@githolon/dsl 0.102.5 → 0.103.0

package/dart/lib/src/test_harness.dart

@@ -7,7 +7,7 @@
 //
 // ```dart
 // final harness = await NomosTestHarness.ephemeral(
-//   deployJsonPaths: ['build/guestbook.deploy.json'],
+//   lawUsdzPaths: ['build/guestbook.law.usdz'],
 //   registerTearDown: addTearDown,   // auto-disposes when the test ends (see below)
 // );
 // final app = guestbookClient(harness.bridge); // the generated client — same one the app uses
@@ -85,10 +85,10 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
     '${root.path}/cloud/dev-server/kernel-testmint.wasm',
   );
   final bootstrap = File(
-    '${root.path}/cloud/cloudflare-shell/domains/domain_bootstrap.package.usda',
+    '${root.path}/cloud/cloudflare-shell/domains/build/bootstrap/domain_bootstrap.law.usdz',
   );
   final nomos = File(
-    '${root.path}/cloud/cloudflare-shell/domains/domain_nomos.package.usda',
+    '${root.path}/cloud/cloudflare-shell/domains/build/nomos/nomos.law.usdz',
   );
   for (final file in [production, testMint, bootstrap, nomos]) {
     if (!file.existsSync()) {
@@ -111,14 +111,14 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
       '${short(productionActual)}/${short(testMintActual)} — run the kernel candidate preparation before testing',
     );
   }
-  final bootstrapText = await bootstrap.readAsString();
-  final nomosText = await nomos.readAsString();
+  final bootstrapBytes = await bootstrap.readAsBytes();
+  final nomosBytes = await nomos.readAsBytes();
   final bundleIdentity = sha256
       .convert(
         utf8.encode(
           '$productionActual:$testMintActual:'
-          '${sha256.convert(utf8.encode(bootstrapText))}:'
-          '${sha256.convert(utf8.encode(nomosText))}',
+          '${sha256.convert(bootstrapBytes)}:'
+          '${sha256.convert(nomosBytes)}',
         ),
       )
       .toString();
@@ -146,13 +146,8 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
 
   await publish('holon.wasm', productionBytes);
   await publish('holon-testmint.wasm', testMintBytes);
-  await publish(
-    'packages.json',
-    utf8.encode(jsonEncode(<String, String>{
-      'bootstrap': bootstrapText,
-      'nomos': nomosText,
-    })),
-  );
+  await publish('bootstrap.law.usdz', bootstrapBytes);
+  await publish('nomos.law.usdz', nomosBytes);
   return runtime.path;
 }
 
@@ -193,7 +188,7 @@ String? nmsPermanentConvergenceFailure(Map<String, Object?> result) {
 
 /// The offline-install lane configuration a harness keeps so the CUSTODY DIAGNOSTIC helpers
 /// (ask 9 of architecture/session_bound_clients.md) can re-run installs after construction:
-/// [seedWorkspaceFromDeployJson] / [resetWorkspaceCustody].
+/// [seedWorkspaceFromLawUsdz] / [resetWorkspaceCustody].
 class _InstallLane {
   final String node;
   final bool useInRepoScript;
@@ -323,7 +318,7 @@ class NomosTestHarness {
   /// workspace → the base64 restore snapshot it was seeded from (for [resetWorkspaceCustody]).
   final Map<String, String> _snapshots;
 
-  /// The offline-install lane config (for [seedWorkspaceFromDeployJson]); null when unknown.
+  /// The offline-install lane config (for [seedWorkspaceFromLawUsdz]); null when unknown.
   final _InstallLane? _installLane;
 
   /// When set, overrides EVERY phase's default deadline (see [HarnessPhaseTimeout]).
@@ -505,13 +500,13 @@ class NomosTestHarness {
     return bridge.session(workspace);
   }
 
-  /// Install [deployJsonPaths] into a fresh LOCAL workspace and boot a bridge over it — NO cloud contact.
+  /// Install [lawUsdzPaths] into a fresh LOCAL workspace and boot a bridge over it — NO cloud contact.
   ///
-  /// [deployJsonPaths] — the `build/<name>.deploy.json` files `nomos-compile` emits (installed in order;
+  /// [lawUsdzPaths] — the `build/<name>.law.usdz` files `nomos-compile` emits (installed in order;
   /// framework/platform law before a domain that depends on it).
   /// [workspace] — the local workspace name (default `test-ws`; law-only, never leaves the machine).
   /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon-testmint.wasm` +
-  /// `packages.json`. The harness owns a throwaway test root; app code never handles its key material.
+  /// `bootstrap.law.usdz` + `nomos.law.usdz`. The harness owns a throwaway test root; app code never handles its key material.
   /// [nodeEntry] — path to `node-entry.ts`; when omitted it is resolved from [resolveFrom] via
   /// `require.resolve('@githolon/client/runner/node-entry.ts')`.
   /// [installHelper] — the offline law-install lane. An EXISTING `.ts` or `.mjs` file is run as a node script (the
@@ -523,7 +518,7 @@ class NomosTestHarness {
   /// (feature-detecting `package:test` from a library is not clean in Dart, so this is explicit and safe).
   /// [autoTearDown] — when true (default) and [registerTearDown] is given, registers [dispose] as a teardown.
   static Future<NomosTestHarness> ephemeral({
-    required List<String> deployJsonPaths,
+    required List<String> lawUsdzPaths,
     String? ownerSubject,
     String workspace = 'test-ws',
     String clientId = 'test-runner',
@@ -540,9 +535,9 @@ class NomosTestHarness {
     Duration? phaseTimeout,
     bool decoySession = true,
   }) async {
-    if (deployJsonPaths.isEmpty) {
+    if (lawUsdzPaths.isEmpty) {
       throw NomosTestHarnessException(
-        'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits',
+        'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
     final entry = nodeEntry ??
@@ -592,8 +587,7 @@ class NomosTestHarness {
     try {
       final snapshot = '${workdir.path}/snapshot.bin';
       final info = await _phased(
-        phase:
-            '1/4: offline law install (${deployJsonPaths.length} package(s))',
+        phase: '1/4: offline law install (${lawUsdzPaths.length} package(s))',
         workspace: installWorkspace,
         awaiting:
             useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
@@ -608,7 +602,7 @@ class NomosTestHarness {
           useInRepoScript: useInRepoScript,
           inRepoScript: resolvedHelper,
           githolonCmd: githolonCmd,
-          deployJsonPaths: deployJsonPaths,
+          lawUsdzPaths: lawUsdzPaths,
           workspace: installWorkspace,
           snapshot: snapshot,
           runtimeDir: effectiveRuntimeDir,
@@ -647,7 +641,7 @@ class NomosTestHarness {
         timeout: phaseTimeout ?? readyTimeout,
         onDiagnostic: onDiagnostic,
         likelyCauses: const [
-          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
+          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + framework law archives)',
           'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
         ],
         run: () => plane.ready,
@@ -872,18 +866,16 @@ class NomosTestHarness {
           // application-ready.
         }
       }
-      final installedHashes =
-          ((info['lawHashes'] as List?) ?? const [])
-              .map((hash) => hash.toString())
-              .where((hash) => hash.isNotEmpty)
-              .toList();
-      final sessionLaw =
-          installedHashes.isEmpty
-              ? 'installed'
-              : (birthsApplicationHome
+      final installedHashes = ((info['lawHashes'] as List?) ?? const [])
+          .map((hash) => hash.toString())
+          .where((hash) => hash.isNotEmpty)
+          .toList();
+      final sessionLaw = installedHashes.isEmpty
+          ? 'installed'
+          : (birthsApplicationHome
                   ? installedHashes.last
                   : installedHashes.first)
-                  .substring(0, 12);
+              .substring(0, 12);
       phase('ready — session "$workspace" connected (law $sessionLaw)');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
@@ -978,7 +970,7 @@ class NomosTestHarness {
   /// the SAME offline lane [ephemeral] uses (one snapshot per workspace), then `connect`ed as its own session;
   /// the per-connect restore snapshot loads it into the shared plane.
   ///
-  /// [workspaces] — `{ workspaceName: [deployJsonPaths] }` (installed in order per workspace). Get a
+  /// [workspaces] — `{ workspaceName: [lawUsdzPaths] }` (installed in order per workspace). Get a
   /// session-scoped view with [session] and bind it to a generated client: `EstateClient(harness.session(
   /// 'estate'))`. All other params mirror [ephemeral]. [clientId] is suffixed per session.
   /// [deviceKeyed] names workspaces to open WITH a fresh in-kernel device key as their signing `authorSecret`
@@ -1003,13 +995,13 @@ class NomosTestHarness {
   }) async {
     if (workspaces.isEmpty) {
       throw NomosTestHarnessException(
-        'no workspaces — pass { workspaceName: [build/<name>.deploy.json] } for each colocated workspace',
+        'no workspaces — pass { workspaceName: [build/<name>.law.usdz] } for each colocated workspace',
       );
     }
     for (final e in workspaces.entries) {
       if (e.value.isEmpty) {
         throw NomosTestHarnessException(
-          'workspace "${e.key}" has no deployJsonPaths — pass its build/<name>.deploy.json',
+          'workspace "${e.key}" has no lawUsdzPaths — pass its build/<name>.law.usdz',
         );
       }
     }
@@ -1061,7 +1053,7 @@ class NomosTestHarness {
             useInRepoScript: useInRepoScript,
             inRepoScript: resolvedHelper,
             githolonCmd: githolonCmd,
-            deployJsonPaths: e.value,
+            lawUsdzPaths: e.value,
             workspace: e.key,
             snapshot: snap,
             runtimeDir: effectiveRuntimeDir,
@@ -1116,7 +1108,7 @@ class NomosTestHarness {
         timeout: phaseTimeout ?? readyTimeout,
         onDiagnostic: onDiagnostic,
         likelyCauses: const [
-          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + packages.json)',
+          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + framework law archives)',
           'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
         ],
         run: () => bridge.ready,
@@ -1255,7 +1247,7 @@ class NomosTestHarness {
   /// ```dart
   /// final cloud = await NomosTestCloud.start(serverEntry: devServer);
   /// final h = await NomosTestHarness.cloudBound(
-  ///   cloud: cloud, deployJsonPaths: ['build/co2.deploy.json'],
+  ///   cloud: cloud, lawUsdzPaths: ['build/co2.law.usdz'],
   ///   platformWorkspace: 'co2-platform', subject: 'user:test');
   /// final home = h.homeSession;                    // the app's entry point
   /// cloud.setOnline(false);                        // PARTITION
@@ -1266,7 +1258,7 @@ class NomosTestHarness {
   /// ```
   static Future<NomosTestHarness> cloudBound({
     required NomosTestCloud cloud,
-    required List<String> deployJsonPaths,
+    required List<String> lawUsdzPaths,
     String platformWorkspace = 'test-platform',
     required String subject,
     String? authToken,
@@ -1282,9 +1274,9 @@ class NomosTestHarness {
     Duration? phaseTimeout,
     bool decoySession = true,
   }) async {
-    if (deployJsonPaths.isEmpty) {
+    if (lawUsdzPaths.isEmpty) {
       throw NomosTestHarnessException(
-        'no deployJsonPaths — pass the build/<name>.deploy.json `npx githolon compile` emits',
+        'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
     final entry = nodeEntry ??
@@ -1333,8 +1325,9 @@ class NomosTestHarness {
     final workdir = await Directory.systemTemp.createTemp('nomos-harness-');
     NodeRunnerTransport? transport;
     try {
-      // 1/6 — the remote control plane: BOOT the BORN platform + deploy the law under the test cloud's own
-      //       trust universe. ERA-0: the host does not create workspaces — the platform must have been stood
+      // 1/6 — BOOT the BORN platform and inspect the law already installed by the test cloud's operator
+      //       birth lane. Raw host deployment is retired: the harness never uploads or interprets law.
+      //       ERA-0: the host does not create workspaces — the platform must have been stood
       //       up BY THE CLOUD at boot (`NomosTestCloud.start(platform: '$platformWorkspace')`, the dev
       //       server's in-process operator lane). Booting a born workspace is idempotent; an unborn one
       //       refuses 409, surfaced here with the fix.
@@ -1343,9 +1336,9 @@ class NomosTestHarness {
           <({String domain, String directive, String path})>[];
       final lawHashes = <String>[];
       await _phased(
-        phase: '1/6: boot the born platform + deploy law on the test cloud',
+        phase: '1/6: boot the born platform + inspect installed law',
         workspace: platformWorkspace,
-        awaiting: 'POST /v2/workspaces + /domains',
+        awaiting: 'POST /v2/workspaces + GET /domains + /openapi.json',
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         run: () async {
@@ -1368,50 +1361,52 @@ class NomosTestHarness {
           final existing = await get(
             '/v2/workspaces/$platformWorkspace/domains',
           );
-          final heldHashes = <String>{
-            ...((existing['domains'] as List?) ?? const [])
-                .map((row) => (row as Map?)?['domainHash']?.toString())
-                .whereType<String>()
-                .where((hash) => hash.isNotEmpty),
-            ...(((existing['currentLaw'] as Map?) ?? const {})
-                .values
-                .map((hash) => hash?.toString())
-                .whereType<String>()
-                .where((hash) => hash.isNotEmpty)),
-          };
-          for (final p in deployJsonPaths) {
-            final body = await File(p).readAsString();
-            final deploy = (jsonDecode(body) as Map);
-            final summary = (deploy['summary'] as Map?);
-            final h = summary?['domainHash']?.toString();
-            // A composed test application is normally installed atomically by the bootstrap operator.
-            // The signed-in scenario participant must not need installDomain authority merely because the
-            // harness was also handed those artifacts for routes, hashes and child-law selection.
-            if (h == null || h.isEmpty || !heldHashes.contains(h)) {
-              await post('/v2/workspaces/$platformWorkspace/domains', body);
-              if (h != null && h.isNotEmpty) heldHashes.add(h);
+          for (final path in lawUsdzPaths) {
+            if (!File(path).existsSync()) {
+              throw NomosTestHarnessException(
+                'cloudBound: compiled law archive is missing: $path',
+              );
             }
-            if (h != null && h.isNotEmpty) lawHashes.add(h);
-            final openapi = deploy['openapi'] as Map?;
-            final pathSets = <Map>[
-              (openapi?['paths'] as Map?) ?? const {},
-              (((openapi?['x-nomos-framework-routes'] as Map?)?['paths'])
-                      as Map?) ??
-                  const {},
-            ];
-            for (final paths in pathSets) {
-              for (final entry in paths.entries) {
-                final post = (entry.value as Map?)?['post'] as Map?;
-                final route = post?['x-nomos'] as Map?;
-                final domain = route?['domain']?.toString() ?? '';
-                final directive = route?['directiveId']?.toString() ?? '';
-                if (domain.isNotEmpty && directive.isNotEmpty) {
-                  frameworkPostRoutes.add((
-                    domain: domain,
-                    directive: directive,
-                    path: entry.key.toString(),
-                  ));
-                }
+          }
+          void rememberLaw(Object? value) {
+            final hash = value?.toString() ?? '';
+            if (hash.isNotEmpty &&
+                hash != frameworkHash &&
+                !lawHashes.contains(hash)) {
+              lawHashes.add(hash);
+            }
+          }
+
+          // DomainInstallation rows preserve the operator-authored install order; currentLaw fills
+          // any projection-era gap. These are authenticated kernel reads, not host package metadata.
+          for (final row in ((existing['domains'] as List?) ?? const [])) {
+            rememberLaw((row as Map?)?['domainHash']);
+          }
+          for (final hash
+              in (((existing['currentLaw'] as Map?) ?? const {}).values)) {
+            rememberLaw(hash);
+          }
+          final openapi = await get(
+            '/v2/workspaces/$platformWorkspace/openapi.json',
+          );
+          final pathSets = <Map>[
+            (openapi['paths'] as Map?) ?? const {},
+            (((openapi['x-nomos-framework-routes'] as Map?)?['paths'])
+                    as Map?) ??
+                const {},
+          ];
+          for (final paths in pathSets) {
+            for (final entry in paths.entries) {
+              final operation = (entry.value as Map?)?['post'] as Map?;
+              final route = operation?['x-nomos'] as Map?;
+              final domain = route?['domain']?.toString() ?? '';
+              final directive = route?['directiveId']?.toString() ?? '';
+              if (domain.isNotEmpty && directive.isNotEmpty) {
+                frameworkPostRoutes.add((
+                  domain: domain,
+                  directive: directive,
+                  path: entry.key.toString(),
+                ));
               }
             }
           }
@@ -1424,7 +1419,7 @@ class NomosTestHarness {
       }
       if (lawHashes.isEmpty) {
         throw NomosTestHarnessException(
-          'cloudBound: no deploy.json carried a summary.domainHash — cannot run the birth ceremony (lawHash unknown)',
+          'cloudBound: the born test platform reported no installed application law — cannot run the birth ceremony',
         );
       }
       final birthRoutes = frameworkPostRoutes
@@ -1440,7 +1435,6 @@ class NomosTestHarness {
         );
       }
       final applicationHomeDomain = birthRoutes.single.domain;
-      final birthReceivingGroupPath = birthRoutes.single.path;
       // A composed application has two distinct laws at this seam:
       //   * the parent's CURRENT control law authors enrollFirstDevice + the birth offer;
       //   * the application's final PAYLOAD package is the law installed into the born receiving group.
@@ -1462,7 +1456,7 @@ class NomosTestHarness {
       }
       if (!lawHashes.contains(controlHomeLawHash)) {
         throw NomosTestHarnessException(
-          "cloudBound: current application/home control law '$controlHomeLawHash' was not among the packages this scenario deployed",
+          "cloudBound: current application/home control law '$controlHomeLawHash' was not among the platform's installed packages",
         );
       }
       final applicationHomeLawHash = lawHashes.last;
@@ -1479,7 +1473,11 @@ class NomosTestHarness {
           "cloudBound: application/home domain '$applicationHomeDomain' must expose exactly one semantic enrollFirstDevice route; found ${enrollmentRoutes.length}",
         );
       }
-      final enrollFirstDevicePath = enrollmentRoutes.single.path;
+      if (enrollmentRoutes.single.path.isEmpty) {
+        throw NomosTestHarnessException(
+          'cloudBound: enrollFirstDevice generated an empty relay path',
+        );
+      }
       // 2/6 — the LOCAL engine plane, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
       //       what mints the device key + signs the birth cert (era-0: a birth is ATTESTED or not at all).
       // The executable is device custody too. A process restart while offline must not fetch the kernel
@@ -1586,7 +1584,7 @@ class NomosTestHarness {
           final issuer = (minted['issuer'] ?? '').toString();
           if (idpToken.isEmpty || issuer.isEmpty) {
             throw NomosTestHarnessException(
-              'cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?',
+              'cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/lawUsdzPath: and a law composing setAuthProvider?',
             );
           }
           // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
@@ -1605,20 +1603,44 @@ class NomosTestHarness {
             'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
             'epoch': 0,
           }, secret);
-          await post(
-            '/v2/workspaces/$platformWorkspace$enrollFirstDevicePath',
-            {
+          // Mount the target workspace in the SAME kernel plane and author through its own
+          // installed law. The HTTP host is neither given raw business fields nor a signing key;
+          // sync carries the already-sealed offer and the receiving kernel replays the one gate.
+          // The enroll route was still resolved above to prove the generated public surface
+          // names this semantic route exactly once, but route strings grant no authority here.
+          final platformAuthorSession = '$clientId-platform-author';
+          await plane.connect(
+            cloud: cloud.origin,
+            workspace: platformWorkspace,
+            session: platformAuthorSession,
+            clientId: '$clientId-platform-author',
+            authToken: idpToken,
+            authorSecret: secret,
+          );
+          await plane.offerDirective(
+            domain: applicationHomeDomain,
+            directiveId: 'enrollFirstDevice',
+            domainHash: controlHomeLawHash,
+            actor: subject,
+            authorSecret: secret,
+            session: platformAuthorSession,
+            payload: {
               'keyHash': keyHash,
               'verifiedVia': issuer,
               'validFromEpoch': 0,
               'grantedAt': DateTime.now().toUtc().toIso8601String(),
               'idpToken': idpToken,
-              'actor': subject,
-              'authorSecret': secret,
               'delegationCert': jsonEncode(delegationCert),
             },
-            headers: {'x-nomos-auth': idpToken},
           );
+          final enrollmentSync = await plane.sync(
+            session: platformAuthorSession,
+          );
+          if (enrollmentSync['ok'] == false) {
+            throw NomosTestHarnessException(
+              'cloudBound: sealed enrollFirstDevice offer did not converge: $enrollmentSync',
+            );
+          }
           return (
             publicB64: publicB64,
             secret: secret,
@@ -1627,21 +1649,26 @@ class NomosTestHarness {
           );
         },
       );
-      // 5/6 — THE HOME CEREMONY, remotely: the platform's own gateway offer births the home (the ONE
-      //       control-plane contact; the app lane below never touches the platform again). The offer carries
-      //       the device-signed homeCert + the owner's device keyHash (the home's genesis ENROLS it, so the
-      //       born home is SIGNER-READY — it can birth its own estates/catalogues from intent 0).
+      // 5/6 — THE HOME CEREMONY. Author the birth in the already-mounted PARENT kernel, then sync its sealed
+      //       intent to the remote parent where the same offer gate replays it. The HTTP host never receives
+      //       business fields or a signing secret and has no birth-authoring lane. The offer carries the
+      //       device-signed homeCert + the owner's device keyHash (the home's genesis ENROLS it, so the born
+      //       home is SIGNER-READY — it can birth its own estates/catalogues from intent 0).
       String? home;
       await _phased(
         phase: '5/6: remote home-birth ceremony (attested)',
         workspace: platformWorkspace,
-        awaiting:
-            'POST /v2/workspaces/$platformWorkspace$birthReceivingGroupPath',
+        awaiting: 'parent-kernel offer → sealed sync replay',
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         run: () async {
           final homeName = _receivingGroupNameOf(subject);
-          final homeCert = await plane.signBirthCert({
+          // The plane deliberately still has both the empty onboarding scratch holon and the
+          // authenticated platform holon mounted. Bind this parent certificate operation to the
+          // platform session explicitly; relying on the single-session convenience API becomes
+          // ambiguous as soon as the ceremony correctly opens the target workspace in-kernel.
+          final homeCert =
+              await plane.session('$clientId-platform-author').signBirthCert({
             'child': homeName,
             'founder': subject,
             // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries the
@@ -1651,33 +1678,54 @@ class NomosTestHarness {
             'parentId': platformWorkspace,
             'epoch': 0,
           }, device.secret);
-          final out = await post(
-            '/v2/workspaces/$platformWorkspace$birthReceivingGroupPath',
-            {
+          final localBirth =
+              await plane.session('$clientId-platform-author').offerOutcome(
+            domain: applicationHomeDomain,
+            directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
+            actor: subject,
+            authorSecret: device.secret,
+            payload: <String, Object?>{
               'owner': subject,
               'ownerKeyHash': device.keyHash,
               'frameworkHash': frameworkHash,
               'lawHash': applicationHomeLawHash,
               'bornAt': DateTime.now().toUtc().toIso8601String(),
               'homeCert': jsonEncode(homeCert),
-              'actor': subject,
-              'authorSecret': device.secret,
             },
-            headers: {'x-nomos-auth': device.idpToken},
           );
-          final born = (out['born'] as List?) ?? const [];
-          final bornNames = born
-              .map((b) => (b as Map)['workspace']?.toString())
-              .whereType<String>()
-              .where((w) => w.isNotEmpty)
-              .toList();
-          home = bornNames.isEmpty ? null : bornNames.first;
-          if (home == null) {
-            final outcomes = jsonEncode(out['birthOutcomes'] ?? const []);
+          if (!localBirth.born.contains(homeName)) {
+            throw NomosTestHarnessException(
+              'cloudBound: the local parent kernel admitted the receiving-group offer but did not birth '
+              '"$homeName" (born=${localBirth.born}, birthOutcomes=${localBirth.birthOutcomes})',
+            );
+          }
+          final birthSync = await plane.sync(
+            session: '$clientId-platform-author',
+          );
+          if (birthSync['pushFailed'] == true ||
+              birthSync['diverged'] == true ||
+              birthSync['stillAhead'] == true) {
+            throw NomosTestHarnessException(
+              'cloudBound: the sealed receiving-group offer did not converge: $birthSync',
+            );
+          }
+          final remoteOutcomes =
+              ((birthSync['birthOutcomes'] as List?) ?? const [])
+                  .whereType<Map>()
+                  .map((entry) => entry.cast<String, Object?>())
+                  .toList();
+          final failedRemoteBirth = remoteOutcomes.where(
+            (entry) =>
+                entry['workspace']?.toString() == homeName &&
+                entry['status']?.toString() != 'born',
+          );
+          if (failedRemoteBirth.isNotEmpty) {
             throw NomosTestHarnessException(
-              'cloudBound: birthHome admitted but spawned no home (birthOutcomes=$outcomes)',
+              'cloudBound: the remote parent replay refused the receiving-group birth: '
+              '${jsonEncode(failedRemoteBirth.toList())}',
             );
           }
+          home = homeName;
         },
       );
       // 6/6 — mount the born home as a normal cloud-bound session (clone from the test cloud).
@@ -1770,8 +1818,7 @@ class NomosTestHarness {
     // Every LIVE session on the plane (not the harness's construction-time list — a locally-born child
     // acquired after construction must converge too), PARENT-FIRST: the home syncs before its children, so
     // its birth offer-effect creates each child's remote custody BEFORE that child pushes its own writes.
-    final live =
-        bridge.connectedSessions.where((w) => w != _decoyWorkspace).toList();
+    final live = _applicationConnectedSessions();
     final hw = homeWorkspace;
     if (hw != null && live.remove(hw)) live.insert(0, hw); // the parent leads
     final targets = workspaces ?? live;
@@ -1821,6 +1868,23 @@ class NomosTestHarness {
     return b is NomosSession ? b.parent : b;
   }
 
+  /// Live sessions which belong to the simulated application. The cloud-bound constructor temporarily
+  /// mounts a scratch holon and the application parent to author the receiving-group ceremony. Those are
+  /// deliberately on the same kernel plane, but they are not application workspaces to persist, converge,
+  /// restart or reinstall. In particular, a session label is not necessarily its workspace address:
+  /// replaying `test-runner-platform-author` as an address silently points at a workspace that never existed.
+  List<String> _applicationConnectedSessions() {
+    final lane = _cloudRestartLane;
+    final ceremonySessions = <String>{
+      _decoyWorkspace,
+      if (lane != null) '${lane.clientId}-onboard-scratch',
+      if (lane != null) '${lane.clientId}-platform-author',
+    };
+    return _plane.connectedSessions
+        .where((session) => !ceremonySessions.contains(session))
+        .toList();
+  }
+
   /// RESET a workspace's LOCAL custody to the snapshot it was seeded from — the "stale/corrupt
   /// local custody" repair move in tests. Reconnects the session in place (watches on the old
   /// holon are stopped by the runner's re-connect semantics).
@@ -1848,22 +1912,22 @@ class NomosTestHarness {
     );
   }
 
-  /// SEED a NEW workspace on this plane from `build/<name>.deploy.json` law packages — the
+  /// SEED a NEW workspace on this plane from `build/<name>.law.usdz` law packages — the
   /// mid-test twin of [cluster]'s per-workspace install: runs the SAME offline install lane,
   /// then connects the workspace as its own session. Returns its [NomosSession].
-  Future<NomosSession> seedWorkspaceFromDeployJson({
+  Future<NomosSession> seedWorkspaceFromLawUsdz({
     required String workspace,
-    required List<String> deployJsonPaths,
+    required List<String> lawUsdzPaths,
   }) async {
     final lane = _installLane;
     if (lane == null) {
       throw NomosTestHarnessException(
-        'seedWorkspaceFromDeployJson: this harness holds no install-lane config',
+        'seedWorkspaceFromLawUsdz: this harness holds no install-lane config',
       );
     }
-    if (deployJsonPaths.isEmpty) {
+    if (lawUsdzPaths.isEmpty) {
       throw NomosTestHarnessException(
-        'seedWorkspaceFromDeployJson("$workspace"): pass the build/<name>.deploy.json paths',
+        'seedWorkspaceFromLawUsdz("$workspace"): pass the build/<name>.law.usdz paths',
       );
     }
     final snap = '${_workdir.path}/$workspace.bin';
@@ -1880,7 +1944,7 @@ class NomosTestHarness {
         useInRepoScript: lane.useInRepoScript,
         inRepoScript: lane.inRepoScript,
         githolonCmd: lane.githolonCmd,
-        deployJsonPaths: deployJsonPaths,
+        lawUsdzPaths: lawUsdzPaths,
         workspace: workspace,
         snapshot: snap,
         runtimeDir: lane.runtimeDir,
@@ -1973,9 +2037,7 @@ class NomosTestHarness {
   /// carried per entry). The plane-level twin of [snapshotWorkspace] — migrate a whole staged AppSim plane.
   Future<PlaneSnapshot> snapshotPlane() async {
     final out = <String, WorkspaceSnapshot>{};
-    final connected = _plane.connectedSessions.where(
-      (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
-    );
+    final connected = _applicationConnectedSessions();
     for (final ws in connected) {
       out[ws] = await snapshotWorkspace(ws);
     }
@@ -2037,11 +2099,7 @@ class NomosTestHarness {
     }
 
     final oldPlane = _plane;
-    final targets = oldPlane.connectedSessions
-        .where(
-          (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
-        )
-        .toList();
+    final targets = _applicationConnectedSessions();
     if (targets.remove(home)) targets.insert(0, home);
     final snapshots = <String, String>{};
     for (final ws in targets) {
@@ -2139,11 +2197,7 @@ class NomosTestHarness {
     }
 
     final oldPlane = _plane;
-    final targets = oldPlane.connectedSessions
-        .where(
-          (ws) => ws != _decoyWorkspace && !ws.endsWith('-onboard-scratch'),
-        )
-        .toList();
+    final targets = _applicationConnectedSessions();
     if (targets.remove(home)) targets.insert(0, home);
     for (final ws in targets) {
       await oldPlane.session(ws).stopAutoSync();
@@ -2249,17 +2303,17 @@ class NomosTestHarness {
     required bool useInRepoScript,
     required String inRepoScript,
     required String githolonCmd,
-    required List<String> deployJsonPaths,
+    required List<String> lawUsdzPaths,
     required String workspace,
     required String snapshot,
     String? runtimeDir,
     void Function(String line)? onDiagnostic,
   }) async {
-    // Both lanes take the SAME flags (--deploy/--workspace/--out/--runtime) and print the SAME one-line JSON
+    // Both lanes take the SAME flags (--law/--workspace/--out/--runtime) and print the SAME one-line JSON
     // contract; only the leading command differs (node <script> vs `<githolon...> harness-install`).
     final common = <String>[
-      '--deploy',
-      deployJsonPaths.join(','),
+      '--law',
+      lawUsdzPaths.join(','),
       '--workspace',
       workspace,
       '--out',