@githolon/dsl 0.101.6 → 0.102.0

package/dart/test/parent_signer_recovery_test.dart

@@ -16,7 +16,7 @@ library;
 
 import 'dart:io';
 
-import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:nomos_types/nomos_types.dart'
     show ParentSignerEnrollmentMissing, NomosRecommendedAction;
 import 'package:test/test.dart';
@@ -25,7 +25,10 @@ String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deploy =>
     '$_root/bench/scale/fixtures/estate-birth-signed/build/estate-birth-signed.deploy.json';
-String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
+String get _runtimeDir =>
+    Platform.environment['NOMOS_DART_RUNTIME'] ??
+    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
+    '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 
 const _ws = 'estate-birth-signed';
 const _uid = 'sample-owner';

package/dart/test/schema_validation_test.dart

@@ -5,7 +5,7 @@
 // wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
 // If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
-import 'package:nomos_client/nomos_client.dart';
+import 'package:nomos_client/src/nms_generated_runtime.dart';
 import 'package:test/test.dart';
 
 void main() {

package/dart/test/sealing_client_test.dart

@@ -12,7 +12,7 @@ import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 
-import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
@@ -22,6 +22,7 @@ String get _deploy => '$_fixture/build/encrypted-notes.deploy.json';
 String get _lockfile => '$_fixture/nomos.stable-ids.json';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
+    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
     '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 
 const _domain = 'encrypted_notes';

package/dart/test/session_bound_test.dart

@@ -1,15 +1,15 @@
-// SESSION-BOUND CLIENTS — THE ACCEPTANCE (architecture/session_bound_clients.md). The blessed app
-// shape end-to-end, against the REAL wasm on a local plane, with ZERO workspace/domain/directive
-// strings in the app-side code:
+// SESSION-BOUND APPLICATIONS — framework acceptance against the REAL wasm on a local plane.
+// Generated clients are private implementation parts. These tests bind the generated application
+// surface and use raw session calls only where they deliberately exercise nomos_client internals:
 //
-//   engine → mount → Client.bind(session) (preflight) → a PARENTLESS birth landing in the session
-//   workspace → engine.follow(ref) → a second client → a directive on it.
+//   engine → mount → generated application bind (preflight) → an internal fixture birth landing in
+//   the session workspace → engine.follow(ref) → a second application → a business record operation.
 //
-// Plus the typed failure modes: bind on a deliberately WRONG session throws
+// Plus the typed failure modes: application bind on a deliberately WRONG session throws
 // DomainClientSessionMismatch with every spec field; a dispatch naming an uninstalled domain
 // surfaces as DomainNotInstalledForSession (the context-rich replacement of the kernel's generic
-// "no active installed law declares domain 'x'"); and the deprecated engine-level shims still
-// function (compatibility is deprecation, not breakage).
+// "no active installed law declares domain 'x'"). Raw calls here are framework-test setup only;
+// they are not a supported tenant lane and are not exported by nomos_client.
 @TestOn('vm')
 library;
 
@@ -19,15 +19,11 @@ import 'dart:io';
 import 'package:crypto/crypto.dart' show sha256;
 
 // ignore: deprecated_member_use
-import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:test/test.dart';
 
-// home.client.dart re-exports home.dart + the nomos_client surface (NomosSession, the typed errors,
-// NomosOfferOutcome, …); estate.client.dart adds the child-law client. One import each = the whole
-// typed surface. ZERO raw strings needed below.
-import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/home.client.dart';
-import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/estate.client.dart'
-    show EstateClient, SeedEstateWorkspacePayload;
+import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/home.application.dart';
+import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/estate.application.dart';
 
 String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
@@ -37,13 +33,15 @@ String get _otherDeployJson =>
     '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
+    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
     '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 
 const _workspace = 'estate-birth';
 const _owner = 'user:session-bound-owner';
 
 String? _missingPrereq() {
-  if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
+  if (!File(_repoEntry).existsSync())
+    return 'in-repo runner not found at $_repoEntry';
   if (!File(_deployJson).existsSync() || !File(_otherDeployJson).existsSync()) {
     return 'compile the fixtures: (cd bench/scale/fixtures/estate-birth && node ../../../../dsl/compile_package.mjs); '
         '(cd bench/scale/fixtures/surfaced && node ../../../../dsl/compile_package.mjs)';
@@ -67,10 +65,31 @@ Future<NomosTestHarness> _harness() => NomosTestHarness.ephemeral(
       workspace: _workspace,
     );
 
+Future<NomosOfferOutcome> _birthEstate(
+  NomosSession session,
+  NomosTestHarness harness, {
+  String owner = _owner,
+  bool enrollOwnerKey = true,
+}) {
+  final facts = BirthEstateWorkspacePayload(
+    owner: owner,
+    frameworkHash: harness.frameworkHash!,
+    lawHash: harness.lawHashes(harness.workspace).first,
+    bornAt: DateTime.now().toUtc().toIso8601String(),
+    ownerKeyHash: enrollOwnerKey ? _ownerKeyHash(harness) : null,
+  );
+  return session.offerOutcome(
+    domain: 'home',
+    directiveId: 'birthEstateWorkspace',
+    payload: facts.nmsInternalToPayloadJson(),
+    actor: owner,
+  );
+}
+
 void main() {
   test(
-      'THE BLESSED SHAPE: mount → bind (preflight) → parentless birth in the session workspace → '
-      'follow(ref) → second client → directive — zero routing strings in app code', () async {
+      'generated applications: mount → bind (preflight) → fixture birth → follow(ref) → '
+      'second application → typed record operation', () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -82,48 +101,50 @@ void main() {
       final home = harness.session(harness.workspace);
 
       // BIND (ask 2/5): the async preflight — reachable, domain installed, shape-compatible.
-      final homeClient = await HomeClient.bind(home, actor: _owner);
-      expect(homeClient.session, isNotNull);
-      expect(homeClient.session!.workspace, harness.workspace,
-          reason: 'inspectable session context (ask 3)');
+      final homeApplication =
+          await nomosInternalBindHomeApplication(home, _owner);
+      expect(homeApplication.activity, isA<HomeActivity>());
 
-      // PARENTLESS BIRTH (ask 4): no parent parameter — the parent IS the session workspace.
-      final birth = await homeClient.birthEstateWorkspace(
-        payload: BirthEstateWorkspacePayload(
-          owner: _owner,
-          frameworkHash: harness.frameworkHash!,
-          lawHash: harness.lawHashes(harness.workspace).first,
-          bornAt: DateTime.now().toUtc().toIso8601String(),
-          ownerKeyHash: _ownerKeyHash(harness),
-        ),
-      );
+      // This fixture predates businessBirth and intentionally keeps its kernel birth
+      // primitive out of the generated tenant application. The raw offer is framework
+      // setup; the generated application remains the only public business surface.
+      final birth = await _birthEstate(home, harness);
       expect(birth.workspace, harness.workspace,
-          reason: 'the birth offer landed in the SESSION workspace, no loose parent');
-      expect(birth.gatewayVerdict, isNull, reason: 'the local offer lane, not the legacy relay');
+          reason:
+              'the birth offer landed in the SESSION workspace, no loose parent');
+      expect(birth.gatewayVerdict, isNull,
+          reason: 'the local offer lane, not the legacy relay');
       expect(birth.born, hasLength(1));
       expect(birth.birthOutcomes.first['status'], 'born');
 
       // FOLLOW THE REF (ask 8): NomosRef in, mounted session out — never a string pair.
-      final estate = await harness.bridge.follow(birth.bornRefs.single, authorSecret: harness.deviceSecret(harness.workspace));
+      final estate = await harness.bridge.follow(birth.bornRefs.single,
+          authorSecret: harness.deviceSecret(harness.workspace));
       expect(estate.workspace, birth.born.single);
 
       // SECOND CLIENT + a typed read AND a directive on it.
-      final estateClient = await EstateClient.bind(estate, actor: _owner);
-      final rows = await estateClient.estatesByOwner(owner: _owner);
-      expect(rows, hasLength(1), reason: 'the child genesis seed reads back typed');
+      final estateApplication =
+          await nomosInternalBindEstateApplication(estate, _owner);
+      final rows =
+          await estateApplication.estateOwners.estatesByOwner(owner: _owner);
+      expect(rows, hasLength(1),
+          reason: 'the child genesis seed reads back typed');
       final seeded = rows.single;
       // A directive on the second client: re-ensure the singleton with the SAME seeded values
       // (`.ensures` — idempotent; the squat invariant re-accepts its own binding).
-      final reseed = await estateClient.seedEstateWorkspace(SeedEstateWorkspacePayload(
+      await estateApplication.estateOwners
+          .seedEstateWorkspace(SeedEstateWorkspacePayload(
         owner: seeded.owner!,
         estateName: seeded.estateName!,
         bornAt: seeded.bornAt!,
       ));
-      expect(reseed.head, isNotEmpty);
+      final afterReseed =
+          await estateApplication.estateOwners.estatesByOwner(owner: _owner);
+      expect(afterReseed, hasLength(1));
 
       // ask 9: the harness diagnostic names the installed domains.
       await harness.assertDomainInstalled(
-          workspace: estate.workspace, domain: EstateClient.interface.domain);
+          workspace: estate.workspace, domain: 'estate');
     } finally {
       await harness.dispose();
     }
@@ -131,7 +152,8 @@ void main() {
 
   test(
       'session.watchPendingConflicts() EMITS (the 0.48.0 regression: the session-level stream '
-      'registered on an object with no message loop and never emitted)', () async {
+      'registered on an object with no message loop and never emitted)',
+      () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -146,32 +168,26 @@ void main() {
       // emitted, regardless of ticks. The fix delegates to the parent plane like every other
       // reactive read; the first tick must deliver a snapshot (empty — no Surfaced law here).
       final first = session.watchPendingConflicts().first;
-      final client = await HomeClient.bind(session, actor: _owner);
-      await client.birthEstateWorkspace(
-        payload: BirthEstateWorkspacePayload(
-          owner: _owner,
-          frameworkHash: harness.frameworkHash!,
-          lawHash: harness.lawHashes(harness.workspace).first,
-          bornAt: DateTime.now().toUtc().toIso8601String(),
-          ownerKeyHash: _ownerKeyHash(harness),
-        ),
-      );
+      await nomosInternalBindHomeApplication(session, _owner);
+      await _birthEstate(session, harness);
       final rows = await first.timeout(const Duration(seconds: 30));
       expect(rows, isEmpty,
-          reason: 'no Surfaced law in this fixture — the point is the stream EMITS at all');
+          reason:
+              'no Surfaced law in this fixture — the point is the stream EMITS at all');
     } finally {
       await harness.dispose();
     }
   }, timeout: const Timeout(Duration(minutes: 4)));
 
-  test('bind on a deliberately WRONG session throws DomainClientSessionMismatch with every field',
+  test(
+      'bind on a deliberately WRONG session throws DomainClientSessionMismatch with every field',
       () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
       return;
     }
-    // TWO workspaces, TWO different laws, ONE plane — binding HomeClient to the docs
+    // TWO workspaces, TWO different laws, ONE plane — binding HomeApplication to the docs
     // workspace is the deliberate wrong-session case (wrong-package-mounted).
     final harness = await NomosTestHarness.cluster(
       nodeEntry: _repoEntry,
@@ -185,18 +201,19 @@ void main() {
       final wrong = harness.session('docs-ws');
       Object? thrown;
       try {
-        await HomeClient.bind(wrong);
+        await nomosInternalBindHomeApplication(wrong, null);
       } catch (e) {
         thrown = e;
       }
       expect(thrown, isA<DomainClientSessionMismatch>(),
-          reason: 'the mismatch fires at CONSTRUCTION, not two clicks into the app');
+          reason:
+              'the mismatch fires at CONSTRUCTION, not two clicks into the app');
       final m = thrown! as DomainClientSessionMismatch;
       expect(m.sessionId, 'docs-ws');
       expect(m.sessionWorkspace, 'docs-ws');
-      expect(m.expectedDomainKey, HomeClient.interface.domain);
-      expect(m.expectedDomainHash, HomeClient.interface.expectedDomainHash);
-      expect(m.expectedInterfaceHash, HomeClient.interface.expectedInterfaceHash);
+      expect(m.expectedDomainKey, 'home');
+      expect(m.expectedDomainHash, isNotEmpty);
+      expect(m.expectedInterfaceHash, isNotEmpty);
       expect(m.activeDomainKeys, isNot(contains(m.expectedDomainKey)));
       expect(m.cause, SessionMismatchCause.wrongPackageMounted,
           reason: 'the docs workspace RUNS law — just not this domain');
@@ -204,10 +221,12 @@ void main() {
       expect(m.toString(), contains(m.expectedDomainKey));
 
       // The RIGHT session still binds (the plane is unharmed).
-      await HomeClient.bind(harness.session(harness.workspace));
+      await nomosInternalBindHomeApplication(
+          harness.session(harness.workspace), null);
 
-      // session.assertCompatible is directly usable from tests (ask 9), same typed refusal.
-      await expectLater(wrong.assertCompatible(EstateClient.interface),
+      // The other generated application gets the same typed refusal without exposing
+      // its private interface descriptor.
+      await expectLater(nomosInternalBindEstateApplication(wrong, null),
           throwsA(isA<DomainClientSessionMismatch>()));
     } finally {
       await harness.dispose();
@@ -215,8 +234,8 @@ void main() {
   }, timeout: const Timeout(Duration(minutes: 4)));
 
   test(
-      'a dispatch naming an UNINSTALLED domain surfaces as DomainNotInstalledForSession '
-      '(context-rich, ask 6) — and the deprecated engine shims still function (ask 1/7)', () async {
+      'a framework-test dispatch naming an UNINSTALLED domain surfaces as '
+      'DomainNotInstalledForSession with context', () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -228,7 +247,9 @@ void main() {
       Object? thrown;
       try {
         await session.offerOutcome(
-            domain: 'not_installed_domain', directiveId: 'doIt', payload: const {});
+            domain: 'not_installed_domain',
+            directiveId: 'doIt',
+            payload: const {});
       } catch (e) {
         thrown = e;
       }
@@ -237,61 +258,13 @@ void main() {
       expect(err.expectedDomainKey, 'not_installed_domain');
       expect(err.sessionWorkspace, harness.workspace);
       expect(err.requestedWorkspace, harness.workspace);
-      expect(err.activeDomainKeys, contains(HomeClient.interface.domain),
+      expect(err.activeDomainKeys, contains('home'),
           reason: 'the error NAMES what the workspace actually runs');
-      expect(err.possibleCauses, DomainNotInstalledForSession.defaultPossibleCauses);
-      expect(err.underlying.toString(), contains('no active installed law declares domain'));
+      expect(err.possibleCauses,
+          DomainNotInstalledForSession.defaultPossibleCauses);
+      expect(err.underlying.toString(),
+          contains('no active installed law declares domain'));
       expect(err.toString(), contains('Possible causes'));
-
-      // THE DEPRECATED SHIM still functions: the engine-level generic write authors fine.
-      // ignore: deprecated_member_use
-      final head = await session.offerDirective(
-        domain: HomeClient.interface.domain,
-        directiveId: 'birthEstateWorkspace',
-        payload: {
-          'owner': 'user:legacy-lane-owner',
-          'frameworkHash': harness.frameworkHash,
-          'lawHash': harness.lawHashes(harness.workspace).first,
-          'bornAt': DateTime.now().toUtc().toIso8601String(),
-        },
-        actor: 'user:legacy-lane-owner',
-      );
-      expect(head, isNotEmpty, reason: 'deprecation, not breakage — the old lane still writes');
-    } finally {
-      await harness.dispose();
-    }
-  }, timeout: const Timeout(Duration(minutes: 4)));
-
-  test('the SYNC constructor lazily preflights on first dispatch (the can\'t-await path)',
-      () async {
-    final skip = _missingPrereq();
-    if (skip != null) {
-      markTestSkipped(skip);
-      return;
-    }
-    final harness = await NomosTestHarness.cluster(
-      nodeEntry: _repoEntry,
-      runtimeDir: _runtimeDir,
-      workspaces: {
-        _workspace: [_deployJson],
-        'docs-ws': [_otherDeployJson],
-      },
-    );
-    try {
-      // Constructing synchronously on the wrong session succeeds (no await possible here)…
-      final client = HomeClient(harness.session('docs-ws'), actor: _owner);
-      // …but the FIRST dispatch runs the same preflight and throws the same typed mismatch.
-      await expectLater(
-        client.birthEstateWorkspace(
-          payload: BirthEstateWorkspacePayload(
-            owner: _owner,
-            frameworkHash: harness.frameworkHash!,
-            lawHash: harness.lawHashes(harness.workspace).first,
-            bornAt: DateTime.now().toUtc().toIso8601String(),
-          ),
-        ),
-        throwsA(isA<DomainClientSessionMismatch>()),
-      );
     } finally {
       await harness.dispose();
     }

package/dart/test/stale_bundle_test.dart

@@ -3,7 +3,7 @@
 // bundle's self-stamped version; the bridge refuses stale/pre-stamp bundles LOUDLY at boot.
 import 'dart:async';
 
-import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:test/test.dart';
 
 class _StampedRunner implements BridgeTransport {

package/dart/test/test_harness_test.dart

@@ -11,7 +11,7 @@ library;
 
 import 'dart:io';
 
-import 'package:nomos_client/nomos_headless.dart';
+import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:test/test.dart';
 
 String get _repoEntry =>
@@ -19,26 +19,63 @@ String get _repoEntry =>
 String get _guestbookDeployJson =>
     '${Directory.current.path}/../../examples/guestbook/build/guestbook.deploy.json';
 String get _runtimeDir =>
+    Platform.environment['NOMOS_DART_RUNTIME'] ??
+    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
     '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 // The built CLI bin — drives the `githolon harness-install` SUBCOMMAND lane (the published-harness path).
-String get _cliDist =>
-    '${Directory.current.path}/../../cli/dist/cli.mjs';
+String get _cliDist => '${Directory.current.path}/../../cli/dist/cli.mjs';
 
 /// The prerequisite that isn't installable in-test (a warm runtime cache + the compiled fixture). Returns a
 /// skip reason, or null when everything the harness needs is present.
 String? _missingPrereq() {
-  if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
+  if (!File(_repoEntry).existsSync())
+    return 'in-repo runner not found at $_repoEntry';
   if (!File(_guestbookDeployJson).existsSync()) {
     return 'compile the fixture first: cd examples/guestbook && npx nomos-compile';
   }
   if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
       !File('$_runtimeDir/packages.json').existsSync()) {
-    return 'warm ~/.holon/runtime first (run any `githolon` command once to cache the runtime)';
+    return 'provide the coordinated candidate with NOMOS_DART_RUNTIME, or warm ~/.holon/runtime once';
   }
   return null;
 }
 
 void main() {
+  test(
+      'convergence never reports rejected or dead-lettered business work as success',
+      () {
+    expect(
+        nmsPermanentConvergenceFailure({
+          'stillAhead': false,
+          'admission': {
+            'ok': true,
+            'sessions': [
+              {
+                'rejected': [
+                  {'directiveId': 'commissionAsset', 'error': 'event-mismatch'}
+                ]
+              }
+            ],
+            'deadLetters': [
+              {'directiveId': 'commissionAsset', 'error': 'event-mismatch'}
+            ],
+          },
+        }),
+        contains('commissionAsset'));
+    expect(
+        nmsPermanentConvergenceFailure({
+          'stillAhead': false,
+          'pushError': {'refused': true, 'error': 'policy-refused'},
+        }),
+        contains('policy-refused'));
+    expect(
+        nmsPermanentConvergenceFailure({
+          'stillAhead': false,
+          'admission': {'ok': true, 'sessions': const []},
+        }),
+        isNull);
+  });
+
   test('ephemeral rejects an empty deploy list with a named remedy', () async {
     await expectLater(
       NomosTestHarness.ephemeral(deployJsonPaths: const []),
@@ -46,7 +83,8 @@ void main() {
     );
   });
 
-  test('OFFLINE: install real law, write one directive, read it back, dispose', () async {
+  test('OFFLINE: install real law, write one directive, read it back, dispose',
+      () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -56,7 +94,8 @@ void main() {
       deployJsonPaths: [_guestbookDeployJson],
       nodeEntry: _repoEntry,
       runtimeDir: _runtimeDir,
-      registerTearDown: addTearDown, // deterministic auto-dispose even if an expect() throws
+      registerTearDown:
+          addTearDown, // deterministic auto-dispose even if an expect() throws
     );
 
     // Drive the REAL law: a create directive + a declared query — the same ops a generated client emits.
@@ -73,16 +112,20 @@ void main() {
     expect(outcome.created, hasLength(1));
     expect(outcome.created.single.type, 'guestbook.GuestbookEntry');
 
-    final rows = await harness.bridge.query('entriesByAuthor', {'author': 'harness'});
+    final rows =
+        await harness.bridge.query('entriesByAuthor', {'author': 'harness'});
     expect(rows, hasLength(1));
     expect(rows.first['id'], outcome.created.single.id);
     expect((rows.first['data'] as Map)['message'], 'offline fixture green');
-    expect((rows.first['data'] as Map)['moodEmoji'], '😊'); // proves the law's plan ran, not a stub
+    expect((rows.first['data'] as Map)['moodEmoji'],
+        '😊'); // proves the law's plan ran, not a stub
 
     stdout.writeln('offline harness green: ws=${harness.workspace}');
   }, timeout: const Timeout(Duration(minutes: 2)));
 
-  test('DECOY: the harness plane is multi-session — an unpinned plane op refuses like production', () async {
+  test(
+      'DECOY: the harness plane is multi-session — an unpinned plane op refuses like production',
+      () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -96,7 +139,8 @@ void main() {
     );
     // harness.bridge is a SESSION HANDLE — pinned ops work as before…
     expect(harness.bridge, isA<NomosSession>());
-    expect(await harness.bridge.query('entriesByAuthor', {'author': 'x'}), isEmpty);
+    expect(await harness.bridge.query('entriesByAuthor', {'author': 'x'}),
+        isEmpty);
     // …but the RAW PLANE holds the decoy too, so an op that forgot its session refuses HERE —
     // exactly the refusal a real multi-workspace app would hit (never a silent sole-session guess).
     final plane = (harness.bridge as NomosSession).parent;
@@ -106,7 +150,9 @@ void main() {
     );
   }, timeout: const Timeout(Duration(minutes: 2)));
 
-  test('DX: ephemeral emits phase-progress diagnostics (install → runner → ready → connect)', () async {
+  test(
+      'DX: ephemeral emits phase-progress diagnostics (install → runner → ready → connect)',
+      () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
@@ -145,23 +191,28 @@ void main() {
       autoTearDown: false, // drive dispose explicitly to assert its determinism
     );
     // A read proves the holon is live before teardown.
-    expect(await harness.bridge.query('entriesByAuthor', {'author': 'nobody'}), isEmpty);
+    expect(await harness.bridge.query('entriesByAuthor', {'author': 'nobody'}),
+        isEmpty);
 
     await harness.dispose();
-    await harness.dispose(); // idempotent: the second call is a no-op, never throws
+    await harness
+        .dispose(); // idempotent: the second call is a no-op, never throws
     // The bridge is dead after dispose — a call fails rather than silently reaching a leaked runner.
-    await expectLater(
-        harness.bridge.query('entriesByAuthor', {'author': 'x'}), throwsA(anything));
+    await expectLater(harness.bridge.query('entriesByAuthor', {'author': 'x'}),
+        throwsA(anything));
   }, timeout: const Timeout(Duration(minutes: 2)));
 
-  test('OFFLINE: the `githolon harness-install` SUBCOMMAND lane installs law and drives a read', () async {
+  test(
+      'OFFLINE: the `githolon harness-install` SUBCOMMAND lane installs law and drives a read',
+      () async {
     final skip = _missingPrereq();
     if (skip != null) {
       markTestSkipped(skip);
       return;
     }
     if (!File(_cliDist).existsSync()) {
-      markTestSkipped('build the CLI first: cd cli && npm run build (needs dist/cli.mjs)');
+      markTestSkipped(
+          'build the CLI first: cd cli && npm run build (needs dist/cli.mjs)');
       return;
     }
     // FORCE the published subcommand lane via the installHelper seam: a githolon command line (here the
@@ -170,7 +221,8 @@ void main() {
       deployJsonPaths: [_guestbookDeployJson],
       nodeEntry: _repoEntry,
       runtimeDir: _runtimeDir,
-      installHelper: 'node $_cliDist', // NOT an existing .mjs file ⇒ the subcommand lane
+      installHelper:
+          'node $_cliDist', // NOT an existing .mjs file ⇒ the subcommand lane
       registerTearDown: addTearDown,
     );
 
@@ -185,10 +237,13 @@ void main() {
       },
     );
     expect(outcome.created, hasLength(1));
-    final rows = await harness.bridge.query('entriesByAuthor', {'author': 'subcommand'});
+    final rows =
+        await harness.bridge.query('entriesByAuthor', {'author': 'subcommand'});
     expect(rows, hasLength(1));
-    expect((rows.first['data'] as Map)['message'], 'installed via githolon harness-install');
-    expect((rows.first['data'] as Map)['moodEmoji'], '😊'); // the law's plan ran through the subcommand-built snapshot
+    expect((rows.first['data'] as Map)['message'],
+        'installed via githolon harness-install');
+    expect((rows.first['data'] as Map)['moodEmoji'],
+        '😊'); // the law's plan ran through the subcommand-built snapshot
 
     stdout.writeln('subcommand harness green: ws=${harness.workspace}');
   }, timeout: const Timeout(Duration(minutes: 2)));