@githolon/dsl 0.102.1 → 0.102.3

package/dart/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.64.1
+
+- Resolve a compiled OpenUSD application as one ordered package set in generated offline and connected
+  scenarios, keeping reference-only control law off user replicas while payload law births their workspaces.
+- Pin source and published test runs to the exact coordinated kernel release, and make restart, reconnect and
+  clean reinstall use the same hidden multi-workspace custody lifecycle.
+- Seat every business workspace founder on its private transport relation at genesis so public business
+  records can coexist with framework-private identity state and still reopen on a fresh device.
+
 ## 0.64.0
 
 - Generate one self-documenting application object: intent-shaped business actions at the root, typed

package/dart/lib/src/dev_cloud.dart

@@ -58,8 +58,14 @@ class NomosTestCloud {
   bool _online = true;
   bool _stopped = false;
 
-  NomosTestCloud._(this._server, this._proxy, this._upstream, this._client,
-      this._onDiagnostic, this.testKRootPublic);
+  NomosTestCloud._(
+    this._server,
+    this._proxy,
+    this._upstream,
+    this._client,
+    this._onDiagnostic,
+    this.testKRootPublic,
+  );
 
   /// The base URL a cloud-BOUND session connects to (`connect(cloud: cloud.origin)`). Points at the PARTITION
   /// PROXY, so [setOnline] deterministically severs/heals the whole plane's link to custody.
@@ -71,7 +77,8 @@ class NomosTestCloud {
   void setOnline(bool online) {
     _online = online;
     _log(
-        'partition: ${online ? "ONLINE (link up)" : "OFFLINE (link severed)"}');
+      'partition: ${online ? "ONLINE (link up)" : "OFFLINE (link severed)"}',
+    );
   }
 
   bool get online => _online;
@@ -80,8 +87,9 @@ class NomosTestCloud {
   /// live cloud state DIRECTLY (bypassing the partition proxy) — a test assertion about custody must see the
   /// truth even while the app's link is partitioned OFFLINE.
   Future<RemoteWorkspaceState> remoteHead(String workspace) async {
-    final body =
-        await _getJson(_upstream.replace(path: '/v2/workspaces/$workspace'));
+    final body = await _getJson(
+      _upstream.replace(path: '/v2/workspaces/$workspace'),
+    );
     final ledger =
         (body['ledgerState'] as Map?)?.cast<String, Object?>() ?? const {};
     return RemoteWorkspaceState(
@@ -110,9 +118,14 @@ class NomosTestCloud {
     /// (the old lane — the harness POST-creating the platform — refuses 409 `unborn` by design).
     String? platform,
 
-    /// Optional platform law to deploy at boot (`--deploy build/<name>.deploy.json`) — the dev server
-    /// installs it on [platform] before serving. The harness may also deploy law itself post-boot.
+    /// Optional single platform law to deploy at boot. Prefer [deployJsonPaths] for a composed application.
     String? deployJsonPath,
+
+    /// Ordered application package set installed by the warranted bootstrap operator before serving.
+    /// Reference-only/control packages go first and remain active on the parent; the home payload package
+    /// goes last and is retained as the explicit law used to birth a receiving group. A payload package is
+    /// not made current on the parent merely to make it available to a child.
+    List<String> deployJsonPaths = const [],
     Duration readyTimeout = const Duration(seconds: 30),
     void Function(String line)? onDiagnostic,
   }) async {
@@ -124,19 +137,31 @@ class NomosTestCloud {
       if (ephemeral) '--ephemeral',
       if (dataDir != null) ...['--data', dataDir],
       if (platform != null) ...['--platform', platform],
-      if (deployJsonPath != null) ...['--deploy', deployJsonPath],
+      for (final deploy in [
+        ...deployJsonPaths,
+        if (deployJsonPath != null && !deployJsonPaths.contains(deployJsonPath))
+          deployJsonPath,
+      ]) ...['--deploy', deploy],
     ];
     void log(String m) => onDiagnostic?.call('[nomos-test-cloud] $m');
     log('spawning: $node ${args.join(' ')}');
     final proc = await Process.start(node, args, mode: ProcessStartMode.normal);
+    final serverTail = <String>[];
+    void remember(String stream, String line) {
+      serverTail.add('$stream: $line');
+      if (serverTail.length > 24) serverTail.removeAt(0);
+      log('$stream: $line');
+    }
     proc.stdout
         .transform(utf8.decoder)
         .transform(const LineSplitter())
-        .listen((l) => log('server: $l'));
+        .listen((l) => remember('server', l));
     proc.stderr
         .transform(utf8.decoder)
         .transform(const LineSplitter())
-        .listen((l) => log('server!: $l'));
+        .listen((l) => remember('server!', l));
+    int? prematureExitCode;
+    unawaited(proc.exitCode.then((code) => prematureExitCode = code));
 
     final upstream = Uri.parse('http://127.0.0.1:$chosenPort');
     final client = HttpClient();
@@ -147,6 +172,7 @@ class NomosTestCloud {
     var ready = false;
     String? testKRootPublic;
     while (DateTime.now().isBefore(deadline)) {
+      if (prematureExitCode != null) break;
       try {
         final req = await client.getUrl(upstream.replace(path: '/health'));
         final resp = await req.close();
@@ -160,20 +186,35 @@ class NomosTestCloud {
             break;
           }
         }
-      } catch (_) {/* not up yet */}
+      } catch (_) {
+        /* not up yet */
+      }
       await Future<void>.delayed(const Duration(milliseconds: 200));
     }
     if (!ready) {
-      proc.kill(ProcessSignal.sigkill);
+      if (prematureExitCode == null) proc.kill(ProcessSignal.sigkill);
+      final exited = prematureExitCode;
+      final tail = serverTail.isEmpty ? '' : '\nserver tail:\n${serverTail.join('\n')}';
       throw NomosTestCloudException(
-          'the dev cloud did not answer /health${platform != null ? ' with platformReady:true' : ''} within ${readyTimeout.inSeconds}s (serverEntry: $serverEntry)');
+        exited == null
+            ? 'the dev cloud did not answer /health${platform != null ? ' with platformReady:true' : ''} within ${readyTimeout.inSeconds}s (serverEntry: $serverEntry)$tail'
+            : 'the dev cloud exited with code $exited before /health${platform != null ? ' reported platformReady:true' : ' became ready'} (serverEntry: $serverEntry)$tail',
+      );
     }
-    log('dev cloud healthy at $upstream${platform != null ? ' (platform ceremony complete)' : ''}');
+    log(
+      'dev cloud healthy at $upstream${platform != null ? ' (platform ceremony complete)' : ''}',
+    );
 
     // The partition proxy — forwards to the dev cloud when ONLINE, fails fast when OFFLINE.
     final proxy = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
     final cloud = NomosTestCloud._(
-        proc, proxy, upstream, client, onDiagnostic, testKRootPublic);
+      proc,
+      proxy,
+      upstream,
+      client,
+      onDiagnostic,
+      testKRootPublic,
+    );
     proxy.listen(cloud._handleProxy);
     log('partition proxy at ${cloud.origin} → $upstream');
     return cloud;
@@ -192,8 +233,9 @@ class NomosTestCloud {
     }
     try {
       final target = _upstream.replace(
-          path: req.uri.path,
-          query: req.uri.query.isEmpty ? null : req.uri.query);
+        path: req.uri.path,
+        query: req.uri.query.isEmpty ? null : req.uri.query,
+      );
       final fwd = await _client.openUrl(req.method, target);
       req.headers.forEach((name, values) {
         if (name.toLowerCase() != 'host')
@@ -220,7 +262,8 @@ class NomosTestCloud {
     final text = await resp.transform(utf8.decoder).join();
     if (resp.statusCode != 200) {
       throw NomosTestCloudException(
-          'GET $url → ${resp.statusCode}: ${text.substring(0, text.length.clamp(0, 200))}');
+        'GET $url → ${resp.statusCode}: ${text.substring(0, text.length.clamp(0, 200))}',
+      );
     }
     return (jsonDecode(text) as Map).cast<String, Object?>();
   }

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 
+// <define:__NOMOS_KERNEL_RELEASE__>
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "bc52f7eb630bc5a9a03b4c62b9b7ab58c4b6f25e687ecd51c72f9251763593fc", version: "kernel-bc52f7eb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "17d8f91b661dc8c3a6dea72d699f9f5759ab5e6b4e3e3e5e90afceb3a7034154", version: "kernel-17d8f91b", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -2597,12 +2601,20 @@ function parseBulkReadForbidden(status, bodyText) {
 // src/kernel_provider_wasm.ts
 var enc2 = new TextEncoder();
 var dec2 = new TextDecoder();
-var snapB64 = (bytes) => {
+var nmsInternalSnapshotToBase64 = (bytes) => {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+  }
   let s = "";
-  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+  }
   return btoa(s);
 };
-var snapUnb64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+var nmsInternalSnapshotFromBase64 = (s) => {
+  if (typeof Buffer !== "undefined") return Buffer.from(s, "base64");
+  return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+};
 var unpack = (p) => {
   const v = typeof p === "bigint" ? p : BigInt(p);
   return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
@@ -2647,7 +2659,7 @@ function wasmModuleFor(base, fetchImpl) {
 function parseSnapshot(bytes) {
   try {
     const o = JSON.parse(dec2.decode(bytes));
-    if (o && o.v === 2 && typeof o.tree === "string") return { treeBytes: snapUnb64(o.tree), ckpt: o.ckpt ?? null, frontier: o.frontier ?? null, syncedBase: o.syncedBase ?? null };
+    if (o && o.v === 2 && typeof o.tree === "string") return { treeBytes: nmsInternalSnapshotFromBase64(o.tree), ckpt: o.ckpt ?? null, frontier: o.frontier ?? null, syncedBase: o.syncedBase ?? null };
   } catch {
   }
   return { treeBytes: bytes, ckpt: null, frontier: null, syncedBase: null };
@@ -2656,7 +2668,7 @@ function buildSnapshot(treeBytes, ckpt, syncedBase) {
   if ((!ckpt || !ckpt.blob && !ckpt.frontier) && !syncedBase) return treeBytes;
   return enc2.encode(JSON.stringify({
     v: 2,
-    tree: snapB64(treeBytes),
+    tree: nmsInternalSnapshotToBase64(treeBytes),
     ckpt: ckpt && ckpt.blob ? ckpt.blob : null,
     frontier: ckpt ? ckpt.frontier ?? null : null,
     cursor: ckpt ? ckpt.cursor ?? null : null,
@@ -2896,7 +2908,7 @@ function createWasmEnginePlane({ span } = {}) {
           }
           const buf = new Uint8Array(await r.arrayBuffer());
           if (!buf.length) return { applied: false };
-          view.applyPack(snapB64(buf));
+          view.applyPack(nmsInternalSnapshotToBase64(buf));
           return { applied: true };
         } finally {
           if (end) end();
@@ -9027,6 +9039,15 @@ function offlineOpenRealm() {
   const restorePath = process.env["NOMOS_OFFLINE_RESTORE"];
   const wasmName = process.env["NOMOS_OFFLINE_WASM"] || "holon.wasm";
   const wasm = readFileSync(join(runtimeDir, wasmName));
+  if (typeof define_NOMOS_KERNEL_RELEASE_default !== "undefined") {
+    const expected = wasmName === "holon-testmint.wasm" ? define_NOMOS_KERNEL_RELEASE_default.testMint.hash : define_NOMOS_KERNEL_RELEASE_default.production.hash;
+    const actual = createHash("sha256").update(wasm).digest("hex");
+    if (actual !== expected) {
+      throw new Error(
+        `offline runtime/kernel skew: ${wasmName} is ${actual.slice(0, 12)}\u2026, but this SDK requires ${expected.slice(0, 12)}\u2026; the installer must acquire the release-pinned runtime before boot`
+      );
+    }
+  }
   const pkgs = readFileSync(join(runtimeDir, "packages.json"));
   let manifests = null;
   try {

package/dart/lib/src/runner/offline-install.mjs

@@ -5,15 +5,19 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// <define:__NOMOS_KERNEL_RELEASE__>
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "bc52f7eb630bc5a9a03b4c62b9b7ab58c4b6f25e687ecd51c72f9251763593fc", version: "kernel-bc52f7eb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "17d8f91b661dc8c3a6dea72d699f9f5759ab5e6b4e3e3e5e90afceb3a7034154", version: "kernel-17d8f91b", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+
 // runner/offline-install.ts
-import { readFileSync, writeFileSync as writeFileSync2, existsSync } from "node:fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join as join2, dirname } from "node:path";
 import { randomBytes, webcrypto as wc } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
 // runner/runtime-refresh.ts
-import { statSync, renameSync, writeFileSync, mkdirSync } from "node:fs";
+import { statSync, renameSync, writeFileSync, mkdirSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 var RUNTIME_FRESH_MS = 15 * 60 * 1e3;
 var _refreshedDirs = /* @__PURE__ */ new Set();
@@ -32,12 +36,29 @@ function atomicWrite(target, data) {
   writeFileSync(tmp, data);
   renameSync(tmp, target);
 }
-async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log: log2, mode } = {}) {
+var sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function runtimeReleaseMismatch(dir, expected) {
+  try {
+    const production = sha256(readFileSync(join(dir, "holon.wasm")));
+    if (production !== expected.production) {
+      return `production kernel ${production.slice(0, 12)}\u2026; SDK requires ${expected.production.slice(0, 12)}\u2026`;
+    }
+    const testMint = sha256(readFileSync(join(dir, "holon-testmint.wasm")));
+    if (testMint !== expected.testMint) {
+      return `test-mint kernel ${testMint.slice(0, 12)}\u2026; SDK requires ${expected.testMint.slice(0, 12)}\u2026`;
+    }
+    return void 0;
+  } catch (error) {
+    return `runtime cache is incomplete (${error.message})`;
+  }
+}
+async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log: log2, mode, expected } = {}) {
   const m = String(mode ?? process.env["NOMOS_RUNTIME_REFRESH"] ?? "auto").toLowerCase();
   if (m === "never") return false;
+  const coherent = expected === void 0 || runtimeReleaseMismatch(dir, expected) === void 0;
   if (m !== "always") {
-    if (_refreshedDirs.has(dir)) return false;
-    if (runtimeIsWarm(dir)) return false;
+    if (coherent && _refreshedDirs.has(dir)) return false;
+    if (coherent && runtimeIsWarm(dir)) return false;
   }
   try {
     const r = await fetchImpl(`${cloud}/v1/runtime/holon.wasm`);
@@ -46,6 +67,15 @@ async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log
     const testmintResp = await fetchImpl(`${cloud}/v1/runtime/holon-testmint.wasm`);
     if (!testmintResp.ok) throw new Error(`test-mint runtime wasm \u2192 ${testmintResp.status}`);
     const testmintBytes = new Uint8Array(await testmintResp.arrayBuffer());
+    if (expected !== void 0) {
+      const productionHash = sha256(bytes);
+      const testMintHash = sha256(testmintBytes);
+      if (productionHash !== expected.production || testMintHash !== expected.testMint) {
+        throw new Error(
+          `cloud runtime does not match this SDK release (production ${productionHash.slice(0, 12)}\u2026/${expected.production.slice(0, 12)}\u2026, test-mint ${testMintHash.slice(0, 12)}\u2026/${expected.testMint.slice(0, 12)}\u2026)`
+        );
+      }
+    }
     const pkgsResp = await fetchImpl(`${cloud}/v1/runtime/packages`);
     if (!pkgsResp.ok) throw new Error(`runtime packages \u2192 ${pkgsResp.status}`);
     const pkgText = await pkgsResp.text();
@@ -56,7 +86,10 @@ async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log
     _refreshedDirs.add(dir);
     if (typeof log2 === "function") log2(`offline-install: refreshed runtime cache from the cloud \u2192 ${dir}`);
     return true;
-  } catch {
+  } catch (error) {
+    if (typeof log2 === "function" && expected !== void 0) {
+      log2(`offline-install: release-pinned runtime refresh failed: ${error.message}`);
+    }
     return false;
   }
 }
@@ -1863,11 +1896,16 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
   });
   cmds.push(FLUSH);
   const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
-  const r = await fetch(`${remote}/git-receive-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
-    body
-  });
+  let r;
+  try {
+    r = await fetch(`${remote}/git-receive-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+      body
+    });
+  } catch (error) {
+    throw new Error(`receive-pack transport failed (${body.byteLength} bytes): ${String(error)}`, { cause: error });
+  }
   const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
   const unpacked = /unpack ok/.test(txt);
   const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
@@ -3322,7 +3360,12 @@ async function custodyFetch(eng2, ws, ledger, { remoteRef = "refs/heads/main", l
 async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
-  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  let remote;
+  try {
+    remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  } catch (error) {
+    throw new Error(`custody receive-pack advertisement failed for ${remoteRefFull}: ${String(error)}`, { cause: error });
+  }
   const oldOid = remote[remoteRefFull] || ZERO_OID;
   if (del) {
     if (oldOid === ZERO_OID) return;
@@ -3336,14 +3379,21 @@ async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del =
     pack = oldOid !== ZERO_OID ? packDelta(eng2, ws, oldOid, tgt) : null;
     if (!pack) pack = packDelta(eng2, ws, "", tgt);
   }
-  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  const packBytes = pack?.byteLength ?? 0;
+  try {
+    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+  } catch (error) {
+    throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
+  }
 }
 async function commitAndPush(eng2, ws, ledger) {
   try {
     await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
   } catch (e) {
     unmount(eng2, ws);
-    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
+    const cause = e instanceof Error ? e.cause : void 0;
+    const detail = cause === void 0 ? String(e) : `${e}; cause: ${String(cause)}`;
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${detail}`, { cause: e });
   }
 }
 async function pushShape(eng2, ws, ledger) {
@@ -4627,6 +4677,7 @@ function sealAttestationBatches(eng2, ws, domain, controllerHash, opts = {}) {
 
 // runner/offline-install.ts
 var HERE = dirname(fileURLToPath(import.meta.url));
+var EXPECTED_RUNTIME = typeof define_NOMOS_KERNEL_RELEASE_default === "undefined" ? void 0 : { production: define_NOMOS_KERNEL_RELEASE_default.production.hash, testMint: define_NOMOS_KERNEL_RELEASE_default.testMint.hash };
 var engineModule = process.env["NOMOS_ADAPTER_ENGINE"] ? await import(process.env["NOMOS_ADAPTER_ENGINE"]) : engine_exports;
 var treeModule = process.env["NOMOS_ADAPTER_TREE"] ? await import(process.env["NOMOS_ADAPTER_TREE"]) : { serializeTree };
 var { createEngine: createEngine2, mountWorkspace: mountWorkspace2, author: author2, installPayload: installPayload2, authorKeygen: authorKeygen2, refreshProjection: refreshProjection2, currentLaw: currentLaw2, exportCheckpoint: exportCheckpoint2 } = engineModule;
@@ -4654,14 +4705,25 @@ if (!outPath) die("no --out snapshot path given");
 var CLOUD = (process.env["NOMOS_CLOUD"] || "https://nomos.captainapp.co.uk").replace(/\/+$/, "");
 var STALE_RUNTIME_HINT = "your cached kernel runtime may be stale \u2014 rm -rf ~/.holon/runtime and re-run (it re-fetches from the cloud)";
 var looksLikeStaleRuntime = (msg) => /\bbbox param\b|missing.*param|non-numeric|unknown (op|query op)|unsupported op|unexpected (field|key)|no such op/i.test(msg);
-await refreshRuntimeDir(CLOUD, runtimeDir, { log: (m) => process.stderr.write(m + "\n") });
+await refreshRuntimeDir(CLOUD, runtimeDir, {
+  log: (m) => process.stderr.write(m + "\n"),
+  ...EXPECTED_RUNTIME !== void 0 ? { expected: EXPECTED_RUNTIME } : {}
+});
+if (EXPECTED_RUNTIME !== void 0) {
+  const mismatch = runtimeReleaseMismatch(runtimeDir, EXPECTED_RUNTIME);
+  if (mismatch !== void 0) {
+    die(
+      `runtime release coherence failed: ${mismatch}. The SDK will not run generated law against a different kernel; reconnect once so it can fetch this release's runtime, or set NOMOS_OFFLINE_RUNTIME to the exact candidate bundle.`
+    );
+  }
+}
 var wasmFile = join2(runtimeDir, "holon-testmint.wasm");
 var pkgsFile = join2(runtimeDir, "packages.json");
 if (!existsSync(wasmFile) || !existsSync(pkgsFile)) {
   die(`test runtime cache missing at ${runtimeDir} (holon-testmint.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`);
 }
-var wasm = readFileSync(wasmFile);
-var pkgs = JSON.parse(readFileSync(pkgsFile, "utf8"));
+var wasm = readFileSync2(wasmFile);
+var pkgs = JSON.parse(readFileSync2(pkgsFile, "utf8"));
 var wasmModule = await WebAssembly.compile(wasm);
 var replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
 var eng = await createEngine2({ wasmModule, bootstrapPkg: pkgs.bootstrap, nomosPkg: pkgs.nomos, replica, installedBy: "nomos-test-harness" });
@@ -4688,7 +4750,7 @@ var lawHashes = [];
 var expectedDomainLaw = /* @__PURE__ */ new Map();
 for (const p of deployPaths) {
   if (!existsSync(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
-  const deploy2 = JSON.parse(readFileSync(p, "utf8"));
+  const deploy2 = JSON.parse(readFileSync2(p, "utf8"));
   const usda = deploy2.packageUsda;
   if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
   const lawHash = await sha256hex2(usda);