@githolon/dsl 0.102.5 → 0.103.0

package/dart/lib/src/webview_bridge.dart

@@ -27,10 +27,17 @@ import 'package:nomos_types/nomos_types.dart'
         NomosTraceContext,
         NomosErrorInfo,
         NomosRef,
+        VersionedNomosRef,
+        ReferenceFreshness,
+        ReferenceCurrent,
+        ReferenceStale,
+        ReferenceFreshnessUnavailable,
         CustodyBreakPolicy,
         NomosCustodyEvent,
         NomosCustodyStatus;
 import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
+import 'package:nomos_types/src/versioned_nomos_ref.dart'
+    show NmsInternalVersionedNomosRefs;
 import 'package:nomos_types/src/foreign_ref.dart'
     show NomosForeignReader, NomosForeignWorkspaceReader;
 
@@ -43,6 +50,17 @@ import 'session_bound.dart' show DomainNotInstalledForSession;
 /// bridge root so app code reads as the four-layer split (engine → session → client → values).
 typedef NomosEngine = NomosBridge;
 
+/// One stable bounded page from an authenticated declared-query index. [cursor] is opaque framework
+/// state: pass it back unchanged to request the next page; [done] means this page exhausted the query.
+final class NomosPage<T> {
+  const NomosPage(
+      {required this.rows, required this.cursor, required this.done});
+
+  final List<T> rows;
+  final String? cursor;
+  final bool done;
+}
+
 /// The protocol version the runner and the bridge agree on (`webview-runner.mjs` `WEBVIEW_BRIDGE_VERSION`).
 const int kWebviewBridgeVersion = 1;
 
@@ -1498,7 +1516,7 @@ class NomosBridge {
           {'id': id, if (session != null) 'session': session}));
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
-  /// writes + the DLQ), each with its full `intentB64` bytes: `{pendingWrites, deadLetters}`. The
+  /// writes + the DLQ), each with its full `changeB64` bytes: `{pendingWrites, deadLetters}`. The
   /// read half of the recovery lane (`connect(recover: true)` runs salvage → [absorbSalvage]).
   Future<Map<String, Object?>> salvage({String? session}) async =>
       _asMap(await _call('salvage', {if (session != null) 'session': session}));
@@ -1537,11 +1555,9 @@ class NomosBridge {
   /// `encodeIntentOfferBytes`, with `security.actor` included iff [actor] is set). The generated Dart client
   /// calls THIS — it never hand-builds offer bytes, so there is exactly ONE copy of the wire format. Returns
   /// the new local head; durable on [sync]. ([offer] with opaque bytes stays for back-compat carriers.)
-  /// [attestations] hand-injects the signed foreign-read envelopes a captured-read directive consumes
-  /// (each `{queryId, result, attestation}` — the shape the kernel's attested-read gate re-derives against
-  /// its trust policy); [force] carries the deploy/evolve force flag through. Both are OMITTED from the wire
-  /// when absent, so a plain offer is byte-identical to before. [session] pins the colocated workspace in a
-  /// cluster harness (absent ⇒ the runner's sole-session default).
+  /// Declared foreign reads are resolved and proved inside the shared kernel plane; callers never fetch or
+  /// inject evidence. [force] carries the deploy/evolve force flag through. [session] pins the workspace in
+  /// a cluster harness (absent ⇒ the runner's sole-session default).
   @Deprecated(
       'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession '
@@ -1553,7 +1569,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1567,7 +1582,6 @@ class NomosBridge {
       'payload': payload,
       if (actor != null) 'actor': actor,
       if (domainHash != null) 'domainHash': domainHash,
-      if (attestations != null) 'attestations': attestations,
       if (nomosConflictSnapshots != null)
         '__nomosConflictSnapshots': nomosConflictSnapshots,
       if (force != null) 'force': force,
@@ -1591,7 +1605,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1603,7 +1616,6 @@ class NomosBridge {
         payload: payload,
         actor: actor,
         domainHash: domainHash,
-        attestations: attestations,
         nomosConflictSnapshots: nomosConflictSnapshots,
         force: force,
         session: session,
@@ -1621,7 +1633,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1644,7 +1655,6 @@ class NomosBridge {
         'payload': payload,
         if (actor != null) 'actor': actor,
         if (domainHash != null) 'domainHash': domainHash,
-        if (attestations != null) 'attestations': attestations,
         if (nomosConflictSnapshots != null)
           '__nomosConflictSnapshots': nomosConflictSnapshots,
         if (force != null) 'force': force,
@@ -1786,6 +1796,22 @@ class NomosBridge {
     return (r['offer'] as Map?)?.cast<String, Object?>();
   }
 
+  /// Prepare the exact authenticated execution slice a generated client is about to use. This is
+  /// a readiness hint only: compilation, composition, cache custody and all trust decisions remain
+  /// inside the kernel. Generated `bind` calls it so first-use cost is paid before the client becomes
+  /// interactive, rather than on the person's first button press.
+  Future<void> prepareDomain({
+    required String domain,
+    String? directiveId,
+    required String packageHash,
+  }) async {
+    await _call('prepareDomain', {
+      'domain': domain,
+      if (directiveId != null) 'directiveId': directiveId,
+      'packageHash': packageHash,
+    });
+  }
+
   /// FOLLOW A [NomosRef] — THE cross-workspace primitive (session_bound_clients.md ask 8): mount
   /// the referenced workspace on this device's plane (idempotent — an already-open workspace is
   /// just returned) and hand back its [NomosSession]. Typed client construction is then one line:
@@ -1906,6 +1932,16 @@ class NomosBridge {
       (_asMap(await _call('mintId', {'typeTag': typeTag}))['id'] ?? '')
           .toString();
 
+  /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
+  /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
+  Future<String> nomosWorkspaceGenesis(String workspace,
+      {String? session}) async =>
+      (_asMap(await _call('nomosWorkspaceGenesis', {
+        'workspace': workspace,
+        if (session != null) 'session': session,
+      }))['genesis'] ?? '')
+          .toString();
+
   /// UNDO the most-recent action via the kernel STRIKE primitive (the fold drops the struck intent by parity).
   /// [scope] `'all'` undoes any author's most-recent action; `'user'` only THIS replica's own. [actions] is the
   /// app's set of undoable directive ids (so undo never strikes a framework/control intent). [domain] +
@@ -1924,7 +1960,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1935,21 +1970,10 @@ class NomosBridge {
           payload: payload,
           actor: actor,
           domainHash: domainHash,
-          attestations: attestations,
           nomosConflictSnapshots: nomosConflictSnapshots,
           force: force,
           session: session);
 
-  /// ATTESTED READ — serve + SIGN a declared query over a COLOCATED source session's certified fold (the
-  /// dynamic-source trust lane; architecture/dynamic_source_attested_reads.md). In a [NomosTestHarness.cluster]
-  /// (one engine plane, many sessions) this fulfils the read IN-PROCESS from the [from] session and returns
-  /// `{ entry: {queryId, result, attestation:{source_genesis, public_key, …}} }` — pass `result['entry']`
-  /// (the whole entry map) as one [offerDirective] `attestations` element, or read
-  /// `entry['attestation']['source_genesis']` to enrol the source in a reader's allow-list. [args] are the
-  /// query params. [session] is the caller/reader session (defaults to this view's bound session).
-  /// [attestorSecret] is the source's base64 read-attestor secret (from [authorKeygen]); when omitted the
-  /// source session's connect-time `authorSecret` signs. [nowMs] stamps the freshness clock (defaults to the
-  /// source's own clock).
   /// RELEASE COHERENCE — assert the connected cloud's kernel supports every capability this law needs (the
   /// generated client passes its baked `requiresKernel`, e.g. `['compoundKeys']` for a compound-key query).
   /// Throws a typed [KernelCoherenceError] on a skew (a stale/mismatched cloud kernel) with the named reason,
@@ -1964,23 +1988,6 @@ class NomosBridge {
     });
   }
 
-  Future<Map<String, Object?>> attestedRead({
-    required String from,
-    required String queryId,
-    Map<String, Object?> args = const {},
-    String? attestorSecret,
-    int? nowMs,
-    String? session,
-  }) async =>
-      _asMap(await _call('attestedRead', {
-        'from': from,
-        'queryId': queryId,
-        'args': args,
-        if (attestorSecret != null) 'attestorSecret': attestorSecret,
-        if (nowMs != null) 'nowMs': nowMs,
-        if (session != null) 'session': session,
-      }));
-
   /// MAKE A WORKSPACE — the one-call tenant path. A child workspace under a platform/[parent] is a SIGNED
   /// control-plane offer; the holon seals `createWorkspace` (or [directiveId] `birthChild`, or ANY
   /// tenant-defined `.births()` directive — see [domain]) with the requester's device key ([authorSecret],
@@ -2196,8 +2203,10 @@ class NomosBridge {
 
   /// Watch the RUNTIME activity feed: a stream that re-emits the newest-first activity rows on every local
   /// change (doorbell/sync tick). `base` = a commit-oid cursor. Cancelling drops the watch on the runner.
-  Stream<List<dynamic>> watchActivity({String? base, String? session}) =>
-      _watchStream(kind: 'activity', base: base, session: session);
+  Stream<List<dynamic>> watchActivity(
+          {String? base, int? limit, String? session}) =>
+      _watchStream(
+          kind: 'activity', base: base, limit: limit, session: session);
 
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
@@ -2388,16 +2397,46 @@ class NomosBridge {
   /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
   /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
   Future<List<Map<String, dynamic>>> query(String queryId,
-          [Map<String, Object?> params = const {},
-          List<NomosScopeKey>? keys,
-          String? principal,
-          String? session]) async =>
-      _asRows(await _call('query', {
-        'queryId': queryId,
-        'params': params,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }));
+      [Map<String, Object?> params = const {},
+      List<NomosScopeKey>? keys,
+      String? principal,
+      String? session]) async {
+    return _asRows(await _call('query', {
+      'queryId': queryId,
+      'params': params,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }));
+  }
+
+  /// One bounded query page. Unlike [query], this never requires the kernel to materialize or serialize
+  /// the complete result set merely to show the first screen.
+  Future<NomosPage<Map<String, dynamic>>> queryPage(
+    String queryId, {
+    Map<String, Object?> params = const {},
+    int pageSize = 100,
+    String? cursor,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  }) async {
+    if (pageSize < 1 || pageSize > 1000) {
+      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
+    }
+    final result = _asMap(await _call('queryPage', {
+      'queryId': queryId,
+      'params': params,
+      'pageSize': pageSize,
+      if (cursor != null) 'cursor': cursor,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }));
+    return NomosPage<Map<String, dynamic>>(
+      rows: _asRows(result),
+      cursor: result['cursor'] as String?,
+      done: result['done'] == true,
+    );
+  }
 
   /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
   Future<List<Map<String, dynamic>>> queryById(String id,
@@ -2410,6 +2449,42 @@ class NomosBridge {
         if (session != null) 'session': session,
       }));
 
+  /// Compare an immutable publication pin with the stable series' one compiled
+  /// current pointer. This is an O(current-state) check: it neither resolves the
+  /// pinned publication nor reconstructs aggregate history.
+  Future<ReferenceFreshness<TVersion>> checkReferenceFreshness<TVersion, TSeries>(
+    VersionedNomosRef<TVersion, TSeries> reference,
+  ) async {
+    final result = _asMap(await _call('checkRefFreshness', {
+      'refs': [
+        {
+          'pinned': NmsInternalNomosRefs.toJson(reference.pinned),
+          'series': NmsInternalNomosRefs.toJson(reference.series),
+          'currentField':
+              NmsInternalVersionedNomosRefs.currentField(reference),
+        },
+      ],
+    }));
+    final unique = result['unique'] as List?;
+    final first = unique == null || unique.isEmpty
+        ? const <String, Object?>{}
+        : _asMap(unique.first);
+    final outcome = _asMap(first['outcome']);
+    final status = (outcome['status'] ?? 'unknown').toString();
+    if (status == 'current') {
+      return ReferenceCurrent<TVersion>(reference.pinned);
+    }
+    if (status == 'stale') {
+      final latest = outcome['latest'];
+      if (latest != null) {
+        return ReferenceStale<TVersion>(
+          NmsInternalNomosRefs.fromJson<TVersion>(latest),
+        );
+      }
+    }
+    return ReferenceFreshnessUnavailable<TVersion>(status);
+  }
+
   /// Verified points in this workspace's history, oldest to newest. The generated client presents these
   /// as `client.past.moments()`; callers pass the opaque [NomosMoment] back to `past.at(moment)` and never
   /// need to know that the framework uses commit identities underneath.
@@ -2592,11 +2667,12 @@ class NomosBridge {
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
   Future<NomosScopeKey> nomosOwnedBirthScopeKey(
-      String scope, String namespace, Object? key) async {
+      String scope, String namespace, Object? key, String recordType, String recordId) async {
     final out = _asMap(await _call('cryptoOwnedBirthScopeKey', {
       'scope': scope,
       'namespace': namespace,
       'key': key,
+      'record': {'type': recordType, 'id': recordId},
     }));
     return NomosScopeKey(
       scope: (out['scope'] ?? scope).toString(),
@@ -2876,13 +2952,15 @@ class NomosBridge {
   Stream<List<dynamic>> watch(String queryId,
           [Map<String, Object?> params = const {},
           String? session,
-          String? principal]) =>
+          String? principal,
+          int? intervalMs]) =>
       _watchStream(
           kind: 'query',
           queryId: queryId,
           params: params,
           session: session,
-          principal: principal);
+          principal: principal,
+          intervalMs: intervalMs);
   Stream<List<dynamic>> watchById(String id,
           [String? session, String? principal]) =>
       _watchStream(
@@ -3003,12 +3081,18 @@ class NomosBridge {
     final subId = 'c${++_eventPlane._seq}';
     late final StreamController<Map<String, Object?>> ctrl;
     ctrl = StreamController<Map<String, Object?>>(
-      onListen: () => _call('watch', {
-        'subId': subId,
-        'kind': 'compat',
-        'requirement': requirement,
-        if (session != null) 'session': session,
-      }),
+      onListen: () {
+        unawaited(_call('watch', {
+          'subId': subId,
+          'kind': 'compat',
+          'requirement': requirement,
+          if (session != null) 'session': session,
+        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
+          if (!ctrl.isClosed && ctrl.hasListener) {
+            ctrl.addError(error, stackTrace);
+          }
+        }));
+      },
       onCancel: () {
         _eventPlane._compatWatches.remove(subId);
         // Cancellation is a local lifecycle boundary and must complete even if the runner is slow,
@@ -3029,25 +3113,35 @@ class NomosBridge {
       String? spatialId,
       NomosBbox? bbox,
       String? base,
+      int? limit,
       String? session,
-      String? principal}) {
+      String? principal,
+      int? intervalMs}) {
     // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
     // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
     final subId = 'w${++_eventPlane._seq}';
     late final StreamController<List<dynamic>> ctrl;
     ctrl = StreamController<List<dynamic>>(
-      onListen: () => _call('watch', {
-        'subId': subId,
-        'kind': kind,
-        if (queryId != null) 'queryId': queryId,
-        if (params != null) 'params': params,
-        if (id != null) 'id': id,
-        if (spatialId != null) 'spatialId': spatialId,
-        if (bbox != null) 'bbox': bbox.toJson(),
-        if (base != null) 'base': base,
-        if (principal != null) 'principal': principal,
-        if (session != null) 'session': session,
-      }),
+      onListen: () {
+        unawaited(_call('watch', {
+          'subId': subId,
+          'kind': kind,
+          if (queryId != null) 'queryId': queryId,
+          if (params != null) 'params': params,
+          if (id != null) 'id': id,
+          if (spatialId != null) 'spatialId': spatialId,
+          if (bbox != null) 'bbox': bbox.toJson(),
+          if (base != null) 'base': base,
+          if (limit != null) 'limit': limit,
+          if (principal != null) 'principal': principal,
+          if (intervalMs != null) 'intervalMs': intervalMs,
+          if (session != null) 'session': session,
+        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
+          if (!ctrl.isClosed && ctrl.hasListener) {
+            ctrl.addError(error, stackTrace);
+          }
+        }));
+      },
       onCancel: () {
         _eventPlane._watches.remove(subId);
         // A caller owns its local subscription; it must never need a healthy transport in order to release
@@ -3062,28 +3156,41 @@ class NomosBridge {
   /// Tear down: stop the transport subscription + fail any in-flight calls.
   Future<void> dispose() async {
     await _sub.cancel();
-    for (final entry in _pending.entries) {
-      final c = entry.value;
+    final pending = _pending.entries
+        .map((entry) => (
+              completer: entry.value,
+              trace: _pendingTraces[entry.key] ?? const NomosTraceContext(),
+              operation: _pendingOps[entry.key],
+            ))
+        .toList(growable: false);
+    _pending.clear();
+    _pendingOps.clear();
+    _pendingTraces.clear();
+    for (final entry in pending) {
+      final c = entry.completer;
       if (!c.isCompleted) {
-        final trace = _pendingTraces[entry.key] ?? const NomosTraceContext();
-        final info = NomosErrorInfo.legacy('bridge disposed',
+        final operation = entry.operation ?? 'unknown';
+        final info = NomosErrorInfo.legacy(
+            'bridge disposed while $operation was pending',
             code: 'nomos.bridge.disposed',
-            operation: _pendingOps[entry.key],
-            trace: trace);
+            operation: entry.operation,
+            trace: entry.trace);
         c.completeError(nomosErrorFromInfo(info));
       }
     }
-    _pending.clear();
-    _pendingOps.clear();
-    _pendingTraces.clear();
-    for (final w in _watches.values) {
-      if (!w.isClosed) await w.close();
-    }
+    final watches = _watches.values.toList(growable: false);
     _watches.clear();
-    for (final w in _compatWatches.values) {
-      if (!w.isClosed) await w.close();
+    for (final w in watches) {
+      // A paused consumer can keep StreamController.close() pending forever.
+      // Disposal is the owner boundary: detach the controller immediately and
+      // let its done event complete if/when that consumer resumes.
+      if (!w.isClosed) unawaited(w.close());
     }
+    final compatWatches = _compatWatches.values.toList(growable: false);
     _compatWatches.clear();
+    for (final w in compatWatches) {
+      if (!w.isClosed) unawaited(w.close());
+    }
     _stopStatusPoll();
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.0"
+    version: "0.8.1"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -8,7 +8,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.64.1
+version: 0.64.2
 
 environment:
   sdk: ^3.5.0
@@ -17,7 +17,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.0
+  nomos_types: ^0.8.1
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart/test/acquire_session_credentials_test.dart

@@ -20,7 +20,7 @@ import 'package:test/test.dart';
 String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _docsDeploy =>
-    '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
+    '$_root/bench/scale/fixtures/surfaced/build/surfaced.law.usdz';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
     Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -34,7 +34,8 @@ String? _missingPrereq() {
         '(cd bench/scale/fixtures/surfaced && node ../../../../dsl/compile_package.mjs)';
   }
   if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
-      !File('$_runtimeDir/packages.json').existsSync()) {
+      !File('$_runtimeDir/bootstrap.law.usdz').existsSync() ||
+      !File('$_runtimeDir/nomos.law.usdz').existsSync()) {
     return 'warm ~/.holon/runtime first (run any `githolon` command once)';
   }
   return null;
@@ -65,7 +66,7 @@ void main() {
       return;
     }
     final harness = await NomosTestHarness.ephemeral(
-      deployJsonPaths: [_docsDeploy],
+      lawUsdzPaths: [_docsDeploy],
       workspace: 'acquire-home',
       nodeEntry: _repoEntry,
       runtimeDir: _runtimeDir,

package/dart/test/adv_realm_interference_test.dart

@@ -28,13 +28,13 @@ String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _installer => '$_root/cloud/web-client/runner/offline-install.ts';
 String get _guestbook =>
-    '$_root/examples/guestbook/build/guestbook.deploy.json';
+    '$_root/examples/guestbook/build/guestbook.law.usdz';
 String get _surfaced =>
-    '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
+    '$_root/bench/scale/fixtures/surfaced/build/surfaced.law.usdz';
 String get _attributed =>
-    '$_root/bench/scale/fixtures/attributed/build/attributed.deploy.json';
+    '$_root/bench/scale/fixtures/attributed/build/attributed.law.usdz';
 String get _estateBirth =>
-    '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
+    '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.law.usdz';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
     Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -53,7 +53,8 @@ String? _missingPrereq() {
       return 'missing $p (compile the fixture / example first)';
   }
   if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
-      !File('$_runtimeDir/packages.json').existsSync()) {
+      !File('$_runtimeDir/bootstrap.law.usdz').existsSync() ||
+      !File('$_runtimeDir/nomos.law.usdz').existsSync()) {
     return 'warm ~/.holon/runtime first (run any `githolon` command once)';
   }
   return null;
@@ -499,7 +500,7 @@ void main() {
           final out = '${workdir.path}/$ws.bin';
           final r = await Process.run('node', [
             _installer,
-            '--deploy',
+            '--law',
             _guestbook,
             '--workspace',
             ws,

package/dart/test/cloud_bound_topology_test.dart

@@ -25,7 +25,7 @@ String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _devServer => '$_root/cloud/dev-server/server.ts';
 String get _deploy =>
-    '$_root/bench/scale/fixtures/cloud-topology/build/cloud-topology.deploy.json';
+    '$_root/bench/scale/fixtures/cloud-topology/build/cloud-topology.law.usdz';
 const _subject = 'user:topology-test';
 
 String? _missingPrereq() {
@@ -48,13 +48,13 @@ void main() {
     final diag = Platform.environment['NOMOS_HARNESS_DIAG'] == '1'
         ? (String l) => stderr.writeln(l)
         : null;
-    final cloud = await NomosTestCloud.start(serverEntry: _devServer, platform: 'topology-platform', deployJsonPath: _deploy, onDiagnostic: diag);
+    final cloud = await NomosTestCloud.start(serverEntry: _devServer, platform: 'topology-platform', lawUsdzPath: _deploy, onDiagnostic: diag);
     NomosTestHarness? harness;
     try {
       // 1+2 — the remote ceremony + the local mount, in one constructor (the app's boot path).
       harness = await NomosTestHarness.cloudBound(
         cloud: cloud,
-        deployJsonPaths: [_deploy],
+        lawUsdzPaths: [_deploy],
         platformWorkspace: 'topology-platform',
         subject: _subject,
         nodeEntry: _repoEntry,

package/dart/test/cluster_births_test.dart

@@ -29,7 +29,7 @@ import 'package:test/test.dart';
 String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _birthDeploy =>
-    '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
+    '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.law.usdz';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
     Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -41,7 +41,8 @@ String? _missingPrereq() {
     return 'compile the fixture: cd bench/scale/fixtures/estate-birth && node ../../../../dsl/compile_package.mjs — missing $_birthDeploy';
   }
   if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
-      !File('$_runtimeDir/packages.json').existsSync()) {
+      !File('$_runtimeDir/bootstrap.law.usdz').existsSync() ||
+      !File('$_runtimeDir/nomos.law.usdz').existsSync()) {
     return 'warm ~/.holon/runtime first (run any `githolon` command once)';
   }
   return null;
@@ -55,7 +56,7 @@ const _owner = 'sample-owner';
 Future<(NomosTestHarness, NomosOfferOutcome)> _birth(
     {String? frameworkHash, void Function(NomosTestHarness)? onHarness}) async {
   final harness = await NomosTestHarness.ephemeral(
-    deployJsonPaths: [_birthDeploy],
+    lawUsdzPaths: [_birthDeploy],
     nodeEntry: _repoEntry,
     runtimeDir: _runtimeDir,
     workspace: 'estate-birth',