@githolon/dsl 0.102.4 → 0.103.0

package/src/codegen_dart_client.ts

@@ -35,7 +35,7 @@ import {
   OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
   type AggregateHandle,
 } from "./aggregate.js";
-import type { Field } from "./fields.js";
+import { isSha256DigestSchema, type Field } from "./fields.js";
 import type { Directive } from "./directive.js";
 import type { QueryDecl } from "./query.js";
 import type { DomainModule } from "./codegen_dart.js";
@@ -52,42 +52,90 @@ import {
 } from "./codegen_dart.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
-import { autoStampFields, domainEncryptionMap, type EncDomainMap, type InterfaceAggShape } from "./codegen_ts.js";
-import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
+import {
+  autoStampFields,
+  domainEncryptionMap,
+  type EncDomainMap,
+  type InterfaceAggShape,
+} from "./codegen_ts.js";
+import {
+  isNamespacedAggregate,
+  qualifyReadProjectionType,
+} from "./read_projection_namespace.js";
 import { isBusinessIntent } from "./intent.js";
 import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
 import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.js";
 import { deriveDirectiveRecordTarget } from "./workspace_routing.js";
-import { buildNomosDescribeModel, type NomosDescribeModel } from "./describe_model.js";
+import {
+  buildNomosDescribeModel,
+  type NomosDescribeModel,
+} from "./describe_model.js";
 import { assertModelClientMemberAvailable } from "./generated_client_names.js";
 import { ownedRecordActionDirectiveId } from "./framework/owned_custody.js";
 import { contractTypeName } from "./contract.js";
 import { admitsNull } from "./null_meta.js";
 
-const camel = (s: string) => s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
-const lcFirst = (s: string) => (s.length ? s[0]!.toLowerCase() + s.slice(1) : s);
+const camel = (s: string) =>
+  s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
+const lcFirst = (s: string) =>
+  s.length ? s[0]!.toLowerCase() + s.slice(1) : s;
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AnyDirective = Directive<any>;
 
 /** Dart reserved words that can't be method names — suffixed `_` if one slips through. */
 const DART_RESERVED = new Set([
-  "assert", "break", "case", "catch", "class", "const", "continue", "default", "do", "else", "enum",
-  "extends", "false", "final", "finally", "for", "if", "in", "is", "new", "null", "rethrow", "return",
-  "super", "switch", "this", "throw", "true", "try", "var", "void", "while", "with", "dynamic",
+  "assert",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "default",
+  "do",
+  "else",
+  "enum",
+  "extends",
+  "false",
+  "final",
+  "finally",
+  "for",
+  "if",
+  "in",
+  "is",
+  "new",
+  "null",
+  "rethrow",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "var",
+  "void",
+  "while",
+  "with",
+  "dynamic",
 ]);
 const safeMethod = (s: string): string => (DART_RESERVED.has(s) ? `${s}_` : s);
 
 /** `guestbook` / `tool-library` / `Tool Library` → `GuestbookClient` / `ToolLibraryClient`. */
-export const dartClientClassName = (domain: string): string => `${cap(camel(domain))}Client`;
+export const dartClientClassName = (domain: string): string =>
+  `${cap(camel(domain))}Client`;
 /** `guestbook` → `guestbookDomainHash` — the Dart top-level const (lowerCamel by lint). */
-export const dartHashConstName = (fileBase: string): string => `${lcFirst(camel(fileBase))}DomainHash`;
+export const dartHashConstName = (fileBase: string): string =>
+  `${lcFirst(camel(fileBase))}DomainHash`;
 
 /** `todo-nomos` → `todoNomosInterfaceJson` — the baked structural-interface JSON const (#72). */
-export const interfaceConstNameDart = (fileBase: string): string => `${lcFirst(camel(fileBase))}InterfaceJson`;
+export const interfaceConstNameDart = (fileBase: string): string =>
+  `${lcFirst(camel(fileBase))}InterfaceJson`;
 
 /** `todo-nomos` → `todoNomosCompatJson` — the baked client/law compat manifest JSON const (§5). */
-export const compatConstNameDart = (fileBase: string): string => `${lcFirst(camel(fileBase))}CompatJson`;
+export const compatConstNameDart = (fileBase: string): string =>
+  `${lcFirst(camel(fileBase))}CompatJson`;
 
 /** Emit a Dart RAW triple-quoted string literal of an object's JSON (the interface is JSON-only
  *  data — no `'`/`$`/backslash escaping concerns under `r'''…'''`; JSON never contains `'''`). */
@@ -95,7 +143,8 @@ function dartRawJson(value: unknown): string {
   return `r'''${JSON.stringify(value)}'''`;
 }
 
-const dartStr = (s: string) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+const dartStr = (s: string) =>
+  `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
 
 /** The Dart param type for a query index key. Aggregate relations keep their canonical typed ref. */
 function dartKeyType(agg: AggregateHandle | undefined, key: string): string {
@@ -104,12 +153,17 @@ function dartKeyType(agg: AggregateHandle | undefined, key: string): string {
   if (f && (f.kind === "int" || f.kind === "counter")) return "int";
   if (f?.kind === "ref") {
     if (f.foreignRef !== undefined) {
-      const target = f.foreignRef.targetIsContract === true
-        ? contractTypeName(f.foreignRef.targetAggregateId)
-        : concreteClassName(f.foreignRef.targetAggregateId);
+      const target =
+        f.foreignRef.targetIsContract === true
+          ? contractTypeName(f.foreignRef.targetAggregateId)
+          : concreteClassName(f.foreignRef.targetAggregateId);
       return `ForeignRef<${target}>`;
     }
-    if (f.refAggregateId !== undefined) return `NomosRef<${concreteClassName(f.refAggregateId)}>`;
+    if (f.refAggregateId !== undefined)
+      return `NomosRef<${concreteClassName(f.refAggregateId)}>`;
+  }
+  if (f?.kind === "string" && isSha256DigestSchema(f.zod as z.ZodTypeAny)) {
+    return "Sha256Digest";
   }
   return "String";
 }
@@ -118,6 +172,12 @@ function dartKeyExpr(agg: AggregateHandle | undefined, key: string): string {
   const lead = key.includes(".") ? key.split(".")[0]! : key;
   const field = agg?.fields[lead] as Field | undefined;
   const param = dartKeyParam(key);
+  if (
+    field?.kind === "string" &&
+    isSha256DigestSchema(field.zod as z.ZodTypeAny)
+  ) {
+    return `${param}.value`;
+  }
   if (field?.kind !== "ref") return param;
   return field.foreignRef !== undefined
     ? `NmsInternalNomosRefs.id(${param}.ref)`
@@ -127,7 +187,14 @@ function dartKeyExpr(agg: AggregateHandle | undefined, key: string): string {
 /** A Dart-safe param identifier from a (possibly dotted) index key: `a.b.c` → `aBC`. */
 function dartKeyParam(key: string): string {
   const parts = key.split(".").filter((p) => p !== "");
-  const id = parts.length === 0 ? "key" : parts[0]! + parts.slice(1).map((p) => cap(p)).join("");
+  const id =
+    parts.length === 0
+      ? "key"
+      : parts[0]! +
+        parts
+          .slice(1)
+          .map((p) => cap(p))
+          .join("");
   const cleaned = id.replace(/[^A-Za-z0-9_]/g, "_");
   const safe = /^[0-9]/.test(cleaned) ? `v${cleaned}` : cleaned;
   return safeMethod(safe);
@@ -141,7 +208,7 @@ function rowToModel(model: string, rowVar: string, workspace = "_ws"): string {
 }
 
 export interface DartBridgeClientOptions {
-  /** sha256 of the built `.package.usda` — the law this client offers under. */
+  /** Content identity of the built typed USDA closure (`.law.usdz`). */
   readonly domainHash: string;
   /** This domain's STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates
    *  (read shapes, sid-keyed). Baked in as JSON so the app can negotiate shape-compatibility
@@ -193,7 +260,9 @@ export interface DartBridgeClientOptions {
    * Omit (or supply only self-owned aggregates) ⇒ NO cross-domain accessors are emitted — a package
    * whose refs are all same-domain / foreign is byte-identical to before this existed.
    */
-  readonly packageAggregateDomains?: Readonly<Record<string, { domain: string; name: string }>>;
+  readonly packageAggregateDomains?: Readonly<
+    Record<string, { domain: string; name: string }>
+  >;
   /**
    * LAYERED-PACKAGES `barrelExports: 'explicit'` MODE: the full package URIs of the per-domain TYPES
    * files this client references (e.g. `package:advl_types/src/generated/estate.dart`). Under 'explicit'
@@ -206,9 +275,13 @@ export interface DartBridgeClientOptions {
 }
 
 /** Generate the `<name>.client.dart` async bridge client for one domain module. */
-export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClientOptions): string {
+export function generateDartBridgeClient(
+  mod: DomainModule,
+  opts: DartBridgeClientOptions
+): string {
   const publicAggregates = mod.aggregates.filter(
-    (a) => (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
+    (a) =>
+      (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true
   );
   const publicAggregateIds = new Set(publicAggregates.map((a) => a.id));
   const publicDirectives = mod.applicationIntents ?? mod.directives;
@@ -216,25 +289,38 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     ...mod,
     aggregates: publicAggregates,
     directives: publicDirectives.filter(
-      (d) => (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
+      (d) =>
+        (d as { businessBirthInternal?: unknown }).businessBirthInternal !==
+        true
     ),
     ...(mod.queries === undefined
       ? {}
-      : { queries: mod.queries.filter((q) => (q as { businessBirthInternal?: unknown }).businessBirthInternal !== true) }),
+      : {
+          queries: mod.queries.filter(
+            (q) =>
+              (q as { businessBirthInternal?: unknown })
+                .businessBirthInternal !== true
+          ),
+        }),
     ...(mod.readModelAggregates === undefined
       ? {}
-      : { readModelAggregates: mod.readModelAggregates.filter((id) => publicAggregateIds.has(id)) }),
+      : {
+          readModelAggregates: mod.readModelAggregates.filter((id) =>
+            publicAggregateIds.has(id)
+          ),
+        }),
   };
   registerDartNames(mod.aggregates); // `.dartName` overrides for read-model class names in the client.
   const domain = mod.domain ?? mod.name;
   assertModelClientMemberAvailable(mod);
-  const describeModel = opts.describeModel ?? buildNomosDescribeModel([mod], domain);
-  const clientInterface = opts.interface === undefined
-    ? undefined
-    : publicClientInterface(
-        [mod],
-        { [domain]: opts.interface as unknown as DomainInterface },
-      )[domain];
+  const describeModel =
+    opts.describeModel ?? buildNomosDescribeModel([mod], domain);
+  const clientInterface =
+    opts.interface === undefined
+      ? undefined
+      : publicClientInterface([mod], {
+          [domain]: opts.interface as unknown as DomainInterface,
+        })[domain];
   const className = dartClientClassName(domain);
   const hashConst = dartHashConstName(mod.name);
   const requiresKernelFeats = requiredKernelFeatures([mod]);
@@ -247,7 +333,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   const conflictAggregateType = (aggregateId: string): string => {
     const aggregate = aggById.get(aggregateId);
     if (aggregate === undefined) {
-      throw new Error(`generated conflict policy refers to unknown aggregate '${aggregateId}' in domain '${domain}'`);
+      throw new Error(
+        `generated conflict policy refers to unknown aggregate '${aggregateId}' in domain '${domain}'`
+      );
     }
     return isNamespacedAggregate(aggregate)
       ? qualifyReadProjectionType(domain, aggregateId)
@@ -264,23 +352,37 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   // the TS client (one source of truth: `domainEncryptionMap`); requires the baked interface for the sids.
   const encMap: EncDomainMap | null =
     clientInterface !== undefined
-      ? domainEncryptionMap(mod, clientInterface as { aggregates?: Record<string, InterfaceAggShape> })
+      ? domainEncryptionMap(
+          mod,
+          clientInterface as { aggregates?: Record<string, InterfaceAggShape> }
+        )
       : null;
   const encPresent = encMap !== null;
-  const manualEncryptionPresent = encMap !== null &&
-    [...Object.values(encMap.directives), ...Object.values(encMap.reads)].some((fields) =>
-      Object.values(fields).some((field) => field.owned !== true),
+  const manualEncryptionPresent =
+    encMap !== null &&
+    [...Object.values(encMap.directives), ...Object.values(encMap.reads)].some(
+      (fields) => Object.values(fields).some((field) => field.owned !== true)
     );
   /** The distinct scopes a read of `typeId` must inject keys for (empty ⇒ nothing encrypted on it). */
   const readScopesFor = (typeId: string): { scope: string; owned?: true }[] => {
     const r = encMap?.reads?.[typeId];
     if (r === undefined) return [];
     const byKey = new Map<string, { scope: string; owned?: true }>();
-    for (const x of Object.values(r)) byKey.set(`${x.scope}:${x.owned === true}`, x);
+    for (const x of Object.values(r))
+      byKey.set(`${x.scope}:${x.owned === true}`, x);
     return [...byKey.values()].sort((a, b) => a.scope.localeCompare(b.scope));
   };
-  const scopesExpr = (scopes: readonly { scope: string; owned?: true }[]): string =>
-    `[${scopes.map((s) => `{${dartStr("scope")}: ${dartStr(s.scope)}${s.owned === true ? `, ${dartStr("owned")}: true` : ""}}`).join(", ")}]`;
+  const scopesExpr = (
+    scopes: readonly { scope: string; owned?: true }[]
+  ): string =>
+    `[${scopes
+      .map(
+        (s) =>
+          `{${dartStr("scope")}: ${dartStr(s.scope)}${
+            s.owned === true ? `, ${dartStr("owned")}: true` : ""
+          }}`
+      )
+      .join(", ")}]`;
   const needsReadPrincipal = (typeId: string): boolean => {
     const audience = aggById.get(typeId)?.audience;
     return audience?.kind === "readableBy" || audience?.kind === "owned";
@@ -288,14 +390,18 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   const keysArg = (typeId: string): string => {
     const scopes = readScopesFor(typeId);
     if (scopes.length) {
-      return `, await _readKeys(${scopesExpr(scopes)})${needsReadPrincipal(typeId) ? ", actor" : ""}`;
+      return `, await _readKeys(${scopesExpr(scopes)})${
+        needsReadPrincipal(typeId) ? ", actor" : ""
+      }`;
     }
     return needsReadPrincipal(typeId) ? ", null, actor" : "";
   };
   const pastKeysArg = (typeId: string): string => {
     const scopes = readScopesFor(typeId);
     if (scopes.length) {
-      return `, await _client._readKeys(${scopesExpr(scopes)})${needsReadPrincipal(typeId) ? ", _client.actor" : ""}`;
+      return `, await _client._readKeys(${scopesExpr(scopes)})${
+        needsReadPrincipal(typeId) ? ", _client.actor" : ""
+      }`;
     }
     return needsReadPrincipal(typeId) ? ", null, _client.actor" : "";
   };
@@ -304,23 +410,46 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   const domScopes: string[] = (() => {
     if (encMap === null) return [];
     const s = new Set<string>();
-    for (const r of Object.values(encMap.reads)) for (const f of Object.values(r)) if (f.owned !== true) s.add(f.scope);
-    for (const dir of Object.values(encMap.directives)) for (const f of Object.values(dir)) if (f.owned !== true) s.add(f.scope);
+    for (const r of Object.values(encMap.reads))
+      for (const f of Object.values(r)) if (f.owned !== true) s.add(f.scope);
+    for (const dir of Object.values(encMap.directives))
+      for (const f of Object.values(dir)) if (f.owned !== true) s.add(f.scope);
     return [...s].sort();
   })();
   const ownedScopes: string[] = (() => {
     if (encMap === null) return [];
     const scopes = new Set<string>();
-    for (const r of Object.values(encMap.reads)) for (const f of Object.values(r)) if (f.owned === true) scopes.add(f.scope);
-    for (const dir of Object.values(encMap.directives)) for (const f of Object.values(dir)) if (f.owned === true) scopes.add(f.scope);
+    for (const r of Object.values(encMap.reads))
+      for (const f of Object.values(r))
+        if (f.owned === true) scopes.add(f.scope);
+    for (const dir of Object.values(encMap.directives))
+      for (const f of Object.values(dir))
+        if (f.owned === true) scopes.add(f.scope);
     return [...scopes].sort();
   })();
   if (ownedScopes.length > 1) {
-    throw new Error(`dart codegen: owned business state in domain '${domain}' unexpectedly uses more than one framework scope`);
+    throw new Error(
+      `dart codegen: owned business state in domain '${domain}' unexpectedly uses more than one framework scope`
+    );
   }
   const ownedScope = ownedScopes[0];
 
   const methods: string[] = [];
+  const hasVersionedRefs = mod.aggregates.some((aggregate) =>
+    Object.values(aggregate.fields as Record<string, Field>).some(
+      (field) => field.versionedForeignRef !== undefined
+    )
+  );
+  if (hasVersionedRefs) {
+    methods.push(
+      `  /// Check only whether an immutable publication pin is still the stable series' current`,
+      `  /// publication. The kernel reads one compiled current pointer; it does not resolve history.`,
+      `  Future<ReferenceFreshness<TVersion>> referenceFreshness<TVersion, TSeries>(`,
+      `      VersionedNomosRef<TVersion, TSeries> reference) =>`,
+      `      bridge.checkReferenceFreshness(reference);`,
+      ``
+    );
+  }
   const pastMethods: string[] = [];
   const pastDeclarations: string[] = [];
   const conflictDeclarations: string[] = [];
@@ -328,17 +457,29 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     (mod.aggregates as AggregateHandle[])
       .filter((aggregate) => aggregate.audience?.kind === "owned")
       .map((aggregate) => {
-        const type = isNamespacedAggregate(aggregate) ? qualifyReadProjectionType(domain, aggregate.id) : aggregate.id;
-        return [type, {
-          share: ownedRecordActionDirectiveId("share", aggregate.id),
-          unshare: ownedRecordActionDirectiveId("unshare", aggregate.id),
-          transfer: ownedRecordActionDirectiveId("transfer", aggregate.id),
-        }];
-      }),
+        const type = isNamespacedAggregate(aggregate)
+          ? qualifyReadProjectionType(domain, aggregate.id)
+          : aggregate.id;
+        return [
+          type,
+          {
+            share: ownedRecordActionDirectiveId("share", aggregate.id),
+            unshare: ownedRecordActionDirectiveId("unshare", aggregate.id),
+            transfer: ownedRecordActionDirectiveId("transfer", aggregate.id),
+          },
+        ];
+      })
   );
-  const ownedActionsDart = `{${Object.entries(ownedActions).map(([type, actions]) =>
-    `${dartStr(type)}: {${Object.entries(actions).map(([action, directive]) => `${dartStr(action)}: ${dartStr(directive)}`).join(", ")}}`,
-  ).join(", ")}}`;
+  const ownedActionsDart = `{${Object.entries(ownedActions)
+    .map(
+      ([type, actions]) =>
+        `${dartStr(type)}: {${Object.entries(actions)
+          .map(
+            ([action, directive]) => `${dartStr(action)}: ${dartStr(directive)}`
+          )
+          .join(", ")}}`
+    )
+    .join(", ")}}`;
   if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
     methods.push(
       `  /// Share one record. The peer can read its history and future changes; Nomos owns the keys and policy.`,
@@ -349,28 +490,36 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       ``,
       `  /// Hand ownership, readable history and future authority for one record to another person.`,
       `  Future<NomosOfferOutcome> transfer<TAggregate>(NomosRef<TAggregate> record, String peer) => _ownedRecordAction('transfer', record, peer);`,
-      ``,
+      ``
     );
   }
 
   // THE STATIC INTERFACE DESCRIPTOR (`XClient.interface`, session_bound_clients.md asks 5/9) —
   // what this client EXPECTS of a workspace: the domain key, the law hash it compiled under, and
   // the structural interface (#72). `bind(session)` / `session.assertCompatible(...)` consume it.
-  const compatInterfaceHash = (opts.compat as { interfaceHash?: string } | undefined)?.interfaceHash;
+  const compatInterfaceHash = (
+    opts.compat as { interfaceHash?: string } | undefined
+  )?.interfaceHash;
 
   // ── directives → typed offer ──
   // A `.births()` directive (birthsChild === true) is NOT a same-workspace write — it is a signed
   // cross-workspace governance offer to a PARENT. It gets a typed `bridge.createWorkspace(...)` wrapper
   // (below), NOT an `offerOutcome`; excluded here so a frontend dev can never call it as a local write.
   const allDirs = (mod.directives as AnyDirective[]).filter(
-    (d) => d && typeof d.id === "string"
-      && typeof (d as { payloadSchema?: unknown }).payloadSchema === "object"
-      && (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
+    (d) =>
+      d &&
+      typeof d.id === "string" &&
+      typeof (d as { payloadSchema?: unknown }).payloadSchema === "object" &&
+      (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+  );
+  const birthDirs = allDirs.filter(
+    (d) => (d as { birthsChild?: boolean }).birthsChild === true
+  );
+  const dirs = allDirs.filter(
+    (d) => (d as { birthsChild?: boolean }).birthsChild !== true
   );
-  const birthDirs = allDirs.filter((d) => (d as { birthsChild?: boolean }).birthsChild === true);
-  const dirs = allDirs.filter((d) => (d as { birthsChild?: boolean }).birthsChild !== true);
   const correctionActions = dirs.filter(
-    (d) => (d as { businessBirth?: unknown }).businessBirth === undefined,
+    (d) => (d as { businessBirth?: unknown }).businessBirth === undefined
   );
   if (correctionActions.length > 0) {
     const correctionsClass = `${className}Corrections`;
@@ -378,7 +527,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     methods.push(
       `  /// Correct this principal's latest business change. The framework owns target selection and replay.`,
       `  ${correctionsClass} get corrections => ${correctionsClass}(this);`,
-      ``,
+      ``
     );
     pastDeclarations.push(
       `/// Result of a reasoned business correction. Framework intent and testimony ids remain private.`,
@@ -404,57 +553,71 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `    if (reason.trim().isEmpty) throw ArgumentError('corrections.\$kind() needs a reason');`,
       `    final result = await _client.bridge.correctMostRecent(`,
       `      kind: kind, domain: ${dartStr(domain)},`,
-      `      actions: const [${correctionActions.map((d) => dartStr(d.id)).join(", ")}],`,
+      `      actions: const [${correctionActions
+        .map((d) => dartStr(d.id))
+        .join(", ")}],`,
       `      reason: reason, domainHash: _client.domainHash, actor: _client.actor);`,
       `    return ${outcomeClass}.fromJson(result);`,
       `  }`,
       `}`,
-      ``,
+      ``
     );
   }
   for (const d of dirs) {
     const payloadClass = dartActionInputClassName(d);
-    const stamps = autoStampFields((d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema);
+    const stamps = autoStampFields(
+      (d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema
+    );
     const method = safeMethod(d.id);
     // THE AUTHORITY GATE (codegen-time): a directive carrying `.requires(relation)` is GATED — its method
     // throws MissingOfferAuthority when `actor` is null/empty, BEFORE any submit, so an actorless gated
     // offer is impossible to GENERATE (the war: the gate is structural, not just kernel-side). Secrets never
     // appear — only the actor identity (the bridge owns signing).
-    const gate = (d as { requiresRelationGate?: { relation: string } }).requiresRelationGate;
-    const gateGuard = gate !== undefined
-      ? `    if (actor == null || actor!.trim().isEmpty) {\n      throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(gate.relation)});\n    }`
-      : "";
-    const gateDoc = gate !== undefined
-      ? `  /// GATED: needs an \`actor\` (the \`${gate.relation}\` relation) — throws MissingOfferAuthority otherwise.`
-      : "";
-    // FALLBACK ATTESTATION INJECTION (co2): a directive whose law declares a foreign read (`.readsFrom(...)`)
-    // accepts pre-fetched signed envelopes as an optional `attestations:` param — the manual override when the
-    // colocation resolver can't serve the read (the source isn't mounted on the plane). The in-engine
-    // colocation path stays the default; only foreign-read directives carry the extra named param.
-    const wantAttest = (((d as { declaredForeignReads?: unknown[] }).declaredForeignReads?.length ?? 0) > 0);
-    const attNamed = wantAttest ? "List<Map<String, Object?>>? attestations" : "";
-    const attArg = wantAttest ? ", attestations: attestations" : "";
+    const gate = (d as { requiresRelationGate?: { relation: string } })
+      .requiresRelationGate;
+    const gateGuard =
+      gate !== undefined
+        ? `    if (actor == null || actor!.trim().isEmpty) {\n      throw MissingOfferAuthority(domain: ${dartStr(
+            domain
+          )}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(
+            gate.relation
+          )});\n    }`
+        : "";
+    const gateDoc =
+      gate !== undefined
+        ? `  /// GATED: needs an \`actor\` (the \`${gate.relation}\` relation) — throws MissingOfferAuthority otherwise.`
+        : "";
     // E2E SEALING (the sealing client): a directive with `.encrypted()` payload fields SEALS them via the
     // bound [keyStore] before dispatch (a missing key throws [EncryptionKeyUnavailable] — never a plaintext
     // write). One async block covers creates + mutate + gated + stamps; `seal: false` is the escape hatch.
     // THE ONE WRITE OUTCOME (architecture/nomos_ref.md): EVERY directive method returns Future<NomosOfferOutcome>
     // via the ONE lane `bridge.offerOutcome` — `outcome.created` carries every minted aggregate (each with its
     // typed `.ref`), `outcome.head` the new local head. The breaking cut: creates AND non-creates alike.
-    const createsDoc = (d as { marker?: string }).marker === "creates"
-      ? ` The LAW mints the ${(d as { aggregateId?: string }).aggregateId ?? "aggregate"} id inside the sealed intent — it rides back on \`outcome.created\` (no id in the payload, no query-after).`
-      : "";
+    const createsDoc =
+      (d as { marker?: string }).marker === "creates"
+        ? ` The LAW mints the ${
+            (d as { aggregateId?: string }).aggregateId ?? "aggregate"
+          } id inside the sealed intent — it rides back on \`outcome.created\` (no id in the payload, no query-after).`
+        : "";
     const recordInputs = dartBusinessRecordInputs(d, mod.aggregates);
     const principalField = d.businessPrincipalField;
-    const principalPrelude = principalField === undefined
-      ? []
-      : [
-          `    final nmsInternalPrincipal = actor ?? bridge.principal;`,
-          `    if (nmsInternalPrincipal == null || nmsInternalPrincipal.trim().isEmpty) {`,
-          `      throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: 'the signed-in Nomos principal');`,
-          `    }`,
-        ];
+    const principalPrelude =
+      principalField === undefined
+        ? []
+        : [
+            `    final nmsInternalPrincipal = actor ?? bridge.principal;`,
+            `    if (nmsInternalPrincipal == null || nmsInternalPrincipal.trim().isEmpty) {`,
+            `      throw MissingOfferAuthority(domain: ${dartStr(
+              domain
+            )}, directiveId: ${dartStr(
+              d.id
+            )}, requires: 'the signed-in Nomos principal');`,
+            `    }`,
+          ];
     const payloadJsonArgs = [
-      ...(principalField === undefined ? [] : ["nmsInternalPrincipal: nmsInternalPrincipal"]),
+      ...(principalField === undefined
+        ? []
+        : ["nmsInternalPrincipal: nmsInternalPrincipal"]),
       ...(recordInputs.length === 0
         ? []
         : [
@@ -462,64 +625,95 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
             "nmsInternalIdOf: (record) => NmsInternalRecordOrigins.require(record).id",
           ]),
     ];
-    const payloadJson = payloadJsonArgs.length === 0
-      ? "payload.nmsInternalToPayloadJson()"
-      : `payload.nmsInternalToPayloadJson(${payloadJsonArgs.join(", ")})`;
-    const stampsDoc = stamps.length > 0 ? `\n  /// Omitted ${stamps.map((s) => `\`${s}\``).join(" / ")} auto-stamp(s) ISO now() at offer.` : "";
+    const payloadJson =
+      payloadJsonArgs.length === 0
+        ? "payload.nmsInternalToPayloadJson()"
+        : `payload.nmsInternalToPayloadJson(${payloadJsonArgs.join(", ")})`;
+    const stampsDoc =
+      stamps.length > 0
+        ? `\n  /// Omitted ${stamps
+            .map((s) => `\`${s}\``)
+            .join(" / ")} auto-stamp(s) ISO now() at offer.`
+        : "";
     const directiveEncryption = encMap?.directives?.[d.id];
     if (directiveEncryption !== undefined) {
-      const ownedSeal = Object.values(directiveEncryption).every((field) => field.owned === true);
-      const targetAggregate = ownedSeal ? aggById.get((d as { aggregateId?: string }).aggregateId ?? "") : undefined;
-      const recordTarget = targetAggregate === undefined ? undefined : deriveDirectiveRecordTarget(d, targetAggregate);
+      const ownedSeal = Object.values(directiveEncryption).every(
+        (field) => field.owned === true
+      );
+      const targetAggregate = ownedSeal
+        ? aggById.get((d as { aggregateId?: string }).aggregateId ?? "")
+        : undefined;
+      const recordTarget =
+        targetAggregate === undefined
+          ? undefined
+          : deriveDirectiveRecordTarget(d, targetAggregate);
       if (ownedSeal && recordTarget === undefined) {
         throw new Error(
           `dart codegen: cannot derive the record targeted by encrypted owned directive '${domain}/${d.id}'. ` +
-            `Address it from one string payload field, one deterministic instance, or create it with create(Aggregate).`,
+            `Address it from one string payload field, one deterministic instance, or create it with create(Aggregate).`
         );
       }
-      const runtimeType = targetAggregate === undefined
-        ? undefined
-        : isNamespacedAggregate(targetAggregate)
+      const runtimeType =
+        targetAggregate === undefined
+          ? undefined
+          : isNamespacedAggregate(targetAggregate)
           ? qualifyReadProjectionType(domain, targetAggregate.id)
           : targetAggregate.id;
-      const recordPrelude = recordTarget === undefined || runtimeType === undefined
-        ? []
-        : recordTarget.kind === "premint"
+      const recordPrelude =
+        recordTarget === undefined || runtimeType === undefined
+          ? []
+          : recordTarget.kind === "premint"
           ? [
               `    final ownedRecordType = ${dartStr(runtimeType)};`,
               `    final ownedRecordId = await bridge.mintId(ownedRecordType);`,
               `    const ownedRecordPreMinted = true;`,
             ]
           : recordTarget.kind === "payload"
-            ? [
-                `    final ownedRecordType = ${dartStr(runtimeType)};`,
-                `    final ownedRecordId = (data[${dartStr(recordTarget.field)}] ?? '').toString();`,
-                `    const ownedRecordPreMinted = false;`,
-              ]
-            : [
-                `    final ownedRecordType = ${dartStr(runtimeType)};`,
-                `    final ownedRecordId = ${dartStr(recordTarget.id)};`,
-                `    const ownedRecordPreMinted = false;`,
-              ];
+          ? [
+              `    final ownedRecordType = ${dartStr(runtimeType)};`,
+              `    final ownedRecordId = (data[${dartStr(
+                recordTarget.field
+              )}] ?? '').toString();`,
+              `    const ownedRecordPreMinted = false;`,
+            ]
+          : [
+              `    final ownedRecordType = ${dartStr(runtimeType)};`,
+              `    final ownedRecordId = ${dartStr(recordTarget.id)};`,
+              `    const ownedRecordPreMinted = false;`,
+            ];
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}`,
-        `  /// ${ownedSeal ? "Owned content is encrypted automatically by Nomos." : "Encrypted field(s) are SEALED via the bound [keyStore] before dispatch (pass `seal: false` to skip)."}${stampsDoc}`,
+        `  /// ${
+          ownedSeal
+            ? "Owned content is encrypted automatically by Nomos."
+            : "Encrypted field(s) are SEALED via the bound [keyStore] before dispatch (pass `seal: false` to skip)."
+        }${stampsDoc}`,
         ...(gateDoc ? [gateDoc] : []),
-        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload${ownedSeal && !wantAttest ? "" : `, {${ownedSeal ? "" : "bool seal = true"}${wantAttest ? `${ownedSeal ? "" : ", "}${attNamed}` : ""}}`}) async {`,
+        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload${
+          ownedSeal ? "" : ", {bool seal = true}"
+        }) async {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
         `    final data = ${payloadJson};`,
         ...(stamps.length > 0
           ? [
               `    final now = DateTime.now().toUtc().toIso8601String();`,
-              ...stamps.map((s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`),
+              ...stamps.map(
+                (s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`
+              ),
             ]
           : []),
         ...recordPrelude,
-        `    await _sealPayload(data, ${dartStr(d.id)}, ${ownedSeal ? "true" : "seal"}${ownedSeal ? ", null, ownedRecordType, ownedRecordId, ownedRecordPreMinted" : ""});`,
-        `    return _offer(${dartStr(d.id)}, data${attArg});`,
+        `    await _sealPayload(data, ${dartStr(d.id)}, ${
+          ownedSeal ? "true" : "seal"
+        }${
+          ownedSeal
+            ? ", null, ownedRecordType, ownedRecordId, ownedRecordPreMinted"
+            : ""
+        });`,
+        `    return _offer(${dartStr(d.id)}, data);`,
         `  }`,
-        ``,
+        ``
       );
       continue;
     }
@@ -527,15 +721,15 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}${stampsDoc}`,
         ...(gateDoc ? [gateDoc] : []),
-        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload${wantAttest ? ", {" + attNamed + "}" : ""}) {`,
+        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload) {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
         `    final data = ${payloadJson};`,
         `    final now = DateTime.now().toUtc().toIso8601String();`,
         ...stamps.map((s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`),
-        `    return _offer(${dartStr(d.id)}, data${attArg});`,
+        `    return _offer(${dartStr(d.id)}, data);`,
         `  }`,
-        ``,
+        ``
       );
     } else if (gateGuard || principalPrelude.length > 0) {
       // A gated or principal-bound directive with no timestamp sugar still needs a block body
@@ -543,20 +737,20 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}`,
         gateDoc,
-        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload${wantAttest ? ", {" + attNamed + "}" : ""}) {`,
+        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload) {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
-        `    return _offer(${dartStr(d.id)}, ${payloadJson}${attArg});`,
+        `    return _offer(${dartStr(d.id)}, ${payloadJson});`,
         `  }`,
-        ``,
+        ``
       );
     } else {
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}`,
         ...(gateDoc ? [gateDoc] : []),
-        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload${wantAttest ? ", {" + attNamed + "}" : ""}) =>`,
-        `      _offer(${dartStr(d.id)}, ${payloadJson}${attArg});`,
-        ``,
+        `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload) =>`,
+        `      _offer(${dartStr(d.id)}, ${payloadJson});`,
+        ``
       );
     }
   }
@@ -569,46 +763,120 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   for (const d of birthDirs) {
     const method = safeMethod(d.id);
     const publicMethod = isBusinessIntent(d) ? method : "birth";
-    const gate = (d as { requiresRelationGate?: { relation: string } }).requiresRelationGate;
-    const businessBirth = (d as unknown as {
-      businessBirth?: { aggregateId: string; rootId: string; namespace: string; keyField: string; publicPayloadSchema: z.ZodTypeAny };
-    }).businessBirth;
+    const gate = (d as { requiresRelationGate?: { relation: string } })
+      .requiresRelationGate;
+    const businessBirth = (
+      d as unknown as {
+        businessBirth?: {
+          aggregateId: string;
+          domain: string;
+          rootId: string;
+          namespace: string;
+          keyField: string;
+          seedDirectiveId?: string;
+          genesisDirectiveIds?: readonly string[];
+          publicPayloadSchema: z.ZodTypeAny;
+        };
+      }
+    ).businessBirth;
     const payloadClass = dartActionInputClassName(d);
     if (businessBirth !== undefined) {
+      const seedDirectiveId =
+        businessBirth.seedDirectiveId ??
+        `nomosSeed${businessBirth.aggregateId.replace(/[^A-Za-z0-9]/g, "")}`;
+      const genesisDirectiveIds = businessBirth.genesisDirectiveIds ?? [
+        "enrollSigner",
+      ];
       const birthEncryption = encMap?.directives?.[d.id];
-      const ownedBirthDescriptor = birthEncryption === undefined
+      const ownedBirthDescriptor =
+        birthEncryption === undefined
+          ? undefined
+          : Object.values(birthEncryption).find(
+              (field) => field.owned === true
+            );
+      const birthAggregate = (mod.aggregates as AggregateHandle[]).find(
+        (aggregate) => aggregate.id === businessBirth.aggregateId
+      );
+      const birthRuntimeType = birthAggregate === undefined
         ? undefined
-        : Object.values(birthEncryption).find((field) => field.owned === true);
+        : isNamespacedAggregate(birthAggregate)
+          ? qualifyReadProjectionType(domain, birthAggregate.id)
+          : birthAggregate.id;
+      if (ownedBirthDescriptor !== undefined && birthRuntimeType === undefined) {
+        throw new Error(
+          `codegen: cannot derive the record identity for encrypted owned birth '${domain}/${d.id}'`
+        );
+      }
       methods.push(
         `  /// Give one ${businessBirth.aggregateId} its own durable life. Nomos owns identity, authorship,`,
         `  /// provenance, persistence and recovery; the app supplies only business facts.`,
-        `  Future<NomosRef<${concreteClassName(businessBirth.aggregateId)}>> ${publicMethod}(${payloadClass} payload) async {`,
+        `  Future<NomosRef<${concreteClassName(
+          businessBirth.aggregateId
+        )}>> ${publicMethod}(${payloadClass} payload) async {`,
         `    final principal = actor ?? bridge.principal;`,
         `    if (principal == null || principal.trim().isEmpty) {`,
-        `      throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: 'a signed-in Nomos session');`,
+        `      throw MissingOfferAuthority(domain: ${dartStr(
+          domain
+        )}, directiveId: ${dartStr(
+          d.id
+        )}, requires: 'a signed-in Nomos session');`,
         `    }`,
+        `    await _preflightOnce();`,
+        `    await _prepareCommand(${dartStr(d.id)});`,
+        ...(businessBirth.domain === domain
+          ? []
+          : [
+              `    // This parent offer synchronously runs the child genesis plan. Name that exact`,
+              `    // authenticated slice now so birth never composes an unrelated or cold domain.`,
+              `    await bridge.prepareDomain(domain: ${dartStr(
+                businessBirth.domain
+              )}, directiveId: ${dartStr(
+                seedDirectiveId
+              )}, packageHash: ${hashConst});`,
+              ...genesisDirectiveIds.map(
+                (directiveId) =>
+                  `    await bridge.prepareDomain(domain: ${dartStr(
+                    businessBirth.domain
+                  )}, directiveId: ${dartStr(
+                    directiveId
+                  )}, packageHash: ${hashConst});`
+              ),
+            ]),
         `    final data = payload.nmsInternalToPayloadJson();`,
         ...(ownedBirthDescriptor === undefined
           ? []
           : [
               `    final ownedBirthKey = await bridge.nomosOwnedBirthScopeKey(`,
-              `        ${dartStr(ownedBirthDescriptor.scope)}, ${dartStr(businessBirth.namespace)}, data[${dartStr(businessBirth.keyField)}]);`,
+              `        ${dartStr(ownedBirthDescriptor.scope)}, ${dartStr(
+                businessBirth.namespace
+              )}, data[${dartStr(businessBirth.keyField)}], ${dartStr(
+                birthRuntimeType!
+              )}, ${dartStr(businessBirth.rootId)});`,
             ]),
         ...(birthEncryption === undefined
           ? []
           : [
               `    final sealedGenesis = Map<String, dynamic>.from(data);`,
-              `    await _sealPayload(sealedGenesis, ${dartStr(d.id)}, true${ownedBirthDescriptor === undefined ? "" : ", ownedBirthKey"});`,
-              `    data[${dartStr(BUSINESS_BIRTH_SEED_PAYLOAD_FIELD)}] = jsonEncode(sealedGenesis);`,
+              `    await _sealPayload(sealedGenesis, ${dartStr(d.id)}, true${
+                ownedBirthDescriptor === undefined ? "" : ", ownedBirthKey"
+              });`,
+              `    data[${dartStr(
+                BUSINESS_BIRTH_SEED_PAYLOAD_FIELD
+              )}] = jsonEncode(sealedGenesis);`,
               ...(ownedBirthDescriptor === undefined
                 ? []
-                : [`    data[${dartStr(OWNED_KEY_PAYLOAD_FIELD)}] = ownedBirthKey.ownedKeySubject;`]),
+                : [
+                    `    data[${dartStr(
+                      OWNED_KEY_PAYLOAD_FIELD
+                    )}] = ownedBirthKey.ownedKeySubject;`,
+                  ]),
             ]),
         `    data['principal'] = principal;`,
         `    data['bornAt'] = DateTime.now().toUtc().toIso8601String();`,
         `    final outcome = await _offer(${dartStr(d.id)}, data);`,
         `    if (outcome.born.length != 1) {`,
-        `      throw StateError('birth() committed without returning exactly one born workspace');`,
+        `      throw StateError('birth() committed without returning exactly one born workspace '
+            '(born: \${outcome.born}, birthOutcomes: \${outcome.birthOutcomes}, head: \${outcome.head})');`,
         `    }`,
         ...(ownedBirthDescriptor === undefined
           ? []
@@ -620,9 +888,13 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         // Birth is a local, durable business commit. The application host's continuous custody lifecycle
         // pushes it immediately when online and retries when offline; awaiting a network round here makes
         // the supposedly offline-first business action hang behind transport availability.
-        `    return NmsInternalNomosRefs.create<${concreteClassName(businessBirth.aggregateId)}>(workspace: outcome.born.single, type: ${dartStr(businessBirth.aggregateId)}, id: ${dartStr(businessBirth.rootId)});`,
+        `    return NmsInternalNomosRefs.create<${concreteClassName(
+          businessBirth.aggregateId
+        )}>(workspace: outcome.born.single, type: ${dartStr(
+          businessBirth.aggregateId
+        )}, id: ${dartStr(businessBirth.rootId)});`,
         `  }`,
-        ``,
+        ``
       );
       continue;
     }
@@ -652,7 +924,11 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `    if (explicitParent != null && explicitParent.isNotEmpty && explicitParent != ws) {`,
       `      // LEGACY GATEWAY SHIM — the pre-session-bound cross-workspace relay, delegated unchanged.`,
       `      if (actor == null) {`,
-      `        throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: 'a requesting principal (actor) on the legacy parent-relay lane');`,
+      `        throw MissingOfferAuthority(domain: ${dartStr(
+        domain
+      )}, directiveId: ${dartStr(
+        d.id
+      )}, requires: 'a requesting principal (actor) on the legacy parent-relay lane');`,
       `      }`,
       `      final verdict = await bridge.createWorkspace(`,
       `        domain: ${dartStr(domain)},`,
@@ -679,14 +955,23 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       ...(gate !== undefined
         ? [
             `    if (effActor == null || effActor.trim().isEmpty) {`,
-            `      throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(gate.relation)});`,
+            `      throw MissingOfferAuthority(domain: ${dartStr(
+              domain
+            )}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(
+              gate.relation
+            )});`,
             `    }`,
           ]
         : []),
       `    await _preflightOnce();`,
-      `    return bridge.offerOutcome(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, payload: payload.nmsInternalToPayloadJson(), actor: effActor, domainHash: domainHash);`,
+      `    await _prepareCommand(${dartStr(d.id)});`,
+      `    return bridge.offerOutcome(domain: ${dartStr(
+        domain
+      )}, directiveId: ${dartStr(
+        d.id
+      )}, payload: payload.nmsInternalToPayloadJson(), actor: effActor, domainHash: domainHash);`,
       `  }`,
-      ``,
+      ``
     );
   }
 
@@ -694,51 +979,126 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   for (const q of (mod.queries ?? []) as QueryDecl[]) {
     const model = readModelClassName(q.returns);
     const agg = aggById.get(q.returns);
-    const params = q.key.map((k) => `required ${dartKeyType(agg, k)} ${dartKeyParam(k)}`).join(", ");
-    const argMap = `{${q.key.map((k) => `${dartStr(k)}: ${dartKeyExpr(agg, k)}`).join(", ")}}`;
+    const params = q.key
+      .map((k) => `required ${dartKeyType(agg, k)} ${dartKeyParam(k)}`)
+      .join(", ");
+    const argMap = `{${q.key
+      .map((k) => `${dartStr(k)}: ${dartKeyExpr(agg, k)}`)
+      .join(", ")}}`;
     const m = safeMethod(lcFirst(camel(q.id)));
     const qScopes = readScopesFor(q.returns);
     const qOwned = qScopes.some((scope) => scope.owned === true);
     const qPrivate = needsReadPrincipal(q.returns);
     const qScopesExpr = scopesExpr(qScopes);
+    const pageRead = qOwned
+      ? `_readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.queryPage(${dartStr(
+          q.id
+        )}, params: ${argMap}, pageSize: pageSize, cursor: cursor, keys: keys${
+          qPrivate ? ", principal: actor" : ""
+        }))`
+      : `bridge.queryPage(${dartStr(
+          q.id
+        )}, params: ${argMap}, pageSize: pageSize, cursor: cursor${
+          qScopes.length ? `, keys: await _readKeys(${qScopesExpr})` : ""
+        }${qPrivate ? ", principal: actor" : ""})`;
     methods.push(
-      `  /// Declared query \`${q.id}\` (indexed probe — routed by the read manifest).${readScopesFor(q.returns).length ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key; else they stay opaque envelopes." : ""}`,
+      `  /// Declared query \`${q.id}\` as one complete result set.${
+        readScopesFor(q.returns).length
+          ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key; else they stay opaque envelopes."
+          : ""
+      }`,
+      `  @Deprecated('Whole-result reads scale with result size; use ${m}Page().')`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      (await _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(q.id)}, ${argMap}, keys${qPrivate ? ", actor" : ""}))).map((r) => ${rowToModel(model, "r")}).toList();`
-        : `      (await bridge.query(${dartStr(q.id)}, ${argMap}${keysArg(q.returns)})).map((r) => ${rowToModel(model, "r")}).toList();`,
+        ? `      (await _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(
+            q.id
+          )}, ${argMap}, keys${
+            qPrivate ? ", actor" : ""
+          }))).map((r) => ${rowToModel(model, "r")}).toList();`
+        : `      (await bridge.query(${dartStr(q.id)}, ${argMap}${keysArg(
+            q.returns
+          )})).map((r) => ${rowToModel(model, "r")}).toList();`,
+      ``,
+      `  /// One bounded \`${q.id}\` page. The opaque [cursor] is returned unchanged by [NomosPage].`,
+      `  Future<NomosPage<${model}>> ${m}Page({${params}${
+        params ? ", " : ""
+      }int pageSize = 100, String? cursor}) async {`,
+      `    final page = await ${pageRead};`,
+      `    return NomosPage<${model}>(`,
+      `      rows: page.rows.map((r) => ${rowToModel(model, "r")}).toList(),`,
+      `      cursor: page.cursor,`,
+      `      done: page.done,`,
+      `    );`,
+      `  }`,
       ``,
       `  /// Reactive \`${q.id}\` — re-emits on every local change (cancel the subscription to stop).`,
       `  Stream<List<${model}>> watch${cap(camel(q.id))}({${params}}) =>`,
       qOwned
-        ? `      bridge.watch(${dartStr(q.id)}, ${argMap}, null${qPrivate ? ", actor" : ""}).asyncMap((_) => _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(q.id)}, ${argMap}, keys${qPrivate ? ", actor" : ""}))).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`
-        : `      bridge.watch(${dartStr(q.id)}, ${argMap}${qPrivate ? ", null, actor" : ""}).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`,
-      ``,
+        ? `      bridge.watch(${dartStr(q.id)}, ${argMap}, null${
+            qPrivate ? ", actor" : ""
+          }).asyncMap((_) => _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(
+            q.id
+          )}, ${argMap}, keys${
+            qPrivate ? ", actor" : ""
+          }))).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`
+        : `      bridge.watch(${dartStr(q.id)}, ${argMap}${
+            qPrivate ? ", null, actor" : ""
+          }).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`,
+      ``
     );
     pastMethods.push(
       `  /// Declared query \`${q.id}\` in the verified world at [moment].`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      (await _client._readWithOwnedKeys(${qScopesExpr}, (keys) => _client.bridge.queryAt(moment, ${dartStr(q.id)}, ${argMap}, keys${qPrivate ? ", _client.actor" : ""}))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
-        : `      (await _client.bridge.queryAt(moment, ${dartStr(q.id)}, ${argMap}${pastKeysArg(q.returns)})).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`,
-      ``,
+        ? `      (await _client._readWithOwnedKeys(${qScopesExpr}, (keys) => _client.bridge.queryAt(moment, ${dartStr(
+            q.id
+          )}, ${argMap}, keys${
+            qPrivate ? ", _client.actor" : ""
+          }))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
+        : `      (await _client.bridge.queryAt(moment, ${dartStr(
+            q.id
+          )}, ${argMap}${pastKeysArg(q.returns)})).map((r) => ${rowToModel(
+            model,
+            "r",
+            "_client._ws"
+          )}).toList();`,
+      ``
     );
   }
 
   // ── declared spatial indexes → typed bbox reads (lane-2 read-serving) ──
-  for (const sp of (mod.spatials ?? []) as { id: string; of: string; on: string }[]) {
+  for (const sp of (mod.spatials ?? []) as {
+    id: string;
+    of: string;
+    on: string;
+  }[]) {
     const model = readModelClassName(sp.of);
     const m = safeMethod(lcFirst(camel(sp.id)));
     methods.push(
       `  /// Declared spatial index \`${sp.id}\` — rows of \`${sp.of}\` whose \`${sp.on}\` geometry`,
       `  /// intersects [bbox] (an R*Tree probe on the local projection, never a scan).`,
       `  Future<List<${model}>> ${m}({required NomosBbox bbox}) async =>`,
-      `      (await bridge.spatialWithin(${dartStr(sp.id)}, bbox)).map((r) => ${rowToModel(model, "r")}).toList();`,
+      `      (await bridge.spatialWithin(${dartStr(
+        sp.id
+      )}, bbox)).map((r) => ${rowToModel(model, "r")}).toList();`,
       ``,
       `  /// Reactive \`${sp.id}\` — re-emits when the probe's rows change locally.`,
-      `  Stream<List<${model}>> watch${cap(camel(sp.id))}({required NomosBbox bbox}) =>`,
-      `      bridge.watchSpatial(${dartStr(sp.id)}, bbox).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`,
-      ``,
+      `  Stream<List<${model}>> watch${cap(
+        camel(sp.id)
+      )}({required NomosBbox bbox}) =>`,
+      `      bridge.watchSpatial(${dartStr(
+        sp.id
+      )}, bbox).map((rows) => rows.map((r) => ${rowToModel(
+        model,
+        "r"
+      )}).toList());`,
+      ``
     );
   }
 
@@ -750,15 +1110,33 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const groupValue = c.by == null ? "" : dartKeyExpr(aggregate, c.by);
     methods.push(
       c.by != null
-        ? `  /// Declared count \`${c.id}\` — the maintained O(1) tally per \`${c.by}\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(c.by)}) => bridge.count(${dartStr(c.id)}, ${groupValue});`
-        : `  /// Declared count \`${c.id}\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.count(${dartStr(c.id)});`,
-      ``,
+        ? `  /// Declared count \`${c.id}\` — the maintained O(1) tally per \`${
+            c.by
+          }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
+            c.by
+          )}) => bridge.count(${dartStr(c.id)}, ${groupValue});`
+        : `  /// Declared count \`${
+            c.id
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.count(${dartStr(
+            c.id
+          )});`,
+      ``
     );
     pastMethods.push(
       c.by != null
-        ? `  /// Declared count \`${c.id}\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(c.by)}) => _client.bridge.countAt(moment, ${dartStr(c.id)}, ${groupValue});`
-        : `  /// Declared count \`${c.id}\` at [moment].\n  Future<int> ${m}() => _client.bridge.countAt(moment, ${dartStr(c.id)});`,
-      ``,
+        ? `  /// Declared count \`${
+            c.id
+          }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
+            c.by
+          )}) => _client.bridge.countAt(moment, ${dartStr(
+            c.id
+          )}, ${groupValue});`
+        : `  /// Declared count \`${
+            c.id
+          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.countAt(moment, ${dartStr(
+            c.id
+          )});`,
+      ``
     );
   }
   for (const s of (mod.sums ?? []).map((raw) => finishSum(raw))) {
@@ -768,22 +1146,43 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const groupValue = s.by == null ? "" : dartKeyExpr(aggregate, s.by);
     methods.push(
       s.by != null
-        ? `  /// Declared sum \`${s.id}\` — the maintained O(1) total per \`${s.by}\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(s.by)}) => bridge.sum(${dartStr(s.id)}, ${groupValue});`
-        : `  /// Declared sum \`${s.id}\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.sum(${dartStr(s.id)});`,
-      ``,
+        ? `  /// Declared sum \`${s.id}\` — the maintained O(1) total per \`${
+            s.by
+          }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
+            s.by
+          )}) => bridge.sum(${dartStr(s.id)}, ${groupValue});`
+        : `  /// Declared sum \`${
+            s.id
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.sum(${dartStr(
+            s.id
+          )});`,
+      ``
     );
     pastMethods.push(
       s.by != null
-        ? `  /// Declared sum \`${s.id}\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(s.by)}) => _client.bridge.sumAt(moment, ${dartStr(s.id)}, ${groupValue});`
-        : `  /// Declared sum \`${s.id}\` at [moment].\n  Future<int> ${m}() => _client.bridge.sumAt(moment, ${dartStr(s.id)});`,
-      ``,
+        ? `  /// Declared sum \`${
+            s.id
+          }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
+            s.by
+          )}) => _client.bridge.sumAt(moment, ${dartStr(s.id)}, ${groupValue});`
+        : `  /// Declared sum \`${
+            s.id
+          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.sumAt(moment, ${dartStr(
+            s.id
+          )});`,
+      ``
     );
   }
 
   // ── BUSINESS MERGE CONFLICT DX: keep the heterogeneous Nomos index behind an aggregate-specific,
   // chained API. A pending conflict is a typed reference to its own `merge(...)` capability; callers
   // inspect all versions and produce a merge result rather than choosing a winner.
-  const resolverBindings = (mod as { surfacedResolvers?: import("./surfaced_lint.js").SurfacedResolverBinding[] }).surfacedResolvers ?? [];
+  const resolverBindings =
+    (
+      mod as {
+        surfacedResolvers?: import("./surfaced_lint.js").SurfacedResolverBinding[];
+      }
+    ).surfacedResolvers ?? [];
   if (resolverBindings.length > 0) {
     const conflictsClass = `${cap(camel(domain))}Conflicts`;
     const summaryClass = `${cap(camel(domain))}ConflictSummary`;
@@ -796,7 +1195,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     };
     const byAggregate = new Map<string, typeof resolverBindings>();
     for (const binding of resolverBindings) {
-      byAggregate.set(binding.aggregateId, [...(byAggregate.get(binding.aggregateId) ?? []), binding]);
+      byAggregate.set(binding.aggregateId, [
+        ...(byAggregate.get(binding.aggregateId) ?? []),
+        binding,
+      ]);
     }
     methods.push(
       `  /// Pending business merges: summary → aggregate → typed conflict → merge().`,
@@ -805,39 +1207,53 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `  /// Nomos-internal aggregate-filtered index used only by generated conflict references.`,
       `  Future<List<${rowClass}>> _pendingConflictRows(String aggregateType) async =>`,
       `      (await bridge.pendingConflictsFor(aggregateType)).map(${rowClass}.fromJson).toList();`,
-      ``,
+      ``
     );
     for (const b of resolverBindings) {
-      if (b.valuePayloadField === undefined || b.idPayloadField === undefined) continue; // probe couldn't bind — dispatch the directive method directly.
+      if (b.valuePayloadField === undefined || b.idPayloadField === undefined)
+        continue; // probe couldn't bind — dispatch the directive method directly.
       const agg = aggById.get(b.aggregateId);
       const fieldKind = (agg?.fields[b.field] as Field | undefined)?.kind;
-      const mergedType = fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
-        ? "String"
-        : fieldKind === "int"
+      const mergedType =
+        fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
+          ? "String"
+          : fieldKind === "int"
           ? "int"
           : fieldKind === "bool"
-            ? "bool"
-            : "Object?";
-      const helper = `_merge${cap(camel(concreteClassName(b.aggregateId)))}${cap(camel(b.field))}`;
+          ? "bool"
+          : "Object?";
+      const helper = `_merge${cap(
+        camel(concreteClassName(b.aggregateId))
+      )}${cap(camel(b.field))}`;
       const dir = allDirs.find((d) => d.id === b.directiveId);
-      const gate = (dir as { requiresRelationGate?: { relation: string } } | undefined)?.requiresRelationGate;
+      const gate = (
+        dir as { requiresRelationGate?: { relation: string } } | undefined
+      )?.requiresRelationGate;
       methods.push(
         `  Future<NomosOfferOutcome> ${helper}(${rowClass} conflict, ${mergedType} merged,`,
         `      {Map<String, Object?> rest = const {}}) {`,
         ...(gate !== undefined
           ? [
               `    if (actor == null || actor!.trim().isEmpty) {`,
-              `      throw MissingOfferAuthority(domain: ${dartStr(domain)}, directiveId: ${dartStr(b.directiveId)}, requires: ${dartStr(gate.relation)});`,
+              `      throw MissingOfferAuthority(domain: ${dartStr(
+                domain
+              )}, directiveId: ${dartStr(b.directiveId)}, requires: ${dartStr(
+                gate.relation
+              )});`,
               `    }`,
             ]
           : []),
-        `    final data = <String, Object?>{...rest, ${dartStr(b.idPayloadField)}: conflict.aggregateId, ${dartStr(b.valuePayloadField)}: merged};`,
-        `    return _offer(${dartStr(b.directiveId)}, data, conflictSnapshots: [<String, Object?>{`,
+        `    final data = <String, Object?>{...rest, ${dartStr(
+          b.idPayloadField
+        )}: conflict.aggregateId, ${dartStr(b.valuePayloadField)}: merged};`,
+        `    return _offer(${dartStr(
+          b.directiveId
+        )}, data, conflictSnapshots: [<String, Object?>{`,
         `      'aggregateType': conflict.aggregateType, 'aggregateId': conflict.aggregateId,`,
         `      'field': conflict.field, 'targetSchema': conflict.targetSchema, 'token': conflict.snapshot,`,
         `    }]);`,
         `  }`,
-        ``,
+        ``
       );
     }
 
@@ -895,11 +1311,14 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `      byAggregate: Map.unmodifiable(byAggregate),`,
       `    );`,
       `  }`,
-      ...[...byAggregate.keys()].map((aggregateId) =>
-        `  ${aggregateConflictsClass(aggregateId)} get ${lcFirst(camel(concreteClassName(aggregateId)))} => ${aggregateConflictsClass(aggregateId)}(_client);`,
+      ...[...byAggregate.keys()].map(
+        (aggregateId) =>
+          `  ${aggregateConflictsClass(aggregateId)} get ${lcFirst(
+            camel(concreteClassName(aggregateId))
+          )} => ${aggregateConflictsClass(aggregateId)}(_client);`
       ),
       `}`,
-      ``,
+      ``
     );
 
     for (const [aggregateId, bindings] of byAggregate) {
@@ -913,21 +1332,25 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         `  String get aggregateId;`,
         `  String get field;`,
         `}`,
-        ``,
+        ``
       );
       for (const b of bindings) {
-        if (b.valuePayloadField === undefined || b.idPayloadField === undefined) continue;
+        if (b.valuePayloadField === undefined || b.idPayloadField === undefined)
+          continue;
         const agg = aggById.get(b.aggregateId);
         const fieldKind = (agg?.fields[b.field] as Field | undefined)?.kind;
-        const mergedType = fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
-          ? "String"
-          : fieldKind === "int"
+        const mergedType =
+          fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
+            ? "String"
+            : fieldKind === "int"
             ? "int"
             : fieldKind === "bool"
-              ? "bool"
-              : "Object?";
+            ? "bool"
+            : "Object?";
         const typeName = `${aggregateName}${cap(camel(b.field))}Conflict`;
-        const evolutionTypeName = `${aggregateName}${cap(camel(b.field))}ConflictEvolutionRequired`;
+        const evolutionTypeName = `${aggregateName}${cap(
+          camel(b.field)
+        )}ConflictEvolutionRequired`;
         const helper = `_merge${aggregateName}${cap(camel(b.field))}`;
         conflictDeclarations.push(
           `/// Pending versions of \`${aggregateId}.${b.field}\`. [merge] commits a result that may`,
@@ -962,7 +1385,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `  String get field => _details.field;`,
           `  Map<String, dynamic> get evolution => _details.evolution ?? const {};`,
           `}`,
-          ``,
+          ``
         );
       }
       conflictDeclarations.push(
@@ -972,7 +1395,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         `  const ${aggregateConflictsClass(aggregateId)}(this._client);`,
         ``,
         `  Future<List<${aggregateConflict}>> pending() async {`,
-        `    final rows = await _client._pendingConflictRows(${dartStr(runtimeAggregateType)});`,
+        `    final rows = await _client._pendingConflictRows(${dartStr(
+          runtimeAggregateType
+        )});`,
         `    final out = <${aggregateConflict}>[];`,
         `    for (final row in rows) {`,
         `      if (row.aggregateType != ${dartStr(runtimeAggregateType)}) {`,
@@ -980,9 +1405,15 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         `      }`,
         `      switch (row.field) {`,
         ...bindings.flatMap((b) => {
-          if (b.valuePayloadField === undefined || b.idPayloadField === undefined) return [];
+          if (
+            b.valuePayloadField === undefined ||
+            b.idPayloadField === undefined
+          )
+            return [];
           const typeName = `${aggregateName}${cap(camel(b.field))}Conflict`;
-          const evolutionTypeName = `${aggregateName}${cap(camel(b.field))}ConflictEvolutionRequired`;
+          const evolutionTypeName = `${aggregateName}${cap(
+            camel(b.field)
+          )}ConflictEvolutionRequired`;
           return [
             `        case ${dartStr(b.field)}:`,
             `          if (row.status == 'ready') {`,
@@ -999,7 +1430,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         `    return List.unmodifiable(out);`,
         `  }`,
         `}`,
-        ``,
+        ``
       );
     }
   }
@@ -1016,168 +1447,250 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const aOwned = aScopes.some((scope) => scope.owned === true);
     const aPrivate = needsReadPrincipal(agg.id);
     const aScopesExpr = scopesExpr(aScopes);
-    const runtimeType = isNamespacedAggregate(agg) ? qualifyReadProjectionType(domain, agg.id) : agg.id;
-    const byIdKeys = aScopes.length === 0
-      ? (aPrivate ? ", null, actor" : "")
-      : aOwned
-        ? `, await _readKeys(${aScopesExpr}, [{${dartStr("type")}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${aPrivate ? ", actor" : ""}`
+    const runtimeType = isNamespacedAggregate(agg)
+      ? qualifyReadProjectionType(domain, agg.id)
+      : agg.id;
+    const byIdKeys =
+      aScopes.length === 0
+        ? aPrivate
+          ? ", null, actor"
+          : ""
+        : aOwned
+        ? `, await _readKeys(${aScopesExpr}, [{${dartStr("type")}: ${dartStr(
+            runtimeType
+          )}, ${dartStr("id")}: id}])${aPrivate ? ", actor" : ""}`
         : keysArg(agg.id);
-    const pastByIdKeys = aScopes.length === 0
-      ? (aPrivate ? ", null, _client.actor" : "")
-      : aOwned
-        ? `, await _client._readKeys(${aScopesExpr}, [{${dartStr("type")}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${aPrivate ? ", _client.actor" : ""}`
+    const pastByIdKeys =
+      aScopes.length === 0
+        ? aPrivate
+          ? ", null, _client.actor"
+          : ""
+        : aOwned
+        ? `, await _client._readKeys(${aScopesExpr}, [{${dartStr(
+            "type"
+          )}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${
+            aPrivate ? ", _client.actor" : ""
+          }`
         : pastKeysArg(agg.id);
     methods.push(
-      `  /// Read one ${agg.id} by aggregate id.${readScopesFor(agg.id).length ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key." : ""}`,
+      `  /// Read one ${agg.id} by aggregate id.${
+        readScopesFor(agg.id).length
+          ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key."
+          : ""
+      }`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      (await bridge.queryById(id${byIdKeys})).map((r) => ${rowToModel(model, "r")}).toList();`,
+      `      (await bridge.queryById(id${byIdKeys})).map((r) => ${rowToModel(
+        model,
+        "r"
+      )}).toList();`,
       ``,
       `  /// Watch one ${agg.id} by aggregate id (local reactive read).`,
       `  Stream<List<${model}>> watch${Cap}ById(String id) =>`,
       aOwned
-        ? `      bridge.watchById(id, null${aPrivate ? ", actor" : ""}).asyncMap((_) async => bridge.queryById(id, await _readKeys(${aScopesExpr}, [{${dartStr("type")}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${aPrivate ? ", actor" : ""})).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`
-        : `      bridge.watchById(id${aPrivate ? ", null, actor" : ""}).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`,
+        ? `      bridge.watchById(id, null${
+            aPrivate ? ", actor" : ""
+          }).asyncMap((_) async => bridge.queryById(id, await _readKeys(${aScopesExpr}, [{${dartStr(
+            "type"
+          )}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${
+            aPrivate ? ", actor" : ""
+          })).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`
+        : `      bridge.watchById(id${
+            aPrivate ? ", null, actor" : ""
+          }).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`,
       ``,
       `  /// Every ${agg.id} (the type-index probe — O(result), not a scan).`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      (await _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(runtimeType)}}, keys${aPrivate ? ", actor" : ""}))).map((r) => ${rowToModel(model, "r")}).toList();`
-        : `      (await bridge.query('aggregatesByType', {'__type': ${dartStr(runtimeType)}}${keysArg(agg.id)})).map((r) => ${rowToModel(model, "r")}).toList();`,
+        ? `      (await _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}, keys${aPrivate ? ", actor" : ""}))).map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList();`
+        : `      (await bridge.query('aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}${keysArg(agg.id)})).map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList();`,
       ``,
       `  /// Watch every ${agg.id} (the same indexed local read, re-emitted after each change).`,
       `  Stream<List<${model}>> ${safeMethod(`watchAll${Cap}s`)}() =>`,
       aOwned
-        ? `      bridge.watch('aggregatesByType', {'__type': ${dartStr(runtimeType)}}, null${aPrivate ? ", actor" : ""}).asyncMap((_) => _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(runtimeType)}}, keys${aPrivate ? ", actor" : ""}))).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`
-        : `      bridge.watch('aggregatesByType', {'__type': ${dartStr(runtimeType)}}${aPrivate ? ", null, actor" : ""}).map((rows) => rows.map((r) => ${rowToModel(model, "r")}).toList());`,
-      ``,
+        ? `      bridge.watch('aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}, null${
+            aPrivate ? ", actor" : ""
+          }).asyncMap((_) => _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}, keys${
+            aPrivate ? ", actor" : ""
+          }))).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`
+        : `      bridge.watch('aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}${
+            aPrivate ? ", null, actor" : ""
+          }).map((rows) => rows.map((r) => ${rowToModel(
+            model,
+            "r"
+          )}).toList());`,
+      ``
     );
     pastMethods.push(
       `  /// Read one ${agg.id} by aggregate id in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      (await _client.bridge.queryByIdAt(moment, id${pastByIdKeys})).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`,
+      `      (await _client.bridge.queryByIdAt(moment, id${pastByIdKeys})).map((r) => ${rowToModel(
+        model,
+        "r",
+        "_client._ws"
+      )}).toList();`,
       ``,
       `  /// Every ${agg.id} in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      (await _client._readWithOwnedKeys(${aScopesExpr}, (keys) => _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(runtimeType)}}, keys${aPrivate ? ", _client.actor" : ""}))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
-        : `      (await _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(runtimeType)}}${pastKeysArg(agg.id)})).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`,
-      ``,
+        ? `      (await _client._readWithOwnedKeys(${aScopesExpr}, (keys) => _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}, keys${
+            aPrivate ? ", _client.actor" : ""
+          }))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
+        : `      (await _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(
+            runtimeType
+          )}}${pastKeysArg(agg.id)})).map((r) => ${rowToModel(
+            model,
+            "r",
+            "_client._ws"
+          )}).toList();`,
+      ``
     );
   }
 
-  if (opts.emitActivity === true) methods.push(
-    `  /// Adopt THIS generated model. Nomos proves it against current history; a deliberate`,
-    `  /// difference returns a decision whose accept(reason) re-proves and records the reason.`,
-    `  NomosModel get model => NomosModel(_adoptGeneratedModel, _restorePreviousGeneratedModel);`,
-    ``,
-    `  NomosModelReview _nomosModelReview(Map<String, Object?>? report) {`,
-    `    final differences = <NomosModelDifference>[];`,
-    `    for (final raw in ((report?['divergences'] as List?) ?? const [])) {`,
-    `      final difference = (raw as Map).cast<String, Object?>();`,
-    `      final rawArea = difference['domain'];`,
-    `      final area = rawArea is String && !rawArea.contains('nomos_internal') ? rawArea : null;`,
-    `      final rawAction = difference['directiveId'];`,
-    `      final action = rawAction is String && !rawAction.contains('nomos_internal') ? rawAction : null;`,
-    `      final rawKind = difference['kind']?.toString();`,
-    `      final kind = rawKind == 'plan-divergence'`,
-    `          ? NomosModelDifferenceKind.outcome`,
-    `          : rawKind == 'unsupported-premise' || rawKind == 'read-conflict'`,
-    `              ? NomosModelDifferenceKind.evidence`,
-    `              : NomosModelDifferenceKind.rules;`,
-    `      final subject = action ?? (kind == NomosModelDifferenceKind.outcome ? 'A business action' : 'A historical action');`,
-    `      final summary = kind == NomosModelDifferenceKind.outcome`,
-    `          ? '\$subject would produce a different result under this model.'`,
-    `          : kind == NomosModelDifferenceKind.evidence`,
-    `              ? 'Nomos could not reproduce all evidence needed by \$subject.'`,
-    `              : "\$subject is not accepted by this model's rules.";`,
-    `      differences.add(NomosModelDifference(kind: kind, area: area, action: action, summary: summary));`,
-    `    }`,
-    `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-    `    if (report != null && evolve?['ok'] != true && !differences.any((d) => d.kind == NomosModelDifferenceKind.rules)) {`,
-    `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.rules, summary: 'This model does not yet explain how to interpret every existing value.'));`,
-    `    }`,
-    `    if (report != null && (report['sourceVerified'] != true || report['complete'] != true)`,
-    `        && !differences.any((d) => d.kind == NomosModelDifferenceKind.evidence)) {`,
-    `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.evidence, summary: 'Nomos could not re-prove every premise in the current business history.'));`,
-    `    }`,
-    `    final projection = (report?['projection'] as Map?)?.cast<String, Object?>();`,
-    `    int number(String name) => (report?[name] as num?)?.toInt() ?? 0;`,
-    `    return NomosModelReview(`,
-    `      checkedActions: number('replayedIntents'), candidateActions: number('candidateIntents'),`,
-    `      sameOutcome: projection?['equal'] as bool?, differences: differences);`,
-    `  }`,
-    ``,
-    `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`,
-    `    final raw = await bridge.nomosFrameworkAdoptGeneratedModel(`,
-    `      domain: ${dartStr(domain)}, candidateHash: domainHash, because: because);`,
-    `    final reportRaw = raw['report'];`,
-    `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
-    `    final review = _nomosModelReview(report);`,
-    `    final stage = raw['stage']?.toString();`,
-    `    if (stage == 'promoted' && raw['ok'] == true) {`,
-    `      return NomosModelAdoption.adopted(`,
-    `        summary: 'Nomos proved this model against current history and made it active.', review: review);`,
-    `    }`,
-    `    if (stage == 'acceptance') {`,
-    `      return NomosModelAdoption.needsDecision(`,
-    `        summary: 'This model would change prior business outcomes. Review the differences and record why that is intended.',`,
-    `        review: review, accept: (reason) => _adoptGeneratedModel(reason));`,
-    `    }`,
-    `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-    `    final summary = stage == 'identity'`,
-    `        ? 'Sign in before adopting this model so the decision is accountable.'`,
-    `        : report != null && report['sourceVerified'] != true`,
-    `            ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
-    `            : report != null && report['complete'] != true`,
-    `                ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
-    `                : report != null && evolve?['ok'] != true`,
-    `                    ? 'This model cannot yet interpret every existing value. Nothing changed and the current model remains active.'`,
-    `                    : 'The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.';`,
-    `    return NomosModelAdoption.blocked(summary: summary, review: review);`,
-    `  }`,
-    ``,
-    `  Future<NomosModelRestoration> _restorePreviousGeneratedModel([String? because]) async {`,
-    `    final raw = await bridge.nomosFrameworkRestorePreviousGeneratedModel(`,
-    `      domain: ${dartStr(domain)}, currentHash: domainHash, because: because);`,
-    `    final reportRaw = raw['report'];`,
-    `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
-    `    final review = _nomosModelReview(report);`,
-    `    final stage = raw['stage']?.toString();`,
-    `    if (stage == 'restored' && raw['ok'] == true) {`,
-    `      return NomosModelRestoration.restored(`,
-    `        summary: 'Nomos re-proved current history and restored the previous model.', review: review);`,
-    `    }`,
-    `    if (stage == 'acceptance') {`,
-    `      return NomosModelRestoration.needsDecision(`,
-    `        summary: 'Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.',`,
-    `        review: review, accept: (reason) => _restorePreviousGeneratedModel(reason));`,
-    `    }`,
-    `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-    `    final error = raw['error']?.toString();`,
-    `    final summary = stage == 'identity'`,
-    `        ? 'Sign in before restoring a model so the decision is accountable.'`,
-    `        : error?.contains('restore-no-previous') == true`,
-    `            ? 'This is the first model for this business; there is no previous model to restore.'`,
-    `            : error?.contains('restore-current-changed') == true`,
-    `                ? 'The current model changed before restoration could finish. Nothing changed; ask Nomos to review again.'`,
-    `                : report != null && report['sourceVerified'] != true`,
-    `                    ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
-    `                    : report != null && report['complete'] != true`,
-    `                        ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
-    `                        : report != null && evolve?['ok'] != true`,
-    `                            ? 'The previous model cannot safely interpret every existing value. Nothing changed and the current model remains active.'`,
-    `                            : 'The workspace refused restoration. Nothing changed and the current model remains active.';`,
-    `    return NomosModelRestoration.blocked(summary: summary, review: review);`,
-    `  }`,
-    ``,
-  );
+  if (opts.emitActivity === true)
+    methods.push(
+      `  /// Adopt THIS generated model. Nomos proves it against current history; a deliberate`,
+      `  /// difference returns a decision whose accept(reason) re-proves and records the reason.`,
+      `  NomosModel get model => NomosModel(_adoptGeneratedModel, _restorePreviousGeneratedModel);`,
+      ``,
+      `  NomosModelReview _nomosModelReview(Map<String, Object?>? report) {`,
+      `    final differences = <NomosModelDifference>[];`,
+      `    for (final raw in ((report?['divergences'] as List?) ?? const [])) {`,
+      `      final difference = (raw as Map).cast<String, Object?>();`,
+      `      final rawArea = difference['domain'];`,
+      `      final area = rawArea is String && !rawArea.contains('nomos_internal') ? rawArea : null;`,
+      `      final rawAction = difference['directiveId'];`,
+      `      final action = rawAction is String && !rawAction.contains('nomos_internal') ? rawAction : null;`,
+      `      final rawKind = difference['kind']?.toString();`,
+      `      final kind = rawKind == 'plan-divergence'`,
+      `          ? NomosModelDifferenceKind.outcome`,
+      `          : rawKind == 'unsupported-premise' || rawKind == 'read-conflict'`,
+      `              ? NomosModelDifferenceKind.evidence`,
+      `              : NomosModelDifferenceKind.rules;`,
+      `      final subject = action ?? (kind == NomosModelDifferenceKind.outcome ? 'A business action' : 'A historical action');`,
+      `      final summary = kind == NomosModelDifferenceKind.outcome`,
+      `          ? '\$subject would produce a different result under this model.'`,
+      `          : kind == NomosModelDifferenceKind.evidence`,
+      `              ? 'Nomos could not reproduce all evidence needed by \$subject.'`,
+      `              : "\$subject is not accepted by this model's rules.";`,
+      `      differences.add(NomosModelDifference(kind: kind, area: area, action: action, summary: summary));`,
+      `    }`,
+      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
+      `    if (report != null && evolve?['ok'] != true && !differences.any((d) => d.kind == NomosModelDifferenceKind.rules)) {`,
+      `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.rules, summary: 'This model does not yet explain how to interpret every existing value.'));`,
+      `    }`,
+      `    if (report != null && (report['sourceVerified'] != true || report['complete'] != true)`,
+      `        && !differences.any((d) => d.kind == NomosModelDifferenceKind.evidence)) {`,
+      `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.evidence, summary: 'Nomos could not re-prove every premise in the current business history.'));`,
+      `    }`,
+      `    final projection = (report?['projection'] as Map?)?.cast<String, Object?>();`,
+      `    int number(String name) => (report?[name] as num?)?.toInt() ?? 0;`,
+      `    return NomosModelReview(`,
+      `      checkedActions: number('replayedIntents'), candidateActions: number('candidateIntents'),`,
+      `      sameOutcome: projection?['equal'] as bool?, differences: differences);`,
+      `  }`,
+      ``,
+      `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`,
+      `    final raw = await bridge.nomosFrameworkAdoptGeneratedModel(`,
+      `      domain: ${dartStr(
+        domain
+      )}, candidateHash: domainHash, because: because);`,
+      `    final reportRaw = raw['report'];`,
+      `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
+      `    final review = _nomosModelReview(report);`,
+      `    final stage = raw['stage']?.toString();`,
+      `    if (stage == 'promoted' && raw['ok'] == true) {`,
+      `      return NomosModelAdoption.adopted(`,
+      `        summary: 'Nomos proved this model against current history and made it active.', review: review);`,
+      `    }`,
+      `    if (stage == 'acceptance') {`,
+      `      return NomosModelAdoption.needsDecision(`,
+      `        summary: 'This model would change prior business outcomes. Review the differences and record why that is intended.',`,
+      `        review: review, accept: (reason) => _adoptGeneratedModel(reason));`,
+      `    }`,
+      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
+      `    final summary = stage == 'identity'`,
+      `        ? 'Sign in before adopting this model so the decision is accountable.'`,
+      `        : report != null && report['sourceVerified'] != true`,
+      `            ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
+      `            : report != null && report['complete'] != true`,
+      `                ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
+      `                : report != null && evolve?['ok'] != true`,
+      `                    ? 'This model cannot yet interpret every existing value. Nothing changed and the current model remains active.'`,
+      `                    : 'The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.';`,
+      `    return NomosModelAdoption.blocked(summary: summary, review: review);`,
+      `  }`,
+      ``,
+      `  Future<NomosModelRestoration> _restorePreviousGeneratedModel([String? because]) async {`,
+      `    final raw = await bridge.nomosFrameworkRestorePreviousGeneratedModel(`,
+      `      domain: ${dartStr(
+        domain
+      )}, currentHash: domainHash, because: because);`,
+      `    final reportRaw = raw['report'];`,
+      `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
+      `    final review = _nomosModelReview(report);`,
+      `    final stage = raw['stage']?.toString();`,
+      `    if (stage == 'restored' && raw['ok'] == true) {`,
+      `      return NomosModelRestoration.restored(`,
+      `        summary: 'Nomos re-proved current history and restored the previous model.', review: review);`,
+      `    }`,
+      `    if (stage == 'acceptance') {`,
+      `      return NomosModelRestoration.needsDecision(`,
+      `        summary: 'Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.',`,
+      `        review: review, accept: (reason) => _restorePreviousGeneratedModel(reason));`,
+      `    }`,
+      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
+      `    final error = raw['error']?.toString();`,
+      `    final summary = stage == 'identity'`,
+      `        ? 'Sign in before restoring a model so the decision is accountable.'`,
+      `        : error?.contains('restore-no-previous') == true`,
+      `            ? 'This is the first model for this business; there is no previous model to restore.'`,
+      `            : error?.contains('restore-current-changed') == true`,
+      `                ? 'The current model changed before restoration could finish. Nothing changed; ask Nomos to review again.'`,
+      `                : report != null && report['sourceVerified'] != true`,
+      `                    ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
+      `                    : report != null && report['complete'] != true`,
+      `                        ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
+      `                        : report != null && evolve?['ok'] != true`,
+      `                            ? 'The previous model cannot safely interpret every existing value. Nothing changed and the current model remains active.'`,
+      `                            : 'The workspace refused restoration. Nothing changed and the current model remains active.';`,
+      `    return NomosModelRestoration.blocked(summary: summary, review: review);`,
+      `  }`,
+      ``
+    );
 
   const pastClass = `${className}Past`;
   const atClass = `${className}At`;
   methods.push(
     `  /// Read the same typed business world at a verified point in its history.`,
     `  ${pastClass} get past => ${pastClass}(this);`,
-    ``,
+    ``
   );
   pastDeclarations.push(
     `/// The accountable timeline for a [${className}]. Commit identities remain opaque inside [NomosMoment].`,
@@ -1187,10 +1700,19 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     ``,
     `  Future<List<NomosMoment>> moments({int limit = 100}) async {`,
     `    final moments = await _client.bridge.moments(limit: limit);`,
-    `    const actions = <String>{${[...allDirs.map((directive) => directive.id), ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : [])].map(dartStr).join(", ")}};`,
+    `    const actions = <String>{${[
+      ...allDirs.map((directive) => directive.id),
+      ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : []),
+    ]
+      .map(dartStr)
+      .join(", ")}};`,
     `    return moments.where((moment) =>`,
-    `        moment.domain == ${dartStr(domain)} && moment.action != null && actions.contains(moment.action)).map((moment) =>`,
-    `          moment.action == ${dartStr(BUSINESS_CORRECTION_DIRECTIVE)} ? NomosMoment(`,
+    `        moment.domain == ${dartStr(
+      domain
+    )} && moment.action != null && actions.contains(moment.action)).map((moment) =>`,
+    `          moment.action == ${dartStr(
+      BUSINESS_CORRECTION_DIRECTIVE
+    )} ? NomosMoment(`,
     `            id: moment.id, occurredAt: moment.occurredAt, performedBy: moment.performedBy, domain: moment.domain, action: 'correction') : moment).toList();`,
     `  }`,
     `  ${atClass} at(NomosMoment moment) => ${atClass}(_client, moment);`,
@@ -1204,7 +1726,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     ``,
     ...pastMethods,
     `}`,
-    ``,
+    ``
   );
 
   // ── REF-TRAVERSAL ACCESSORS (dart_codegen_parity.md P2 + §2a follow-on — ref ergonomics) ──
@@ -1239,16 +1761,34 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const model = readModelClassName(agg.id);
     const entries = Object.entries(agg.fields) as [string, Field][];
     const sameDomainRefs = entries.filter(
-      ([, f]) => f.kind === "ref" && f.foreignRef === undefined && f.refAggregateId !== undefined && aggById.has(f.refAggregateId!),
+      ([, f]) =>
+        f.kind === "ref" &&
+        f.foreignRef === undefined &&
+        f.refAggregateId !== undefined &&
+        aggById.has(f.refAggregateId!)
     );
     const crossDomainRefs = entries.filter(([, f]) => {
-      if (!(f.kind === "ref" && f.foreignRef === undefined && f.refAggregateId !== undefined)) return false;
+      if (
+        !(
+          f.kind === "ref" &&
+          f.foreignRef === undefined &&
+          f.refAggregateId !== undefined
+        )
+      )
+        return false;
       if (aggById.has(f.refAggregateId!)) return false; // same-domain — handled above
       const owner = pkgDomains[f.refAggregateId!];
       return owner !== undefined && owner.domain !== domain; // resolvable on a SIBLING domain's client
     });
-    const foreignRefs = entries.filter(([, f]) => f.kind === "ref" && f.foreignRef !== undefined);
-    if (sameDomainRefs.length === 0 && crossDomainRefs.length === 0 && foreignRefs.length === 0) continue;
+    const foreignRefs = entries.filter(
+      ([, f]) => f.kind === "ref" && f.foreignRef !== undefined
+    );
+    if (
+      sameDomainRefs.length === 0 &&
+      crossDomainRefs.length === 0 &&
+      foreignRefs.length === 0
+    )
+      continue;
     const lines: string[] = [
       `/// Ref-traversal accessors for [${model}] (dart_codegen_parity.md P2) — resolve a stored ref id`,
       `/// to the actual target row via the SAME by-id read lane already exposed above.`,
@@ -1263,7 +1803,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       const member = dartMemberName(fieldName);
       // `siteId` → `site` (the common `<name>Id` ref-field convention); anything else gets a `Ref`
       // suffix so the resolver method never collides with the stored field's own getter.
-      const methodStem = member.length > 2 && member.endsWith("Id") ? member.slice(0, -2) : `${member}Ref`;
+      const methodStem =
+        member.length > 2 && member.endsWith("Id")
+          ? member.slice(0, -2)
+          : `${member}Ref`;
       const method = safeMethod(methodStem);
       // NULLABILITY: the read-model member's Dart type follows the PROJECTION's own nullability, not
       // the DSL schema's `.optional()` — a partial fold decodes every scalar `null` when absent
@@ -1281,10 +1824,12 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
               `    if (id == null) return null;`,
               `    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(id));`,
             ]
-          : [`    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(${member}));`]),
+          : [
+              `    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(${member}));`,
+            ]),
         `    return rows.isEmpty ? null : rows.first;`,
         `  }`,
-        ``,
+        ``
       );
     }
     for (const [fieldName, f] of crossDomainRefs) {
@@ -1301,7 +1846,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       addImport(importUri, targetClient);
       addImport(importUri, targetModel);
       const member = dartMemberName(fieldName);
-      const methodStem = member.length > 2 && member.endsWith("Id") ? member.slice(0, -2) : `${member}Ref`;
+      const methodStem =
+        member.length > 2 && member.endsWith("Id")
+          ? member.slice(0, -2)
+          : `${member}Ref`;
       const method = safeMethod(methodStem);
       const memberNullable = admitsNull(f) || f.isFromBirth !== true;
       const memberValue = admitsNull(f) ? `${member}.valueOrNull` : member;
@@ -1317,10 +1865,12 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
               `    if (id == null) return null;`,
               `    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(id));`,
             ]
-          : [`    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(${member}));`]),
+          : [
+              `    final rows = await client.${byIdMethod}(NmsInternalNomosRefs.id(${member}));`,
+            ]),
         `    return rows.isEmpty ? null : rows.first;`,
         `  }`,
-        ``,
+        ``
       );
     }
     for (const [fieldName, f] of foreignRefs) {
@@ -1333,14 +1883,16 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       // raw `ForeignRef<T>` field — no resolver, no dangling type reference.
       if (fr.targetIsContract === true) continue;
       const owner = pkgDomains[targetType];
-      const targetInThisDomain = aggById.has(targetType) || owner?.name === thisDomainName;
+      const targetInThisDomain =
+        aggById.has(targetType) || owner?.name === thisDomainName;
       if (!targetInThisDomain) {
         if (owner === undefined) continue; // target not in this package — unreachable, skip the resolver
         // LAYERED-packages mode: the sibling domain's TYPES file lives in the TYPES package, not
         // beside this client file — a relative `<name>.dart` import points at a nonexistent path in
         // the client package (the co2 0.75.0 regression). The types-barrel import above already
         // re-exports every generated concrete class, so the extra import is only needed FLAT.
-        if (opts.typesImportUri === undefined) addImport(`${owner.name}.dart`, concreteClassName(targetType));
+        if (opts.typesImportUri === undefined)
+          addImport(`${owner.name}.dart`, concreteClassName(targetType));
       }
       const targetConcrete = concreteClassName(targetType);
       const member = dartMemberName(fieldName);
@@ -1358,7 +1910,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
         `    if (ref == null) return Future<${targetConcrete}?>.value(null);`,
         `    return NmsInternalForeignRefs.resolve(ref, engine.foreignReader(cloud: cloud));`,
         `  }`,
-        ``,
+        ``
       );
     }
     lines.push(`}`);
@@ -1372,19 +1924,28 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `  /// [ActivityEvent]s (automatic baseline; \`.activity(...)\` enriches it). Re-emits on every new`,
       `  /// committed intent; a directive`,
       `  /// outside this generated business package is dropped. Cancel the subscription to stop.`,
-      `  Stream<List<ActivityEvent>> watchActivity() =>`,
-      `      bridge.watchActivity().map((rows) => rows`,
+      `  /// A bounded recent activity feed. [limit] is required and kernel-capped.`,
+      `  Stream<List<ActivityEvent>> watchRecentActivity({required int limit}) =>`,
+      `      bridge.watchActivity(limit: limit).map((rows) => rows`,
       `          .map((r) => renderActivity((r as Map).cast<String, dynamic>()))`,
       `          .whereType<ActivityEvent>()`,
       `          .toList());`,
       ``,
-      `  /// One-shot: the current committed activity log, folded to typed [ActivityEvent]s.`,
-      `  Future<List<ActivityEvent>> activityLog({String? base, int? limit}) async =>`,
+      `  /// A bounded one-shot recent activity feed. [limit] is required and kernel-capped.`,
+      `  Future<List<ActivityEvent>> recentActivity({String? base, required int limit}) async =>`,
       `      (await bridge.activityLog(base: base, limit: limit))`,
       `          .map((r) => renderActivity(r.cast<String, dynamic>()))`,
       `          .whereType<ActivityEvent>()`,
       `          .toList();`,
       ``,
+      `  @Deprecated('Reconstructs ledger history. Use recentActivity with an explicit bounded limit, or a DSL managed count for quantities.')`,
+      `  Future<List<ActivityEvent>> activityLog({String? base, int? limit}) =>`,
+      `      recentActivity(base: base, limit: limit ?? 50);`,
+      ``,
+      `  @Deprecated('Reconstructs ledger history. Use watchRecentActivity with an explicit bounded limit.')`,
+      `  Stream<List<ActivityEvent>> watchActivity() =>`,
+      `      watchRecentActivity(limit: 50);`,
+      ``,
       `  /// THE SELF-DESCRIPTION: root links to exactly six grounded pages — model, current state, rules,`,
       `  /// history, decisions and evidence. The old events/transcript fields remain on [NomosDescription].`,
       `  Future<NomosDescription> describe({`,
@@ -1576,7 +2137,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       `        .toList();`,
       `    return activityNarrative(events);`,
       `  }`,
-      ``,
+      ``
     );
   }
 
@@ -1592,21 +2153,32 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     ``,
     // `dart:convert` is needed ONLY for the interface block's `jsonDecode` — the offer lane no longer encodes
     // any envelope (it routes through `bridge.offerDirective` → THE ONE ENCODER). Omit it when no interface.
-    ...(clientInterface !== undefined || roleHelpers !== "" || opts.emitActivity === true ? [`import 'dart:convert';`, ``] : []),
+    ...(clientInterface !== undefined ||
+    roleHelpers !== "" ||
+    opts.emitActivity === true
+      ? [`import 'dart:convert';`, ``]
+      : []),
     `import '${supportImport}';`,
     // Layered-packages mode: the sibling types live in their OWN package — one barrel import
     // replaces both the relative types import and the relative framework import.
-    ...(opts.typesImportUri !== undefined ? [`import '${opts.typesImportUri}';`] : [`import '${mod.name}.dart';`]),
+    ...(opts.typesImportUri !== undefined
+      ? [`import '${opts.typesImportUri}';`]
+      : [`import '${mod.name}.dart';`]),
     // EXPLICIT-BARREL layered mode: the types barrel withholds per-domain classes, so import the defining
     // per-domain TYPES files directly (this domain's own + any sibling whose classes this client names).
     // The client header already `ignore_for_file: unused_import`, so an over-broad set is harmless.
     ...(opts.explicitTypeImports ?? []).map((uri) => `import '${uri}';`),
     // ACTIVITY FEED (flat mode): the shared pure `renderActivity` lives in the sibling `activity_registry.dart`
     // (in layered mode it resolves through the types-package barrel above). Only when the package opts in.
-    ...(opts.emitActivity === true && opts.activityImportUri !== undefined ? [`import '${opts.activityImportUri}';`] : []),
+    ...(opts.emitActivity === true && opts.activityImportUri !== undefined
+      ? [`import '${opts.activityImportUri}';`]
+      : []),
     // Framework-shared aggregate types (RelationTupleReadModel, …) live in the ONE shared file — import
     // them (the by-id accessors reference them) and re-export them (once per package, Dart de-dups).
-    ...(opts.typesImportUri === undefined && opts.frameworkImportUri !== undefined ? [`import '${opts.frameworkImportUri}';`] : []),
+    ...(opts.typesImportUri === undefined &&
+    opts.frameworkImportUri !== undefined
+      ? [`import '${opts.frameworkImportUri}';`]
+      : []),
     // CROSS-DOMAIN REF TRAVERSAL (§2a follow-on): a cross-domain resolver references a SIBLING domain's
     // generated client class + read model (from `<name>.client.dart`, co-located with this file in BOTH
     // modes) or — FLAT MODE ONLY — a foreignRef target's concrete class from the sibling TYPES
@@ -1615,19 +2187,29 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     // Empty for a domain with no cross-domain ref (byte-identical to before this existed).
     ...[...crossDomainImports.entries()]
       .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-      .map(([uri, names]) => `import '${uri}' show ${[...names].sort().join(", ")};`),
+      .map(
+        ([uri, names]) =>
+          `import '${uri}' show ${[...names].sort().join(", ")};`
+      ),
     `// Re-export business types only. The runtime import above is an implementation dependency, never`,
     `// a tenant API: exporting it would create a second raw bridge/session/sync application lane.`,
-    ...(opts.typesImportUri !== undefined ? [`export '${opts.typesImportUri}';`] : [`export '${mod.name}.dart';`]),
-    ...(opts.typesImportUri === undefined && opts.frameworkImportUri !== undefined ? [`export '${opts.frameworkImportUri}';`] : []),
+    ...(opts.typesImportUri !== undefined
+      ? [`export '${opts.typesImportUri}';`]
+      : [`export '${mod.name}.dart';`]),
+    ...(opts.typesImportUri === undefined &&
+    opts.frameworkImportUri !== undefined
+      ? [`export '${opts.frameworkImportUri}';`]
+      : []),
     ``,
-    `/// sha256 of the deployed \`.package.usda\` — the installed law this client offers under.`,
+    `/// Content identity of the installed typed USDA closure (transported as \`.law.usdz\`).`,
     `const String ${hashConst} = ${dartStr(opts.domainHash)};`,
     ``,
     ...(opts.emitActivity === true
       ? [
           `/// Compiler-known business language and policy; verified runtime facts join it behind describe().`,
-          `const String _nomosDescribeModelJson = ${dartRawJson(describeModel)};`,
+          `const String _nomosDescribeModelJson = ${dartRawJson(
+            describeModel
+          )};`,
           ``,
         ]
       : []),
@@ -1637,7 +2219,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `/// shapes) + aggregates (read shapes, sid-keyed) it depends on. \`connect()\` negotiates this`,
           `/// against the workspace's installed offer by SHAPE (stable-id subtyping), not by law hash,`,
           `/// so the domain can evolve without republishing this client.`,
-          `const String ${interfaceConstNameDart(mod.name)} = ${dartRawJson(clientInterface)};`,
+          `const String ${interfaceConstNameDart(mod.name)} = ${dartRawJson(
+            clientInterface
+          )};`,
           ``,
         ]
       : []),
@@ -1646,7 +2230,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `/// The CLIENT/LAW COMPAT MANIFEST (§5) as JSON — the law hash, structural interface hash, and`,
           `/// generator provenance this client was generated against. A DIAGNOSIS surface for connect-time`,
           `/// classification (silent / shape-compatible / incompatible); it NEVER gates.`,
-          `const String ${compatConstNameDart(mod.name)} = ${dartRawJson(opts.compat)};`,
+          `const String ${compatConstNameDart(mod.name)} = ${dartRawJson(
+            opts.compat
+          )};`,
           ``,
         ]
       : []),
@@ -1676,21 +2262,31 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `  final NomosKeyStore? keyStore;`,
         ]
       : []),
-    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor${manualEncryptionPresent ? ", this.keyStore" : ""}});`,
+    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor${
+      manualEncryptionPresent ? ", this.keyStore" : ""
+    }});`,
     ``,
     `  /// THE STATIC INTERFACE DESCRIPTOR (session_bound_clients.md asks 5/9): what this client EXPECTS`,
     `  /// of the workspace it binds to — the domain key, the law hash it was generated against, and the`,
     `  /// structural interface (#72). Consumed by [bind] and by \`session.assertCompatible(${className}.interface)\`.`,
     `  /// The kernel capabilities this law REQUIRES (release coherence): a compound-key query needs`,
     `  /// 'compoundKeys', etc. [bind] asserts the connected cloud's kernel advertises these.`,
-    `  static const List<String> requiresKernel = [${requiresKernelFeats.map((f) => dartStr(f)).join(", ")}];`,
+    `  static const List<String> requiresKernel = [${requiresKernelFeats
+      .map((f) => dartStr(f))
+      .join(", ")}];`,
     ``,
     `  static const NomosClientInterface interface = NomosClientInterface(`,
     `    domain: ${dartStr(domain)},`,
     `    expectedDomainHash: ${hashConst},`,
-    ...(compatInterfaceHash !== undefined ? [`    expectedInterfaceHash: ${dartStr(compatInterfaceHash)},`] : []),
-    ...(clientInterface !== undefined ? [`    interfaceJson: ${interfaceConstNameDart(mod.name)},`] : []),
-    ...(opts.compat !== undefined ? [`    compatJson: ${compatConstNameDart(mod.name)},`] : []),
+    ...(compatInterfaceHash !== undefined
+      ? [`    expectedInterfaceHash: ${dartStr(compatInterfaceHash)},`]
+      : []),
+    ...(clientInterface !== undefined
+      ? [`    interfaceJson: ${interfaceConstNameDart(mod.name)},`]
+      : []),
+    ...(opts.compat !== undefined
+      ? [`    compatJson: ${compatConstNameDart(mod.name)},`]
+      : []),
     `  );`,
     ``,
     `  /// THE SESSION-BOUND CONSTRUCTION PATH (session_bound_clients.md asks 2/5): bind this client to`,
@@ -1700,7 +2296,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `  /// IMMEDIATELY — at provider construction, not two clicks into the app. The synchronous`,
     `  /// constructor remains for codepaths that can't await; it lazily runs the SAME preflight on the`,
     `  /// first dispatch.`,
-    `  static Future<${className}> bind(NomosSession session, {String? actor${manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""}}) async {`,
+    `  static Future<${className}> bind(NomosSession session, {String? actor${
+      manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
+    }}) async {`,
     `    await session.assertCompatible(interface);`,
     `    // RELEASE COHERENCE: the cloud's kernel must support what this law needs (e.g. a compound-key query`,
     `    // needs 'compoundKeys'). Throws a typed KernelCoherenceError on a stale/mismatched cloud kernel,`,
@@ -1708,8 +2306,16 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `    await session.assertKernelCoherence(requiresKernel, lawHash: ${hashConst});`,
     ...(ownedScope === undefined
       ? []
-      : [`    await session.nomosEnsureOwnedIdentity(scope: ${dartStr(ownedScope)}, domain: ${dartStr(domain)}, domainHash: ${hashConst});`]),
-    `    return ${className}(session, actor: actor${manualEncryptionPresent ? ", keyStore: keyStore" : ""}).._preflighted = true${ownedScope === undefined ? "" : ".._ownedIdentityReady = true"};`,
+      : [
+          `    await session.nomosEnsureOwnedIdentity(scope: ${dartStr(
+            ownedScope
+          )}, domain: ${dartStr(domain)}, domainHash: ${hashConst});`,
+        ]),
+    `    return ${className}(session, actor: actor${
+      manualEncryptionPresent ? ", keyStore: keyStore" : ""
+    }).._preflighted = true${
+      ownedScope === undefined ? "" : ".._ownedIdentityReady = true"
+    };`,
     `  }`,
     ``,
     `  /// OPEN-THEN-BIND (session_bound_clients.md ask 3) — the ONE-CALL path for a born/resident workspace:`,
@@ -1718,13 +2324,17 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `  /// resident/parked/just-born one opens local-only in place) and THEN binds — so a not-open workspace`,
     `  /// fails HERE, at open, never later on the client's first query. The generated stateful application`,
     `  /// privately retains refreshable cloud access for a genuinely-absent authorized workspace.`,
-    `  static Future<${className}> open<TAggregate>(NomosBridge bridge, {NomosRef<TAggregate>? ref, String? workspace, String? actor${manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""}}) async {`,
+    `  static Future<${className}> open<TAggregate>(NomosBridge bridge, {NomosRef<TAggregate>? ref, String? workspace, String? actor${
+      manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
+    }}) async {`,
     `    final ws = ref == null ? workspace : NmsInternalNomosRefs.workspace(ref);`,
     `    if (ws == null || ws.isEmpty) {`,
     `      throw ArgumentError('${className}.open: pass a workspace: or ref: — the workspace to open and bind');`,
     `    }`,
     `    final session = await bridge.acquireSession(ws);`,
-    `    return bind(session, actor: actor${manualEncryptionPresent ? ", keyStore: keyStore" : ""});`,
+    `    return bind(session, actor: actor${
+      manualEncryptionPresent ? ", keyStore: keyStore" : ""
+    });`,
     `  }`,
     ``,
     `  /// The session workspace this client is bound to (from the [NomosSession] handle, when constructed with`,
@@ -1749,7 +2359,22 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `    if (_preflighted) return;`,
     `    _preflighted = true;`,
     `    final b = bridge;`,
-    `    if (b is NomosSession) await b.assertCompatible(interface);`,
+    `    if (b is NomosSession) {`,
+    `      await b.assertCompatible(interface);`,
+    `    }`,
+    `  }`,
+    ``,
+    `  // Command readiness is deliberately separate from client/read compatibility. Binding a`,
+    `  // generated application may construct clients for every installed domain; compiling every`,
+    `  // offer plan at that point recreates whole-law runtime work. The first actual offer prepares`,
+    `  // exactly this authenticated package/domain slice, once, before dispatch.`,
+    `  final Set<String> _preparedCommands = <String>{};`,
+    `  Future<void> _prepareCommand(String directiveId) async {`,
+    `    if (_preparedCommands.contains(directiveId)) return;`,
+    `    await bridge.prepareDomain(domain: ${dartStr(
+      domain
+    )}, directiveId: directiveId, packageHash: ${hashConst});`,
+    `    _preparedCommands.add(directiveId);`,
     `  }`,
     ``,
     ...(ownedScope === undefined || Object.keys(ownedActions).length === 0
@@ -1759,7 +2384,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `  bool _ownedIdentityReady = false;`,
           `  Future<void> _ensureOwnedIdentity() async {`,
           `    if (_ownedIdentityReady) return;`,
-          `    await bridge.nomosEnsureOwnedIdentity(scope: ${dartStr(ownedScope)}, domain: ${dartStr(domain)}, domainHash: domainHash);`,
+          `    await bridge.nomosEnsureOwnedIdentity(scope: ${dartStr(
+            ownedScope
+          )}, domain: ${dartStr(domain)}, domainHash: domainHash);`,
           `    _ownedIdentityReady = true;`,
           `  }`,
           ``,
@@ -1769,34 +2396,53 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `    if (NmsInternalNomosRefs.workspace(record) != _ws) throw ArgumentError('$action() cannot use a record from another workspace');`,
           `    final directiveId = _ownedRecordActions[NmsInternalNomosRefs.type(record)]?[action];`,
           `    if (directiveId == null) throw ArgumentError('$action() needs a generated owned record reference');`,
+          `    await _prepareCommand(directiveId);`,
           `    if (peer.trim().isEmpty) throw ArgumentError('$action() needs the person to act with');`,
-          `    final payload = await bridge.nomosPrepareOwnedRecordAction(action: action, scope: ${dartStr(ownedScope)}, record: record, peer: peer);`,
-          `    return bridge.offerOutcome(domain: ${dartStr(domain)}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash);`,
+          `    final payload = await bridge.nomosPrepareOwnedRecordAction(action: action, scope: ${dartStr(
+            ownedScope
+          )}, record: record, peer: peer);`,
+          `    return bridge.offerOutcome(domain: ${dartStr(
+            domain
+          )}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash);`,
           `  }`,
           ``,
         ]),
-    ...(dirs.length > 0 || birthDirs.some((d) => (d as { businessBirth?: unknown }).businessBirth !== undefined)
+    ...(dirs.length > 0 ||
+    birthDirs.some(
+      (d) => (d as { businessBirth?: unknown }).businessBirth !== undefined
+    )
       ? [
           `  /// THE ONE DISPATCH LANE every generated directive method routes through: lazy preflight, then`,
           `  /// the session's offer (the generated-internal use of the engine-level lane).`,
-          `  Future<NomosOfferOutcome> _offer(String directiveId, Object? payload, {List<Map<String, Object?>>? attestations, List<Map<String, Object?>>? conflictSnapshots}) async {`,
+          `  Future<NomosOfferOutcome> _offer(String directiveId, Object? payload, {List<Map<String, Object?>>? conflictSnapshots}) async {`,
           `    await _preflightOnce();`,
-          `    return bridge.offerOutcome(domain: ${dartStr(domain)}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash, attestations: attestations, nomosConflictSnapshots: conflictSnapshots);`,
+          `    await _prepareCommand(directiveId);`,
+          `    return bridge.offerOutcome(domain: ${dartStr(
+            domain
+          )}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash, nomosConflictSnapshots: conflictSnapshots);`,
           `  }`,
           ``,
         ]
       : []),
-    ...(encPresent ? dartEncClassMembers(encMap!, manualEncryptionPresent) : []),
+    ...(encPresent
+      ? dartEncClassMembers(encMap!, manualEncryptionPresent)
+      : []),
     ...(ownedScope === undefined
       ? []
       : [
           `  /// Opt into all-device-loss recovery with one explicitly designated person.`,
           `  NomosRecovery get recovery => NomosRecovery(`,
-          `      bridge: bridge, domain: ${dartStr(domain)}, domainHash: domainHash, scope: ${dartStr(ownedScope)});`,
+          `      bridge: bridge, domain: ${dartStr(
+            domain
+          )}, domainHash: domainHash, scope: ${dartStr(ownedScope)});`,
           ``,
           `  /// Add another of this person's devices. Requests are opaque; Nomos owns the handoff.`,
           `  NomosDevices get devices => NomosDevices(`,
-          `      bridge: bridge, domain: ${dartStr(domain)}, domainHash: domainHash, actor: actor, scope: ${dartStr(ownedScope)});`,
+          `      bridge: bridge, domain: ${dartStr(
+            domain
+          )}, domainHash: domainHash, actor: actor, scope: ${dartStr(
+            ownedScope
+          )});`,
           ``,
         ]),
     // THE OWNER CEREMONY (slice 2): grantAndWrap / revokeAndRotate / rotate — the operator-blind key-epoch
@@ -1806,8 +2452,12 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `  /// OWNER CEREMONY (slice 2): \`grantAndWrap\` / \`revokeAndRotate\` / \`rotate\` — the operator-blind`,
           `  /// key-epoch handshake as one call. Bind \`actor\` (the owner) to author the fan-out.`,
           `  NomosEncryption get encryption => NomosEncryption(`,
-          `      bridge: bridge, domain: ${dartStr(domain)}, domainHash: domainHash, actor: actor,`,
-          `      scopes: const [${domScopes.map((s) => dartStr(s)).join(", ")}]);`,
+          `      bridge: bridge, domain: ${dartStr(
+            domain
+          )}, domainHash: domainHash, actor: actor,`,
+          `      scopes: const [${domScopes
+            .map((s) => dartStr(s))
+            .join(", ")}]);`,
           ``,
         ]
       : []),
@@ -1818,7 +2468,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
           `  String get interfaceJson => ${interfaceConstNameDart(mod.name)};`,
           ``,
           `  Map<String, Object?> get _requirement =>`,
-          `      {${dartStr(domain)}: (jsonDecode(interfaceJson) as Map).cast<String, Object?>()};`,
+          `      {${dartStr(
+            domain
+          )}: (jsonDecode(interfaceJson) as Map).cast<String, Object?>()};`,
           ``,
           `  /// SHAPE COMPATIBILITY (#72): one-shot verdict for THIS client against the workspace's`,
           `  /// ON-LEDGER offer — \`{ ok, missing[], incompatible[] }\`, by shape not law hash.`,
@@ -1834,7 +2486,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
                 `  /// workspace's on-ledger offer + arm the pre-call refusal. Await it after connect so a KNOWN-`,
                 `  /// incompatible directive throws [LawMismatchError] CLIENT-SIDE at write time (never a server 422).`,
                 `  Future<NomosCompat?> checkCompat() => bridge.checkCompat(`,
-                `      (jsonDecode(${compatConstNameDart(mod.name)}) as Map).cast<String, Object?>(), _requirement);`,
+                `      (jsonDecode(${compatConstNameDart(
+                  mod.name
+                )}) as Map).cast<String, Object?>(), _requirement);`,
                 ``,
                 `  /// THE FEATURE FLAG (dark-launch): true iff [member] exists on the offer AND is compatible — ship`,
                 `  /// UI with a member dark, deploy the law, it lights up. Await [checkCompat] once first to arm it.`,
@@ -1851,7 +2505,11 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `}`,
     ``,
     ...(refExtensions.length > 0
-      ? [`// ---- ref-traversal accessors (dart_codegen_parity.md P2) ----`, refExtensions.join("\n\n"), ``]
+      ? [
+          `// ---- ref-traversal accessors (dart_codegen_parity.md P2) ----`,
+          refExtensions.join("\n\n"),
+          ``,
+        ]
       : []),
     ...(roleHelpers !== ""
       ? [
@@ -1863,11 +2521,16 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
 }
 
 /** The in-class E2E-sealing members: the baked map + the seal/read private helpers. */
-function dartEncClassMembers(encMap: EncDomainMap, manualEncryptionPresent: boolean): string[] {
+function dartEncClassMembers(
+  encMap: EncDomainMap,
+  manualEncryptionPresent: boolean
+): string[] {
   return [
     `  /// The baked E2E-sealing map (compile-time, from the SAME sids the law was compiled with): which`,
     `  /// directive payload fields seal → { scope, aggSid, fieldSid }, and which read-model fields decrypt.`,
-    `  static final Map<String, dynamic> encryptionMap = (jsonDecode(${dartRawJson(encMap)}) as Map).cast<String, dynamic>();`,
+    `  static final Map<String, dynamic> encryptionMap = (jsonDecode(${dartRawJson(
+      encMap
+    )}) as Map).cast<String, dynamic>();`,
     ``,
     `  /// Seal the mapped encrypted fields of \`data\` in place before dispatch. Ordinary encryption may`,
     `  /// use the bound keyStore; .owned() keys are held internally by the connected Nomos client.`,
@@ -1897,10 +2560,14 @@ function dartEncClassMembers(encMap: EncDomainMap, manualEncryptionPresent: bool
     `      }`,
     `      data[${JSON.stringify(OWNED_KEY_PAYLOAD_FIELD)}] = subject;`,
     `      if (ownedKey.ownedCustody != null && ownedKey.ownedCustody!.isNotEmpty) {`,
-    `        data[${JSON.stringify(OWNED_CUSTODY_PAYLOAD_FIELD)}] = ownedKey.ownedCustody;`,
+    `        data[${JSON.stringify(
+      OWNED_CUSTODY_PAYLOAD_FIELD
+    )}] = ownedKey.ownedCustody;`,
     `      }`,
     `      if (ownedRecordPreMinted) {`,
-    `        data[${JSON.stringify(OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD)}] = [{'type': ownedRecordType, 'id': ownedRecordId}];`,
+    `        data[${JSON.stringify(
+      OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD
+    )}] = [{'type': ownedRecordType, 'id': ownedRecordId}];`,
     `      }`,
     `    }`,
     `    for (final entry in fields.entries) {`,
@@ -1908,7 +2575,11 @@ function dartEncClassMembers(encMap: EncDomainMap, manualEncryptionPresent: bool
     `      final m = entry.value as Map;`,
     `      if (data[field] == null) continue;`,
     `      final scope = m['scope'] as String;`,
-    `      NomosScopeKey? sk = m['owned'] == true ? ownedKey : ${manualEncryptionPresent ? "keyStore == null ? null : await keyStore!.scopeKey(scope)" : "null"};`,
+    `      NomosScopeKey? sk = m['owned'] == true ? ownedKey : ${
+      manualEncryptionPresent
+        ? "keyStore == null ? null : await keyStore!.scopeKey(scope)"
+        : "null"
+    };`,
     `      if (sk == null) throw EncryptionKeyUnavailable(scope, field);`,
     `      data[field] = await bridge.cryptoSealField(`,
     `        scopeKey: sk.key, scope: m['owned'] == true ? sk.scope : scope, epoch: sk.epoch,`,
@@ -1922,9 +2593,15 @@ function dartEncClassMembers(encMap: EncDomainMap, manualEncryptionPresent: bool
     `  Future<List<NomosScopeKey>?> _readKeys(List<Map<String, Object?>> scopes, [List<Map<String, String>> records = const []]) async {`,
     `    if (scopes.isEmpty) return null;`,
     ...(manualEncryptionPresent
-      ? [`    final ordinary = scopes.where((s) => s['owned'] != true).map((s) => s['scope']! as String).toSet().toList();`]
+      ? [
+          `    final ordinary = scopes.where((s) => s['owned'] != true).map((s) => s['scope']! as String).toSet().toList();`,
+        ]
       : []),
-    `    final keys = ${manualEncryptionPresent ? "keyStore == null || ordinary.isEmpty ? <NomosScopeKey>[] : await keyStore!.readKeys(ordinary)" : "<NomosScopeKey>[]"};`,
+    `    final keys = ${
+      manualEncryptionPresent
+        ? "keyStore == null || ordinary.isEmpty ? <NomosScopeKey>[] : await keyStore!.readKeys(ordinary)"
+        : "<NomosScopeKey>[]"
+    };`,
     `    for (final descriptor in scopes) {`,
     `      if (descriptor['owned'] != true) continue;`,
     `      final scope = descriptor['scope']! as String;`,