@githolon/dsl 0.102.5 → 0.103.1

package/dart/lib/src/webview_bridge.dart

@@ -27,10 +27,17 @@ import 'package:nomos_types/nomos_types.dart'
         NomosTraceContext,
         NomosErrorInfo,
         NomosRef,
+        VersionedNomosRef,
+        ReferenceFreshness,
+        ReferenceCurrent,
+        ReferenceStale,
+        ReferenceFreshnessUnavailable,
         CustodyBreakPolicy,
         NomosCustodyEvent,
         NomosCustodyStatus;
 import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
+import 'package:nomos_types/src/versioned_nomos_ref.dart'
+    show NmsInternalVersionedNomosRefs;
 import 'package:nomos_types/src/foreign_ref.dart'
     show NomosForeignReader, NomosForeignWorkspaceReader;
 
@@ -43,6 +50,17 @@ import 'session_bound.dart' show DomainNotInstalledForSession;
 /// bridge root so app code reads as the four-layer split (engine → session → client → values).
 typedef NomosEngine = NomosBridge;
 
+/// One stable bounded page from an authenticated declared-query index. [cursor] is opaque framework
+/// state: pass it back unchanged to request the next page; [done] means this page exhausted the query.
+final class NomosPage<T> {
+  const NomosPage(
+      {required this.rows, required this.cursor, required this.done});
+
+  final List<T> rows;
+  final String? cursor;
+  final bool done;
+}
+
 /// The protocol version the runner and the bridge agree on (`webview-runner.mjs` `WEBVIEW_BRIDGE_VERSION`).
 const int kWebviewBridgeVersion = 1;
 
@@ -1021,6 +1039,11 @@ class NomosBridge {
   // [acquireSession]'s per-workspace single-flight: workspace → the in-flight open every concurrent
   // acquirer joins (removed when it completes; a live session then hits the fast path instead).
   final Map<String, Future<NomosSession>> _acquiring = {};
+  // Every workspace opened as part of one stateful application participates in continuous custody exchange.
+  // Starting that lifecycle is itself single-flight: generated navigation may discover the same child through
+  // several references, but the runner gets one autoSync registration for that session.
+  final Set<String> _autoSyncSessions = {};
+  final Map<String, Future<void>> _autoSyncStarting = {};
   int _seq = 0;
   final String _traceId = _newTraceId();
   late final StreamSubscription<Map<String, Object?>> _sub;
@@ -1498,7 +1521,7 @@ class NomosBridge {
           {'id': id, if (session != null) 'session': session}));
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
-  /// writes + the DLQ), each with its full `intentB64` bytes: `{pendingWrites, deadLetters}`. The
+  /// writes + the DLQ), each with its full `changeB64` bytes: `{pendingWrites, deadLetters}`. The
   /// read half of the recovery lane (`connect(recover: true)` runs salvage → [absorbSalvage]).
   Future<Map<String, Object?>> salvage({String? session}) async =>
       _asMap(await _call('salvage', {if (session != null) 'session': session}));
@@ -1537,11 +1560,9 @@ class NomosBridge {
   /// `encodeIntentOfferBytes`, with `security.actor` included iff [actor] is set). The generated Dart client
   /// calls THIS — it never hand-builds offer bytes, so there is exactly ONE copy of the wire format. Returns
   /// the new local head; durable on [sync]. ([offer] with opaque bytes stays for back-compat carriers.)
-  /// [attestations] hand-injects the signed foreign-read envelopes a captured-read directive consumes
-  /// (each `{queryId, result, attestation}` — the shape the kernel's attested-read gate re-derives against
-  /// its trust policy); [force] carries the deploy/evolve force flag through. Both are OMITTED from the wire
-  /// when absent, so a plain offer is byte-identical to before. [session] pins the colocated workspace in a
-  /// cluster harness (absent ⇒ the runner's sole-session default).
+  /// Declared foreign reads are resolved and proved inside the shared kernel plane; callers never fetch or
+  /// inject evidence. [force] carries the deploy/evolve force flag through. [session] pins the workspace in
+  /// a cluster harness (absent ⇒ the runner's sole-session default).
   @Deprecated(
       'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
       'dispatch through a generated <Domain>Client bound to a NomosSession '
@@ -1553,7 +1574,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1567,7 +1587,6 @@ class NomosBridge {
       'payload': payload,
       if (actor != null) 'actor': actor,
       if (domainHash != null) 'domainHash': domainHash,
-      if (attestations != null) 'attestations': attestations,
       if (nomosConflictSnapshots != null)
         '__nomosConflictSnapshots': nomosConflictSnapshots,
       if (force != null) 'force': force,
@@ -1591,7 +1610,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1603,7 +1621,6 @@ class NomosBridge {
         payload: payload,
         actor: actor,
         domainHash: domainHash,
-        attestations: attestations,
         nomosConflictSnapshots: nomosConflictSnapshots,
         force: force,
         session: session,
@@ -1621,7 +1638,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1644,7 +1660,6 @@ class NomosBridge {
         'payload': payload,
         if (actor != null) 'actor': actor,
         if (domainHash != null) 'domainHash': domainHash,
-        if (attestations != null) 'attestations': attestations,
         if (nomosConflictSnapshots != null)
           '__nomosConflictSnapshots': nomosConflictSnapshots,
         if (force != null) 'force': force,
@@ -1786,6 +1801,22 @@ class NomosBridge {
     return (r['offer'] as Map?)?.cast<String, Object?>();
   }
 
+  /// Prepare the exact authenticated execution slice a generated client is about to use. This is
+  /// a readiness hint only: compilation, composition, cache custody and all trust decisions remain
+  /// inside the kernel. Generated `bind` calls it so first-use cost is paid before the client becomes
+  /// interactive, rather than on the person's first button press.
+  Future<void> prepareDomain({
+    required String domain,
+    String? directiveId,
+    required String packageHash,
+  }) async {
+    await _call('prepareDomain', {
+      'domain': domain,
+      if (directiveId != null) 'directiveId': directiveId,
+      'packageHash': packageHash,
+    });
+  }
+
   /// FOLLOW A [NomosRef] — THE cross-workspace primitive (session_bound_clients.md ask 8): mount
   /// the referenced workspace on this device's plane (idempotent — an already-open workspace is
   /// just returned) and hand back its [NomosSession]. Typed client construction is then one line:
@@ -1849,14 +1880,34 @@ class NomosBridge {
       plane._sessionPrincipals[workspace] = sourcePrincipal;
     }
 
+    Future<NomosSession> ready(NomosSession opened) async {
+      inheritPrincipal();
+      if (!plane._autoSyncSessions.contains(workspace)) {
+        final start = plane._autoSyncStarting.putIfAbsent(workspace, () async {
+          await opened.autoSync();
+          plane._autoSyncSessions.add(workspace);
+        });
+        try {
+          await start;
+        } finally {
+          if (identical(plane._autoSyncStarting[workspace], start)) {
+            plane._autoSyncStarting.remove(workspace);
+          }
+        }
+      }
+      return opened;
+    }
+
     if (plane._sessionNames.contains(workspace)) {
       inheritPrincipal();
-      return Future.value(session(workspace));
+      return ready(session(workspace));
     }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
     return plane._acquiring.putIfAbsent(workspace, () async {
       try {
-        if (plane._sessionNames.contains(workspace)) return session(workspace);
+        if (plane._sessionNames.contains(workspace)) {
+          return ready(session(workspace));
+        }
         // Consult the plane's TRUTHFUL registry (mounted ∪ parked ∪ resident custody — the runner's
         // realm.list()): anything the device already holds opens locally, no cloud, no credentials.
         var resident = false;
@@ -1872,8 +1923,7 @@ class NomosBridge {
               session: workspace,
               allowUnborn: true,
               authorSecret: authorSecret);
-          inheritPrincipal();
-          return session(workspace);
+          return ready(session(workspace));
         }
         if (ifAbsentCredentials == null) {
           throw StateError(
@@ -1890,8 +1940,7 @@ class NomosBridge {
           authorSecret: c.authorSecret ?? authorSecret,
           allowUnborn: c.allowUnborn,
         );
-        inheritPrincipal();
-        return session(workspace);
+        return ready(session(workspace));
       } finally {
         // completed (either way) — the next acquire re-evaluates fresh (a live session hits the fast path).
         plane._acquiring.remove(workspace);
@@ -1906,6 +1955,17 @@ class NomosBridge {
       (_asMap(await _call('mintId', {'typeTag': typeTag}))['id'] ?? '')
           .toString();
 
+  /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
+  /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
+  Future<String> nomosWorkspaceGenesis(String workspace,
+          {String? session}) async =>
+      (_asMap(await _call('nomosWorkspaceGenesis', {
+                'workspace': workspace,
+                if (session != null) 'session': session,
+              }))['genesis'] ??
+              '')
+          .toString();
+
   /// UNDO the most-recent action via the kernel STRIKE primitive (the fold drops the struck intent by parity).
   /// [scope] `'all'` undoes any author's most-recent action; `'user'` only THIS replica's own. [actions] is the
   /// app's set of undoable directive ids (so undo never strikes a framework/control intent). [domain] +
@@ -1924,7 +1984,6 @@ class NomosBridge {
     required Object? payload,
     String? actor,
     String? domainHash,
-    List<Map<String, Object?>>? attestations,
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
@@ -1935,21 +1994,10 @@ class NomosBridge {
           payload: payload,
           actor: actor,
           domainHash: domainHash,
-          attestations: attestations,
           nomosConflictSnapshots: nomosConflictSnapshots,
           force: force,
           session: session);
 
-  /// ATTESTED READ — serve + SIGN a declared query over a COLOCATED source session's certified fold (the
-  /// dynamic-source trust lane; architecture/dynamic_source_attested_reads.md). In a [NomosTestHarness.cluster]
-  /// (one engine plane, many sessions) this fulfils the read IN-PROCESS from the [from] session and returns
-  /// `{ entry: {queryId, result, attestation:{source_genesis, public_key, …}} }` — pass `result['entry']`
-  /// (the whole entry map) as one [offerDirective] `attestations` element, or read
-  /// `entry['attestation']['source_genesis']` to enrol the source in a reader's allow-list. [args] are the
-  /// query params. [session] is the caller/reader session (defaults to this view's bound session).
-  /// [attestorSecret] is the source's base64 read-attestor secret (from [authorKeygen]); when omitted the
-  /// source session's connect-time `authorSecret` signs. [nowMs] stamps the freshness clock (defaults to the
-  /// source's own clock).
   /// RELEASE COHERENCE — assert the connected cloud's kernel supports every capability this law needs (the
   /// generated client passes its baked `requiresKernel`, e.g. `['compoundKeys']` for a compound-key query).
   /// Throws a typed [KernelCoherenceError] on a skew (a stale/mismatched cloud kernel) with the named reason,
@@ -1964,23 +2012,6 @@ class NomosBridge {
     });
   }
 
-  Future<Map<String, Object?>> attestedRead({
-    required String from,
-    required String queryId,
-    Map<String, Object?> args = const {},
-    String? attestorSecret,
-    int? nowMs,
-    String? session,
-  }) async =>
-      _asMap(await _call('attestedRead', {
-        'from': from,
-        'queryId': queryId,
-        'args': args,
-        if (attestorSecret != null) 'attestorSecret': attestorSecret,
-        if (nowMs != null) 'nowMs': nowMs,
-        if (session != null) 'session': session,
-      }));
-
   /// MAKE A WORKSPACE — the one-call tenant path. A child workspace under a platform/[parent] is a SIGNED
   /// control-plane offer; the holon seals `createWorkspace` (or [directiveId] `birthChild`, or ANY
   /// tenant-defined `.births()` directive — see [domain]) with the requester's device key ([authorSecret],
@@ -2196,8 +2227,10 @@ class NomosBridge {
 
   /// Watch the RUNTIME activity feed: a stream that re-emits the newest-first activity rows on every local
   /// change (doorbell/sync tick). `base` = a commit-oid cursor. Cancelling drops the watch on the runner.
-  Stream<List<dynamic>> watchActivity({String? base, String? session}) =>
-      _watchStream(kind: 'activity', base: base, session: session);
+  Stream<List<dynamic>> watchActivity(
+          {String? base, int? limit, String? session}) =>
+      _watchStream(
+          kind: 'activity', base: base, limit: limit, session: session);
 
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
@@ -2388,16 +2421,46 @@ class NomosBridge {
   /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
   /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
   Future<List<Map<String, dynamic>>> query(String queryId,
-          [Map<String, Object?> params = const {},
-          List<NomosScopeKey>? keys,
-          String? principal,
-          String? session]) async =>
-      _asRows(await _call('query', {
-        'queryId': queryId,
-        'params': params,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }));
+      [Map<String, Object?> params = const {},
+      List<NomosScopeKey>? keys,
+      String? principal,
+      String? session]) async {
+    return _asRows(await _call('query', {
+      'queryId': queryId,
+      'params': params,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }));
+  }
+
+  /// One bounded query page. Unlike [query], this never requires the kernel to materialize or serialize
+  /// the complete result set merely to show the first screen.
+  Future<NomosPage<Map<String, dynamic>>> queryPage(
+    String queryId, {
+    Map<String, Object?> params = const {},
+    int pageSize = 100,
+    String? cursor,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  }) async {
+    if (pageSize < 1 || pageSize > 1000) {
+      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
+    }
+    final result = _asMap(await _call('queryPage', {
+      'queryId': queryId,
+      'params': params,
+      'pageSize': pageSize,
+      if (cursor != null) 'cursor': cursor,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }));
+    return NomosPage<Map<String, dynamic>>(
+      rows: _asRows(result),
+      cursor: result['cursor'] as String?,
+      done: result['done'] == true,
+    );
+  }
 
   /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
   Future<List<Map<String, dynamic>>> queryById(String id,
@@ -2410,6 +2473,42 @@ class NomosBridge {
         if (session != null) 'session': session,
       }));
 
+  /// Compare an immutable publication pin with the stable series' one compiled
+  /// current pointer. This is an O(current-state) check: it neither resolves the
+  /// pinned publication nor reconstructs aggregate history.
+  Future<ReferenceFreshness<TVersion>>
+      checkReferenceFreshness<TVersion, TSeries>(
+    VersionedNomosRef<TVersion, TSeries> reference,
+  ) async {
+    final result = _asMap(await _call('checkRefFreshness', {
+      'refs': [
+        {
+          'pinned': NmsInternalNomosRefs.toJson(reference.pinned),
+          'series': NmsInternalNomosRefs.toJson(reference.series),
+          'currentField': NmsInternalVersionedNomosRefs.currentField(reference),
+        },
+      ],
+    }));
+    final unique = result['unique'] as List?;
+    final first = unique == null || unique.isEmpty
+        ? const <String, Object?>{}
+        : _asMap(unique.first);
+    final outcome = _asMap(first['outcome']);
+    final status = (outcome['status'] ?? 'unknown').toString();
+    if (status == 'current') {
+      return ReferenceCurrent<TVersion>(reference.pinned);
+    }
+    if (status == 'stale') {
+      final latest = outcome['latest'];
+      if (latest != null) {
+        return ReferenceStale<TVersion>(
+          NmsInternalNomosRefs.fromJson<TVersion>(latest),
+        );
+      }
+    }
+    return ReferenceFreshnessUnavailable<TVersion>(status);
+  }
+
   /// Verified points in this workspace's history, oldest to newest. The generated client presents these
   /// as `client.past.moments()`; callers pass the opaque [NomosMoment] back to `past.at(moment)` and never
   /// need to know that the framework uses commit identities underneath.
@@ -2591,12 +2690,13 @@ class NomosBridge {
       }));
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
-  Future<NomosScopeKey> nomosOwnedBirthScopeKey(
-      String scope, String namespace, Object? key) async {
+  Future<NomosScopeKey> nomosOwnedBirthScopeKey(String scope, String namespace,
+      Object? key, String recordType, String recordId) async {
     final out = _asMap(await _call('cryptoOwnedBirthScopeKey', {
       'scope': scope,
       'namespace': namespace,
       'key': key,
+      'record': {'type': recordType, 'id': recordId},
     }));
     return NomosScopeKey(
       scope: (out['scope'] ?? scope).toString(),
@@ -2723,14 +2823,20 @@ class NomosBridge {
   /// Each round arrives on [syncEvents] as `{ event:'sync', reason, result }`; socket state as `{event:'link'}`.
   /// Call once after [connect] — then the app never polls.
   Future<void> autoSync(
-          {int? debounceMs, int? fallbackMs, String? signalId}) async =>
-      await _call('autoSync', {
-        if (debounceMs != null) 'debounceMs': debounceMs,
-        if (fallbackMs != null) 'fallbackMs': fallbackMs,
-        if (signalId != null) 'signalId': signalId
-      });
+      {int? debounceMs, int? fallbackMs, String? signalId}) async {
+    await _call('autoSync', {
+      if (debounceMs != null) 'debounceMs': debounceMs,
+      if (fallbackMs != null) 'fallbackMs': fallbackMs,
+      if (signalId != null) 'signalId': signalId
+    });
+    final workspace = _sessionName;
+    if (workspace != null) _eventPlane._autoSyncSessions.add(workspace);
+  }
+
   Future<void> stopAutoSync() async {
     await _call('stopAutoSync');
+    final workspace = _sessionName;
+    if (workspace != null) _eventPlane._autoSyncSessions.remove(workspace);
   }
 
   /// Background-sync telemetry: each autoSync round (`event:'sync'`) and doorbell socket state (`event:'link'`).
@@ -2876,13 +2982,15 @@ class NomosBridge {
   Stream<List<dynamic>> watch(String queryId,
           [Map<String, Object?> params = const {},
           String? session,
-          String? principal]) =>
+          String? principal,
+          int? intervalMs]) =>
       _watchStream(
           kind: 'query',
           queryId: queryId,
           params: params,
           session: session,
-          principal: principal);
+          principal: principal,
+          intervalMs: intervalMs);
   Stream<List<dynamic>> watchById(String id,
           [String? session, String? principal]) =>
       _watchStream(
@@ -3003,12 +3111,18 @@ class NomosBridge {
     final subId = 'c${++_eventPlane._seq}';
     late final StreamController<Map<String, Object?>> ctrl;
     ctrl = StreamController<Map<String, Object?>>(
-      onListen: () => _call('watch', {
-        'subId': subId,
-        'kind': 'compat',
-        'requirement': requirement,
-        if (session != null) 'session': session,
-      }),
+      onListen: () {
+        unawaited(_call('watch', {
+          'subId': subId,
+          'kind': 'compat',
+          'requirement': requirement,
+          if (session != null) 'session': session,
+        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
+          if (!ctrl.isClosed && ctrl.hasListener) {
+            ctrl.addError(error, stackTrace);
+          }
+        }));
+      },
       onCancel: () {
         _eventPlane._compatWatches.remove(subId);
         // Cancellation is a local lifecycle boundary and must complete even if the runner is slow,
@@ -3029,25 +3143,35 @@ class NomosBridge {
       String? spatialId,
       NomosBbox? bbox,
       String? base,
+      int? limit,
       String? session,
-      String? principal}) {
+      String? principal,
+      int? intervalMs}) {
     // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
     // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
     final subId = 'w${++_eventPlane._seq}';
     late final StreamController<List<dynamic>> ctrl;
     ctrl = StreamController<List<dynamic>>(
-      onListen: () => _call('watch', {
-        'subId': subId,
-        'kind': kind,
-        if (queryId != null) 'queryId': queryId,
-        if (params != null) 'params': params,
-        if (id != null) 'id': id,
-        if (spatialId != null) 'spatialId': spatialId,
-        if (bbox != null) 'bbox': bbox.toJson(),
-        if (base != null) 'base': base,
-        if (principal != null) 'principal': principal,
-        if (session != null) 'session': session,
-      }),
+      onListen: () {
+        unawaited(_call('watch', {
+          'subId': subId,
+          'kind': kind,
+          if (queryId != null) 'queryId': queryId,
+          if (params != null) 'params': params,
+          if (id != null) 'id': id,
+          if (spatialId != null) 'spatialId': spatialId,
+          if (bbox != null) 'bbox': bbox.toJson(),
+          if (base != null) 'base': base,
+          if (limit != null) 'limit': limit,
+          if (principal != null) 'principal': principal,
+          if (intervalMs != null) 'intervalMs': intervalMs,
+          if (session != null) 'session': session,
+        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
+          if (!ctrl.isClosed && ctrl.hasListener) {
+            ctrl.addError(error, stackTrace);
+          }
+        }));
+      },
       onCancel: () {
         _eventPlane._watches.remove(subId);
         // A caller owns its local subscription; it must never need a healthy transport in order to release
@@ -3062,28 +3186,41 @@ class NomosBridge {
   /// Tear down: stop the transport subscription + fail any in-flight calls.
   Future<void> dispose() async {
     await _sub.cancel();
-    for (final entry in _pending.entries) {
-      final c = entry.value;
+    final pending = _pending.entries
+        .map((entry) => (
+              completer: entry.value,
+              trace: _pendingTraces[entry.key] ?? const NomosTraceContext(),
+              operation: _pendingOps[entry.key],
+            ))
+        .toList(growable: false);
+    _pending.clear();
+    _pendingOps.clear();
+    _pendingTraces.clear();
+    for (final entry in pending) {
+      final c = entry.completer;
       if (!c.isCompleted) {
-        final trace = _pendingTraces[entry.key] ?? const NomosTraceContext();
-        final info = NomosErrorInfo.legacy('bridge disposed',
+        final operation = entry.operation ?? 'unknown';
+        final info = NomosErrorInfo.legacy(
+            'bridge disposed while $operation was pending',
             code: 'nomos.bridge.disposed',
-            operation: _pendingOps[entry.key],
-            trace: trace);
+            operation: entry.operation,
+            trace: entry.trace);
         c.completeError(nomosErrorFromInfo(info));
       }
     }
-    _pending.clear();
-    _pendingOps.clear();
-    _pendingTraces.clear();
-    for (final w in _watches.values) {
-      if (!w.isClosed) await w.close();
-    }
+    final watches = _watches.values.toList(growable: false);
     _watches.clear();
-    for (final w in _compatWatches.values) {
-      if (!w.isClosed) await w.close();
+    for (final w in watches) {
+      // A paused consumer can keep StreamController.close() pending forever.
+      // Disposal is the owner boundary: detach the controller immediately and
+      // let its done event complete if/when that consumer resumes.
+      if (!w.isClosed) unawaited(w.close());
     }
+    final compatWatches = _compatWatches.values.toList(growable: false);
     _compatWatches.clear();
+    for (final w in compatWatches) {
+      if (!w.isClosed) unawaited(w.close());
+    }
     _stopStatusPoll();
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.0"
+    version: "0.8.1"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -8,7 +8,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.64.1
+version: 0.64.3
 
 environment:
   sdk: ^3.5.0
@@ -17,7 +17,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.0
+  nomos_types: ^0.8.1
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart/test/acquire_session_credentials_test.dart

@@ -20,7 +20,7 @@ import 'package:test/test.dart';
 String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _docsDeploy =>
-    '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
+    '$_root/bench/scale/fixtures/surfaced/build/surfaced.law.usdz';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
     Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -34,7 +34,8 @@ String? _missingPrereq() {
         '(cd bench/scale/fixtures/surfaced && node ../../../../dsl/compile_package.mjs)';
   }
   if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
-      !File('$_runtimeDir/packages.json').existsSync()) {
+      !File('$_runtimeDir/bootstrap.law.usdz').existsSync() ||
+      !File('$_runtimeDir/nomos.law.usdz').existsSync()) {
     return 'warm ~/.holon/runtime first (run any `githolon` command once)';
   }
   return null;
@@ -65,7 +66,7 @@ void main() {
       return;
     }
     final harness = await NomosTestHarness.ephemeral(
-      deployJsonPaths: [_docsDeploy],
+      lawUsdzPaths: [_docsDeploy],
       workspace: 'acquire-home',
       nodeEntry: _repoEntry,
       runtimeDir: _runtimeDir,

package/dart/test/acquire_session_test.dart

@@ -25,6 +25,11 @@ class FakeRunner implements BridgeTransport {
   }
 
   int get connectCount => sent.where((m) => m['op'] == 'connect').length;
+  int autoSyncCount(String workspace) => sent
+      .where((m) =>
+          m['op'] == 'autoSync' &&
+          ((m['args'] as Map)['session']).toString() == workspace)
+      .length;
   Map<String, Object?> connectArgs(int i) =>
       (sent.where((m) => m['op'] == 'connect').elementAt(i)['args'] as Map)
           .cast<String, Object?>();
@@ -89,6 +94,8 @@ void main() {
             fail('credentials must not be requested for a mounted session'));
     expect(identical(s, bridge.session('home')), isTrue);
     expect(runner.connectCount, 1, reason: 'no re-connect for a live session');
+    expect(runner.autoSyncCount('home'), 1,
+        reason: 'an acquired application workspace continuously syncs');
     await bridge.dispose();
   });
 
@@ -140,6 +147,8 @@ void main() {
         reason: 'ONE connect for three concurrent acquires');
     expect(identical(results[0], results[1]), isTrue);
     expect(identical(results[1], results[2]), isTrue);
+    expect(runner.autoSyncCount('cloudy'), 1,
+        reason: 'the workspace lifecycle is single-flight too');
     final args = runner.connectArgs(0);
     expect(args['cloud'], 'https://cloud.example');
     expect(args['authToken'], 'tok');