => {
+        'scope': scope,
+        'epoch': epoch,
+        'key': key,
+        if (ownedKeySubject != null) 'ownedKeySubject': ownedKeySubject,
+        if (ownedCustody != null) 'ownedCustody': ownedCustody,
+        if (workspace != null) 'workspace': workspace,
+      };
+}
+
+/// The entire app-facing multi-device surface for owned business state. The request is deliberately an
+/// opaque string: apps may copy, share or QR it, but never parse certificates, key material or signer law.
+class NomosDevices {
+  final NomosBridge bridge;
+  final String domain;
+  final String domainHash;
+  final String? actor;
+  final String scope;
+
+  const NomosDevices({
+    required this.bridge,
+    required this.domain,
+    required this.domainHash,
+    required this.actor,
+    required this.scope,
+  });
+
+  Future<String> request() => bridge.nomosOwnedDeviceRequest(scope);
+
+  Future<NomosOfferOutcome> approve(String request) async {
+    final principal = actor ?? bridge.principal;
+    if (principal == null || principal.trim().isEmpty) {
+      throw StateError('devices.approve() needs a signed-in Nomos session');
+    }
+    final payload =
+        await bridge.nomosPrepareOwnedDeviceApproval(request, scope);
+    return bridge.offerOutcome(
+      domain: domain,
+      directiveId: 'nomos_internal_approve_owned_device_7c1f5e',
+      payload: payload,
+      actor: principal,
+      domainHash: domainHash,
+    );
+  }
+}
+
+/// The one business-level recovery policy surface. Escrow wraps, Orders, Receipts and retries stay inside Nomos.
+class NomosRecovery {
+  final NomosBridge bridge;
+  final String domain;
+  final String domainHash;
+  final String scope;
+
+  const NomosRecovery({
+    required this.bridge,
+    required this.domain,
+    required this.domainHash,
+    required this.scope,
+  });
+
+  /// Opt into all-device-loss recovery with [person]. This is intentionally one-way for a workspace:
+  /// a principal who has legitimately recovered a key cannot be made to forget it later.
+  Future<Map<String, Object?>> protectWith(String person) {
+    if (person.trim().isEmpty) {
+      throw ArgumentError(
+          'recovery.protectWith() needs the person who will recover you');
+    }
+    return bridge.nomosProtectOwnedIdentity(
+      scope: scope,
+      domain: domain,
+      domainHash: domainHash,
+      recoveryPrincipal: person,
+    );
+  }
 }
 
 /// The app-supplied KEY CUSTODY surface (E2E sealing). Supply one to a generated `<Domain>Client` and its
@@ -341,9 +480,7 @@ class WrappedKeyStore implements NomosKeyStore {
             hpkeEpk: d['hpkeEpk'].toString(),
             ct: d['ct'].toString());
         held.add(NomosScopeKey(
-            scope: scope,
-            epoch: (d['epoch'] as num?)?.toInt() ?? 0,
-            key: key));
+            scope: scope, epoch: (d['epoch'] as num?)?.toInt() ?? 0, key: key));
       }
       held.sort((a, b) => b.epoch - a.epoch);
       return held;
@@ -416,7 +553,10 @@ class BirthIncomplete implements Exception {
 
   /// The first failed child's kernel code (e.g. `BirthLawPackageUnavailable`), or `BirthFailed`.
   String get code =>
-      (failedBirths.isNotEmpty ? failedBirths.first['code']?.toString() : null) ?? 'BirthFailed';
+      (failedBirths.isNotEmpty
+          ? failedBirths.first['code']?.toString()
+          : null) ??
+      'BirthFailed';
 
   /// The child workspace name(s) that did not come up.
   List<String> get workspaces => failedBirths
@@ -489,8 +629,7 @@ class NomosEncryption {
 
   Future<List<String>> _readRoster(String scope) async {
     final s = _parseScope(scope);
-    final rows =
-        await bridge.queryById('reltuple-${s.object}-${s.relation}');
+    final rows = await bridge.queryById('reltuple-${s.object}-${s.relation}');
     final subjects = rows.isEmpty
         ? const <String, dynamic>{}
         : ((rows.first['data'] as Map?)?['subjects'] as Map?) ??
@@ -499,9 +638,8 @@ class NomosEncryption {
     subjects.forEach((subj, leafRaw) {
       Map? leaf;
       try {
-        leaf = leafRaw is String
-            ? jsonDecode(leafRaw) as Map
-            : (leafRaw as Map);
+        leaf =
+            leafRaw is String ? jsonDecode(leafRaw) as Map : (leafRaw as Map);
       } catch (_) {
         leaf = null;
       }
@@ -524,11 +662,14 @@ class NomosEncryption {
   Future<String> _freshScopeKey() async {
     final kp = await bridge.cryptoKeygen();
     final secret = base64Decode((kp['secret'] ?? '').toString());
-    return base64Encode(secret.sublist(0, 32)); // the 32-byte epoch secret; NEVER lands on chain
+    return base64Encode(secret.sublist(
+        0, 32)); // the 32-byte epoch secret; NEVER lands on chain
   }
 
   Future<String?> _memberPubKey(String principal,
-      {String? newcomer, String? newcomerPub, Map<String, String>? memberKeys}) async {
+      {String? newcomer,
+      String? newcomerPub,
+      Map<String, String>? memberKeys}) async {
     if (memberKeys != null && memberKeys[principal] != null) {
       return memberKeys[principal];
     }
@@ -589,7 +730,9 @@ class NomosEncryption {
     final wraps = <Map<String, Object?>>[];
     for (final principal in members) {
       final pub = await _memberPubKey(principal,
-          newcomer: addPrincipal, newcomerPub: addPublicKey, memberKeys: memberKeys);
+          newcomer: addPrincipal,
+          newcomerPub: addPublicKey,
+          memberKeys: memberKeys);
       if (pub == null) throw EncryptionMemberKeyMissing(principal, scope);
       final w = await bridge.cryptoWrapKey(recipientPub: pub, scopeKey: key);
       wraps.add({
@@ -599,7 +742,8 @@ class NomosEncryption {
         'ct': (w['ct'] ?? '').toString(),
       });
     }
-    final epoch = (await _currentEpoch(scope)) + 1; // forward-only: strictly increments
+    final epoch =
+        (await _currentEpoch(scope)) + 1; // forward-only: strictly increments
     final head = (await bridge.offerOutcome(
       domain: domain,
       directiveId: 'advanceKeyEpoch',
@@ -750,7 +894,8 @@ extension NomosRefAcquire on NomosRef {
       throw ArgumentError.value(this, 'ref',
           'NomosRef.acquire: the ref carries no workspace — only a workspace-complete ref is openable');
     }
-    return bridge.acquireSession(workspace, ifAbsentCredentials: ifAbsentCredentials);
+    return bridge.acquireSession(workspace,
+        ifAbsentCredentials: ifAbsentCredentials);
   }
 }
 
@@ -817,9 +962,12 @@ class NomosBridge {
   final StreamController<TransferProgress> _transferEvents =
       StreamController<TransferProgress>.broadcast();
   // The DERIVED app-ready sync state. seeded-on-listen with a metrics poll; updated on sync/signal/transfer.
-  late final StreamController<SyncStatus> _syncStatusCtrl = StreamController<SyncStatus>.broadcast(
+  late final StreamController<SyncStatus> _syncStatusCtrl =
+      StreamController<SyncStatus>.broadcast(
     onListen: _startStatusPoll,
-    onCancel: () { if (!_syncStatusCtrl.hasListener) _stopStatusPoll(); },
+    onCancel: () {
+      if (!_syncStatusCtrl.hasListener) _stopStatusPoll();
+    },
   );
   SyncStatus _status = const SyncStatus();
   Timer? _metricsTimer;
@@ -852,7 +1000,8 @@ class NomosBridge {
   StaleRunnerBundle? _staleBundleError(Object? bundleVersion) {
     final v = bundleVersion is String ? bundleVersion : null;
     if (v == 'unbundled-dev') return null;
-    if (v != null && _semverAtLeast(v, kExpectedRunnerBundleVersion)) return null;
+    if (v != null && _semverAtLeast(v, kExpectedRunnerBundleVersion))
+      return null;
     return StaleRunnerBundle(found: v, expected: kExpectedRunnerBundleVersion);
   }
 
@@ -963,7 +1112,8 @@ class NomosBridge {
     if (event == 'lawChanged') {
       // COMPAT SUPERPOWER (#72b): a synced install/upgrade/retire moved the workspace's offer under this
       // live client. Cache the fresh verdict + emit it so the app re-checks feature flags without polling.
-      final c = NomosCompat.fromJson((m['compat'] as Map?)?.cast<String, Object?>());
+      final c =
+          NomosCompat.fromJson((m['compat'] as Map?)?.cast<String, Object?>());
       if (c != null) {
         _lastCompat = c;
         final sess = m['session'] as String?;
@@ -979,7 +1129,9 @@ class NomosBridge {
       if (event == 'sync') {
         // a completed round → idle (the next metrics poll folds in residual ahead/behind), stamp the time.
         _pushStatus(_status.copyWith(
-            phase: SyncPhase.idle, clearTransfer: true, lastSyncedAt: DateTime.now()));
+            phase: SyncPhase.idle,
+            clearTransfer: true,
+            lastSyncedAt: DateTime.now()));
       } else if (m['status'] == 'closed' || m['status'] == 'offline') {
         _pushStatus(_status.copyWith(phase: SyncPhase.offline));
       }
@@ -998,7 +1150,8 @@ class NomosBridge {
       if (!_transferEvents.isClosed) _transferEvents.add(tp);
       _pushStatus(_status.copyWith(
           phase: tp.done ? SyncPhase.syncing : SyncPhase.transferring,
-          transfer: tp, clearTransfer: tp.done));
+          transfer: tp,
+          clearTransfer: tp.done));
       return;
     }
     if (event == 'trace') {
@@ -1010,7 +1163,8 @@ class NomosBridge {
       // signal holon projection: ephemeral coordination such as peer frontiers / lag.
       if (!_signalEvents.isClosed) _signalEvents.add(m);
       // the doorbell says canonical main advanced → we're behind until the next pull lands.
-      if (_status.phase == SyncPhase.idle) _pushStatus(_status.copyWith(phase: SyncPhase.behind));
+      if (_status.phase == SyncPhase.idle)
+        _pushStatus(_status.copyWith(phase: SyncPhase.behind));
       return;
     }
     if (event == 'span') {
@@ -1087,7 +1241,8 @@ class NomosBridge {
     try {
       final parts = token.split('.');
       if (parts.length < 2) return null;
-      final payload = jsonDecode(utf8.decode(base64Url.decode(base64Url.normalize(parts[1]))));
+      final payload = jsonDecode(
+          utf8.decode(base64Url.decode(base64Url.normalize(parts[1]))));
       final sub = payload is Map ? payload['sub'] : null;
       if (sub is! String || sub.trim().isEmpty) return null;
       final value = sub.trim();
@@ -1115,7 +1270,8 @@ class NomosBridge {
   /// `ForeignNotFound`, not a throw) and reads it. [cloud] is the cloud the foreign workspaces sync from
   /// (usually the same cloud your primary workspace uses); omit for a purely local plane. This is a LOCATOR
   /// resolver, not a foreign key — the foreign holon is sovereign, mounted only when you choose to resolve.
-  NomosForeignReader foreignReader({String? cloud}) => _BridgeForeignReader(this, cloud);
+  NomosForeignReader foreignReader({String? cloud}) =>
+      _BridgeForeignReader(this, cloud);
 
   /// The workspace names [connect] has opened on this plane (the live sessions).
   List<String> get connectedSessions =>
@@ -1128,7 +1284,9 @@ class NomosBridge {
     final plane = _eventPlane;
     final scoped = _sessionName;
     if (scoped != null) return plane._sessionPrincipals[scoped];
-    return plane._sessionPrincipals.length == 1 ? plane._sessionPrincipals.values.first : null;
+    return plane._sessionPrincipals.length == 1
+        ? plane._sessionPrincipals.values.first
+        : null;
   }
 
   /// ENUMERATE THE LOCAL PLANE — every workspace on this device + its lifecycle STATE and sync posture:
@@ -1141,17 +1299,17 @@ class NomosBridge {
   /// `syncPosture` is `"local-only"` (no cloud counterpart) or `"cloud-bound"`.
   Future<List<Map<String, Object?>>> listWorkspaces() async {
     final connected = _eventPlane._sessionNames.toSet();
-    return (((_asMap(await _call('listWorkspaces'))['workspaces']) as List?) ?? const [])
+    return (((_asMap(await _call('listWorkspaces'))['workspaces']) as List?) ??
+            const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .map((w) {
-          final ws = w['workspace']?.toString() ?? '';
-          // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
-          w['state'] = (w['parked'] == true)
-              ? 'parked'
-              : (connected.contains(ws) ? 'connected' : 'resident');
-          return w;
-        })
-        .toList();
+      final ws = w['workspace']?.toString() ?? '';
+      // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
+      w['state'] = (w['parked'] == true)
+          ? 'parked'
+          : (connected.contains(ws) ? 'connected' : 'resident');
+      return w;
+    }).toList();
   }
 
   /// Open a workspace on this plane: boot its LOCAL githolon under the installed law (from [restoreFrom]
@@ -1200,22 +1358,26 @@ class NomosBridge {
       // fail closed (the break surfaces as an error on the sync/pull that hit it; the holon stays local).
       if (onCustodyBreak != null) 'onCustodyBreak': onCustodyBreak.wire,
     }));
-    _eventPlane._sessionNames.add(ws); // the open succeeded — the session is real now
+    _eventPlane._sessionNames
+        .add(ws); // the open succeeded — the session is real now
     final boundPrincipal = _principalFromToken(authToken);
-    if (boundPrincipal != null) _eventPlane._sessionPrincipals[ws] = boundPrincipal;
-    _eventPlane._lastRecovery = (r['recovery'] as Map?)?.cast<String, Object?>();
+    if (boundPrincipal != null)
+      _eventPlane._sessionPrincipals[ws] = boundPrincipal;
+    _eventPlane._lastRecovery =
+        (r['recovery'] as Map?)?.cast<String, Object?>();
   }
 
   /// The custody lifecycle stream (rebirth_and_custody_lifecycle.md) — a rebirth/divergence surfaces here as a
   /// typed [NomosCustodyEvent]. Bind a Flutter break dialog / posture banner to it; for a `CustodyBreakPolicy.
   /// ask` session, an event of `kind == 'ask'` awaits [resolveCustodyBreak].
-  Stream<NomosCustodyEvent> get custodyEvents => _eventPlane._custodyEvents.stream;
+  Stream<NomosCustodyEvent> get custodyEvents =>
+      _eventPlane._custodyEvents.stream;
 
   /// Where a session sits on the custody spectrum (incarnation, posture, pending/salvaged local work,
   /// supersession history) — for a status banner or a "you're offline on old truth" indicator.
   Future<NomosCustodyStatus> custodyStatus({String? session}) async =>
-      NomosCustodyStatus.fromJson(
-          _asMap(await _call('custodyStatus', {if (session != null) 'session': session})));
+      NomosCustodyStatus.fromJson(_asMap(await _call(
+          'custodyStatus', {if (session != null) 'session': session})));
 
   /// Continue an `ask`-policy custody break with the user's decision (adopt|reject) — the async UX lane.
   Future<Map<String, Object?>> resolveCustodyBreak(String decision,
@@ -1227,7 +1389,8 @@ class NomosBridge {
 
   /// The parked salvaged intents (re-offerable local work an `adopt` rescued) — metadata only.
   Future<List<Map<String, Object?>>> salvagedIntents({String? session}) async {
-    final r = _asMap(await _call('salvagedIntents', {if (session != null) 'session': session}));
+    final r = _asMap(await _call(
+        'salvagedIntents', {if (session != null) 'session': session}));
     return ((r['salvaged'] as List?) ?? const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .toList();
@@ -1235,13 +1398,16 @@ class NomosBridge {
 
   /// Re-offer parked salvaged work under the current (adopted) law — the explicit app move (never automatic
   /// across incarnations). [id] re-offers one; omitted re-offers all.
-  Future<Map<String, Object?>> reofferSalvaged({String? id, String? session}) async =>
+  Future<Map<String, Object?>> reofferSalvaged(
+          {String? id, String? session}) async =>
       _asMap(await _call('reofferSalvaged',
           {if (id != null) 'id': id, if (session != null) 'session': session}));
 
   /// Discard one parked salvaged intent — the app's explicit choice.
-  Future<Map<String, Object?>> discardSalvaged(String id, {String? session}) async =>
-      _asMap(await _call('discardSalvaged', {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> discardSalvaged(String id,
+          {String? session}) async =>
+      _asMap(await _call('discardSalvaged',
+          {'id': id, if (session != null) 'session': session}));
 
   // ── THE DEAD-LETTER QUEUE (refused-but-legitimate work is NEVER lost) — the Dart mirror of the
   //   JS holon's DLQ surface (`deadLetters()` / `retryDeadLetter()` / `discardDeadLetter()`). A
@@ -1252,7 +1418,8 @@ class NomosBridge {
   /// The parked dead letters — metadata only (`{id, oid, source, error, domain, directiveId, at}`);
   /// the intent bytes stay in the durable queue.
   Future<List<Map<String, Object?>>> deadLetters({String? session}) async {
-    final r = _asMap(await _call('deadLetters', {if (session != null) 'session': session}));
+    final r = _asMap(
+        await _call('deadLetters', {if (session != null) 'session': session}));
     return ((r['dead'] as List?) ?? const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .toList();
@@ -1261,12 +1428,16 @@ class NomosBridge {
   /// Retry one dead letter (after the law fix landed): pulls canon first (it may already be
   /// admitted), else re-offers the parked bytes locally. `{ok, head?|alreadyOnMain?|error?}` —
   /// a refusal leaves the entry parked (with the fresh error), never lost.
-  Future<Map<String, Object?>> retryDeadLetter(String id, {String? session}) async =>
-      _asMap(await _call('retryDeadLetter', {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> retryDeadLetter(String id,
+          {String? session}) async =>
+      _asMap(await _call('retryDeadLetter',
+          {'id': id, if (session != null) 'session': session}));
 
   /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
-  Future<Map<String, Object?>> discardDeadLetter(String id, {String? session}) async =>
-      _asMap(await _call('discardDeadLetter', {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> discardDeadLetter(String id,
+          {String? session}) async =>
+      _asMap(await _call('discardDeadLetter',
+          {'id': id, if (session != null) 'session': session}));
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
   /// writes + the DLQ), each with its full `intentB64` bytes: `{pendingWrites, deadLetters}`. The
@@ -1278,9 +1449,9 @@ class NomosBridge {
   /// (a refusal dead-letters — never lost), and dead-letter entries are re-queued into the DLQ.
   /// Returns the recovery report `{salvagedWrites, requeuedDeadLetters, unsalvageable}`.
   Future<Map<String, Object?>> absorbSalvage(
-      {List<Map<String, Object?>> pendingWrites = const [],
-      List<Map<String, Object?>> deadLetters = const [],
-      String? session}) async =>
+          {List<Map<String, Object?>> pendingWrites = const [],
+          List<Map<String, Object?>> deadLetters = const [],
+          String? session}) async =>
       _asMap(await _call('absorbSalvage', {
         'pendingWrites': pendingWrites,
         'deadLetters': deadLetters,
@@ -1294,7 +1465,8 @@ class NomosBridge {
   Map<String, Object?>? _lastRecovery;
 
   /// LOCAL-FIRST offer: carry opaque intent bytes into the GitHolon. Returns the new local head; durable on [sync].
-  @Deprecated('Engine-level generic writes are the footgun (session_bound_clients.md ask 1/7): '
+  @Deprecated(
+      'Engine-level generic writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession '
       '(XClient.bind(session)). Retained for CLIs/admin tooling/generated internals only.')
   Future<String> offer({required String intentBytes}) async {
@@ -1312,7 +1484,8 @@ class NomosBridge {
   /// its trust policy); [force] carries the deploy/evolve force flag through. Both are OMITTED from the wire
   /// when absent, so a plain offer is byte-identical to before. [session] pins the colocated workspace in a
   /// cluster harness (absent ⇒ the runner's sole-session default).
-  @Deprecated('Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+  @Deprecated(
+      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession '
       '(XClient.bind(session) — no domain/directive strings at call sites). '
       'Retained for CLIs/admin tooling/generated internals only.')
@@ -1323,6 +1496,7 @@ class NomosBridge {
     String? actor,
     String? domainHash,
     List<Map<String, Object?>>? attestations,
+    List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
     // Per-offer signing key (base64 device secret): sign THIS offer with a specific device key instead of
@@ -1336,6 +1510,8 @@ class NomosBridge {
       if (actor != null) 'actor': actor,
       if (domainHash != null) 'domainHash': domainHash,
       if (attestations != null) 'attestations': attestations,
+      if (nomosConflictSnapshots != null)
+        '__nomosConflictSnapshots': nomosConflictSnapshots,
       if (force != null) 'force': force,
       if (session != null) 'session': session,
       if (authorSecret != null) 'authorSecret': authorSecret,
@@ -1347,7 +1523,8 @@ class NomosBridge {
   /// inside the sealed intent (callers never supply one); the runner hands back what was minted, so a
   /// generated create method returns the typed id with NO query-after round-trip. [created] is empty for
   /// pure mutations.
-  @Deprecated('Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+  @Deprecated(
+      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession. '
       'Retained for CLIs/admin tooling/generated internals only.')
   Future<NomosOfferOutcome> offerCreates({
@@ -1357,6 +1534,7 @@ class NomosBridge {
     String? actor,
     String? domainHash,
     List<Map<String, Object?>>? attestations,
+    List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
     String? authorSecret,
@@ -1368,6 +1546,7 @@ class NomosBridge {
         actor: actor,
         domainHash: domainHash,
         attestations: attestations,
+        nomosConflictSnapshots: nomosConflictSnapshots,
         force: force,
         session: session,
         authorSecret: authorSecret,
@@ -1385,6 +1564,7 @@ class NomosBridge {
     String? actor,
     String? domainHash,
     List<Map<String, Object?>>? attestations,
+    List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
     // Per-offer signing key (base64 device secret): sign THIS offer with a specific device key instead
@@ -1407,6 +1587,8 @@ class NomosBridge {
         if (actor != null) 'actor': actor,
         if (domainHash != null) 'domainHash': domainHash,
         if (attestations != null) 'attestations': attestations,
+        if (nomosConflictSnapshots != null)
+          '__nomosConflictSnapshots': nomosConflictSnapshots,
         if (force != null) 'force': force,
         if (session != null) 'session': session,
         if (authorSecret != null) 'authorSecret': authorSecret,
@@ -1424,12 +1606,19 @@ class NomosBridge {
           final x = v.toInt();
           return x < t0 ? t0 : (x > t1 ? t1 : x);
         }
+
         noteLocalSpan(
-            track: 'submit', name: 'offer: bridge ipc (up-leg)', kind: 'bridge-ipc',
-            t0: t0, t1: within(recv));
+            track: 'submit',
+            name: 'offer: bridge ipc (up-leg)',
+            kind: 'bridge-ipc',
+            t0: t0,
+            t1: within(recv));
         noteLocalSpan(
-            track: 'submit', name: 'offer: response delivery (down-leg)', kind: 'response-delivery',
-            t0: within(done), t1: t1);
+            track: 'submit',
+            name: 'offer: response delivery (down-leg)',
+            kind: 'response-delivery',
+            t0: within(done),
+            t1: t1);
       }
     }
     final births = ((r['birthOutcomes'] as List?) ?? const [])
@@ -1451,8 +1640,8 @@ class NomosBridge {
     final bornRaw = (r['born'] as List?);
     final bornNames = <String>[
       if (bornRaw != null)
-        ...bornRaw.map((e) =>
-            (e is Map ? (e['workspace'] ?? '') : e).toString())
+        ...bornRaw
+            .map((e) => (e is Map ? (e['workspace'] ?? '') : e).toString())
       else
         ...births
             .map((m) => (m['workspace'] ?? '').toString())
@@ -1487,15 +1676,20 @@ class NomosBridge {
   /// originates in the sealed kernel, so the bridge (not the kernel) owns the ergonomics.
   /// Anything that isn't that refusal passes through unchanged.
   Future<Object> _wrapDomainNotInstalled(Object e,
-      {required String domain, String? domainHash, String? requestedWorkspace}) async {
-    if (!RegExp(r"no active installed law declares domain '").hasMatch(e.toString())) return e;
+      {required String domain,
+      String? domainHash,
+      String? requestedWorkspace}) async {
+    if (!RegExp(r"no active installed law declares domain '")
+        .hasMatch(e.toString())) return e;
     final self = this;
     final sessionWs = self is NomosSession ? self.workspace : null;
     var activeKeys = const <String>[];
     try {
       final offer = await interfaceOffer();
       if (offer != null) activeKeys = offer.keys.toList()..sort();
-    } catch (_) {/* best-effort enrichment — the typed error still carries the context we have */}
+    } catch (_) {
+      /* best-effort enrichment — the typed error still carries the context we have */
+    }
     return DomainNotInstalledForSession(
       expectedDomainKey: domain,
       expectedDomainHash: domainHash,
@@ -1512,7 +1706,8 @@ class NomosBridge {
   /// installed package, read off the LOCAL projection (offline). Keys = the ACTIVE domain keys the
   /// workspace serves. Null when no on-ledger interface is observed yet (pre-#72e law).
   Future<Map<String, Object?>?> interfaceOffer({String? session}) async {
-    final r = _asMap(await _call('interfaceOffer', {if (session != null) 'session': session}));
+    final r = _asMap(await _call(
+        'interfaceOffer', {if (session != null) 'session': session}));
     return (r['offer'] as Map?)?.cast<String, Object?>();
   }
 
@@ -1525,7 +1720,11 @@ class NomosBridge {
   /// [authorSecret] — the device signing key for the followed session's writes (era-0: an attested-born
   /// child is WARRANTED; write access needs its owner's enrolled device key).
   Future<NomosSession> follow(NomosRef ref,
-      {String? cloud, String? clientId, String? authToken, bool allowUnborn = false, String? authorSecret}) async {
+      {String? cloud,
+      String? clientId,
+      String? authToken,
+      bool allowUnborn = false,
+      String? authorSecret}) async {
     final ws = ref.workspace;
     if (ws.isEmpty) {
       throw ArgumentError.value(ref, 'ref',
@@ -1580,7 +1779,11 @@ class NomosBridge {
           // a pre-connect plane has no registry yet — fall through to the credentials decision below.
         }
         if (resident) {
-          await connect(workspace: workspace, session: workspace, allowUnborn: true, authorSecret: authorSecret);
+          await connect(
+              workspace: workspace,
+              session: workspace,
+              allowUnborn: true,
+              authorSecret: authorSecret);
           return session(workspace);
         }
         if (ifAbsentCredentials == null) {
@@ -1621,7 +1824,8 @@ class NomosBridge {
   /// OFFER AN INTENT — the write verb. Plan a directive (domain/directiveId/payload) as the verified [actor];
   /// the holon encodes the v2 offer envelope via the single codec and admits it. Returns the new local head.
   /// (This is the canonical name; [offerDirective] is the legacy alias the generated clients still call.)
-  @Deprecated('Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+  @Deprecated(
+      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession. '
       'Retained for CLIs/admin tooling/generated internals only.')
   Future<String> offerIntent({
@@ -1631,6 +1835,7 @@ class NomosBridge {
     String? actor,
     String? domainHash,
     List<Map<String, Object?>>? attestations,
+    List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
   }) =>
@@ -1641,6 +1846,7 @@ class NomosBridge {
           actor: actor,
           domainHash: domainHash,
           attestations: attestations,
+          nomosConflictSnapshots: nomosConflictSnapshots,
           force: force,
           session: session);
 
@@ -1698,7 +1904,8 @@ class NomosBridge {
   /// `bridge.createWorkspace(domain: 'co2_platform', directiveId: 'birthEstateWorkspace', domainHash: ...)`.
   /// The kernel looks up `(domain, directiveId)` in the ACTIVE installed law — [domain] must name the law
   /// that actually declares [directiveId], never assume `'workspaces'`.
-  @Deprecated('Engine-level generic writes with a loose parent string are the footgun '
+  @Deprecated(
+      'Engine-level generic writes with a loose parent string are the footgun '
       '(session_bound_clients.md asks 1/4/7): births go through the generated <Domain>Client '
       'bound to the PARENT NomosSession (its birth method infers parent = the session workspace). '
       'Retained for CLIs/admin tooling/generated compatibility shims only.')
@@ -1807,6 +2014,59 @@ class NomosBridge {
         'directiveId': directiveId,
       }));
 
+  /// Framework-private business correction seam. Generated clients bind the domain, its actions and actor;
+  /// application code supplies only the correction kind and its mandatory reason.
+  Future<Map<String, Object?>> correctMostRecent({
+    required String kind,
+    required String domain,
+    required List<String> actions,
+    required String reason,
+    String? domainHash,
+    String? actor,
+  }) async =>
+      _asMap(await _call('correctMostRecent', {
+        'kind': kind,
+        'domain': domain,
+        'actions': actions,
+        'reason': reason,
+        if (domainHash != null) 'domainHash': domainHash,
+        if (actor != null) 'actor': actor,
+      }));
+
+  /// Framework-private exact-history adoption seam. Generated clients expose this as
+  /// `model.adopt()` and, only when prior business outcomes differ, a chained
+  /// `decision.accept(reason)`. Candidate identities, heads and receipts stay here.
+  Future<Map<String, Object?>> nomosFrameworkAdoptGeneratedModel({
+    required String domain,
+    required String candidateHash,
+    String? because,
+  }) async {
+    final r = _asMap(await _call('adoptGeneratedModel', {
+      'domain': domain,
+      'candidateHash': candidateHash,
+      if (because != null) 'because': because,
+    }));
+    return ((r['verdict'] as Map?) ?? const <String, Object?>{})
+        .cast<String, Object?>();
+  }
+
+  /// Framework-private exact-history restoration seam. Generated clients expose
+  /// `model.restorePrevious()` and a chained `decision.accept(reason)`; predecessor
+  /// identity, derived dispositions, heads and receipts stay below this bridge.
+  Future<Map<String, Object?>> nomosFrameworkRestorePreviousGeneratedModel({
+    required String domain,
+    required String currentHash,
+    String? because,
+  }) async {
+    final r = _asMap(await _call('restorePreviousGeneratedModel', {
+      'domain': domain,
+      'currentHash': currentHash,
+      if (because != null) 'because': because,
+    }));
+    return ((r['verdict'] as Map?) ?? const <String, Object?>{})
+        .cast<String, Object?>();
+  }
+
   /// HISTORY of one aggregate (a todo) — the full action timeline from the ledger: every intent that touched
   /// it + the strikes that retract them (undo/restore/redo), oldest→newest. Each entry:
   /// `{id, who, mine, at(ms), action, fields[], done?, text?, removed?, marker, isStrike, targetAction, struck}`.
@@ -1820,8 +2080,9 @@ class NomosBridge {
   }
 
   /// RUNTIME activity feed — per-committed-intent rows (newest-first) from the local ledger, each carrying
-  /// `{intentId, domain, directiveId, actorSubject, occurredAt, payload}` (payload = the DECODED directive
-  /// payload). `base` = a commit-oid cursor (only intents newer than it); omitted = from the tip bounded by
+  /// `{intentId, domain, directiveId, actorSubject, occurredAt, payload, created, affected}` (payload = the
+  /// DECODED directive payload; affected = the aggregate refs its sealed events touched). `base` = a commit-
+  /// oid cursor (only intents newer than it); omitted = from the tip bounded by
   /// `limit` (default 200). Generic raw rows — the typed shaping is the codegen `renderActivity`.
   Future<List<Map<String, dynamic>>> activityLog(
       {String? base, int? limit}) async {
@@ -1834,6 +2095,15 @@ class NomosBridge {
         .toList();
   }
 
+  /// Framework-private organisational read used by generated `describe()`. The runner joins the parent
+  /// ledger's verified birth witnesses and lifecycle facts; tenant code only receives safe child links.
+  Future<List<Map<String, dynamic>>> nomosFrameworkChildWorkspaces() async {
+    final r = _asMap(await _call('nomosChildWorkspaces'));
+    return ((r['children'] as List?) ?? const [])
+        .map((e) => (e as Map).cast<String, dynamic>())
+        .toList();
+  }
+
   /// Watch the RUNTIME activity feed: a stream that re-emits the newest-first activity rows on every local
   /// change (doorbell/sync tick). `base` = a commit-oid cursor. Cancelling drops the watch on the runner.
   Stream<List<dynamic>> watchActivity({String? base, String? session}) =>
@@ -1897,7 +2167,8 @@ class NomosBridge {
   /// (the secret never leaves the device). The recovery lanes use this when only the secret was
   /// persisted (the device-key store keeps just the seed), including low-level device-bound enrollment.
   Future<String> devicePublicOf(String secret) async =>
-      (_asMap(await _call('devicePublicOf', {'secret': secret}))['public'] ?? '')
+      (_asMap(await _call('devicePublicOf', {'secret': secret}))['public'] ??
+              '')
           .toString();
 
   /// PARENT-AUTHORITY POSTURE (read-only diagnostic): is this device key a LIVE `signer` for
@@ -1986,8 +2257,9 @@ class NomosBridge {
   /// kernel `cert_sign` op (the single source of the byte layout), OFFER the PARAMETERIZED parent's `birthHome`
   /// directive carrying the homeCert, poll the parent for the born home, and CONFIRM the born home's own
   /// `verify_chain` is GREEN (the offline peer-verify — replay IS validation). `spec` MUST carry `parent` (the
-  /// tenant's platform whose governance includes `birthHome`), `principal`, `frameworkHash`, and `lawHash`;
-  /// `subject`/`authToken`/`directiveId` are optional. OURS is the ceremony; the parent is the TENANT's.
+  /// tenant's platform whose governance includes `birthHome`) and `principal`; the client discovers the
+  /// private framework route and active law hashes from that application's live contract. `subject`/
+  /// `authToken`/`directiveId` are optional. OURS is the ceremony; the parent is the TENANT's.
   /// Returns `{home, device:{secret,public}, homeCert, born, verify:{valid,…}}`.
   Future<Map<String, Object?>> birthHome(Map<String, Object?> spec) async =>
       _asMap(await _call('birthHome', spec));
@@ -2045,19 +2317,84 @@ class NomosBridge {
 
   /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
   Future<List<Map<String, dynamic>>> queryById(String id,
-          [List<NomosScopeKey>? keys, String? principal, String? session]) async =>
+          [List<NomosScopeKey>? keys,
+          String? principal,
+          String? session]) async =>
       _asRows(await _call('queryById', {
         'id': id,
         ...?_readAuthArgs(keys, principal),
         if (session != null) 'session': session,
       }));
 
+  /// Verified points in this workspace's history, oldest to newest. The generated client presents these
+  /// as `client.past.moments()`; callers pass the opaque [NomosMoment] back to `past.at(moment)` and never
+  /// need to know that the framework uses commit identities underneath.
+  Future<List<NomosMoment>> moments({int limit = 100, String? session}) async {
+    final r = _asMap(await _call('commits', {
+      'limit': limit,
+      if (session != null) 'session': session,
+    }));
+    return ((r['commits'] as List?) ?? const [])
+        .map((e) => NomosMoment.fromJson((e as Map).cast<String, Object?>()))
+        .toList();
+  }
+
+  /// Run one declared business query against the verified world at [moment], without moving the live world.
+  /// `keys`/`principal` have exactly the same private/encrypted-read semantics as [query].
+  Future<List<Map<String, dynamic>>> queryAt(NomosMoment moment, String queryId,
+          [Map<String, Object?> params = const {},
+          List<NomosScopeKey>? keys,
+          String? principal,
+          String? session]) async =>
+      _asRows(await _call('queryAt', {
+        'commit': moment.id,
+        'queryId': queryId,
+        'params': params,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }));
+
+  /// Read one aggregate from the verified world at [moment]. `keys`/`principal`: see [queryAt].
+  Future<List<Map<String, dynamic>>> queryByIdAt(NomosMoment moment, String id,
+          [List<NomosScopeKey>? keys,
+          String? principal,
+          String? session]) async =>
+      _asRows(await _call('queryByIdAt', {
+        'commit': moment.id,
+        'id': id,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }));
+
+  /// Maintained historic count/sum values at [moment]. These are the temporal counterparts of [count]/[sum].
+  Future<int> countAt(NomosMoment moment, String countId,
+          [String group = '', String? session]) async =>
+      ((_asMap(await _call('countAt', {
+        'commit': moment.id,
+        'countId': countId,
+        'group': group,
+        if (session != null) 'session': session,
+      }))['count']) as num)
+          .toInt();
+
+  Future<int> sumAt(NomosMoment moment, String sumId,
+          [String group = '', String? session]) async =>
+      ((_asMap(await _call('sumAt', {
+        'commit': moment.id,
+        'sumId': sumId,
+        'group': group,
+        if (session != null) 'session': session,
+      }))['sum']) as num)
+          .toInt();
+
   /// The read auth sidecar (private reads + E2E): `keys`/`principal` as top-level call args, or null when
   /// neither is present (so the wire is byte-identical to before this existed).
-  Map<String, Object?>? _readAuthArgs(List<NomosScopeKey>? keys, String? principal) {
+  Map<String, Object?>? _readAuthArgs(
+      List<NomosScopeKey>? keys, String? principal) {
     final out = <String, Object?>{};
     if (principal != null && principal.isNotEmpty) out['principal'] = principal;
-    if (keys != null && keys.isNotEmpty) out['keys'] = keys.map((k) => k.toJson()).toList();
+    if (keys != null && keys.isNotEmpty)
+      out['keys'] = keys.map((k) => k.toJson()).toList();
     return out.isEmpty ? null : out;
   }
 
@@ -2078,15 +2415,127 @@ class NomosBridge {
           required String fieldSid,
           required String plaintext}) async =>
       (_asMap(await _call('cryptoSealField', {
-        'scopeKey': scopeKey,
+                'scopeKey': scopeKey,
+                'scope': scope,
+                'epoch': epoch,
+                'aggSid': aggSid,
+                'fieldSid': fieldSid,
+                'plaintext': plaintext,
+              }))['envelope'] ??
+              '')
+          .toString();
+
+  /// FRAMEWORK-INTERNAL `.owned()` key lane. The connected JS holon derives epoch 0 from its
+  /// already-persisted device credential; generated clients call this without exposing key custody to apps.
+  Future<NomosScopeKey> nomosOwnedScopeKey(String scope,
+      {String? recordType, String? recordId}) async {
+    final out = _asMap(await _call('cryptoOwnedScopeKey', {
+      'scope': scope,
+      if (recordType != null && recordId != null)
+        'record': {'type': recordType, 'id': recordId},
+    }));
+    return NomosScopeKey(
+      scope: (out['scope'] ?? scope).toString(),
+      epoch: (out['epoch'] as num?)?.toInt() ?? 0,
+      key: (out['key'] ?? '').toString(),
+      ownedKeySubject: out['ownedKeySubject']?.toString(),
+      ownedCustody: out['ownedCustody']?.toString(),
+    );
+  }
+
+  /// Every key epoch this principal currently holds for one owned record. Generated reads use the
+  /// complete set so history remains readable after rotations, shares and transfers.
+  Future<List<NomosScopeKey>> nomosOwnedScopeKeys(String scope,
+      {required String recordType, required String recordId}) async {
+    final out = _asMap(await _call('cryptoOwnedScopeKeys', {
+      'scope': scope,
+      'record': {'type': recordType, 'id': recordId},
+    }));
+    return (out['keys'] as List? ?? const [])
+        .map((raw) => _asMap(raw))
+        .map((key) => NomosScopeKey(
+              scope: (key['scope'] ?? scope).toString(),
+              epoch: (key['epoch'] as num?)?.toInt() ?? 0,
+              key: (key['key'] ?? '').toString(),
+              ownedKeySubject: key['ownedKeySubject']?.toString(),
+              ownedCustody: key['ownedCustody']?.toString(),
+            ))
+        .toList();
+  }
+
+  /// Make this signed-in principal ready to receive record shares. Generated clients call this while
+  /// binding; tenant code never handles a key, certificate or identity tuple.
+  Future<void> nomosEnsureOwnedIdentity(
+      {required String scope,
+      required String domain,
+      String? domainHash}) async {
+    await _call('cryptoOwnedEnsureIdentity', {
+      'scope': scope,
+      'domain': domain,
+      if (domainHash != null) 'domainHash': domainHash,
+    });
+  }
+
+  /// Opt into designated-peer all-device-loss recovery. All protocol fields remain in the JS/kernel client.
+  Future<Map<String, Object?>> nomosProtectOwnedIdentity({
+    required String scope,
+    required String domain,
+    required String domainHash,
+    required String recoveryPrincipal,
+  }) async =>
+      _asMap(await _call('cryptoOwnedProtectIdentity', {
         'scope': scope,
-        'epoch': epoch,
-        'aggSid': aggSid,
-        'fieldSid': fieldSid,
-        'plaintext': plaintext,
-      }))['envelope'] ?? '')
+        'domain': domain,
+        'domainHash': domainHash,
+        'recoveryPrincipal': recoveryPrincipal,
+      }));
+
+  /// Prepare the private framework payload behind generated share/unshare/transfer methods.
+  Future<Map<String, Object?>> nomosPrepareOwnedRecordAction(
+          {required String action,
+          required String scope,
+          required NomosRef record,
+          required String peer}) async =>
+      _asMap(await _call('cryptoOwnedPrepareRecordAction', {
+        'action': action,
+        'scope': scope,
+        'record': {'type': record.type, 'id': record.id},
+        'peer': peer,
+      }));
+
+  /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
+  Future<NomosScopeKey> nomosOwnedBirthScopeKey(
+      String scope, String namespace, Object? key) async {
+    final out = _asMap(await _call('cryptoOwnedBirthScopeKey', {
+      'scope': scope,
+      'namespace': namespace,
+      'key': key,
+    }));
+    return NomosScopeKey(
+      scope: (out['scope'] ?? scope).toString(),
+      epoch: (out['epoch'] as num?)?.toInt() ?? 0,
+      key: (out['key'] ?? '').toString(),
+      ownedKeySubject: out['ownedKeySubject']?.toString(),
+      ownedCustody: out['ownedCustody']?.toString(),
+      workspace: out['workspace']?.toString(),
+    );
+  }
+
+  /// FRAMEWORK-INTERNAL: issue an opaque request for this session's current device.
+  Future<String> nomosOwnedDeviceRequest(String scope) async =>
+      (_asMap(await _call('cryptoOwnedDeviceRequest', {'scope': scope}))[
+                  'request'] ??
+              '')
           .toString();
 
+  /// FRAMEWORK-INTERNAL: validate an opaque request and prepare the atomic signer + custody offer.
+  Future<Map<String, Object?>> nomosPrepareOwnedDeviceApproval(
+          String request, String scope) async =>
+      _asMap(await _call('cryptoOwnedPrepareApproval', {
+        'request': request,
+        'scope': scope,
+      }));
+
   /// Wrap a scope key TO a recipient's public key (committer side): `{hpkeEpk, ct}` base64 ciphertext.
   Future<Map<String, Object?>> cryptoWrapKey(
           {required String recipientPub, required String scopeKey}) async =>
@@ -2098,8 +2547,11 @@ class NomosBridge {
           {required String secret,
           required String hpkeEpk,
           required String ct}) async =>
-      (_asMap(await _call('cryptoUnwrapKey',
-                  {'secret': secret, 'hpkeEpk': hpkeEpk, 'ct': ct}))['scopeKey'] ??
+      (_asMap(await _call('cryptoUnwrapKey', {
+                'secret': secret,
+                'hpkeEpk': hpkeEpk,
+                'ct': ct
+              }))['scopeKey'] ??
               '')
           .toString();
 
@@ -2115,7 +2567,8 @@ class NomosBridge {
       }));
 
   /// A maintained O(1) count / sum.
-  Future<int> count(String countId, [String group = '', String? session]) async =>
+  Future<int> count(String countId,
+          [String group = '', String? session]) async =>
       ((_asMap(await _call('count', {
         'countId': countId,
         'group': group,
@@ -2137,13 +2590,31 @@ class NomosBridge {
   /// DERIVED, NOT DRAINED: a resolution write folding in removes its row by derivation.
   /// Empty for a Surfaced-free workspace. (The generated typed client wraps these rows as
   /// `PendingConflictRow` and pairs them with the designated `resolve…` helpers.)
-  Future<List<Map<String, dynamic>>> pendingConflicts([String? session]) async =>
+  Future<List<Map<String, dynamic>>> pendingConflicts(
+          [String? session]) async =>
+      _asRows(await _call('pendingConflicts', {
+        if (session != null) 'session': session,
+      }));
+
+  /// Framework-filtered pending conflicts for one generated aggregate type. This is the
+  /// primitive generated clients use; application code never filters the heterogeneous queue.
+  Future<List<Map<String, dynamic>>> pendingConflictsFor(String aggregateType,
+          [String? session]) async =>
       _asRows(await _call('pendingConflicts', {
+        'aggregateType': aggregateType,
+        if (session != null) 'session': session,
+      }));
+
+  /// Counts-only workspace summary over the maintained conflict index.
+  Future<Map<String, Object?>> pendingConflictSummary(
+          [String? session]) async =>
+      _asMap(await _call('pendingConflictSummary', {
         if (session != null) 'session': session,
       }));
 
   /// Push local writes → the session branch → cloud admission, and pull canonical main back.
-  Future<Map<String, Object?>> sync({bool admit = true, String? session}) async =>
+  Future<Map<String, Object?>> sync(
+          {bool admit = true, String? session}) async =>
       _asMap(await _call('sync', {
         'admit': admit,
         if (session != null) 'session': session,
@@ -2198,7 +2669,8 @@ class NomosBridge {
   void _startStatusPoll() {
     _pushStatus(_status); // seed the new listener with the current snapshot
     _pollMetricsOnce();
-    _metricsTimer ??= Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
+    _metricsTimer ??=
+        Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
   }
 
   void _stopStatusPoll() {
@@ -2209,19 +2681,28 @@ class NomosBridge {
   Future<void> _pollMetricsOnce() async {
     try {
       final m = await metrics();
-      int? n(String k) => m.containsKey(k) ? ((m[k] as num?)?.toInt() ?? 0) : null;
+      int? n(String k) =>
+          m.containsKey(k) ? ((m[k] as num?)?.toInt() ?? 0) : null;
       final ahead = n('ahead') ?? _status.ahead;
       final behind = n('behind') ?? _status.behind;
       // Don't stomp an in-flight transfer's phase; otherwise derive idle/behind/syncing from the counts.
       final phase = _status.transfer != null
           ? _status.phase
-          : (behind > 0 ? SyncPhase.behind : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
+          : (behind > 0
+              ? SyncPhase.behind
+              : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
       _pushStatus(_status.copyWith(
-        ahead: ahead, behind: behind, saved: n('saved'), onMain: n('onMain'),
-        deadLetters: n('deadLetters'), phase: phase, clearError: true,
+        ahead: ahead,
+        behind: behind,
+        saved: n('saved'),
+        onMain: n('onMain'),
+        deadLetters: n('deadLetters'),
+        phase: phase,
+        clearError: true,
       ));
     } catch (e) {
-      _pushStatus(_status.copyWith(phase: SyncPhase.error, lastError: e.toString()));
+      _pushStatus(
+          _status.copyWith(phase: SyncPhase.error, lastError: e.toString()));
     }
   }
 
@@ -2237,8 +2718,7 @@ class NomosBridge {
 
   /// LIVE per-layer spans of the local pipeline (begin/end as they happen): mutex wait, githolon author,
   /// push, converge … The host renders in-progress bars so a hang is visible WHILE it blocks, not after.
-  Stream<Map<String, Object?>> get spanEvents =>
-      _eventPlane._spanEvents.stream;
+  Stream<Map<String, Object?>> get spanEvents => _eventPlane._spanEvents.stream;
 
   /// The buffered recent span events — replay these on first build to recover the BOOT flamepath
   /// (fetch wasm / clone ledger / instantiate) that streamed during connect(), before the UI subscribed.
@@ -2262,8 +2742,21 @@ class NomosBridge {
     final plane = _eventPlane;
     final sid = id ?? 'local-${plane._localSpanSeq++}';
     for (final m in <Map<String, Object?>>[
-      {'event': 'span', 'span': {'phase': 'begin', 'id': sid, 'track': track, 'name': name, 'kind': kind, 't0': t0}},
-      {'event': 'span', 'span': {'phase': 'end', 'id': sid, 't1': t1}},
+      {
+        'event': 'span',
+        'span': {
+          'phase': 'begin',
+          'id': sid,
+          'track': track,
+          'name': name,
+          'kind': kind,
+          't0': t0
+        }
+      },
+      {
+        'event': 'span',
+        'span': {'phase': 'end', 'id': sid, 't1': t1}
+      },
     ]) {
       plane._spanBuffer.add(m);
       if (plane._spanBuffer.length > 400) {
@@ -2283,7 +2776,8 @@ class NomosBridge {
   /// them (a HEAD on the serving pack; the host answers Content-Length only, cached ~15s). Sum across your open
   /// workspaces for an aggregate "X MB to sync" total BEFORE downloading. `{ bytes, kind:'delta'|'full'|
   /// 'up-to-date' }`; `bytes` is null if the host omitted the length.
-  Future<Map<String, Object?>> syncSize() async => _asMap(await _call('syncSize'));
+  Future<Map<String, Object?>> syncSize() async =>
+      _asMap(await _call('syncSize'));
 
   /// Diagnostics — is the expected law installed/active/drift-free here? (The generated client surfaces it
   /// so the app can answer "can I author this directive, and if not what deploy fixes it".)
@@ -2294,14 +2788,16 @@ class NomosBridge {
   /// subscription tells the runner to drop the watch.
   Stream<List<dynamic>> watch(String queryId,
           [Map<String, Object?> params = const {}, String? session]) =>
-      _watchStream(kind: 'query', queryId: queryId, params: params, session: session);
+      _watchStream(
+          kind: 'query', queryId: queryId, params: params, session: session);
   Stream<List<dynamic>> watchById(String id, [String? session]) =>
       _watchStream(kind: 'byId', id: id, session: session);
 
   /// Reactive SPATIAL read: re-emits the R*Tree probe's rows whenever they change locally.
   Stream<List<dynamic>> watchSpatial(String spatialId, NomosBbox bbox,
           [String? session]) =>
-      _watchStream(kind: 'spatial', spatialId: spatialId, bbox: bbox, session: session);
+      _watchStream(
+          kind: 'spatial', spatialId: spatialId, bbox: bbox, session: session);
 
   /// Reactive PENDING-CONFLICTS read: re-emits the maintained Surfaced "decisions needed"
   /// rows whenever the index changes (derived, not drained — a resolution write clears its row).
@@ -2331,7 +2827,8 @@ class NomosBridge {
       'compat': compat,
       if (requirement != null) 'requirement': requirement,
     }));
-    final v = NomosCompat.fromJson((r['compat'] as Map?)?.cast<String, Object?>());
+    final v =
+        NomosCompat.fromJson((r['compat'] as Map?)?.cast<String, Object?>());
     if (v != null) {
       _eventPlane._lastCompat = v;
       // a session's verdict is per-workspace state on the PLANE (so `session.compat` reads it back).
@@ -2566,14 +3063,23 @@ class NomosSession extends NomosBridge {
   Future<NomosSession> acquireSession(String workspace,
           {Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
           String? authorSecret}) =>
-      parent.acquireSession(workspace, ifAbsentCredentials: ifAbsentCredentials, authorSecret: authorSecret);
+      parent.acquireSession(workspace,
+          ifAbsentCredentials: ifAbsentCredentials, authorSecret: authorSecret);
 
   /// A followed ref mounts on the SHARED plane — delegate to the parent (a session never owns mounts).
   @override
   Future<NomosSession> follow(NomosRef ref,
-          {String? cloud, String? clientId, String? authToken, bool allowUnborn = false, String? authorSecret}) =>
+          {String? cloud,
+          String? clientId,
+          String? authToken,
+          bool allowUnborn = false,
+          String? authorSecret}) =>
       parent.follow(ref,
-          cloud: cloud, clientId: clientId, authToken: authToken, allowUnborn: allowUnborn, authorSecret: authorSecret);
+          cloud: cloud,
+          clientId: clientId,
+          authToken: authToken,
+          allowUnborn: allowUnborn,
+          authorSecret: authorSecret);
 
   @override
   Future<Object?> _call(String op, [Map<String, Object?> args = const {}]) =>
@@ -2599,7 +3105,11 @@ class NomosSession extends NomosBridge {
       String? keyHash,
       String? authToken}) async {
     final v = await canAuthor(directiveId,
-        ws: ws, principal: principal, publicKey: publicKey, keyHash: keyHash, authToken: authToken);
+        ws: ws,
+        principal: principal,
+        publicKey: publicKey,
+        keyHash: keyHash,
+        authToken: authToken);
     if (v['ok'] == true) return v;
     final cause = v['cause']?.toString();
     final target = v['ws']?.toString() ?? ws ?? workspace;
@@ -2647,7 +3157,8 @@ class _BridgeForeignReader implements NomosForeignReader {
   // (trustSource + .readsFrom). That gate is the security model (a locator is not a foreign key), not a
   // limitation: unverifiable "evidence" would be the real footgun.
   @override
-  Future<ForeignAttestation> Function(String workspace, String id, String type)? get attestForeign => null;
+  Future<ForeignAttestation> Function(String workspace, String id, String type)?
+      get attestForeign => null;
 }
 
 /// A per-workspace read handle on the bridge plane — mounts [_workspace] lazily on the first read.
@@ -2661,8 +3172,7 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
   // Mount ONCE (idempotent on the plane — "first connect wins"). `allowUnborn` so a not-yet-born foreign
   // workspace reads empty (→ ForeignNotFound) rather than throwing. A genuinely unreachable cloud throws,
   // which resolveResult classifies as ForeignUnreachable.
-  Future<void> _ensureMounted() =>
-      _mounting ??= _bridge.connect(
+  Future<void> _ensureMounted() => _mounting ??= _bridge.connect(
         cloud: _cloud,
         workspace: _workspace,
         session: _workspace,
@@ -2688,10 +3198,14 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
         // a transient read failure is not fatal to the subscription — the next sync tick retries.
       }
     }
+
     ctrl = StreamController<List<Map<String, dynamic>>>(
       onListen: () {
         unawaited(emit());
-        sub = _bridge.session(_workspace).syncEvents.listen((_) => unawaited(emit()));
+        sub = _bridge
+            .session(_workspace)
+            .syncEvents
+            .listen((_) => unawaited(emit()));
       },
       onCancel: () async {
         await sub?.cancel();