@githolon/dsl 0.102.1 → 0.102.3

package/dart/lib/src/test_harness.dart

@@ -48,6 +48,114 @@ import 'node_runner_transport.dart';
 import 'session_bound.dart' show DomainNotInstalledForSession;
 import 'webview_bridge.dart' show NomosBridge, NomosSession;
 
+/// A source checkout is itself a coordinated release candidate: compiler, framework packages and kernels
+/// move together. Generated scenarios must not combine those source-generated laws with a recently-written
+/// but older global runtime cache. Published packages have no release/ directory and keep the normal
+/// release-pinned runtime acquisition path; this branch is only the zero-ceremony dogfood path.
+Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
+  var cursor = File(nodeEntry).absolute.parent;
+  Directory? root;
+  for (var depth = 0; depth < 12; depth++) {
+    if (File('${cursor.path}/release/kernel-candidate.json').existsSync() &&
+        File('${cursor.path}/cloud/dev-server/kernel-testmint.wasm')
+            .existsSync()) {
+      root = cursor;
+      break;
+    }
+    final parent = cursor.parent;
+    if (parent.path == cursor.path) break;
+    cursor = parent;
+  }
+  if (root == null) return null;
+
+  final descriptor = (jsonDecode(
+    await File(
+      '${root.path}/release/kernel-candidate.json',
+    ).readAsString(),
+  ) as Map)
+      .cast<String, Object?>();
+  String expected(String key) =>
+      (((descriptor[key] as Map?)?['sha256'])?.toString() ?? '').trim();
+  final productionExpected = expected('production');
+  final testMintExpected = expected('testMint');
+  final production = File(
+    '${root.path}/cloud/cloudflare-shell/vendor/holon_bytes.wasmbin',
+  );
+  final testMint = File(
+    '${root.path}/cloud/dev-server/kernel-testmint.wasm',
+  );
+  final bootstrap = File(
+    '${root.path}/cloud/cloudflare-shell/domains/domain_bootstrap.package.usda',
+  );
+  final nomos = File(
+    '${root.path}/cloud/cloudflare-shell/domains/domain_nomos.package.usda',
+  );
+  for (final file in [production, testMint, bootstrap, nomos]) {
+    if (!file.existsSync()) {
+      throw NomosTestHarnessException(
+        'source release candidate is incomplete: ${file.path} is missing',
+      );
+    }
+  }
+  final productionBytes = await production.readAsBytes();
+  final testMintBytes = await testMint.readAsBytes();
+  final productionActual = sha256.convert(productionBytes).toString();
+  final testMintActual = sha256.convert(testMintBytes).toString();
+  String short(String value) =>
+      value.length <= 12 ? value : value.substring(0, 12);
+  if (productionActual != productionExpected ||
+      testMintActual != testMintExpected) {
+    throw NomosTestHarnessException(
+      'source release candidate kernel mismatch: release/kernel-candidate.json '
+      'expects ${short(productionExpected)}/${short(testMintExpected)}, but the staged artifacts are '
+      '${short(productionActual)}/${short(testMintActual)} — run the kernel candidate preparation before testing',
+    );
+  }
+  final bootstrapText = await bootstrap.readAsString();
+  final nomosText = await nomos.readAsString();
+  final bundleIdentity = sha256
+      .convert(
+        utf8.encode(
+          '$productionActual:$testMintActual:'
+          '${sha256.convert(utf8.encode(bootstrapText))}:'
+          '${sha256.convert(utf8.encode(nomosText))}',
+        ),
+      )
+      .toString();
+  final runtime = Directory(
+    '${Directory.systemTemp.path}/nomos-source-runtime-${bundleIdentity.substring(0, 20)}',
+  );
+  await runtime.create(recursive: true);
+  Future<void> publish(String name, List<int> bytes) async {
+    final target = File('${runtime.path}/$name');
+    if (target.existsSync() && target.lengthSync() == bytes.length) return;
+    final candidate = File(
+        '${target.path}.tmp-${pid}-${DateTime.now().microsecondsSinceEpoch}');
+    await candidate.writeAsBytes(bytes, flush: true);
+    try {
+      await candidate.rename(target.path);
+    } on FileSystemException {
+      if (!target.existsSync()) rethrow;
+      try {
+        await candidate.delete();
+      } on FileSystemException {
+        // Another process won the same content-addressed publication race; its complete target is enough.
+      }
+    }
+  }
+
+  await publish('holon.wasm', productionBytes);
+  await publish('holon-testmint.wasm', testMintBytes);
+  await publish(
+    'packages.json',
+    utf8.encode(jsonEncode(<String, String>{
+      'bootstrap': bootstrapText,
+      'nomos': nomosText,
+    })),
+  );
+  return runtime.path;
+}
+
 /// Framework-internal classifier for a sync result that can never become converged by retrying. Generated
 /// scenarios use it through [NomosTestHarness.converge]; it is public only inside `package:nomos_client/src`
 /// so the false-green contract has a cheap regression test without booting a cloud.
@@ -58,8 +166,11 @@ String? nmsPermanentConvergenceFailure(Map<String, Object?> result) {
       : const [];
   final rejected = sessions
       .whereType<Map>()
-      .expand((session) =>
-          session['rejected'] is List ? session['rejected'] as List : const [])
+      .expand(
+        (session) => session['rejected'] is List
+            ? session['rejected'] as List
+            : const [],
+      )
       .toList();
   final deadLetters = admission is Map && admission['deadLetters'] is List
       ? admission['deadLetters'] as List
@@ -137,9 +248,10 @@ class HarnessPhaseTimeout extends NomosTestHarnessException {
     required this.awaiting,
     this.likelyCauses = const [],
   }) : super(
-            'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
-            'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
-            '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}');
+          'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
+          'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
+          '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}',
+        );
   @override
   String toString() => 'HarnessPhaseTimeout: $message';
 }
@@ -234,25 +346,32 @@ class NomosTestHarness {
     final ws = homeWorkspace;
     if (ws == null) {
       throw NomosTestHarnessException(
-          'this harness has no primary application session');
+        'this harness has no primary application session',
+      );
     }
     return session(ws);
   }
 
-  NomosTestHarness._(this.bridge, this.workspace, this._transport,
-      this._workdir, this._onDiagnostic, List<String> sessionNames,
-      {Map<String, String> devicePublics = const {},
-      Map<String, String> deviceSecrets = const {},
-      this.frameworkHash,
-      Map<String, List<String>> lawHashes = const {},
-      Map<String, String> snapshots = const {},
-      _InstallLane? installLane,
-      Duration? phaseTimeout,
-      _CloudRestartLane? cloudRestartLane,
-      this.testCloud,
-      this.homeWorkspace})
-      : _sessionNames = List.of(
-            sessionNames), // GROWABLE — restoreWorkspace may add a fresh session
+  NomosTestHarness._(
+    this.bridge,
+    this.workspace,
+    this._transport,
+    this._workdir,
+    this._onDiagnostic,
+    List<String> sessionNames, {
+    Map<String, String> devicePublics = const {},
+    Map<String, String> deviceSecrets = const {},
+    this.frameworkHash,
+    Map<String, List<String>> lawHashes = const {},
+    Map<String, String> snapshots = const {},
+    _InstallLane? installLane,
+    Duration? phaseTimeout,
+    _CloudRestartLane? cloudRestartLane,
+    this.testCloud,
+    this.homeWorkspace,
+  })  : _sessionNames = List.of(
+          sessionNames,
+        ), // GROWABLE — restoreWorkspace may add a fresh session
         _devicePublics = devicePublics,
         _deviceSecrets = deviceSecrets,
         _lawHashes = Map.of(lawHashes),
@@ -286,13 +405,16 @@ class NomosTestHarness {
     final where = workspace != null ? ' "$workspace"' : '';
     log('phase $phase$where (≤${timeout.inSeconds}s) …');
     final sw = Stopwatch()..start();
-    final r = await run().timeout(timeout,
-        onTimeout: () => throw HarnessPhaseTimeout(
-            phase: phase,
-            workspace: workspace,
-            elapsed: timeout,
-            awaiting: awaiting,
-            likelyCauses: likelyCauses));
+    final r = await run().timeout(
+      timeout,
+      onTimeout: () => throw HarnessPhaseTimeout(
+        phase: phase,
+        workspace: workspace,
+        elapsed: timeout,
+        awaiting: awaiting,
+        likelyCauses: likelyCauses,
+      ),
+    );
     log('phase $phase$where done (${sw.elapsedMilliseconds}ms)');
     return r;
   }
@@ -322,13 +444,16 @@ class NomosTestHarness {
     final secret = _deviceSecrets[workspace];
     if (secret == null || secret.isEmpty) {
       throw NomosTestHarnessException(
-          'the generated scenario cannot establish its business permission because the test device secret is unavailable');
+        'the generated scenario cannot establish its business permission because the test device secret is unavailable',
+      );
     }
-    final rows = await session(workspace)
-        .queryById('birth-attestation:self', null, subject);
+    final rows = await session(
+      workspace,
+    ).queryById('birth-attestation:self', null, subject);
     if (rows.length != 1) {
       throw NomosTestHarnessException(
-          'the generated scenario expected one verified birth attestation before establishing business permission; found ${rows.length}');
+        'the generated scenario expected one verified birth attestation before establishing business permission; found ${rows.length}',
+      );
     }
     final row = rows.single;
     final data = row['data'] is Map
@@ -349,7 +474,8 @@ class NomosTestHarness {
     final certificate = issued['certString']?.toString();
     if (certificate == null || certificate.isEmpty) {
       throw NomosTestHarnessException(
-          'the generated scenario could not mint the parent-rooted business delegation');
+        'the generated scenario could not mint the parent-rooted business delegation',
+      );
     }
     await session(workspace).offerOutcome(
       domain: domain,
@@ -373,7 +499,8 @@ class NomosTestHarness {
   NomosSession session(String workspace) {
     if (!_sessionNames.contains(workspace)) {
       throw NomosTestHarnessException(
-          'no session "$workspace" on this harness — connected sessions: $_sessionNames');
+        'no session "$workspace" on this harness — connected sessions: $_sessionNames',
+      );
     }
     return bridge.session(workspace);
   }
@@ -415,13 +542,16 @@ class NomosTestHarness {
   }) async {
     if (deployJsonPaths.isEmpty) {
       throw NomosTestHarnessException(
-          'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits');
+        'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits',
+      );
     }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final effectiveRuntimeDir = runtimeDir ??
+        Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
-        Platform.environment['NOMOS_OFFLINE_RUNTIME'];
+        Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
+        await _sourceCandidateRuntime(entry);
     // THE INSTALL LANE. [installHelper] is the one seam (PACKAGING NOTE above): either the in-repo
     // `offline-install.mjs` node script, OR the published `githolon harness-install` subcommand (the CLI
     // bundles the engine + this exact install sequence, so a published tenant needs nothing but `githolon`).
@@ -462,28 +592,29 @@ class NomosTestHarness {
     try {
       final snapshot = '${workdir.path}/snapshot.bin';
       final info = await _phased(
-          phase:
-              '1/4: offline law install (${deployJsonPaths.length} package(s))',
+        phase:
+            '1/4: offline law install (${deployJsonPaths.length} package(s))',
+        workspace: installWorkspace,
+        awaiting:
+            useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
+        timeout: phaseTimeout ?? _kInstallDeadline,
+        onDiagnostic: onDiagnostic,
+        likelyCauses: const [
+          'a cold npx download of githolon (pre-warm with any `githolon` run)',
+          'a very large law package folding through the offline gate — raise phaseTimeout',
+        ],
+        run: () => _runInstall(
+          node: node,
+          useInRepoScript: useInRepoScript,
+          inRepoScript: resolvedHelper,
+          githolonCmd: githolonCmd,
+          deployJsonPaths: deployJsonPaths,
           workspace: installWorkspace,
-          awaiting: useInRepoScript
-              ? 'offline-install.ts'
-              : 'githolon harness-install',
-          timeout: phaseTimeout ?? _kInstallDeadline,
+          snapshot: snapshot,
+          runtimeDir: effectiveRuntimeDir,
           onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'a cold npx download of githolon (pre-warm with any `githolon` run)',
-            'a very large law package folding through the offline gate — raise phaseTimeout',
-          ],
-          run: () => _runInstall(
-              node: node,
-              useInRepoScript: useInRepoScript,
-              inRepoScript: resolvedHelper,
-              githolonCmd: githolonCmd,
-              deployJsonPaths: deployJsonPaths,
-              workspace: installWorkspace,
-              snapshot: snapshot,
-              runtimeDir: effectiveRuntimeDir,
-              onDiagnostic: onDiagnostic));
+        ),
+      );
 
       final runnerEnvironment = <String, String>{
         'NOMOS_OFFLINE': '1',
@@ -497,50 +628,53 @@ class NomosTestHarness {
           'NOMOS_OFFLINE_RUNTIME': effectiveRuntimeDir,
       };
       transport = await _phased(
-          phase: '2/4: spawn the node runner',
-          awaiting: 'Process.start($node)',
-          timeout: phaseTimeout ?? _kSpawnDeadline,
+        phase: '2/4: spawn the node runner',
+        awaiting: 'Process.start($node)',
+        timeout: phaseTimeout ?? _kSpawnDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () => NodeRunnerTransport.start(
+          entry: entry,
+          resolveFrom: resolveFrom,
+          node: node,
+          environment: runnerEnvironment,
           onDiagnostic: onDiagnostic,
-          run: () => NodeRunnerTransport.start(
-                entry: entry,
-                resolveFrom: resolveFrom,
-                node: node,
-                environment: runnerEnvironment,
-                onDiagnostic: onDiagnostic,
-              ));
+        ),
+      );
       final plane = NomosBridge(transport!);
       await _phased(
-          phase: '3/4: runner ready',
-          awaiting: "event:'ready'",
-          timeout: phaseTimeout ?? readyTimeout,
-          onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
-            'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
-          ],
-          run: () => plane.ready);
+        phase: '3/4: runner ready',
+        awaiting: "event:'ready'",
+        timeout: phaseTimeout ?? readyTimeout,
+        onDiagnostic: onDiagnostic,
+        likelyCauses: const [
+          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
+          'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
+        ],
+        run: () => plane.ready,
+      );
       await _phased(
-          phase: '4/4: connect session',
+        phase: '4/4: connect session',
+        workspace: installWorkspace,
+        awaiting: 'connect',
+        timeout: phaseTimeout ?? connectTimeout,
+        onDiagnostic: onDiagnostic,
+        likelyCauses: const [
+          'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
+          'run with onDiagnostic to see where the runner blocked',
+        ],
+        run: () => plane.connect(
+          cloud:
+              'https://offline.invalid', // ignored: the offline runner serves everything locally
           workspace: installWorkspace,
-          awaiting: 'connect',
-          timeout: phaseTimeout ?? connectTimeout,
-          onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
-            'run with onDiagnostic to see where the runner blocked',
-          ],
-          run: () => plane.connect(
-                cloud:
-                    'https://offline.invalid', // ignored: the offline runner serves everything locally
-                workspace: installWorkspace,
-                session: installWorkspace,
-                clientId: clientId,
-                allowUnborn: true,
-                // THE HARNESS DEVICE (era-0): the install lane mints one device key per plane — sessions
-                // sign with it, and the client completes the self-serve birth ceremony (enrol + cert)
-                // with the SAME key, so offline `.births()` offers Just Work.
-                authorSecret: info['deviceSecret']?.toString(),
-              ));
+          session: installWorkspace,
+          clientId: clientId,
+          allowUnborn: true,
+          // THE HARNESS DEVICE (era-0): the install lane mints one device key per plane — sessions
+          // sign with it, and the client completes the self-serve birth ceremony (enrol + cert)
+          // with the SAME key, so offline `.births()` offers Just Work.
+          authorSecret: info['deviceSecret']?.toString(),
+        ),
+      );
       if (birthsApplicationHome) {
         final devicePublic = info['devicePublic']?.toString();
         final deviceSecret = info['deviceSecret']?.toString();
@@ -557,7 +691,8 @@ class NomosTestHarness {
             framework.isEmpty ||
             laws.isEmpty) {
           throw NomosTestHarnessException(
-              'the offline application parent did not return the framework law, application law and test device needed to birth the signed-in application');
+            'the offline application parent did not return the framework law, application law and test device needed to birth the signed-in application',
+          );
         }
         final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
         final outcome = await _phased(
@@ -575,7 +710,9 @@ class NomosTestHarness {
               'owner': owner,
               'ownerKeyHash': keyHash,
               'frameworkHash': framework,
-              'lawHash': laws.first,
+              // Ordered application deployment is reference packages first, deferred child payload last.
+              // The parent serves the references; the receiving group is born with only its payload law.
+              'lawHash': laws.last,
               'bornAt': DateTime.now().toUtc().toIso8601String(),
             },
           ),
@@ -591,8 +728,9 @@ class NomosTestHarness {
             outcome.born.single != workspace ||
             bornStatus != 'born') {
           throw NomosTestHarnessException(
-              'the offline application parent did not birth "$workspace" cleanly '
-              '(born=${outcome.born}, birthOutcomes=${outcome.birthOutcomes})');
+            'the offline application parent did not birth "$workspace" cleanly '
+            '(born=${outcome.born}, birthOutcomes=${outcome.birthOutcomes})',
+          );
         }
         await _phased(
           phase: 'application: mount the signed-in application',
@@ -616,7 +754,8 @@ class NomosTestHarness {
             deviceSecret == null ||
             deviceSecret.isEmpty) {
           throw NomosTestHarnessException(
-              'the offline install did not return the test device key needed to make "$owner" an application-ready signer');
+            'the offline install did not return the test device key needed to make "$owner" an application-ready signer',
+          );
         }
         try {
           final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
@@ -648,7 +787,8 @@ class NomosTestHarness {
           // signer route. Preserve their old harness behaviour, while keeping
           // every refusal from a current package fatal.
           if (!error.toString().contains(
-              "no active installed law declares domain '__nomos_application_home_v1'")) {
+                "no active installed law declares domain '__nomos_application_home_v1'",
+              )) {
             rethrow;
           }
         }
@@ -732,8 +872,19 @@ class NomosTestHarness {
           // application-ready.
         }
       }
-      phase(
-          'ready — session "$workspace" connected (law ${(info['lawHashes'] as List?)?.isNotEmpty == true ? (info['lawHashes'] as List).first.toString().substring(0, 12) : "installed"})');
+      final installedHashes =
+          ((info['lawHashes'] as List?) ?? const [])
+              .map((hash) => hash.toString())
+              .where((hash) => hash.isNotEmpty)
+              .toList();
+      final sessionLaw =
+          installedHashes.isEmpty
+              ? 'installed'
+              : (birthsApplicationHome
+                  ? installedHashes.last
+                  : installedHashes.first)
+                  .substring(0, 12);
+      phase('ready — session "$workspace" connected (law $sessionLaw)');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
       // silently works in tests and only refuses in production when the app connects its second
@@ -743,58 +894,66 @@ class NomosTestHarness {
       // single-session trips. Opt out with `decoySession: false` (please don't).
       if (decoySession && !birthsApplicationHome) {
         await _phased(
-            phase: 'decoy: connect the decoy session',
-            workspace: _decoyWorkspace,
-            awaiting: 'connect',
-            timeout: phaseTimeout ?? connectTimeout,
-            onDiagnostic: onDiagnostic,
-            run: () async => plane.connect(
-                  cloud: 'https://offline.invalid',
-                  workspace: _decoyWorkspace,
-                  session: _decoyWorkspace,
-                  clientId: '$clientId-decoy',
-                  allowUnborn: true,
-                  restoreFrom: base64Encode(await File(snapshot).readAsBytes()),
-                ));
-      }
-      final harness = NomosTestHarness._(plane.session(workspace), workspace,
-          transport, workdir, onDiagnostic, [workspace],
-          devicePublics: {
-            if (info['devicePublic'] != null)
-              workspace: info['devicePublic'].toString(),
-          },
-          deviceSecrets: {
-            if (info['deviceSecret'] != null)
-              workspace: info['deviceSecret'].toString(),
-          },
-          frameworkHash: info['frameworkHash']?.toString(),
-          lawHashes: {
-            workspace: ((info['lawHashes'] as List?) ?? const [])
-                .map((e) => e.toString())
-                .toList()
-          },
-          snapshots: {
-            workspace: base64Encode(await File(snapshot).readAsBytes())
-          },
-          installLane: _InstallLane(
-              node: node,
-              useInRepoScript: useInRepoScript,
-              inRepoScript: resolvedHelper,
-              githolonCmd: githolonCmd,
-              runtimeDir: effectiveRuntimeDir,
-              clientId: clientId),
-          phaseTimeout: phaseTimeout,
-          cloudRestartLane: _CloudRestartLane(
-            entry: entry,
-            node: node,
+          phase: 'decoy: connect the decoy session',
+          workspace: _decoyWorkspace,
+          awaiting: 'connect',
+          timeout: phaseTimeout ?? connectTimeout,
+          onDiagnostic: onDiagnostic,
+          run: () async => plane.connect(
             cloud: 'https://offline.invalid',
-            authToken: '',
-            authorSecret: info['deviceSecret']?.toString() ?? '',
-            clientId: clientId,
-            resolveFrom: resolveFrom,
-            environment: runnerEnvironment,
+            workspace: _decoyWorkspace,
+            session: _decoyWorkspace,
+            clientId: '$clientId-decoy',
+            allowUnborn: true,
+            restoreFrom: base64Encode(await File(snapshot).readAsBytes()),
           ),
-          homeWorkspace: workspace);
+        );
+      }
+      final harness = NomosTestHarness._(
+        plane.session(workspace),
+        workspace,
+        transport,
+        workdir,
+        onDiagnostic,
+        [workspace],
+        devicePublics: {
+          if (info['devicePublic'] != null)
+            workspace: info['devicePublic'].toString(),
+        },
+        deviceSecrets: {
+          if (info['deviceSecret'] != null)
+            workspace: info['deviceSecret'].toString(),
+        },
+        frameworkHash: info['frameworkHash']?.toString(),
+        lawHashes: {
+          workspace: ((info['lawHashes'] as List?) ?? const [])
+              .map((e) => e.toString())
+              .toList(),
+        },
+        snapshots: {
+          workspace: base64Encode(await File(snapshot).readAsBytes()),
+        },
+        installLane: _InstallLane(
+          node: node,
+          useInRepoScript: useInRepoScript,
+          inRepoScript: resolvedHelper,
+          githolonCmd: githolonCmd,
+          runtimeDir: effectiveRuntimeDir,
+          clientId: clientId,
+        ),
+        phaseTimeout: phaseTimeout,
+        cloudRestartLane: _CloudRestartLane(
+          entry: entry,
+          node: node,
+          cloud: 'https://offline.invalid',
+          authToken: '',
+          authorSecret: info['deviceSecret']?.toString() ?? '',
+          clientId: clientId,
+          resolveFrom: resolveFrom,
+          environment: runnerEnvironment,
+        ),
+        homeWorkspace: workspace,
+      );
       if (autoTearDown && registerTearDown != null) {
         registerTearDown(harness.dispose);
       }
@@ -844,19 +1003,23 @@ class NomosTestHarness {
   }) async {
     if (workspaces.isEmpty) {
       throw NomosTestHarnessException(
-          'no workspaces — pass { workspaceName: [build/<name>.deploy.json] } for each colocated workspace');
+        'no workspaces — pass { workspaceName: [build/<name>.deploy.json] } for each colocated workspace',
+      );
     }
     for (final e in workspaces.entries) {
       if (e.value.isEmpty) {
         throw NomosTestHarnessException(
-            'workspace "${e.key}" has no deployJsonPaths — pass its build/<name>.deploy.json');
+          'workspace "${e.key}" has no deployJsonPaths — pass its build/<name>.deploy.json',
+        );
       }
     }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final effectiveRuntimeDir = runtimeDir ??
+        Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
-        Platform.environment['NOMOS_OFFLINE_RUNTIME'];
+        Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
+        await _sourceCandidateRuntime(entry);
     final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
     final resolvedHelper = installHelper ??
         (File(adjacentInstaller).existsSync()
@@ -882,27 +1045,29 @@ class NomosTestHarness {
       for (final e in workspaces.entries) {
         final snap = '${workdir.path}/${e.key}.bin';
         final info = await _phased(
-            phase: '1: offline law install ${++_i}/${workspaces.length}',
+          phase: '1: offline law install ${++_i}/${workspaces.length}',
+          workspace: e.key,
+          awaiting: useInRepoScript
+              ? 'offline-install.ts'
+              : 'githolon harness-install',
+          timeout: phaseTimeout ?? _kInstallDeadline,
+          onDiagnostic: onDiagnostic,
+          likelyCauses: const [
+            'a cold npx download of githolon (pre-warm with any `githolon` run)',
+            'a very large law package folding through the offline gate — raise phaseTimeout',
+          ],
+          run: () => _runInstall(
+            node: node,
+            useInRepoScript: useInRepoScript,
+            inRepoScript: resolvedHelper,
+            githolonCmd: githolonCmd,
+            deployJsonPaths: e.value,
             workspace: e.key,
-            awaiting: useInRepoScript
-                ? 'offline-install.ts'
-                : 'githolon harness-install',
-            timeout: phaseTimeout ?? _kInstallDeadline,
+            snapshot: snap,
+            runtimeDir: effectiveRuntimeDir,
             onDiagnostic: onDiagnostic,
-            likelyCauses: const [
-              'a cold npx download of githolon (pre-warm with any `githolon` run)',
-              'a very large law package folding through the offline gate — raise phaseTimeout',
-            ],
-            run: () => _runInstall(
-                node: node,
-                useInRepoScript: useInRepoScript,
-                inRepoScript: resolvedHelper,
-                githolonCmd: githolonCmd,
-                deployJsonPaths: e.value,
-                workspace: e.key,
-                snapshot: snap,
-                runtimeDir: effectiveRuntimeDir,
-                onDiagnostic: onDiagnostic));
+          ),
+        );
         snapshots[e.key] = snap;
         lawHashesByWs[e.key] = ((info['lawHashes'] as List?) ?? const [])
             .map((x) => x.toString())
@@ -923,64 +1088,68 @@ class NomosTestHarness {
         if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m');
       };
       transport = await _phased(
-          phase: '2: spawn the node runner (${workspaces.length} workspace(s))',
-          awaiting: 'Process.start($node)',
-          timeout: phaseTimeout ?? _kSpawnDeadline,
+        phase: '2: spawn the node runner (${workspaces.length} workspace(s))',
+        awaiting: 'Process.start($node)',
+        timeout: phaseTimeout ?? _kSpawnDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () => NodeRunnerTransport.start(
+          entry: entry,
+          resolveFrom: resolveFrom,
+          node: node,
+          environment: {
+            'NOMOS_OFFLINE': '1',
+            'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
+            if (planeTestRootPublic != null)
+              'NOMOS_TEST_K_ROOT_PUBLIC': planeTestRootPublic,
+            if (planeTestRootSecret != null)
+              'NOMOS_TEST_ROOT_SECRET': planeTestRootSecret,
+            if (effectiveRuntimeDir != null)
+              'NOMOS_OFFLINE_RUNTIME': effectiveRuntimeDir,
+          },
           onDiagnostic: onDiagnostic,
-          run: () => NodeRunnerTransport.start(
-                entry: entry,
-                resolveFrom: resolveFrom,
-                node: node,
-                environment: {
-                  'NOMOS_OFFLINE': '1',
-                  'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
-                  if (planeTestRootPublic != null)
-                    'NOMOS_TEST_K_ROOT_PUBLIC': planeTestRootPublic,
-                  if (planeTestRootSecret != null)
-                    'NOMOS_TEST_ROOT_SECRET': planeTestRootSecret,
-                  if (effectiveRuntimeDir != null)
-                    'NOMOS_OFFLINE_RUNTIME': effectiveRuntimeDir,
-                },
-                onDiagnostic: onDiagnostic,
-              ));
+        ),
+      );
       final bridge = NomosBridge(transport!);
       await _phased(
-          phase: '2: runner ready',
-          awaiting: "event:'ready'",
-          timeout: phaseTimeout ?? readyTimeout,
-          onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
-            'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
-          ],
-          run: () => bridge.ready);
+        phase: '2: runner ready',
+        awaiting: "event:'ready'",
+        timeout: phaseTimeout ?? readyTimeout,
+        onDiagnostic: onDiagnostic,
+        likelyCauses: const [
+          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
+          'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
+        ],
+        run: () => bridge.ready,
+      );
 
       // 3. connect one SESSION per workspace, each restoring its OWN snapshot — LOCAL-ONLY (no cloud;
       //    these are local githolons on the device plane, offline by nature).
       final snapshotB64 = <String, String>{};
       var _n = 0;
       for (final e in workspaces.entries) {
-        snapshotB64[e.key] =
-            base64Encode(await File(snapshots[e.key]!).readAsBytes());
+        snapshotB64[e.key] = base64Encode(
+          await File(snapshots[e.key]!).readAsBytes(),
+        );
         await _phased(
-            phase: '3: connect session ${++_n}/${workspaces.length}',
+          phase: '3: connect session ${++_n}/${workspaces.length}',
+          workspace: e.key,
+          awaiting: 'connect',
+          timeout: phaseTimeout ?? connectTimeout,
+          onDiagnostic: onDiagnostic,
+          likelyCauses: const [
+            'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
+            'run with onDiagnostic to see where the runner blocked',
+          ],
+          run: () => bridge.connect(
             workspace: e.key,
-            awaiting: 'connect',
-            timeout: phaseTimeout ?? connectTimeout,
-            onDiagnostic: onDiagnostic,
-            likelyCauses: const [
-              'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
-              'run with onDiagnostic to see where the runner blocked',
-            ],
-            run: () => bridge.connect(
-                  workspace: e.key,
-                  session: e.key,
-                  clientId: '$clientId-${e.key}',
-                  restoreFrom: snapshotB64[e.key],
-                  allowUnborn: true,
-                  // signed with the install-lane harness device (era-0 self-serve birth ceremony key)
-                  authorSecret: installDeviceSecrets[e.key],
-                ));
+            session: e.key,
+            clientId: '$clientId-${e.key}',
+            restoreFrom: snapshotB64[e.key],
+            allowUnborn: true,
+            // signed with the install-lane harness device (era-0 self-serve birth ceremony key)
+            authorSecret: installDeviceSecrets[e.key],
+          ),
+        );
       }
       phase('cluster: ${workspaces.length} session(s) connected');
 
@@ -993,60 +1162,71 @@ class NomosTestHarness {
       for (final ws in deviceKeyed) {
         if (!workspaces.containsKey(ws)) {
           throw NomosTestHarnessException(
-              'deviceKeyed names "$ws" but it is not a workspace of this cluster — '
-              'workspaces: ${workspaces.keys.toList()}');
+            'deviceKeyed names "$ws" but it is not a workspace of this cluster — '
+            'workspaces: ${workspaces.keys.toList()}',
+          );
         }
         final kp = await _phased(
-            phase: '3b: device keygen',
-            workspace: ws,
-            awaiting: 'authorKeygen',
-            timeout: phaseTimeout ?? _kOtherDeadline,
-            onDiagnostic: onDiagnostic,
-            run: () => bridge.session(ws).authorKeygen());
+          phase: '3b: device keygen',
+          workspace: ws,
+          awaiting: 'authorKeygen',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () => bridge.session(ws).authorKeygen(),
+        );
         devicePublics[ws] = (kp['public'] ?? '').toString();
         deviceSecretsKeyed[ws] = (kp['secret'] ?? '').toString();
         await _phased(
-            phase: "3b: keyed reconnect of '$ws'",
+          phase: "3b: keyed reconnect of '$ws'",
+          workspace: ws,
+          awaiting: 'connect',
+          timeout: phaseTimeout ?? connectTimeout,
+          onDiagnostic: onDiagnostic,
+          likelyCauses: const [
+            'the runner never answered the re-connect of an already-open session — '
+                'update @githolon/client (the session re-open is an atomic replace)',
+            'a large ledger re-fold on the re-mount — raise connectTimeout/phaseTimeout',
+          ],
+          run: () => bridge.connect(
             workspace: ws,
-            awaiting: 'connect',
-            timeout: phaseTimeout ?? connectTimeout,
-            onDiagnostic: onDiagnostic,
-            likelyCauses: const [
-              'the runner never answered the re-connect of an already-open session — '
-                  'update @githolon/client (the session re-open is an atomic replace)',
-              'a large ledger re-fold on the re-mount — raise connectTimeout/phaseTimeout',
-            ],
-            run: () => bridge.connect(
-                  workspace: ws,
-                  session: ws,
-                  clientId: '$clientId-$ws',
-                  restoreFrom: snapshotB64[ws],
-                  authorSecret: (kp['secret'] ?? '').toString(),
-                  allowUnborn: true,
-                ));
+            session: ws,
+            clientId: '$clientId-$ws',
+            restoreFrom: snapshotB64[ws],
+            authorSecret: (kp['secret'] ?? '').toString(),
+            allowUnborn: true,
+          ),
+        );
       }
       if (deviceKeyed.isNotEmpty) {
         phase(
-            'cluster: ${deviceKeyed.length} device-keyed session(s) re-opened');
+          'cluster: ${deviceKeyed.length} device-keyed session(s) re-opened',
+        );
       }
 
       final names = workspaces.keys.toList();
       final harness = NomosTestHarness._(
-          bridge, names.first, transport, workdir, onDiagnostic, names,
-          // install-lane harness devices under; explicit deviceKeyed re-opens override for their ws
-          devicePublics: {...installDevicePublics, ...devicePublics},
-          deviceSecrets: {...installDeviceSecrets, ...deviceSecretsKeyed},
-          frameworkHash: frameworkHash,
-          lawHashes: lawHashesByWs,
-          snapshots: snapshotB64,
-          installLane: _InstallLane(
-              node: node,
-              useInRepoScript: useInRepoScript,
-              inRepoScript: resolvedHelper,
-              githolonCmd: githolonCmd,
-              runtimeDir: effectiveRuntimeDir,
-              clientId: clientId),
-          phaseTimeout: phaseTimeout);
+        bridge,
+        names.first,
+        transport,
+        workdir,
+        onDiagnostic,
+        names,
+        // install-lane harness devices under; explicit deviceKeyed re-opens override for their ws
+        devicePublics: {...installDevicePublics, ...devicePublics},
+        deviceSecrets: {...installDeviceSecrets, ...deviceSecretsKeyed},
+        frameworkHash: frameworkHash,
+        lawHashes: lawHashesByWs,
+        snapshots: snapshotB64,
+        installLane: _InstallLane(
+          node: node,
+          useInRepoScript: useInRepoScript,
+          inRepoScript: resolvedHelper,
+          githolonCmd: githolonCmd,
+          runtimeDir: effectiveRuntimeDir,
+          clientId: clientId,
+        ),
+        phaseTimeout: phaseTimeout,
+      );
       if (autoTearDown && registerTearDown != null) {
         registerTearDown(harness.dispose);
       }
@@ -1104,15 +1284,19 @@ class NomosTestHarness {
   }) async {
     if (deployJsonPaths.isEmpty) {
       throw NomosTestHarnessException(
-          'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits');
+        'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits',
+      );
     }
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final bareUid =
         subject.startsWith('user:') ? subject.substring(5) : subject;
     final http = HttpClient();
-    Future<Map<String, Object?>> post(String path, Object? body,
-        {Map<String, String> headers = const {}}) async {
+    Future<Map<String, Object?>> post(
+      String path,
+      Object? body, {
+      Map<String, String> headers = const {},
+    }) async {
       final req = await http.postUrl(Uri.parse('${cloud.origin}$path'));
       req.headers.set('content-type', 'application/json');
       req.headers.set('x-nomos-principal', bareUid);
@@ -1125,7 +1309,23 @@ class NomosTestHarness {
       final decoded = (jsonDecode(text) as Map).cast<String, Object?>();
       if (resp.statusCode >= 300 || decoded['ok'] == false) {
         throw NomosTestHarnessException(
-            'cloudBound setup: POST $path → ${resp.statusCode}: ${text.substring(0, text.length.clamp(0, 400))}');
+          'cloudBound setup: POST $path → ${resp.statusCode}: ${text.substring(0, text.length.clamp(0, 400))}',
+        );
+      }
+      return decoded;
+    }
+
+    Future<Map<String, Object?>> get(String path) async {
+      final req = await http.getUrl(Uri.parse('${cloud.origin}$path'));
+      req.headers.set('x-nomos-principal', bareUid);
+      if (authToken != null) req.headers.set('x-nomos-auth', authToken);
+      final resp = await req.close();
+      final text = await resp.transform(utf8.decoder).join();
+      final decoded = (jsonDecode(text) as Map).cast<String, Object?>();
+      if (resp.statusCode >= 300 || decoded['ok'] == false) {
+        throw NomosTestHarnessException(
+          'cloudBound setup: GET $path → ${resp.statusCode}: ${text.substring(0, text.length.clamp(0, 400))}',
+        );
       }
       return decoded;
     }
@@ -1143,86 +1343,141 @@ class NomosTestHarness {
           <({String domain, String directive, String path})>[];
       final lawHashes = <String>[];
       await _phased(
-          phase: '1/6: boot the born platform + deploy law on the test cloud',
-          workspace: platformWorkspace,
-          awaiting: 'POST /v2/workspaces + /domains',
-          timeout: phaseTimeout ?? _kInstallDeadline,
-          onDiagnostic: onDiagnostic,
-          run: () async {
-            Map<String, Object?> created;
-            try {
-              created = await post('/v2/workspaces/$platformWorkspace', null);
-            } on NomosTestHarnessException catch (e) {
-              if (e.message.contains('unborn')) {
-                throw NomosTestHarnessException(
-                    "cloudBound: platform '$platformWorkspace' is UNBORN on the test cloud — era-0 has no "
-                    "host-side create. Start the cloud with it: "
-                    "NomosTestCloud.start(serverEntry: …, platform: '$platformWorkspace') "
-                    '(the dev server births it at boot via its operator lane).');
-              }
-              rethrow;
+        phase: '1/6: boot the born platform + deploy law on the test cloud',
+        workspace: platformWorkspace,
+        awaiting: 'POST /v2/workspaces + /domains',
+        timeout: phaseTimeout ?? _kInstallDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () async {
+          Map<String, Object?> created;
+          try {
+            created = await post('/v2/workspaces/$platformWorkspace', null);
+          } on NomosTestHarnessException catch (e) {
+            if (e.message.contains('unborn')) {
+              throw NomosTestHarnessException(
+                "cloudBound: platform '$platformWorkspace' is UNBORN on the test cloud — era-0 has no "
+                "host-side create. Start the cloud with it: "
+                "NomosTestCloud.start(serverEntry: …, platform: '$platformWorkspace') "
+                '(the dev server births it at boot via its operator lane).',
+              );
             }
-            frameworkHash =
-                ((created['controller'] as Map?)?['domainHash'])?.toString();
-            for (final p in deployJsonPaths) {
-              final body = await File(p).readAsString();
+            rethrow;
+          }
+          frameworkHash =
+              ((created['controller'] as Map?)?['domainHash'])?.toString();
+          final existing = await get(
+            '/v2/workspaces/$platformWorkspace/domains',
+          );
+          final heldHashes = <String>{
+            ...((existing['domains'] as List?) ?? const [])
+                .map((row) => (row as Map?)?['domainHash']?.toString())
+                .whereType<String>()
+                .where((hash) => hash.isNotEmpty),
+            ...(((existing['currentLaw'] as Map?) ?? const {})
+                .values
+                .map((hash) => hash?.toString())
+                .whereType<String>()
+                .where((hash) => hash.isNotEmpty)),
+          };
+          for (final p in deployJsonPaths) {
+            final body = await File(p).readAsString();
+            final deploy = (jsonDecode(body) as Map);
+            final summary = (deploy['summary'] as Map?);
+            final h = summary?['domainHash']?.toString();
+            // A composed test application is normally installed atomically by the bootstrap operator.
+            // The signed-in scenario participant must not need installDomain authority merely because the
+            // harness was also handed those artifacts for routes, hashes and child-law selection.
+            if (h == null || h.isEmpty || !heldHashes.contains(h)) {
               await post('/v2/workspaces/$platformWorkspace/domains', body);
-              final deploy = (jsonDecode(body) as Map);
-              final summary = (deploy['summary'] as Map?);
-              final h = summary?['domainHash']?.toString();
-              if (h != null && h.isNotEmpty) lawHashes.add(h);
-              final openapi = deploy['openapi'] as Map?;
-              final pathSets = <Map>[
-                (openapi?['paths'] as Map?) ?? const {},
-                (((openapi?['x-nomos-framework-routes'] as Map?)?['paths'])
-                        as Map?) ??
-                    const {},
-              ];
-              for (final paths in pathSets) {
-                for (final entry in paths.entries) {
-                  final post = (entry.value as Map?)?['post'] as Map?;
-                  final route = post?['x-nomos'] as Map?;
-                  final domain = route?['domain']?.toString() ?? '';
-                  final directive = route?['directiveId']?.toString() ?? '';
-                  if (domain.isNotEmpty && directive.isNotEmpty) {
-                    frameworkPostRoutes.add((
-                      domain: domain,
-                      directive: directive,
-                      path: entry.key.toString(),
-                    ));
-                  }
+              if (h != null && h.isNotEmpty) heldHashes.add(h);
+            }
+            if (h != null && h.isNotEmpty) lawHashes.add(h);
+            final openapi = deploy['openapi'] as Map?;
+            final pathSets = <Map>[
+              (openapi?['paths'] as Map?) ?? const {},
+              (((openapi?['x-nomos-framework-routes'] as Map?)?['paths'])
+                      as Map?) ??
+                  const {},
+            ];
+            for (final paths in pathSets) {
+              for (final entry in paths.entries) {
+                final post = (entry.value as Map?)?['post'] as Map?;
+                final route = post?['x-nomos'] as Map?;
+                final domain = route?['domain']?.toString() ?? '';
+                final directive = route?['directiveId']?.toString() ?? '';
+                if (domain.isNotEmpty && directive.isNotEmpty) {
+                  frameworkPostRoutes.add((
+                    domain: domain,
+                    directive: directive,
+                    path: entry.key.toString(),
+                  ));
                 }
               }
             }
-          });
+          }
+        },
+      );
       if (frameworkHash == null || frameworkHash!.isEmpty) {
         throw NomosTestHarnessException(
-            'cloudBound: the test cloud returned no controller.domainHash — cannot run the birth ceremony (frameworkHash unknown)');
+          'cloudBound: the test cloud returned no controller.domainHash — cannot run the birth ceremony (frameworkHash unknown)',
+        );
       }
       if (lawHashes.isEmpty) {
         throw NomosTestHarnessException(
-            'cloudBound: no deploy.json carried a summary.domainHash — cannot run the birth ceremony (lawHash unknown)');
+          'cloudBound: no deploy.json carried a summary.domainHash — cannot run the birth ceremony (lawHash unknown)',
+        );
       }
       final birthRoutes = frameworkPostRoutes
-          .where((route) =>
-              route.directive == 'nomosInternalBirthReceivingGroup7c1f5e')
+          .where(
+            (route) =>
+                route.directive == 'nomosInternalBirthReceivingGroup7c1f5e',
+          )
           .toSet()
           .toList();
       if (birthRoutes.length != 1) {
         throw NomosTestHarnessException(
-            'cloudBound: the deployed package must expose exactly one framework receiving-group route; found ${birthRoutes.length}');
+          'cloudBound: the deployed package must expose exactly one framework receiving-group route; found ${birthRoutes.length}',
+        );
       }
       final applicationHomeDomain = birthRoutes.single.domain;
       final birthReceivingGroupPath = birthRoutes.single.path;
+      // A composed application has two distinct laws at this seam:
+      //   * the parent's CURRENT control law authors enrollFirstDevice + the birth offer;
+      //   * the application's final PAYLOAD package is the law installed into the born receiving group.
+      // Treating those as one law clones platform/control state into the user's home. The ordered package
+      // set is the executable form of the application's reference-before-payload arcs: the final artifact is
+      // therefore the explicit child law, even though it is deliberately only staged on the parent.
+      final parentDomains = await get(
+        '/v2/workspaces/$platformWorkspace/domains',
+      );
+      final currentLaw =
+          (parentDomains['currentLaw'] as Map?)?.cast<String, Object?>() ??
+              const <String, Object?>{};
+      final controlHomeLawHash =
+          currentLaw[applicationHomeDomain]?.toString() ?? '';
+      if (controlHomeLawHash.isEmpty) {
+        throw NomosTestHarnessException(
+          "cloudBound: application/home control domain '$applicationHomeDomain' has no current law on '$platformWorkspace'",
+        );
+      }
+      if (!lawHashes.contains(controlHomeLawHash)) {
+        throw NomosTestHarnessException(
+          "cloudBound: current application/home control law '$controlHomeLawHash' was not among the packages this scenario deployed",
+        );
+      }
+      final applicationHomeLawHash = lawHashes.last;
       final enrollmentRoutes = frameworkPostRoutes
-          .where((route) =>
-              route.directive == 'enrollFirstDevice' &&
-              route.domain == applicationHomeDomain)
+          .where(
+            (route) =>
+                route.directive == 'enrollFirstDevice' &&
+                route.domain == applicationHomeDomain,
+          )
           .toSet()
           .toList();
       if (enrollmentRoutes.length != 1) {
         throw NomosTestHarnessException(
-            "cloudBound: application/home domain '$applicationHomeDomain' must expose exactly one semantic enrollFirstDevice route; found ${enrollmentRoutes.length}");
+          "cloudBound: application/home domain '$applicationHomeDomain' must expose exactly one semantic enrollFirstDevice route; found ${enrollmentRoutes.length}",
+        );
       }
       final enrollFirstDevicePath = enrollmentRoutes.single.path;
       // 2/6 — the LOCAL engine plane, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
@@ -1244,15 +1499,19 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
-            final request = await http
-                .getUrl(Uri.parse('${cloud.origin}/v1/runtime/holon.wasm'));
+            final request = await http.getUrl(
+              Uri.parse('${cloud.origin}/v1/runtime/holon.wasm'),
+            );
             final response = await request.close();
-            final bytes = await response
-                .fold<List<int>>(<int>[], (all, chunk) => all..addAll(chunk));
+            final bytes = await response.fold<List<int>>(
+              <int>[],
+              (all, chunk) => all..addAll(chunk),
+            );
             if (response.statusCode != HttpStatus.ok || bytes.length < 1024) {
               throw NomosTestHarnessException(
-                  'cloudBound: could not pin the client kernel before going offline '
-                  '(status ${response.statusCode}, ${bytes.length} bytes)');
+                'cloudBound: could not pin the client kernel before going offline '
+                '(status ${response.statusCode}, ${bytes.length} bytes)',
+              );
             }
             await File(localWasm).writeAsBytes(bytes, flush: true);
           },
@@ -1265,82 +1524,90 @@ class NomosTestHarness {
         'NOMOS_LOCAL_WASM': localWasm,
       };
       transport = await _phased(
-          phase: '2/6: spawn the node runner (cloud-bound)',
-          awaiting: 'Process.start($node)',
-          timeout: phaseTimeout ?? _kSpawnDeadline,
+        phase: '2/6: spawn the node runner (cloud-bound)',
+        awaiting: 'Process.start($node)',
+        timeout: phaseTimeout ?? _kSpawnDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () => NodeRunnerTransport.start(
+          entry: entry,
+          resolveFrom: resolveFrom,
+          node: node,
+          environment: runnerEnvironment,
           onDiagnostic: onDiagnostic,
-          run: () => NodeRunnerTransport.start(
-              entry: entry,
-              resolveFrom: resolveFrom,
-              node: node,
-              environment: runnerEnvironment,
-              onDiagnostic: onDiagnostic));
+        ),
+      );
       final plane = NomosBridge(transport!);
       await _phased(
-          phase: '3/6: runner ready',
-          awaiting: "event:'ready'",
-          timeout: phaseTimeout ?? readyTimeout,
-          onDiagnostic: onDiagnostic,
-          run: () => plane.ready);
+        phase: '3/6: runner ready',
+        awaiting: "event:'ready'",
+        timeout: phaseTimeout ?? readyTimeout,
+        onDiagnostic: onDiagnostic,
+        run: () => plane.ready,
+      );
       // 4/6 — THE ERA-0 DEVICE CEREMONY (the WARRANTED onboarding lane, exactly production's shape): mint the
       //       owner's device key in the LOCAL kernel, get an IdP token from the dev cloud's test IdP
       //       (device-bound: nonce == the device keyHash), and enrol the FIRST DEVICE against the platform's
       //       on-chain AuthProvider (enrollFirstDevice — no admin in the loop). The platform is WARRANTED, so
       //       plain unsigned enrolment refuses by design; this is the one first-device door.
       final device = await _phased(
-          phase:
-              '4/6: device ceremony (keygen → dev-IdP token → enrollFirstDevice)',
-          workspace: platformWorkspace,
-          awaiting: 'authorKeygen + /dev/mint-token + enrollFirstDevice',
-          timeout: phaseTimeout ?? _kInstallDeadline,
-          onDiagnostic: onDiagnostic,
-          run: () async {
-            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open a
-            // SCRATCH session on an unborn name (allowUnborn ⇒ an empty local holon; the pull-miss is
-            // tolerated): a PRIVATE platform (declared read caps — co2's shape) refuses an
-            // unauthenticated ledger clone, and the ceremony never needs the platform's ledger anyway
-            // (its writes go over the HTTP gateway below).
-            await plane.connect(
-              cloud: cloud.origin,
-              workspace: '$clientId-onboard-scratch',
-              session: '$clientId-onboard-scratch',
-              clientId: '$clientId-onboard',
-              allowUnborn: true,
+        phase:
+            '4/6: device ceremony (keygen → dev-IdP token → enrollFirstDevice)',
+        workspace: platformWorkspace,
+        awaiting: 'authorKeygen + /dev/mint-token + enrollFirstDevice',
+        timeout: phaseTimeout ?? _kInstallDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () async {
+          // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open a
+          // SCRATCH session on an unborn name (allowUnborn ⇒ an empty local holon; the pull-miss is
+          // tolerated): a PRIVATE platform (declared read caps — co2's shape) refuses an
+          // unauthenticated ledger clone, and the ceremony never needs the platform's ledger anyway
+          // (its writes go over the HTTP gateway below).
+          await plane.connect(
+            cloud: cloud.origin,
+            workspace: '$clientId-onboard-scratch',
+            session: '$clientId-onboard-scratch',
+            clientId: '$clientId-onboard',
+            allowUnborn: true,
+          );
+          final kp = await plane.authorKeygen();
+          final publicB64 = (kp['public'] ?? '').toString();
+          final secret = (kp['secret'] ?? '').toString();
+          if (publicB64.isEmpty || secret.isEmpty) {
+            throw NomosTestHarnessException(
+              'cloudBound: authorKeygen returned no device key',
             );
-            final kp = await plane.authorKeygen();
-            final publicB64 = (kp['public'] ?? '').toString();
-            final secret = (kp['secret'] ?? '').toString();
-            if (publicB64.isEmpty || secret.isEmpty) {
-              throw NomosTestHarnessException(
-                  'cloudBound: authorKeygen returned no device key');
-            }
-            final keyHash = sha256.convert(base64Decode(publicB64)).toString();
-            final minted = await post(
-                '/dev/mint-token', {'sub': bareUid, 'nonce': keyHash});
-            final idpToken = (minted['token'] ?? '').toString();
-            final issuer = (minted['issuer'] ?? '').toString();
-            if (idpToken.isEmpty || issuer.isEmpty) {
-              throw NomosTestHarnessException(
-                  'cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
-            }
-            // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
-            // its authority the dev-IdP token. enrollFirstDevice SEEDS it as the user's SignerDelegation, so
-            // birthHome's offer-effect assembles a WELL-FORMED chain [home_cert, u_delegation, …platform…].
-            // WITHOUT it the platform holds no delegation for the owner, the assembly falls to the
-            // no-delegation branch, the platform_cert lands in the delegation slot, and the home refuses at
-            // its OWN verify door ("home cert founder != delegation cert founder").
-            final delegationCert = await plane.mintKeylessDelegation({
-              'user': subject,
-              'deviceKey': publicB64,
-              'childName': _receivingGroupNameOf(subject),
-              'parentId': platformWorkspace,
-              'verifiedVia': issuer,
-              'idpToken': idpToken,
-              'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
-              'epoch': 0,
-            }, secret);
-            await post(
-                '/v2/workspaces/$platformWorkspace$enrollFirstDevicePath', {
+          }
+          final keyHash = sha256.convert(base64Decode(publicB64)).toString();
+          final minted = await post('/dev/mint-token', {
+            'sub': bareUid,
+            'nonce': keyHash,
+          });
+          final idpToken = (minted['token'] ?? '').toString();
+          final issuer = (minted['issuer'] ?? '').toString();
+          if (idpToken.isEmpty || issuer.isEmpty) {
+            throw NomosTestHarnessException(
+              'cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?',
+            );
+          }
+          // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
+          // its authority the dev-IdP token. enrollFirstDevice SEEDS it as the user's SignerDelegation, so
+          // birthHome's offer-effect assembles a WELL-FORMED chain [home_cert, u_delegation, …platform…].
+          // WITHOUT it the platform holds no delegation for the owner, the assembly falls to the
+          // no-delegation branch, the platform_cert lands in the delegation slot, and the home refuses at
+          // its OWN verify door ("home cert founder != delegation cert founder").
+          final delegationCert = await plane.mintKeylessDelegation({
+            'user': subject,
+            'deviceKey': publicB64,
+            'childName': _receivingGroupNameOf(subject),
+            'parentId': platformWorkspace,
+            'verifiedVia': issuer,
+            'idpToken': idpToken,
+            'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
+            'epoch': 0,
+          }, secret);
+          await post(
+            '/v2/workspaces/$platformWorkspace$enrollFirstDevicePath',
+            {
               'keyHash': keyHash,
               'verifiedVia': issuer,
               'validFromEpoch': 0,
@@ -1350,86 +1617,89 @@ class NomosTestHarness {
               'authorSecret': secret,
               'delegationCert': jsonEncode(delegationCert),
             },
-                headers: {
-                  'x-nomos-auth': idpToken
-                });
-            return (
-              publicB64: publicB64,
-              secret: secret,
-              keyHash: keyHash,
-              idpToken: idpToken
-            );
-          });
+            headers: {'x-nomos-auth': idpToken},
+          );
+          return (
+            publicB64: publicB64,
+            secret: secret,
+            keyHash: keyHash,
+            idpToken: idpToken,
+          );
+        },
+      );
       // 5/6 — THE HOME CEREMONY, remotely: the platform's own gateway offer births the home (the ONE
       //       control-plane contact; the app lane below never touches the platform again). The offer carries
       //       the device-signed homeCert + the owner's device keyHash (the home's genesis ENROLS it, so the
       //       born home is SIGNER-READY — it can birth its own estates/catalogues from intent 0).
       String? home;
       await _phased(
-          phase: '5/6: remote home-birth ceremony (attested)',
-          workspace: platformWorkspace,
-          awaiting:
-              'POST /v2/workspaces/$platformWorkspace$birthReceivingGroupPath',
-          timeout: phaseTimeout ?? _kInstallDeadline,
-          onDiagnostic: onDiagnostic,
-          run: () async {
-            final homeName = _receivingGroupNameOf(subject);
-            final homeCert = await plane.signBirthCert({
-              'child': homeName,
-              'founder': subject,
-              // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries the
-              // dev-IdP token, so the gate resolves a VERIFIED founder.
-              'verified': true,
-              'parentKey': device.publicB64,
-              'parentId': platformWorkspace,
-              'epoch': 0,
-            }, device.secret);
-            final out = await post(
-                '/v2/workspaces/$platformWorkspace$birthReceivingGroupPath', {
+        phase: '5/6: remote home-birth ceremony (attested)',
+        workspace: platformWorkspace,
+        awaiting:
+            'POST /v2/workspaces/$platformWorkspace$birthReceivingGroupPath',
+        timeout: phaseTimeout ?? _kInstallDeadline,
+        onDiagnostic: onDiagnostic,
+        run: () async {
+          final homeName = _receivingGroupNameOf(subject);
+          final homeCert = await plane.signBirthCert({
+            'child': homeName,
+            'founder': subject,
+            // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries the
+            // dev-IdP token, so the gate resolves a VERIFIED founder.
+            'verified': true,
+            'parentKey': device.publicB64,
+            'parentId': platformWorkspace,
+            'epoch': 0,
+          }, device.secret);
+          final out = await post(
+            '/v2/workspaces/$platformWorkspace$birthReceivingGroupPath',
+            {
               'owner': subject,
               'ownerKeyHash': device.keyHash,
               'frameworkHash': frameworkHash,
-              'lawHash': lawHashes.first,
+              'lawHash': applicationHomeLawHash,
               'bornAt': DateTime.now().toUtc().toIso8601String(),
               'homeCert': jsonEncode(homeCert),
               'actor': subject,
               'authorSecret': device.secret,
             },
-                headers: {
-                  'x-nomos-auth': device.idpToken
-                });
-            final born = (out['born'] as List?) ?? const [];
-            final bornNames = born
-                .map((b) => (b as Map)['workspace']?.toString())
-                .whereType<String>()
-                .where((w) => w.isNotEmpty)
-                .toList();
-            home = bornNames.isEmpty ? null : bornNames.first;
-            if (home == null) {
-              final outcomes = jsonEncode(out['birthOutcomes'] ?? const []);
-              throw NomosTestHarnessException(
-                  'cloudBound: birthHome admitted but spawned no home (birthOutcomes=$outcomes)');
-            }
-          });
+            headers: {'x-nomos-auth': device.idpToken},
+          );
+          final born = (out['born'] as List?) ?? const [];
+          final bornNames = born
+              .map((b) => (b as Map)['workspace']?.toString())
+              .whereType<String>()
+              .where((w) => w.isNotEmpty)
+              .toList();
+          home = bornNames.isEmpty ? null : bornNames.first;
+          if (home == null) {
+            final outcomes = jsonEncode(out['birthOutcomes'] ?? const []);
+            throw NomosTestHarnessException(
+              'cloudBound: birthHome admitted but spawned no home (birthOutcomes=$outcomes)',
+            );
+          }
+        },
+      );
       // 6/6 — mount the born home as a normal cloud-bound session (clone from the test cloud).
       await _phased(
-          phase: '6/6: mount the born home',
-          workspace: home,
-          awaiting: 'connect(cloud:, workspace: $home)',
-          timeout: phaseTimeout ?? connectTimeout,
-          onDiagnostic: onDiagnostic,
-          run: () => plane.connect(
-                cloud: cloud.origin,
-                workspace: home!,
-                clientId: clientId,
-                // A PRIVATE home (declared read caps — co2's shape) serves its ledger only to a VERIFIED
-                // principal: ride the caller's token when given, else the dev-IdP token the ceremony minted.
-                authToken: authToken ?? device.idpToken,
-                // The home was born WARRANTED with THIS device enrolled in its genesis (ownerKeyHash) —
-                // connect with the same key so every write is signed and the home's own `.births()` offers
-                // (estates/catalogues) are device-attested (the client signs the birth cert automatically).
-                authorSecret: device.secret,
-              ));
+        phase: '6/6: mount the born home',
+        workspace: home,
+        awaiting: 'connect(cloud:, workspace: $home)',
+        timeout: phaseTimeout ?? connectTimeout,
+        onDiagnostic: onDiagnostic,
+        run: () => plane.connect(
+          cloud: cloud.origin,
+          workspace: home!,
+          clientId: clientId,
+          // A PRIVATE home (declared read caps — co2's shape) serves its ledger only to a VERIFIED
+          // principal: ride the caller's token when given, else the dev-IdP token the ceremony minted.
+          authToken: authToken ?? device.idpToken,
+          // The home was born WARRANTED with THIS device enrolled in its genesis (ownerKeyHash) —
+          // connect with the same key so every write is signed and the home's own `.births()` offers
+          // (estates/catalogues) are device-attested (the client signs the birth cert automatically).
+          authorSecret: device.secret,
+        ),
+      );
       // NO DECOY on a cloudBound harness: the app is genuinely multi-workspace (the home plus every
       // locally-born child), so the plane is never sole-session — the decoy the offline  harness
       // needs (to break single-session inference) would just be a spurious local-only workspace here.
@@ -1448,7 +1718,11 @@ class NomosTestHarness {
         devicePublics: {home!: device.publicB64},
         deviceSecrets: {home!: device.secret},
         frameworkHash: frameworkHash,
-        lawHashes: {home!: lawHashes},
+        lawHashes: {
+          // The born receiving group contains the payload package, not every reference-only package which
+          // happened to be available on its parent during the ceremony.
+          home!: [applicationHomeLawHash],
+        },
         phaseTimeout: phaseTimeout,
         cloudRestartLane: _CloudRestartLane(
           entry: entry,
@@ -1489,9 +1763,10 @@ class NomosTestHarness {
   /// each locally-born child's remote custody BEFORE that child's own sync converges against it. Repeats
   /// until every session reports neither `pushFailed` nor `stillAhead`, or [timeout] (then throws with the
   /// per-workspace last verdicts). Returns the final sync result per workspace.
-  Future<Map<String, Map<String, Object?>>> converge(
-      {Duration timeout = const Duration(seconds: 120),
-      List<String>? workspaces}) async {
+  Future<Map<String, Map<String, Object?>>> converge({
+    Duration timeout = const Duration(seconds: 120),
+    List<String>? workspaces,
+  }) async {
     // Every LIVE session on the plane (not the harness's construction-time list — a locally-born child
     // acquired after construction must converge too), PARENT-FIRST: the home syncs before its children, so
     // its birth offer-effect creates each child's remote custody BEFORE that child pushes its own writes.
@@ -1528,8 +1803,9 @@ class NomosTestHarness {
       if (pending.isEmpty) break;
       if (DateTime.now().isAfter(deadline)) {
         throw NomosTestHarnessException(
-            'converge: ${pending.length} workspace(s) did not converge within ${timeout.inSeconds}s — '
-            '${pending.map((w) => '$w: ${jsonEncode(last[w] ?? {})}').join('; ')}');
+          'converge: ${pending.length} workspace(s) did not converge within ${timeout.inSeconds}s — '
+          '${pending.map((w) => '$w: ${jsonEncode(last[w] ?? {})}').join('; ')}',
+        );
       }
       await Future<void>.delayed(const Duration(milliseconds: 500));
     }
@@ -1552,22 +1828,24 @@ class NomosTestHarness {
     final snap = _snapshots[workspace];
     if (snap == null) {
       throw NomosTestHarnessException(
-          'resetWorkspaceCustody("$workspace"): no seed snapshot held for this workspace — '
-          'seeded workspaces: ${_snapshots.keys.toList()}');
+        'resetWorkspaceCustody("$workspace"): no seed snapshot held for this workspace — '
+        'seeded workspaces: ${_snapshots.keys.toList()}',
+      );
     }
     await _phased(
-        phase: 'resetWorkspaceCustody: reconnect from seed snapshot',
+      phase: 'resetWorkspaceCustody: reconnect from seed snapshot',
+      workspace: workspace,
+      awaiting: 'connect',
+      timeout: _phaseTimeout ?? const Duration(seconds: 60),
+      onDiagnostic: _onDiagnostic,
+      run: () => _plane.connect(
         workspace: workspace,
-        awaiting: 'connect',
-        timeout: _phaseTimeout ?? const Duration(seconds: 60),
-        onDiagnostic: _onDiagnostic,
-        run: () => _plane.connect(
-              workspace: workspace,
-              session: workspace,
-              clientId: '${_installLane?.clientId ?? 'test-runner'}-$workspace',
-              restoreFrom: snap,
-              allowUnborn: true,
-            ));
+        session: workspace,
+        clientId: '${_installLane?.clientId ?? 'test-runner'}-$workspace',
+        restoreFrom: snap,
+        allowUnborn: true,
+      ),
+    );
   }
 
   /// SEED a NEW workspace on this plane from `build/<name>.deploy.json` law packages — the
@@ -1580,49 +1858,54 @@ class NomosTestHarness {
     final lane = _installLane;
     if (lane == null) {
       throw NomosTestHarnessException(
-          'seedWorkspaceFromDeployJson: this harness holds no install-lane config');
+        'seedWorkspaceFromDeployJson: this harness holds no install-lane config',
+      );
     }
     if (deployJsonPaths.isEmpty) {
       throw NomosTestHarnessException(
-          'seedWorkspaceFromDeployJson("$workspace"): pass the build/<name>.deploy.json paths');
+        'seedWorkspaceFromDeployJson("$workspace"): pass the build/<name>.deploy.json paths',
+      );
     }
     final snap = '${_workdir.path}/$workspace.bin';
     final info = await _phased(
-        phase: 'seed: offline law install',
+      phase: 'seed: offline law install',
+      workspace: workspace,
+      awaiting: lane.useInRepoScript
+          ? 'offline-install.ts'
+          : 'githolon harness-install',
+      timeout: _phaseTimeout ?? _kInstallDeadline,
+      onDiagnostic: _onDiagnostic,
+      run: () => _runInstall(
+        node: lane.node,
+        useInRepoScript: lane.useInRepoScript,
+        inRepoScript: lane.inRepoScript,
+        githolonCmd: lane.githolonCmd,
+        deployJsonPaths: deployJsonPaths,
         workspace: workspace,
-        awaiting: lane.useInRepoScript
-            ? 'offline-install.ts'
-            : 'githolon harness-install',
-        timeout: _phaseTimeout ?? _kInstallDeadline,
+        snapshot: snap,
+        runtimeDir: lane.runtimeDir,
         onDiagnostic: _onDiagnostic,
-        run: () => _runInstall(
-            node: lane.node,
-            useInRepoScript: lane.useInRepoScript,
-            inRepoScript: lane.inRepoScript,
-            githolonCmd: lane.githolonCmd,
-            deployJsonPaths: deployJsonPaths,
-            workspace: workspace,
-            snapshot: snap,
-            runtimeDir: lane.runtimeDir,
-            onDiagnostic: _onDiagnostic));
+      ),
+    );
     final b64 = base64Encode(await File(snap).readAsBytes());
     _snapshots[workspace] = b64;
     _lawHashes[workspace] = ((info['lawHashes'] as List?) ?? const [])
         .map((e) => e.toString())
         .toList();
     await _phased(
-        phase: 'seed: connect session',
+      phase: 'seed: connect session',
+      workspace: workspace,
+      awaiting: 'connect',
+      timeout: _phaseTimeout ?? const Duration(seconds: 60),
+      onDiagnostic: _onDiagnostic,
+      run: () => _plane.connect(
         workspace: workspace,
-        awaiting: 'connect',
-        timeout: _phaseTimeout ?? const Duration(seconds: 60),
-        onDiagnostic: _onDiagnostic,
-        run: () => _plane.connect(
-              workspace: workspace,
-              session: workspace,
-              clientId: '${lane.clientId}-$workspace',
-              restoreFrom: b64,
-              allowUnborn: true,
-            ));
+        session: workspace,
+        clientId: '${lane.clientId}-$workspace',
+        restoreFrom: b64,
+        allowUnborn: true,
+      ),
+    );
     if (!_sessionNames.contains(workspace)) _sessionNames.add(workspace);
     return _plane.session(workspace);
   }
@@ -1631,20 +1914,24 @@ class NomosTestHarness {
   /// for "why does my dispatch refuse". Throws [NomosTestHarnessException] naming the ACTIVE
   /// domain keys when absent. (For the full shape check use
   /// `harness.session(ws).assertCompatible(XClient.interface)`.)
-  Future<void> assertDomainInstalled(
-      {required String workspace, required String domain}) async {
+  Future<void> assertDomainInstalled({
+    required String workspace,
+    required String domain,
+  }) async {
     final offer = await _phased(
-        phase: 'assertDomainInstalled: read the interface offer',
-        workspace: workspace,
-        awaiting: 'interfaceOffer',
-        timeout: _phaseTimeout ?? _kOtherDeadline,
-        onDiagnostic: _onDiagnostic,
-        run: () => _plane.session(workspace).interfaceOffer());
+      phase: 'assertDomainInstalled: read the interface offer',
+      workspace: workspace,
+      awaiting: 'interfaceOffer',
+      timeout: _phaseTimeout ?? _kOtherDeadline,
+      onDiagnostic: _onDiagnostic,
+      run: () => _plane.session(workspace).interfaceOffer(),
+    );
     final keys = (offer?.keys.toList() ?? const <String>[])..sort();
     if (!keys.contains(domain)) {
       throw NomosTestHarnessException(
-          'domain "$domain" is NOT installed on workspace "$workspace" — active domains: '
-          '${keys.isEmpty ? '(none observable — no on-ledger interface yet, or law truly not deployed)' : keys.join(', ')}');
+        'domain "$domain" is NOT installed on workspace "$workspace" — active domains: '
+        '${keys.isEmpty ? '(none observable — no on-ledger interface yet, or law truly not deployed)' : keys.join(', ')}',
+      );
     }
   }
 
@@ -1658,7 +1945,8 @@ class NomosTestHarness {
     final connected = _plane.connectedSessions;
     if (!connected.contains(workspace)) {
       throw NomosTestHarnessException(
-          'snapshotWorkspace("$workspace"): no connected session; connected workspaces: $connected');
+        'snapshotWorkspace("$workspace"): no connected session; connected workspaces: $connected',
+      );
     }
     final s = _plane.session(workspace);
     return _phased(
@@ -1686,19 +1974,24 @@ class NomosTestHarness {
   Future<PlaneSnapshot> snapshotPlane() async {
     final out = <String, WorkspaceSnapshot>{};
     final connected = _plane.connectedSessions.where(
-        (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'));
+      (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
+    );
     for (final ws in connected) {
       out[ws] = await snapshotWorkspace(ws);
     }
     return PlaneSnapshot(
-        workspaces: Map.unmodifiable(out), capturedAt: DateTime.now().toUtc());
+      workspaces: Map.unmodifiable(out),
+      capturedAt: DateTime.now().toUtc(),
+    );
   }
 
   /// Restore a workspace FROM a [WorkspaceSnapshot] — re-open its session on this plane from the snapshot's
   /// LOCAL CUSTODY (no network clone), replacing the resident holon. The workspace need not currently be a
   /// session (a fresh restore is allowed); its name is taken from [snapshot] unless [into] overrides it.
-  Future<NomosSession> restoreWorkspace(WorkspaceSnapshot snapshot,
-      {String? into}) async {
+  Future<NomosSession> restoreWorkspace(
+    WorkspaceSnapshot snapshot, {
+    String? into,
+  }) async {
     final ws = into ?? snapshot.workspace;
     await _phased(
       phase: 'restoreWorkspace',
@@ -1732,19 +2025,22 @@ class NomosTestHarness {
   Future<void> restart() async {
     if (_disposed) {
       throw NomosTestHarnessException(
-          'restart(): this test device has already been disposed');
+        'restart(): this test device has already been disposed',
+      );
     }
     final lane = _cloudRestartLane;
     final home = homeWorkspace;
     if (lane == null || home == null) {
       throw NomosTestHarnessException(
-          'restart() requires a harness with one primary application session');
+        'restart() requires a harness with one primary application session',
+      );
     }
 
     final oldPlane = _plane;
     final targets = oldPlane.connectedSessions
         .where(
-            (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'))
+          (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
+        )
         .toList();
     if (targets.remove(home)) targets.insert(0, home);
     final snapshots = <String, String>{};
@@ -1831,19 +2127,22 @@ class NomosTestHarness {
   Future<void> reinstall() async {
     if (_disposed) {
       throw NomosTestHarnessException(
-          'reinstall(): this test device has already been disposed');
+        'reinstall(): this test device has already been disposed',
+      );
     }
     final lane = _cloudRestartLane;
     final home = homeWorkspace;
     if (lane == null || home == null || testCloud == null) {
       throw NomosTestHarnessException(
-          'reinstall() requires a connected scenario with remote custody');
+        'reinstall() requires a connected scenario with remote custody',
+      );
     }
 
     final oldPlane = _plane;
     final targets = oldPlane.connectedSessions
         .where(
-            (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'))
+          (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
+        )
         .toList();
     if (targets.remove(home)) targets.insert(0, home);
     for (final ws in targets) {
@@ -1890,31 +2189,41 @@ class NomosTestHarness {
     _disposed = true;
     final f = _onDiagnostic;
     if (f != null)
-      f('[nomos-test-harness] phase dispose (≤${(_phaseTimeout ?? _kOtherDeadline).inSeconds}s) …');
+      f(
+        '[nomos-test-harness] phase dispose (≤${(_phaseTimeout ?? _kOtherDeadline).inSeconds}s) …',
+      );
     try {
       // The bridge owns the transport's one message subscription and every watch controller. Closing the
       // transport first makes its incoming stream wait on consumers that can no longer receive their
       // unwatch/done messages—a deterministic teardown deadlock in reactive Flutter tests.
-      await _plane.dispose().timeout(_phaseTimeout ?? _kOtherDeadline,
-          onTimeout: () => throw HarnessPhaseTimeout(
+      await _plane.dispose().timeout(
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
               phase: 'dispose: close bridge watches',
               workspace: workspace,
               elapsed: _phaseTimeout ?? _kOtherDeadline,
-              awaiting: 'NomosBridge.dispose'));
+              awaiting: 'NomosBridge.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
-          '[nomos-test-harness] bridge dispose error (continuing to runner cleanup): $e');
+        '[nomos-test-harness] bridge dispose error (continuing to runner cleanup): $e',
+      );
     }
     try {
-      await _transport.dispose().timeout(_phaseTimeout ?? _kOtherDeadline,
-          onTimeout: () => throw HarnessPhaseTimeout(
+      await _transport.dispose().timeout(
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
               phase: 'dispose: stop the node runner',
               workspace: workspace,
               elapsed: _phaseTimeout ?? _kOtherDeadline,
-              awaiting: 'NodeRunnerTransport.dispose'));
+              awaiting: 'NodeRunnerTransport.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
-          '[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e');
+        '[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e',
+      );
     }
     try {
       if (await _workdir.exists()) await _workdir.delete(recursive: true);
@@ -1971,7 +2280,8 @@ class NomosTestHarness {
           .toList();
       if (tokens.isEmpty) {
         throw NomosTestHarnessException(
-            'no install helper resolved — pass installHelper: (an offline-install.ts path, or a githolon command)');
+          'no install helper resolved — pass installHelper: (an offline-install.ts path, or a githolon command)',
+        );
       }
       executable = tokens.first;
       args = [...tokens.skip(1), 'harness-install', ...common];
@@ -1986,7 +2296,8 @@ class NomosTestHarness {
     }
     if (r.exitCode != 0) {
       throw NomosTestHarnessException(
-          'offline law install for "$workspace" failed (exit ${r.exitCode}): ${err.isEmpty ? "(no stderr)" : err}');
+        'offline law install for "$workspace" failed (exit ${r.exitCode}): ${err.isEmpty ? "(no stderr)" : err}',
+      );
     }
     // The helper prints one JSON line on success; verify it before spawning the runner.
     final out = (r.stdout as String).trim();
@@ -1998,7 +2309,8 @@ class NomosTestHarness {
     } catch (_) {}
     if (decoded['ok'] != true || !File(snapshot).existsSync()) {
       throw NomosTestHarnessException(
-          'offline law install produced no snapshot (stdout: ${out.isEmpty ? "(empty)" : out})');
+        'offline law install produced no snapshot (stdout: ${out.isEmpty ? "(empty)" : out})',
+      );
     }
     // { ok, snapshot, workspace, lawHashes, frameworkHash } — the caller keeps lawHashes/frameworkHash so a
     // `.births()` directive can be driven (its genesis installs the framework + law by hash).
@@ -2042,17 +2354,20 @@ class NomosTestHarness {
       '@githolon/client/runner/node-entry.ts',
     ]) {
       final r = await Process.run(
-        node,
-        ['-p', "require.resolve('$entry')"],
-        workingDirectory: from,
-      );
+          node,
+          [
+            '-p',
+            "require.resolve('$entry')",
+          ],
+          workingDirectory: from);
       final out = (r.stdout as String).trim();
       if (r.exitCode == 0 && out.isNotEmpty) return out;
     }
     throw NomosTestHarnessException(
-        'the Nomos release contains no bundled node runner and '
-        '@githolon/client/runner/node-entry.{mjs,ts} cannot be resolved from $from. '
-        'Reinstall nomos_client, or pass nodeEntry: only when developing Nomos itself.');
+      'the Nomos release contains no bundled node runner and '
+      '@githolon/client/runner/node-entry.{mjs,ts} cannot be resolved from $from. '
+      'Reinstall nomos_client, or pass nodeEntry: only when developing Nomos itself.',
+    );
   }
 }
 
@@ -2091,8 +2406,10 @@ class WorkspaceSnapshot {
         head: (j['head'] ?? '') as String,
         lawHashes:
             ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
-        capturedAt: DateTime.parse((j['capturedAt'] ??
-            DateTime.now().toUtc().toIso8601String()) as String),
+        capturedAt: DateTime.parse(
+          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
+              as String,
+        ),
       );
 
   @override
@@ -2115,12 +2432,15 @@ class PlaneSnapshot {
       };
 
   factory PlaneSnapshot.fromJson(Map<String, Object?> j) => PlaneSnapshot(
-        workspaces: ((j['workspaces'] as Map?) ?? const {}).map((k, v) =>
-            MapEntry(
-                '$k',
-                WorkspaceSnapshot.fromJson(
-                    (v as Map).cast<String, Object?>()))),
-        capturedAt: DateTime.parse((j['capturedAt'] ??
-            DateTime.now().toUtc().toIso8601String()) as String),
+        workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
+          (k, v) => MapEntry(
+            '$k',
+            WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
+          ),
+        ),
+        capturedAt: DateTime.parse(
+          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
+              as String,
+        ),
       );
 }